package/kernel/mac80211/patches/300-pending_work.patch

   1 commit ff9655bebd25d35ab13c2515a029723b69949720
   2 Author: Felix Fietkau <nbd@openwrt.org>
   3 Date:   Mon May 19 21:20:49 2014 +0200
   4
   5     ath9k: avoid passing buffers to the hardware during flush
   6
   7     The commit "ath9k: fix possible hang on flush" changed the receive code
   8     to always link rx descriptors of processed frames, even when flushing.
   9     In some cases, this leads to flushed rx buffers being passed to the
  10     hardware while rx is already stopped.
  11
  12     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  13
  14 commit 46c5d7d207a2a0725066c0928fd19b8c578b7d4f
  15 Author: Oleksij Rempel <linux@rempel-privat.de>
  16 Date:   Tue May 20 00:02:03 2014 +0200
  17
  18     ath9k_htc: fix build with disabled debug
  19
  20       CC [M]  drivers/net/wireless/ath/ath9k/htc_drv_txrx.o
  21     drivers/net/wireless/ath/ath9k/htc_drv_txrx.c: In function ‘ath9k_rx_prepare’:
  22     drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1006:2: warning: passing argument 2 of ‘ath9k_htc_err_stat_rx’ from incompatible pointer type [enabled by default]
  23       ath9k_htc_err_stat_rx(priv, &rx_stats);
  24       ^
  25     In file included from drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:17:0:
  26     drivers/net/wireless/ath/ath9k/htc.h:380:20: note: expected ‘struct ath_htc_rx_status *’ but argument is of type ‘struct ath_rx_status *’
  27      static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
  28
  29     Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
  30
  31 commit 2d331334e9dc5659fdf9a89326c34c3db5a15279
  32 Author: Johannes Berg <johannes.berg@intel.com>
  33 Date:   Mon May 19 17:59:50 2014 +0200
  34
  35     cfg80211: constify wowlan/coalesce mask/pattern pointers
  36
  37     This requires changing the nl80211 parsing code a bit to use
  38     intermediate pointers for the allocation, but clarifies the
  39     API towards the drivers.
  40
  41     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  42
  43 commit 6788105c46babaa6938cbacb72fdf20bec4bb2e3
  44 Author: Johannes Berg <johannes.berg@intel.com>
  45 Date:   Mon May 19 17:53:16 2014 +0200
  46
  47     cfg80211: constify more pointers in the cfg80211 API
  48
  49     This also propagates through the drivers.
  50
  51     The orinoco driver uses the cfg80211 API structs for internal
  52     bookkeeping, and so needs a (void *) cast that removes the
  53     const - but that's OK because it allocates those pointers.
  54
  55     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  56
  57 commit c3d95010fd881da0fa0a4e88532412f5d0c092f6
  58 Author: Johannes Berg <johannes.berg@intel.com>
  59 Date:   Mon May 19 17:19:31 2014 +0200
  60
  61     cfg80211: constify MAC addresses in cfg80211 ops
  62
  63     This propagates through all the drivers and mac80211.
  64
  65     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  66
  67 commit ddf1e6f0f0354c601af7d42e5ace4b51f8b0bffc
  68 Author: Luciano Coelho <luciano.coelho@intel.com>
  69 Date:   Thu May 15 20:32:08 2014 +0300
  70
  71     mac80211: fix csa_counter_offs argument name in docbook
  72
  73     The csa_counter_offs was erroneously described as csa_offs in
  74     the docbook section.
  75
  76     This fixes two warnings when making htmldocs (at least):
  77
  78     Warning(include/net/mac80211.h:3428): No description found for parameter 'csa_counter_offs[IEEE80211_MAX_CSA_COUNTERS_NUM]'
  79     Warning(include/net/mac80211.h:3428): Excess struct/union/enum/typedef member 'csa_offs' description in 'ieee80211_mutable_offsets'
  80
  81     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
  82     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  83
  84 commit 202322d1c04b8e498bd5bb78606fcf3941512b35
  85 Author: Luciano Coelho <luciano.coelho@intel.com>
  86 Date:   Thu May 15 20:18:09 2014 +0300
  87
  88     cfg80211: add documentation for max_num_csa_counters
  89
  90     Move the comment in the structure to a description of the
  91     max_num_csa_counters field in the docbook area.
  92
  93     This fixes a warning when building htmldocs (at least):
  94
  95      Warning(include/net/cfg80211.h:3064): No description found for parameter 'max_num_csa_counters'
  96
  97     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
  98     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  99
 100 commit 457a33192f64b7637e8fd0ae0e9f32701c908603
 101 Author: Johannes Berg <johannes.berg@intel.com>
 102 Date:   Mon May 19 11:24:19 2014 +0200
 103
 104     mac80211: minstrel-ht: small clarifications
 105
 106     Antonio and I were looking over this code and some things
 107     didn't immediately make sense, so we came up with two small
 108     clarifications.
 109
 110     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 111
 112 commit 1e35dce952a64a957de97ae1f2bb19301756b936
 113 Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 114 Date:   Fri May 9 14:11:50 2014 +0300
 115
 116     mac80211: Handle the CSA counters correctly
 117
 118     Make the beacon CSA counters part of ieee80211_mutable_offsets and don't
 119     decrement CSA counters when generating a beacon template. This permits the
 120     driver to offload the CSA counters handling. Since mac80211 updates the probe
 121     responses with the correct counter, the driver should sync the counter's value
 122     with mac80211 using ieee80211_csa_update_counter function.
 123
 124     Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 125     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 126     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 127
 128 commit e7b5c449815d28a2105fde5b42e112f78cc711ac
 129 Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 130 Date:   Fri May 9 14:11:49 2014 +0300
 131
 132     mac80211: Provide ieee80211_beacon_get_template API
 133
 134     Add a new API ieee80211_beacon_get_template, which doesn't
 135     affect DTIM counter and should be used if the device generates beacon
 136     frames, and new beacon template is needed. In addition set the offsets
 137     to TIM IE for MESH interface.
 138
 139     Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 140     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 141     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 142
 143 commit e54eda80273ce8aded058c3c9365dca2342e2e75
 144 Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 145 Date:   Fri May 9 14:11:47 2014 +0300
 146
 147     mac80211: Support multiple CSA counters
 148
 149     Support up to IEEE80211_MAX_CSA_COUNTERS_NUM csa counters.
 150     This is defined to be 2 now, to support both CSA and eCSA
 151     counters.
 152
 153     Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 154     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 155     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 156
 157 commit 678e87c3b929dd60d59470e8981eb551cee10319
 158 Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 159 Date:   Fri May 9 14:11:46 2014 +0300
 160
 161     cfg80211: Support multiple CSA counters
 162
 163     Change the type of NL80211_ATTR_CSA_C_OFF_BEACON and
 164     NL80211_ATTR_CSA_C_OFF_PRESP to be NLA_BINARY which allows
 165     userspace to use beacons and probe responses with
 166     multiple CSA counters.
 167     This isn't breaking the API since userspace can
 168     continue to use nla_put_u16 for this attributes, which
 169     is equivalent to a single element u16 array.
 170     In addition advertise max number of supported CSA counters.
 171     This is needed when using CSA and eCSA IEs together.
 172
 173     Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 174     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 175     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 176
 177 commit 93f4867a966cc8645659031bbd44a9bb4b78485f
 178 Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 179 Date:   Fri May 9 14:11:45 2014 +0300
 180
 181     mac80211: Update CSA counters in mgmt frames
 182
 183     Track current csa counter value and use it
 184     to update mgmt frames at the provided offsets.
 185
 186     Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 187     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 188     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 189
 190 commit 6c8461fcc03ff4d250027e47f53315b5e0ec43aa
 191 Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 192 Date:   Fri May 9 14:11:44 2014 +0300
 193
 194     cfg80211: Add API to update CSA counters in mgmt frames
 195
 196     Add NL80211_ATTR_CSA_C_OFFSETS_TX which holds an array
 197     of offsets to the CSA counters which should be updated
 198     when sending a management frames with NL80211_CMD_FRAME.
 199
 200     This API should be used by the drivers that wish to keep the
 201     CSA counter updated in probe responses, but do not implement
 202     probe response offloading and so, do not use
 203     ieee80211_proberesp_get function.
 204
 205     Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 206     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 207     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 208
 209 commit 7d09fc9f1903b3d5e7d046bdf10467f37a97c4f9
 210 Author: Luciano Coelho <luciano.coelho@intel.com>
 211 Date:   Thu May 15 13:05:39 2014 +0300
 212
 213     cfg80211: pass the actual iftype when calling cfg80211_chandef_dfs_required()
 214
 215     There is no need to pass NL80211_IFTYPE_UNSPECIFIED when calling
 216     cfg80211_chandef_dfs_required() since we always already have the
 217     interface type.  So, pass the actual interface type instead.
 218
 219     Additionally, have cfg80211_chandef_dfs_required() WARN if the passed
 220     interface type is NL80211_IFTYPE_UNSPECIFIED, so we can detect
 221     problems more easily.
 222
 223     Tested-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 224     Reported-by: Eliad Peller <eliad@wizery.com>
 225     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 226     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 227
 228 commit 2b7443b15f26ecb98281474666383cf2a882fbad
 229 Author: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 230 Date:   Wed May 14 13:25:04 2014 +0200
 231
 232     cfg80211: fix start_radar_detection issue
 233
 234     After patch:
 235     cfg80211/mac80211: refactor cfg80211_chandef_dfs_required()
 236
 237     start_radar_detection always fail with -EINVAL.
 238
 239     Acked-by: Luciano Coelho <luciano.coelho@intel.com>
 240     Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 241     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 242
 243 commit 4f46eb8b28f96aca212a364e0fa847eb5333df67
 244 Author: Felix Fietkau <nbd@openwrt.org>
 245 Date:   Mon May 5 11:48:40 2014 +0200
 246
 247     cfg80211: allow restricting supported dfs regions
 248
 249     At the moment, the ath9k/ath10k DFS module only supports detecting ETSI
 250     radar patterns.
 251     Add a bitmap in the interface combinations, indicating which DFS regions
 252     are supported by the detector. If unset, support for all regions is
 253     assumed.
 254
 255     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 256     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 257
 258 commit 0277b034768d1800a00829a755fc56b925aa6b95
 259 Author: Johannes Berg <johannes.berg@intel.com>
 260 Date:   Wed Apr 30 14:19:04 2014 +0200
 261
 262     mac80211: handle failed restart/resume better
 263
 264     When the driver fails during HW restart or resume, the whole
 265     stack goes into a very confused state with interfaces being
 266     up while the hardware is down etc.
 267
 268     Address this by shutting down everything; we'll run into a
 269     lot of warnings in the process but that's better than having
 270     the whole stack get messed up.
 271
 272     Reviewed-by: Arik Nemtsov <arik@wizery.com>
 273     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 274
 275 commit 43fd71bc4b83d24981e90ca178f505cf6a6b16dc
 276 Author: Luciano Coelho <luciano.coelho@intel.com>
 277 Date:   Wed May 7 20:05:12 2014 +0300
 278
 279     mac80211: fix sparse warning caused by __ieee80211_channel_switch()
 280
 281     Commit 59af6928 (mac80211: fix CSA tx queue stopping) introduced a
 282     sparse warning:
 283
 284     net/mac80211/cfg.c:3274:5: warning: symbol '__ieee80211_channel_switch' was not declared. Should it be static?
 285
 286     Fix it by declaring the function static.
 287
 288     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 289     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 290
 291 commit dd4371e2957db19870bb22ab84e841e1ac6e8997
 292 Author: Luciano Coelho <luciano.coelho@intel.com>
 293 Date:   Wed May 7 19:07:05 2014 +0300
 294
 295     cfg80211: fix docbook warning
 296
 297     When trying to generate documentation, at least xmldocs, we get the
 298     following warning:
 299
 300     Warning(include/net/cfg80211.h:461): No description found for parameter 'nl80211_iftype'
 301
 302     Fix it by adding the iftype argument name to the
 303     cfg80211_chandef_dfs_required() function declaration.
 304
 305     Reported-and-tested-by: Masanari Iida <standby24x7@gmail.com>
 306     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 307     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 308
 309 commit 56de850ae960f096c784ec07864ca5b71abd16e6
 310 Author: Michal Kazior <michal.kazior@tieto.com>
 311 Date:   Thu May 8 09:10:02 2014 +0200
 312
 313     mac80211: disconnect iface if CSA unexpectedly fails
 314
 315     It doesn't make much sense to leave a crippled
 316     interface running.
 317
 318     As a side effect this will unblock tx queues with
 319     CSA reason immediately after failure instead of
 320     until after userspace requests interface to stop.
 321
 322     This also gives userspace an opportunity to
 323     indirectly see CSA failure.
 324
 325     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 326     [small code cleanup]
 327     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 328
 329 commit f5894c4f19e55bb1ea6376031fe9d47d7528be9e
 330 Author: Loic Poulain <loic.poulain@intel.com>
 331 Date:   Wed May 7 11:38:11 2014 +0200
 332
 333     rfkill-gpio: Use gpio cansleep version
 334
 335     If gpio controller requires waiting for read and write
 336     GPIO values, then we have to use the gpio cansleep api.
 337     Fix the rfkill_gpio_set_power which calls only the
 338     nonsleep version (causing kernel warning).
 339     There is no problem to use the cansleep version here
 340     because we are not in IRQ handler or similar context
 341     (cf rfkill_set_block).
 342
 343     Signed-off-by: Loic Poulain <loic.poulain@intel.com>
 344     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 345
 346 commit 47fdf5d4f3704d2db9d1c0f647f788edef104fc8
 347 Author: Michal Kazior <michal.kazior@tieto.com>
 348 Date:   Wed Apr 9 15:45:36 2014 +0200
 349
 350     mac80211: ignore cqm during csa
 351
 352     It is not guaranteed that multi-vif channel
 353     switching is tightly synchronized. It makes sense
 354     to ignore cqm (missing beacons, et al) while csa
 355     is progressing and re-check it after it completes.
 356
 357     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 358     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 359
 360 commit 1a8ed386e1684b266a15dacf675102ae53361ee5
 361 Author: Michal Kazior <michal.kazior@tieto.com>
 362 Date:   Wed Apr 9 15:11:01 2014 +0200
 363
 364     cfg80211: export interface stopping function
 365
 366     This exports a new cfg80211_stop_iface() function.
 367
 368     This is intended for driver internal interface
 369     combination management and channel switching.
 370
 371     Due to locking issues (it re-enters driver) the
 372     call is asynchronous and uses cfg80211 event
 373     list/worker.
 374
 375     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 376     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 377
 378 commit 573f31d6d0e572ff8186c45a1ecd9273242233e6
 379 Author: Michal Kazior <michal.kazior@tieto.com>
 380 Date:   Wed Apr 9 15:11:00 2014 +0200
 381
 382     mac80211: split CSA finalize function
 383
 384     Improves readability and modularity.
 385
 386     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 387     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 388
 389 commit 2d104d52e7c7640d68f29f2136dbe3938b7bc9ba
 390 Author: Michal Kazior <michal.kazior@tieto.com>
 391 Date:   Wed Apr 9 15:10:59 2014 +0200
 392
 393     mac80211: fix CSA tx queue stopping
 394
 395     It was possible for tx queues to be stuck stopped
 396     if AP CSA finalization failed. In that case
 397     neither stop_ap nor do_stop woke the queues up.
 398     This means it was impossible to perform tx at all
 399     until driver was reloaded or a successful CSA was
 400     performed later.
 401
 402     It was possible to solve this in a simpler manner
 403     however this is more robust and future proof
 404     (having multi-vif CSA in mind).
 405
 406     New sdata->csa_block_tx is introduced to keep
 407     track of which interfaces requested tx to be
 408     blocked for CSA. This is required because mac80211
 409     stops all tx queues for that purpose. This means
 410     queues must be awoken only when last tx-blocking
 411     CSA interface is finished.
 412
 413     It is still possible to have tx queues stopped
 414     after CSA failure but as soon as offending
 415     interfaces are stopped from userspace (stop_ap or
 416     ifdown) tx queues are woken up properly.
 417
 418     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 419     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 420
 421 commit 6be615d6d42aa7fdab6c4278031d8fa0953e594f
 422 Author: Johannes Berg <johannes.berg@intel.com>
 423 Date:   Wed Apr 9 21:31:13 2014 +0200
 424
 425     mac80211: mark local variable __maybe_unused
 426
 427     The 'local' variable in __ieee80211_vif_copy_chanctx_to_vlans()
 428     is only used/needed when lockdep is compiled in, mark it as such
 429     to avoid compile warnings in the other case.
 430
 431     While at it, fix some indentation where it's used.
 432
 433     Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
 434     Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 435     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 436
 437 commit 43279e584aeb78aa0c853728db047b58156c0753
 438 Author: Arik Nemtsov <arik@wizery.com>
 439 Date:   Thu May 1 10:17:28 2014 +0300
 440
 441     mac80211: move TDLS code to another file
 442
 443     With new additions planned, this code is getting too big for cfg.c.
 444
 445     Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
 446     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 447
 448 commit bf9c234b83c77f1ebbcbab73de2a9e4a5d4aafc6
 449 Author: Arik Nemtsov <arik@wizery.com>
 450 Date:   Thu May 1 10:17:27 2014 +0300
 451
 452     mac80211: set an external flag for TDLS stations
 453
 454     Expose a new tdls flag for the public ieee80211_sta struct.
 455     This can be used in some rate control decisions.
 456
 457     Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
 458     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 459
 460 commit 910e65141a17f645ab85dae1a497e64ebe63df70
 461 Author: Johannes Berg <johannes.berg@intel.com>
 462 Date:   Tue Apr 29 17:55:26 2014 +0200
 463
 464     mac80211: remove BUG_ON usage
 465
 466     These BUG_ON statements should never trigger, but in the unlikely
 467     event that somebody does manage don't stop everything but simply
 468     exit the code path with an error.
 469
 470     Leave the one BUG_ON where changing it would result in a NULL
 471     pointer dereference.
 472
 473     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 474
 475 commit ff36b582a10285530351aab036087b57ddb4ae2b
 476 Author: Johannes Berg <johannes.berg@intel.com>
 477 Date:   Tue Apr 29 17:52:36 2014 +0200
 478
 479     cfg80211: remove BUG_ON usage
 480
 481     These really can't trigger unless somebody messes up the code,
 482     but don't make debugging it needlessly complicated, WARN and
 483     return instead of BUG_ON().
 484
 485     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 486
 487 --- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
 488 +++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
 489 @@ -1759,7 +1759,7 @@ static bool is_rate_ht40(s32 rate, u8 *m
 490  }
 491
 492  static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
 493 -                             u8 *mac, struct station_info *sinfo)
 494 +                             const u8 *mac, struct station_info *sinfo)
 495  {
 496         struct ath6kl *ar = ath6kl_priv(dev);
 497         struct ath6kl_vif *vif = netdev_priv(dev);
 498 @@ -2974,7 +2974,7 @@ static int ath6kl_stop_ap(struct wiphy *
 499  static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 500
 501  static int ath6kl_del_station(struct wiphy *wiphy, struct net_device *dev,
 502 -                             u8 *mac)
 503 +                             const u8 *mac)
 504  {
 505         struct ath6kl *ar = ath6kl_priv(dev);
 506         struct ath6kl_vif *vif = netdev_priv(dev);
 507 @@ -2985,7 +2985,8 @@ static int ath6kl_del_station(struct wip
 508  }
 509
 510  static int ath6kl_change_station(struct wiphy *wiphy, struct net_device *dev,
 511 -                                u8 *mac, struct station_parameters *params)
 512 +                                const u8 *mac,
 513 +                                struct station_parameters *params)
 514  {
 515         struct ath6kl *ar = ath6kl_priv(dev);
 516         struct ath6kl_vif *vif = netdev_priv(dev);
 517 --- a/drivers/net/wireless/ath/ath6kl/wmi.c
 518 +++ b/drivers/net/wireless/ath/ath6kl/wmi.c
 519 @@ -2320,7 +2320,7 @@ int ath6kl_wmi_addkey_cmd(struct wmi *wm
 520         return ret;
 521  }
 522
 523 -int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, u8 *krk)
 524 +int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, const u8 *krk)
 525  {
 526         struct sk_buff *skb;
 527         struct wmi_add_krk_cmd *cmd;
 528 --- a/drivers/net/wireless/ath/ath6kl/wmi.h
 529 +++ b/drivers/net/wireless/ath/ath6kl/wmi.h
 530 @@ -2616,7 +2616,7 @@ int ath6kl_wmi_addkey_cmd(struct wmi *wm
 531                           u8 *key_material,
 532                           u8 key_op_ctrl, u8 *mac_addr,
 533                           enum wmi_sync_flag sync_flag);
 534 -int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, u8 *krk);
 535 +int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, const u8 *krk);
 536  int ath6kl_wmi_deletekey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index);
 537  int ath6kl_wmi_setpmkid_cmd(struct wmi *wmi, u8 if_idx, const u8 *bssid,
 538                             const u8 *pmkid, bool set);
 539 --- a/drivers/net/wireless/ath/ath9k/htc.h
 540 +++ b/drivers/net/wireless/ath/ath9k/htc.h
 541 @@ -378,7 +378,7 @@ void ath9k_htc_get_et_stats(struct ieee8
 542  #define TX_QSTAT_INC(c) do { } while (0)
 543
 544  static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
 545 -                                        struct ath_htc_rx_status *rxs)
 546 +                                        struct ath_rx_status *rs);
 547  {
 548  }
 549
 550 --- a/drivers/net/wireless/ath/wil6210/cfg80211.c
 551 +++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
 552 @@ -172,7 +172,7 @@ static int wil_cid_fill_sinfo(struct wil
 553
 554  static int wil_cfg80211_get_station(struct wiphy *wiphy,
 555                                     struct net_device *ndev,
 556 -                                   u8 *mac, struct station_info *sinfo)
 557 +                                   const u8 *mac, struct station_info *sinfo)
 558  {
 559         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 560         int rc;
 561 @@ -671,7 +671,7 @@ static int wil_cfg80211_stop_ap(struct w
 562  }
 563
 564  static int wil_cfg80211_del_station(struct wiphy *wiphy,
 565 -                                   struct net_device *dev, u8 *mac)
 566 +                                   struct net_device *dev, const u8 *mac)
 567  {
 568         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 569
 570 --- a/drivers/net/wireless/ath/wil6210/main.c
 571 +++ b/drivers/net/wireless/ath/wil6210/main.c
 572 @@ -81,7 +81,7 @@ static void wil_disconnect_cid(struct wi
 573         memset(&sta->stats, 0, sizeof(sta->stats));
 574  }
 575
 576 -static void _wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
 577 +static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
 578  {
 579         int cid = -ENOENT;
 580         struct net_device *ndev = wil_to_ndev(wil);
 581 @@ -252,7 +252,7 @@ int wil_priv_init(struct wil6210_priv *w
 582         return 0;
 583  }
 584
 585 -void wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
 586 +void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
 587  {
 588         del_timer_sync(&wil->connect_timer);
 589         _wil6210_disconnect(wil, bssid);
 590 --- a/drivers/net/wireless/ath/wil6210/wil6210.h
 591 +++ b/drivers/net/wireless/ath/wil6210/wil6210.h
 592 @@ -508,7 +508,7 @@ void wil_wdev_free(struct wil6210_priv *
 593  int wmi_set_mac_address(struct wil6210_priv *wil, void *addr);
 594  int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan);
 595  int wmi_pcp_stop(struct wil6210_priv *wil);
 596 -void wil6210_disconnect(struct wil6210_priv *wil, void *bssid);
 597 +void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid);
 598
 599  int wil_rx_init(struct wil6210_priv *wil);
 600  void wil_rx_fini(struct wil6210_priv *wil);
 601 --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
 602 +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
 603 @@ -2236,7 +2236,7 @@ brcmf_cfg80211_config_default_mgmt_key(s
 604
 605  static s32
 606  brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
 607 -                          u8 *mac, struct station_info *sinfo)
 608 +                          const u8 *mac, struct station_info *sinfo)
 609  {
 610         struct brcmf_if *ifp = netdev_priv(ndev);
 611         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
 612 @@ -4014,7 +4014,7 @@ brcmf_cfg80211_change_beacon(struct wiph
 613
 614  static int
 615  brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
 616 -                          u8 *mac)
 617 +                          const u8 *mac)
 618  {
 619         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 620         struct brcmf_scb_val_le scbval;
 621 @@ -4242,7 +4242,7 @@ static int brcmf_convert_nl80211_tdls_op
 622  }
 623
 624  static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
 625 -                                   struct net_device *ndev, u8 *peer,
 626 +                                   struct net_device *ndev, const u8 *peer,
 627                                     enum nl80211_tdls_operation oper)
 628  {
 629         struct brcmf_if *ifp;
 630 --- a/drivers/net/wireless/libertas/cfg.c
 631 +++ b/drivers/net/wireless/libertas/cfg.c
 632 @@ -1006,9 +1006,8 @@ struct cmd_key_material {
 633  } __packed;
 634
 635  static int lbs_set_key_material(struct lbs_private *priv,
 636 -                               int key_type,
 637 -                               int key_info,
 638 -                               u8 *key, u16 key_len)
 639 +                               int key_type, int key_info,
 640 +                               const u8 *key, u16 key_len)
 641  {
 642         struct cmd_key_material cmd;
 643         int ret;
 644 @@ -1610,7 +1609,7 @@ static int lbs_cfg_del_key(struct wiphy
 645   */
 646
 647  static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
 648 -                             u8 *mac, struct station_info *sinfo)
 649 +                              const u8 *mac, struct station_info *sinfo)
 650  {
 651         struct lbs_private *priv = wiphy_priv(wiphy);
 652         s8 signal, noise;
 653 --- a/drivers/net/wireless/libertas/defs.h
 654 +++ b/drivers/net/wireless/libertas/defs.h
 655 @@ -90,7 +90,8 @@ do { if ((lbs_debug & (grp)) == (grp)) \
 656  #define lbs_deb_cfg80211(fmt, args...)  LBS_DEB_LL(LBS_DEB_CFG80211, " cfg80211", fmt, ##args)
 657
 658  #ifdef DEBUG
 659 -static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, int len)
 660 +static inline void lbs_deb_hex(unsigned int grp, const char *prompt,
 661 +                              const u8 *buf, int len)
 662  {
 663         int i = 0;
 664
 665 --- a/drivers/net/wireless/mwifiex/11n.h
 666 +++ b/drivers/net/wireless/mwifiex/11n.h
 667 @@ -200,7 +200,7 @@ static inline int mwifiex_is_sta_11n_ena
 668  }
 669
 670  static inline u8
 671 -mwifiex_tdls_peer_11n_enabled(struct mwifiex_private *priv, u8 *ra)
 672 +mwifiex_tdls_peer_11n_enabled(struct mwifiex_private *priv, const u8 *ra)
 673  {
 674         struct mwifiex_sta_node *node = mwifiex_get_sta_entry(priv, ra);
 675         if (node)
 676 --- a/drivers/net/wireless/mwifiex/cfg80211.c
 677 +++ b/drivers/net/wireless/mwifiex/cfg80211.c
 678 @@ -994,7 +994,7 @@ mwifiex_dump_station_info(struct mwifiex
 679   */
 680  static int
 681  mwifiex_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
 682 -                            u8 *mac, struct station_info *sinfo)
 683 +                            const u8 *mac, struct station_info *sinfo)
 684  {
 685         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 686
 687 @@ -1270,7 +1270,7 @@ static int mwifiex_cfg80211_change_beaco
 688   */
 689  static int
 690  mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
 691 -                            u8 *mac)
 692 +                            const u8 *mac)
 693  {
 694         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 695         struct mwifiex_sta_node *sta_node;
 696 @@ -2629,7 +2629,7 @@ static int mwifiex_cfg80211_set_coalesce
 697   */
 698  static int
 699  mwifiex_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
 700 -                          u8 *peer, u8 action_code, u8 dialog_token,
 701 +                          const u8 *peer, u8 action_code, u8 dialog_token,
 702                            u16 status_code, u32 peer_capability,
 703                            const u8 *extra_ies, size_t extra_ies_len)
 704  {
 705 @@ -2701,7 +2701,7 @@ mwifiex_cfg80211_tdls_mgmt(struct wiphy
 706
 707  static int
 708  mwifiex_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
 709 -                          u8 *peer, enum nl80211_tdls_operation action)
 710 +                          const u8 *peer, enum nl80211_tdls_operation action)
 711  {
 712         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 713
 714 @@ -2748,9 +2748,8 @@ mwifiex_cfg80211_tdls_oper(struct wiphy
 715  }
 716
 717  static int
 718 -mwifiex_cfg80211_add_station(struct wiphy *wiphy,
 719 -                            struct net_device *dev,
 720 -                            u8 *mac, struct station_parameters *params)
 721 +mwifiex_cfg80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 722 +                            const u8 *mac, struct station_parameters *params)
 723  {
 724         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 725
 726 @@ -2765,9 +2764,9 @@ mwifiex_cfg80211_add_station(struct wiph
 727  }
 728
 729  static int
 730 -mwifiex_cfg80211_change_station(struct wiphy *wiphy,
 731 -                               struct net_device *dev,
 732 -                               u8 *mac, struct station_parameters *params)
 733 +mwifiex_cfg80211_change_station(struct wiphy *wiphy, struct net_device *dev,
 734 +                               const u8 *mac,
 735 +                               struct station_parameters *params)
 736  {
 737         int ret;
 738         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 739 --- a/drivers/net/wireless/mwifiex/main.h
 740 +++ b/drivers/net/wireless/mwifiex/main.h
 741 @@ -910,8 +910,6 @@ int mwifiex_handle_uap_rx_forward(struct
 742                                   struct sk_buff *skb);
 743  int mwifiex_process_sta_event(struct mwifiex_private *);
 744  int mwifiex_process_uap_event(struct mwifiex_private *);
 745 -struct mwifiex_sta_node *
 746 -mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac);
 747  void mwifiex_delete_all_station_list(struct mwifiex_private *priv);
 748  void *mwifiex_process_sta_txpd(struct mwifiex_private *, struct sk_buff *skb);
 749  void *mwifiex_process_uap_txpd(struct mwifiex_private *, struct sk_buff *skb);
 750 @@ -1220,26 +1218,26 @@ void mwifiex_dnld_txpwr_table(struct mwi
 751  extern const struct ethtool_ops mwifiex_ethtool_ops;
 752
 753  void mwifiex_del_all_sta_list(struct mwifiex_private *priv);
 754 -void mwifiex_del_sta_entry(struct mwifiex_private *priv, u8 *mac);
 755 +void mwifiex_del_sta_entry(struct mwifiex_private *priv, const u8 *mac);
 756  void
 757  mwifiex_set_sta_ht_cap(struct mwifiex_private *priv, const u8 *ies,
 758                        int ies_len, struct mwifiex_sta_node *node);
 759  struct mwifiex_sta_node *
 760 -mwifiex_add_sta_entry(struct mwifiex_private *priv, u8 *mac);
 761 +mwifiex_add_sta_entry(struct mwifiex_private *priv, const u8 *mac);
 762  struct mwifiex_sta_node *
 763 -mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac);
 764 -int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, u8 *peer,
 765 +mwifiex_get_sta_entry(struct mwifiex_private *priv, const u8 *mac);
 766 +int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer,
 767                                  u8 action_code, u8 dialog_token,
 768                                  u16 status_code, const u8 *extra_ies,
 769                                  size_t extra_ies_len);
 770 -int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv,
 771 -                                u8 *peer, u8 action_code, u8 dialog_token,
 772 -                                u16 status_code, const u8 *extra_ies,
 773 -                                size_t extra_ies_len);
 774 +int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer,
 775 +                                  u8 action_code, u8 dialog_token,
 776 +                                  u16 status_code, const u8 *extra_ies,
 777 +                                  size_t extra_ies_len);
 778  void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
 779                                        u8 *buf, int len);
 780 -int mwifiex_tdls_oper(struct mwifiex_private *priv, u8 *peer, u8 action);
 781 -int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, u8 *mac);
 782 +int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action);
 783 +int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac);
 784  void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv);
 785  bool mwifiex_is_bss_in_11ac_mode(struct mwifiex_private *priv);
 786  u8 mwifiex_get_center_freq_index(struct mwifiex_private *priv, u8 band,
 787 --- a/drivers/net/wireless/mwifiex/tdls.c
 788 +++ b/drivers/net/wireless/mwifiex/tdls.c
 789 @@ -25,8 +25,8 @@
 790  #define TDLS_RESP_FIX_LEN     8
 791  #define TDLS_CONFIRM_FIX_LEN  6
 792
 793 -static void
 794 -mwifiex_restore_tdls_packets(struct mwifiex_private *priv, u8 *mac, u8 status)
 795 +static void mwifiex_restore_tdls_packets(struct mwifiex_private *priv,
 796 +                                        const u8 *mac, u8 status)
 797  {
 798         struct mwifiex_ra_list_tbl *ra_list;
 799         struct list_head *tid_list;
 800 @@ -84,7 +84,8 @@ mwifiex_restore_tdls_packets(struct mwif
 801         return;
 802  }
 803
 804 -static void mwifiex_hold_tdls_packets(struct mwifiex_private *priv, u8 *mac)
 805 +static void mwifiex_hold_tdls_packets(struct mwifiex_private *priv,
 806 +                                     const u8 *mac)
 807  {
 808         struct mwifiex_ra_list_tbl *ra_list;
 809         struct list_head *ra_list_head;
 810 @@ -228,7 +229,7 @@ mwifiex_tdls_add_ht_oper(struct mwifiex_
 811  }
 812
 813  static int mwifiex_tdls_add_vht_oper(struct mwifiex_private *priv,
 814 -                                    u8 *mac, struct sk_buff *skb)
 815 +                                    const u8 *mac, struct sk_buff *skb)
 816  {
 817         struct mwifiex_bssdescriptor *bss_desc;
 818         struct ieee80211_vht_operation *vht_oper;
 819 @@ -367,8 +368,9 @@ static void mwifiex_tdls_add_qos_capab(s
 820  }
 821
 822  static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
 823 -                            u8 *peer, u8 action_code, u8 dialog_token,
 824 -                            u16 status_code, struct sk_buff *skb)
 825 +                                       const u8 *peer, u8 action_code,
 826 +                                       u8 dialog_token,
 827 +                                       u16 status_code, struct sk_buff *skb)
 828  {
 829         struct ieee80211_tdls_data *tf;
 830         int ret;
 831 @@ -506,7 +508,8 @@ static int mwifiex_prep_tdls_encap_data(
 832  }
 833
 834  static void
 835 -mwifiex_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr, u8 *peer, u8 *bssid)
 836 +mwifiex_tdls_add_link_ie(struct sk_buff *skb, const u8 *src_addr,
 837 +                        const u8 *peer, const u8 *bssid)
 838  {
 839         struct ieee80211_tdls_lnkie *lnkid;
 840
 841 @@ -520,8 +523,8 @@ mwifiex_tdls_add_link_ie(struct sk_buff
 842         memcpy(lnkid->resp_sta, peer, ETH_ALEN);
 843  }
 844
 845 -int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv,
 846 -                                u8 *peer, u8 action_code, u8 dialog_token,
 847 +int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer,
 848 +                                u8 action_code, u8 dialog_token,
 849                                  u16 status_code, const u8 *extra_ies,
 850                                  size_t extra_ies_len)
 851  {
 852 @@ -613,7 +616,8 @@ int mwifiex_send_tdls_data_frame(struct
 853  }
 854
 855  static int
 856 -mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, u8 *peer,
 857 +mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
 858 +                                   const u8 *peer,
 859                                     u8 action_code, u8 dialog_token,
 860                                     u16 status_code, struct sk_buff *skb)
 861  {
 862 @@ -691,10 +695,10 @@ mwifiex_construct_tdls_action_frame(stru
 863         return 0;
 864  }
 865
 866 -int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv,
 867 -                                u8 *peer, u8 action_code, u8 dialog_token,
 868 -                                u16 status_code, const u8 *extra_ies,
 869 -                                size_t extra_ies_len)
 870 +int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer,
 871 +                                  u8 action_code, u8 dialog_token,
 872 +                                  u16 status_code, const u8 *extra_ies,
 873 +                                  size_t extra_ies_len)
 874  {
 875         struct sk_buff *skb;
 876         struct mwifiex_txinfo *tx_info;
 877 @@ -901,7 +905,7 @@ void mwifiex_process_tdls_action_frame(s
 878  }
 879
 880  static int
 881 -mwifiex_tdls_process_config_link(struct mwifiex_private *priv, u8 *peer)
 882 +mwifiex_tdls_process_config_link(struct mwifiex_private *priv, const u8 *peer)
 883  {
 884         struct mwifiex_sta_node *sta_ptr;
 885         struct mwifiex_ds_tdls_oper tdls_oper;
 886 @@ -922,7 +926,7 @@ mwifiex_tdls_process_config_link(struct
 887  }
 888
 889  static int
 890 -mwifiex_tdls_process_create_link(struct mwifiex_private *priv, u8 *peer)
 891 +mwifiex_tdls_process_create_link(struct mwifiex_private *priv, const u8 *peer)
 892  {
 893         struct mwifiex_sta_node *sta_ptr;
 894         struct mwifiex_ds_tdls_oper tdls_oper;
 895 @@ -949,7 +953,7 @@ mwifiex_tdls_process_create_link(struct
 896  }
 897
 898  static int
 899 -mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, u8 *peer)
 900 +mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, const u8 *peer)
 901  {
 902         struct mwifiex_sta_node *sta_ptr;
 903         struct mwifiex_ds_tdls_oper tdls_oper;
 904 @@ -978,7 +982,7 @@ mwifiex_tdls_process_disable_link(struct
 905  }
 906
 907  static int
 908 -mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, u8 *peer)
 909 +mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, const u8 *peer)
 910  {
 911         struct mwifiex_sta_node *sta_ptr;
 912         struct ieee80211_mcs_info mcs;
 913 @@ -1035,7 +1039,7 @@ mwifiex_tdls_process_enable_link(struct
 914         return 0;
 915  }
 916
 917 -int mwifiex_tdls_oper(struct mwifiex_private *priv, u8 *peer, u8 action)
 918 +int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action)
 919  {
 920         switch (action) {
 921         case MWIFIEX_TDLS_ENABLE_LINK:
 922 @@ -1050,7 +1054,7 @@ int mwifiex_tdls_oper(struct mwifiex_pri
 923         return 0;
 924  }
 925
 926 -int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, u8 *mac)
 927 +int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac)
 928  {
 929         struct mwifiex_sta_node *sta_ptr;
 930
 931 --- a/drivers/net/wireless/mwifiex/util.c
 932 +++ b/drivers/net/wireless/mwifiex/util.c
 933 @@ -259,7 +259,7 @@ int mwifiex_complete_cmd(struct mwifiex_
 934   * NULL is returned if station entry is not found in associated STA list.
 935   */
 936  struct mwifiex_sta_node *
 937 -mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac)
 938 +mwifiex_get_sta_entry(struct mwifiex_private *priv, const u8 *mac)
 939  {
 940         struct mwifiex_sta_node *node;
 941
 942 @@ -280,7 +280,7 @@ mwifiex_get_sta_entry(struct mwifiex_pri
 943   * If received mac address is NULL, NULL is returned.
 944   */
 945  struct mwifiex_sta_node *
 946 -mwifiex_add_sta_entry(struct mwifiex_private *priv, u8 *mac)
 947 +mwifiex_add_sta_entry(struct mwifiex_private *priv, const u8 *mac)
 948  {
 949         struct mwifiex_sta_node *node;
 950         unsigned long flags;
 951 @@ -332,7 +332,7 @@ mwifiex_set_sta_ht_cap(struct mwifiex_pr
 952  }
 953
 954  /* This function will delete a station entry from station list */
 955 -void mwifiex_del_sta_entry(struct mwifiex_private *priv, u8 *mac)
 956 +void mwifiex_del_sta_entry(struct mwifiex_private *priv, const u8 *mac)
 957  {
 958         struct mwifiex_sta_node *node;
 959         unsigned long flags;
 960 --- a/drivers/net/wireless/mwifiex/wmm.c
 961 +++ b/drivers/net/wireless/mwifiex/wmm.c
 962 @@ -92,7 +92,7 @@ mwifiex_wmm_ac_debug_print(const struct
 963   * The function also initializes the list with the provided RA.
 964   */
 965  static struct mwifiex_ra_list_tbl *
 966 -mwifiex_wmm_allocate_ralist_node(struct mwifiex_adapter *adapter, u8 *ra)
 967 +mwifiex_wmm_allocate_ralist_node(struct mwifiex_adapter *adapter, const u8 *ra)
 968  {
 969         struct mwifiex_ra_list_tbl *ra_list;
 970
 971 @@ -139,8 +139,7 @@ static u8 mwifiex_get_random_ba_threshol
 972   * This function allocates and adds a RA list for all TIDs
 973   * with the given RA.
 974   */
 975 -void
 976 -mwifiex_ralist_add(struct mwifiex_private *priv, u8 *ra)
 977 +void mwifiex_ralist_add(struct mwifiex_private *priv, const u8 *ra)
 978  {
 979         int i;
 980         struct mwifiex_ra_list_tbl *ra_list;
 981 @@ -566,7 +565,7 @@ mwifiex_clean_txrx(struct mwifiex_privat
 982   */
 983  static struct mwifiex_ra_list_tbl *
 984  mwifiex_wmm_get_ralist_node(struct mwifiex_private *priv, u8 tid,
 985 -                           u8 *ra_addr)
 986 +                           const u8 *ra_addr)
 987  {
 988         struct mwifiex_ra_list_tbl *ra_list;
 989
 990 @@ -587,7 +586,8 @@ mwifiex_wmm_get_ralist_node(struct mwifi
 991   * retrieved.
 992   */
 993  struct mwifiex_ra_list_tbl *
 994 -mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid, u8 *ra_addr)
 995 +mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid,
 996 +                           const u8 *ra_addr)
 997  {
 998         struct mwifiex_ra_list_tbl *ra_list;
 999
1000 --- a/drivers/net/wireless/mwifiex/wmm.h
1001 +++ b/drivers/net/wireless/mwifiex/wmm.h
1002 @@ -99,7 +99,7 @@ mwifiex_wmm_is_ra_list_empty(struct list
1003
1004  void mwifiex_wmm_add_buf_txqueue(struct mwifiex_private *priv,
1005                                  struct sk_buff *skb);
1006 -void mwifiex_ralist_add(struct mwifiex_private *priv, u8 *ra);
1007 +void mwifiex_ralist_add(struct mwifiex_private *priv, const u8 *ra);
1008  void mwifiex_rotate_priolists(struct mwifiex_private *priv,
1009                               struct mwifiex_ra_list_tbl *ra, int tid);
1010
1011 @@ -123,7 +123,8 @@ void mwifiex_wmm_setup_ac_downgrade(stru
1012  int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
1013                                const struct host_cmd_ds_command *resp);
1014  struct mwifiex_ra_list_tbl *
1015 -mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid, u8 *ra_addr);
1016 +mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid,
1017 +                           const u8 *ra_addr);
1018  u8 mwifiex_wmm_downgrade_tid(struct mwifiex_private *priv, u32 tid);
1019
1020  #endif /* !_MWIFIEX_WMM_H_ */
1021 --- a/drivers/net/wireless/orinoco/hw.c
1022 +++ b/drivers/net/wireless/orinoco/hw.c
1023 @@ -988,8 +988,8 @@ int __orinoco_hw_setup_enc(struct orinoc
1024   * tsc must be NULL or up to 8 bytes
1025   */
1026  int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx,
1027 -                             int set_tx, u8 *key, u8 *rsc, size_t rsc_len,
1028 -                             u8 *tsc, size_t tsc_len)
1029 +                             int set_tx, const u8 *key, const u8 *rsc,
1030 +                             size_t rsc_len, const u8 *tsc, size_t tsc_len)
1031  {
1032         struct {
1033                 __le16 idx;
1034 --- a/drivers/net/wireless/orinoco/hw.h
1035 +++ b/drivers/net/wireless/orinoco/hw.h
1036 @@ -38,8 +38,8 @@ int __orinoco_hw_set_wap(struct orinoco_
1037  int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv);
1038  int __orinoco_hw_setup_enc(struct orinoco_private *priv);
1039  int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx,
1040 -                             int set_tx, u8 *key, u8 *rsc, size_t rsc_len,
1041 -                             u8 *tsc, size_t tsc_len);
1042 +                             int set_tx, const u8 *key, const u8 *rsc,
1043 +                             size_t rsc_len, const u8 *tsc, size_t tsc_len);
1044  int orinoco_clear_tkip_key(struct orinoco_private *priv, int key_idx);
1045  int __orinoco_hw_set_multicast_list(struct orinoco_private *priv,
1046                                     struct net_device *dev,
1047 --- a/drivers/net/wireless/orinoco/wext.c
1048 +++ b/drivers/net/wireless/orinoco/wext.c
1049 @@ -52,9 +52,9 @@ static int orinoco_set_key(struct orinoc
1050         priv->keys[index].seq_len = seq_len;
1051
1052         if (key_len)
1053 -               memcpy(priv->keys[index].key, key, key_len);
1054 +               memcpy((void *)priv->keys[index].key, key, key_len);
1055         if (seq_len)
1056 -               memcpy(priv->keys[index].seq, seq, seq_len);
1057 +               memcpy((void *)priv->keys[index].seq, seq, seq_len);
1058
1059         switch (alg) {
1060         case ORINOCO_ALG_TKIP:
1061 --- a/drivers/net/wireless/rndis_wlan.c
1062 +++ b/drivers/net/wireless/rndis_wlan.c
1063 @@ -517,7 +517,7 @@ static int rndis_set_default_key(struct
1064                                  u8 key_index, bool unicast, bool multicast);
1065
1066  static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev,
1067 -                                       u8 *mac, struct station_info *sinfo);
1068 +                            const u8 *mac, struct station_info *sinfo);
1069
1070  static int rndis_dump_station(struct wiphy *wiphy, struct net_device *dev,
1071                                int idx, u8 *mac, struct station_info *sinfo);
1072 @@ -2490,7 +2490,7 @@ static void rndis_fill_station_info(stru
1073  }
1074
1075  static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev,
1076 -                                       u8 *mac, struct station_info *sinfo)
1077 +                            const u8 *mac, struct station_info *sinfo)
1078  {
1079         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
1080         struct usbnet *usbdev = priv->usbdev;
1081 --- a/drivers/net/wireless/ti/wlcore/main.c
1082 +++ b/drivers/net/wireless/ti/wlcore/main.c
1083 @@ -1416,7 +1416,7 @@ void wl1271_rx_filter_free(struct wl12xx
1084
1085  int wl1271_rx_filter_alloc_field(struct wl12xx_rx_filter *filter,
1086                                  u16 offset, u8 flags,
1087 -                                u8 *pattern, u8 len)
1088 +                                const u8 *pattern, u8 len)
1089  {
1090         struct wl12xx_rx_filter_field *field;
1091
1092 --- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
1093 +++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
1094 @@ -512,8 +512,8 @@ int wl1271_recalc_rx_streaming(struct wl
1095  void wl12xx_queue_recovery_work(struct wl1271 *wl);
1096  size_t wl12xx_copy_fwlog(struct wl1271 *wl, u8 *memblock, size_t maxlen);
1097  int wl1271_rx_filter_alloc_field(struct wl12xx_rx_filter *filter,
1098 -                                       u16 offset, u8 flags,
1099 -                                       u8 *pattern, u8 len);
1100 +                                u16 offset, u8 flags,
1101 +                                const u8 *pattern, u8 len);
1102  void wl1271_rx_filter_free(struct wl12xx_rx_filter *filter);
1103  struct wl12xx_rx_filter *wl1271_rx_filter_alloc(void);
1104  int wl1271_rx_filter_get_fields_size(struct wl12xx_rx_filter *filter);
1105 --- a/include/net/cfg80211.h
1106 +++ b/include/net/cfg80211.h
1107 @@ -341,8 +341,8 @@ struct vif_params {
1108   * @seq_len: length of @seq.
1109   */
1110  struct key_params {
1111 -       u8 *key;
1112 -       u8 *seq;
1113 +       const u8 *key;
1114 +       const u8 *seq;
1115         int key_len;
1116         int seq_len;
1117         u32 cipher;
1118 @@ -458,7 +458,7 @@ bool cfg80211_chandef_usable(struct wiph
1119   */
1120  int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
1121                                   const struct cfg80211_chan_def *chandef,
1122 -                                 enum nl80211_iftype);
1123 +                                 enum nl80211_iftype iftype);
1124
1125  /**
1126   * ieee80211_chandef_rate_flags - returns rate flags for a channel
1127 @@ -694,8 +694,10 @@ struct cfg80211_ap_settings {
1128   *
1129   * @chandef: defines the channel to use after the switch
1130   * @beacon_csa: beacon data while performing the switch
1131 - * @counter_offset_beacon: offset for the counter within the beacon (tail)
1132 - * @counter_offset_presp: offset for the counter within the probe response
1133 + * @counter_offsets_beacon: offsets of the counters within the beacon (tail)
1134 + * @counter_offsets_presp: offsets of the counters within the probe response
1135 + * @n_counter_offsets_beacon: number of csa counters the beacon (tail)
1136 + * @n_counter_offsets_presp: number of csa counters in the probe response
1137   * @beacon_after: beacon data to be used on the new channel
1138   * @radar_required: whether radar detection is required on the new channel
1139   * @block_tx: whether transmissions should be blocked while changing
1140 @@ -704,7 +706,10 @@ struct cfg80211_ap_settings {
1141  struct cfg80211_csa_settings {
1142         struct cfg80211_chan_def chandef;
1143         struct cfg80211_beacon_data beacon_csa;
1144 -       u16 counter_offset_beacon, counter_offset_presp;
1145 +       const u16 *counter_offsets_beacon;
1146 +       const u16 *counter_offsets_presp;
1147 +       unsigned int n_counter_offsets_beacon;
1148 +       unsigned int n_counter_offsets_presp;
1149         struct cfg80211_beacon_data beacon_after;
1150         bool radar_required;
1151         bool block_tx;
1152 @@ -1164,7 +1169,7 @@ struct bss_parameters {
1153         int use_cts_prot;
1154         int use_short_preamble;
1155         int use_short_slot_time;
1156 -       u8 *basic_rates;
1157 +       const u8 *basic_rates;
1158         u8 basic_rates_len;
1159         int ap_isolate;
1160         int ht_opmode;
1161 @@ -1694,10 +1699,10 @@ struct cfg80211_disassoc_request {
1162   * @ht_capa_mask:  The bits of ht_capa which are to be used.
1163   */
1164  struct cfg80211_ibss_params {
1165 -       u8 *ssid;
1166 -       u8 *bssid;
1167 +       const u8 *ssid;
1168 +       const u8 *bssid;
1169         struct cfg80211_chan_def chandef;
1170 -       u8 *ie;
1171 +       const u8 *ie;
1172         u8 ssid_len, ie_len;
1173         u16 beacon_interval;
1174         u32 basic_rates;
1175 @@ -1806,8 +1811,8 @@ struct cfg80211_bitrate_mask {
1176   * @pmkid: The PMK material itself.
1177   */
1178  struct cfg80211_pmksa {
1179 -       u8 *bssid;
1180 -       u8 *pmkid;
1181 +       const u8 *bssid;
1182 +       const u8 *pmkid;
1183  };
1184
1185  /**
1186 @@ -1822,7 +1827,7 @@ struct cfg80211_pmksa {
1187   * memory, free @mask only!
1188   */
1189  struct cfg80211_pkt_pattern {
1190 -       u8 *mask, *pattern;
1191 +       const u8 *mask, *pattern;
1192         int pattern_len;
1193         int pkt_offset;
1194  };
1195 @@ -1986,6 +1991,8 @@ struct cfg80211_update_ft_ies_params {
1196   * @len: buffer length
1197   * @no_cck: don't use cck rates for this frame
1198   * @dont_wait_for_ack: tells the low level not to wait for an ack
1199 + * @n_csa_offsets: length of csa_offsets array
1200 + * @csa_offsets: array of all the csa offsets in the frame
1201   */
1202  struct cfg80211_mgmt_tx_params {
1203         struct ieee80211_channel *chan;
1204 @@ -1995,6 +2002,8 @@ struct cfg80211_mgmt_tx_params {
1205         size_t len;
1206         bool no_cck;
1207         bool dont_wait_for_ack;
1208 +       int n_csa_offsets;
1209 +       const u16 *csa_offsets;
1210  };
1211
1212  /**
1213 @@ -2336,28 +2345,29 @@ struct cfg80211_ops {
1214
1215
1216         int     (*add_station)(struct wiphy *wiphy, struct net_device *dev,
1217 -                              u8 *mac, struct station_parameters *params);
1218 +                              const u8 *mac,
1219 +                              struct station_parameters *params);
1220         int     (*del_station)(struct wiphy *wiphy, struct net_device *dev,
1221 -                              u8 *mac);
1222 +                              const u8 *mac);
1223         int     (*change_station)(struct wiphy *wiphy, struct net_device *dev,
1224 -                                 u8 *mac, struct station_parameters *params);
1225 +                                 const u8 *mac,
1226 +                                 struct station_parameters *params);
1227         int     (*get_station)(struct wiphy *wiphy, struct net_device *dev,
1228 -                              u8 *mac, struct station_info *sinfo);
1229 +                              const u8 *mac, struct station_info *sinfo);
1230         int     (*dump_station)(struct wiphy *wiphy, struct net_device *dev,
1231 -                              int idx, u8 *mac, struct station_info *sinfo);
1232 +                               int idx, u8 *mac, struct station_info *sinfo);
1233
1234         int     (*add_mpath)(struct wiphy *wiphy, struct net_device *dev,
1235 -                              u8 *dst, u8 *next_hop);
1236 +                              const u8 *dst, const u8 *next_hop);
1237         int     (*del_mpath)(struct wiphy *wiphy, struct net_device *dev,
1238 -                              u8 *dst);
1239 +                              const u8 *dst);
1240         int     (*change_mpath)(struct wiphy *wiphy, struct net_device *dev,
1241 -                                 u8 *dst, u8 *next_hop);
1242 +                                 const u8 *dst, const u8 *next_hop);
1243         int     (*get_mpath)(struct wiphy *wiphy, struct net_device *dev,
1244 -                              u8 *dst, u8 *next_hop,
1245 -                              struct mpath_info *pinfo);
1246 +                            u8 *dst, u8 *next_hop, struct mpath_info *pinfo);
1247         int     (*dump_mpath)(struct wiphy *wiphy, struct net_device *dev,
1248 -                              int idx, u8 *dst, u8 *next_hop,
1249 -                              struct mpath_info *pinfo);
1250 +                             int idx, u8 *dst, u8 *next_hop,
1251 +                             struct mpath_info *pinfo);
1252         int     (*get_mesh_config)(struct wiphy *wiphy,
1253                                 struct net_device *dev,
1254                                 struct mesh_config *conf);
1255 @@ -2487,11 +2497,11 @@ struct cfg80211_ops {
1256                                   struct cfg80211_gtk_rekey_data *data);
1257
1258         int     (*tdls_mgmt)(struct wiphy *wiphy, struct net_device *dev,
1259 -                            u8 *peer, u8 action_code,  u8 dialog_token,
1260 +                            const u8 *peer, u8 action_code,  u8 dialog_token,
1261                              u16 status_code, u32 peer_capability,
1262                              const u8 *buf, size_t len);
1263         int     (*tdls_oper)(struct wiphy *wiphy, struct net_device *dev,
1264 -                            u8 *peer, enum nl80211_tdls_operation oper);
1265 +                            const u8 *peer, enum nl80211_tdls_operation oper);
1266
1267         int     (*probe_client)(struct wiphy *wiphy, struct net_device *dev,
1268                                 const u8 *peer, u64 *cookie);
1269 @@ -2638,6 +2648,7 @@ struct ieee80211_iface_limit {
1270   *     between infrastructure and AP types must match. This is required
1271   *     only in special cases.
1272   * @radar_detect_widths: bitmap of channel widths supported for radar detection
1273 + * @radar_detect_regions: bitmap of regions supported for radar detection
1274   *
1275   * With this structure the driver can describe which interface
1276   * combinations it supports concurrently.
1277 @@ -2695,6 +2706,7 @@ struct ieee80211_iface_combination {
1278         u8 n_limits;
1279         bool beacon_int_infra_match;
1280         u8 radar_detect_widths;
1281 +       u8 radar_detect_regions;
1282  };
1283
1284  struct ieee80211_txrx_stypes {
1285 @@ -2925,6 +2937,11 @@ struct wiphy_vendor_command {
1286   *     (including P2P GO) or 0 to indicate no such limit is advertised. The
1287   *     driver is allowed to advertise a theoretical limit that it can reach in
1288   *     some cases, but may not always reach.
1289 + *
1290 + * @max_num_csa_counters: Number of supported csa_counters in beacons
1291 + *     and probe responses.  This value should be set if the driver
1292 + *     wishes to limit the number of csa counters. Default (0) means
1293 + *     infinite.
1294   */
1295  struct wiphy {
1296         /* assign these fields before you register the wiphy */
1297 @@ -3045,6 +3062,8 @@ struct wiphy {
1298
1299         u16 max_ap_assoc_sta;
1300
1301 +       u8 max_num_csa_counters;
1302 +
1303         char priv[0] __aligned(NETDEV_ALIGN);
1304  };
1305
1306 @@ -3273,7 +3292,7 @@ struct wireless_dev {
1307                 struct cfg80211_ibss_params ibss;
1308                 struct cfg80211_connect_params connect;
1309                 struct cfg80211_cached_keys *keys;
1310 -               u8 *ie;
1311 +               const u8 *ie;
1312                 size_t ie_len;
1313                 u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
1314                 u8 ssid[IEEE80211_MAX_SSID_LEN];
1315 @@ -3514,7 +3533,8 @@ int ieee80211_data_to_8023(struct sk_buf
1316   * Return: 0 on success, or a negative error code.
1317   */
1318  int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
1319 -                            enum nl80211_iftype iftype, u8 *bssid, bool qos);
1320 +                            enum nl80211_iftype iftype, const u8 *bssid,
1321 +                            bool qos);
1322
1323  /**
1324   * ieee80211_amsdu_to_8023s - decode an IEEE 802.11n A-MSDU frame
1325 @@ -4315,7 +4335,7 @@ void cfg80211_roamed_bss(struct net_devi
1326   * and not try to connect to any AP any more.
1327   */
1328  void cfg80211_disconnected(struct net_device *dev, u16 reason,
1329 -                          u8 *ie, size_t ie_len, gfp_t gfp);
1330 +                          const u8 *ie, size_t ie_len, gfp_t gfp);
1331
1332  /**
1333   * cfg80211_ready_on_channel - notification of remain_on_channel start
1334 @@ -4771,6 +4791,35 @@ int cfg80211_iter_combinations(struct wi
1335                                             void *data),
1336                                void *data);
1337
1338 +/*
1339 + * cfg80211_stop_iface - trigger interface disconnection
1340 + *
1341 + * @wiphy: the wiphy
1342 + * @wdev: wireless device
1343 + * @gfp: context flags
1344 + *
1345 + * Trigger interface to be stopped as if AP was stopped, IBSS/mesh left, STA
1346 + * disconnected.
1347 + *
1348 + * Note: This doesn't need any locks and is asynchronous.
1349 + */
1350 +void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev,
1351 +                        gfp_t gfp);
1352 +
1353 +/**
1354 + * cfg80211_shutdown_all_interfaces - shut down all interfaces for a wiphy
1355 + * @wiphy: the wiphy to shut down
1356 + *
1357 + * This function shuts down all interfaces belonging to this wiphy by
1358 + * calling dev_close() (and treating non-netdev interfaces as needed).
1359 + * It shouldn't really be used unless there are some fatal device errors
1360 + * that really can't be recovered in any other way.
1361 + *
1362 + * Callers must hold the RTNL and be able to deal with callbacks into
1363 + * the driver while the function is running.
1364 + */
1365 +void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy);
1366 +
1367  /* Logging, debugging and troubleshooting/diagnostic helpers. */
1368
1369  /* wiphy_printk helpers, similar to dev_printk */
1370 --- a/include/net/mac80211.h
1371 +++ b/include/net/mac80211.h
1372 @@ -1113,7 +1113,9 @@ enum ieee80211_vif_flags {
1373   * @addr: address of this interface
1374   * @p2p: indicates whether this AP or STA interface is a p2p
1375   *     interface, i.e. a GO or p2p-sta respectively
1376 - * @csa_active: marks whether a channel switch is going on
1377 + * @csa_active: marks whether a channel switch is going on. Internally it is
1378 + *     write-protected by sdata_lock and local->mtx so holding either is fine
1379 + *     for read access.
1380   * @driver_flags: flags/capabilities the driver has for this interface,
1381   *     these need to be set (or cleared) when the interface is added
1382   *     or, if supported by the driver, the interface type is changed
1383 @@ -1374,6 +1376,7 @@ struct ieee80211_sta_rates {
1384   *     the station moves to associated state.
1385   * @smps_mode: current SMPS mode (off, static or dynamic)
1386   * @rates: rate control selection table
1387 + * @tdls: indicates whether the STA is a TDLS peer
1388   */
1389  struct ieee80211_sta {
1390         u32 supp_rates[IEEE80211_NUM_BANDS];
1391 @@ -1388,6 +1391,7 @@ struct ieee80211_sta {
1392         enum ieee80211_sta_rx_bandwidth bandwidth;
1393         enum ieee80211_smps_mode smps_mode;
1394         struct ieee80211_sta_rates __rcu *rates;
1395 +       bool tdls;
1396
1397         /* must be last */
1398         u8 drv_priv[0] __aligned(sizeof(void *));
1399 @@ -3407,6 +3411,47 @@ void ieee80211_tx_status_irqsafe(struct
1400   */
1401  void ieee80211_report_low_ack(struct ieee80211_sta *sta, u32 num_packets);
1402
1403 +#define IEEE80211_MAX_CSA_COUNTERS_NUM 2
1404 +
1405 +/**
1406 + * struct ieee80211_mutable_offsets - mutable beacon offsets
1407 + * @tim_offset: position of TIM element
1408 + * @tim_length: size of TIM element
1409 + * @csa_counter_offs: array of IEEE80211_MAX_CSA_COUNTERS_NUM offsets
1410 + *     to CSA counters.  This array can contain zero values which
1411 + *     should be ignored.
1412 + */
1413 +struct ieee80211_mutable_offsets {
1414 +       u16 tim_offset;
1415 +       u16 tim_length;
1416 +
1417 +       u16 csa_counter_offs[IEEE80211_MAX_CSA_COUNTERS_NUM];
1418 +};
1419 +
1420 +/**
1421 + * ieee80211_beacon_get_template - beacon template generation function
1422 + * @hw: pointer obtained from ieee80211_alloc_hw().
1423 + * @vif: &struct ieee80211_vif pointer from the add_interface callback.
1424 + * @offs: &struct ieee80211_mutable_offsets pointer to struct that will
1425 + *     receive the offsets that may be updated by the driver.
1426 + *
1427 + * If the driver implements beaconing modes, it must use this function to
1428 + * obtain the beacon template.
1429 + *
1430 + * This function should be used if the beacon frames are generated by the
1431 + * device, and then the driver must use the returned beacon as the template
1432 + * The driver or the device are responsible to update the DTIM and, when
1433 + * applicable, the CSA count.
1434 + *
1435 + * The driver is responsible for freeing the returned skb.
1436 + *
1437 + * Return: The beacon template. %NULL on error.
1438 + */
1439 +struct sk_buff *
1440 +ieee80211_beacon_get_template(struct ieee80211_hw *hw,
1441 +                             struct ieee80211_vif *vif,
1442 +                             struct ieee80211_mutable_offsets *offs);
1443 +
1444  /**
1445   * ieee80211_beacon_get_tim - beacon generation function
1446   * @hw: pointer obtained from ieee80211_alloc_hw().
1447 @@ -3418,16 +3463,12 @@ void ieee80211_report_low_ack(struct iee
1448   *     Set to 0 if invalid (in non-AP modes).
1449   *
1450   * If the driver implements beaconing modes, it must use this function to
1451 - * obtain the beacon frame/template.
1452 + * obtain the beacon frame.
1453   *
1454   * If the beacon frames are generated by the host system (i.e., not in
1455   * hardware/firmware), the driver uses this function to get each beacon
1456 - * frame from mac80211 -- it is responsible for calling this function
1457 - * before the beacon is needed (e.g. based on hardware interrupt).
1458 - *
1459 - * If the beacon frames are generated by the device, then the driver
1460 - * must use the returned beacon as the template and change the TIM IE
1461 - * according to the current DTIM parameters/TIM bitmap.
1462 + * frame from mac80211 -- it is responsible for calling this function exactly
1463 + * once before the beacon is needed (e.g. based on hardware interrupt).
1464   *
1465   * The driver is responsible for freeing the returned skb.
1466   *
1467 @@ -3453,6 +3494,20 @@ static inline struct sk_buff *ieee80211_
1468  }
1469
1470  /**
1471 + * ieee80211_csa_update_counter - request mac80211 to decrement the csa counter
1472 + * @vif: &struct ieee80211_vif pointer from the add_interface callback.
1473 + *
1474 + * The csa counter should be updated after each beacon transmission.
1475 + * This function is called implicitly when
1476 + * ieee80211_beacon_get/ieee80211_beacon_get_tim are called, however if the
1477 + * beacon frames are generated by the device, the driver should call this
1478 + * function after each beacon transmission to sync mac80211's csa counters.
1479 + *
1480 + * Return: new csa counter value
1481 + */
1482 +u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif);
1483 +
1484 +/**
1485   * ieee80211_csa_finish - notify mac80211 about channel switch
1486   * @vif: &struct ieee80211_vif pointer from the add_interface callback.
1487   *
1488 --- a/include/uapi/linux/nl80211.h
1489 +++ b/include/uapi/linux/nl80211.h
1490 @@ -503,6 +503,9 @@
1491   *     TX status event pertaining to the TX request.
1492   *     %NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the
1493   *     management frames at CCK rate or not in 2GHz band.
1494 + *     %NL80211_ATTR_CSA_C_OFFSETS_TX is an array of offsets to CSA
1495 + *     counters which will be updated to the current value. This attribute
1496 + *     is used during CSA period.
1497   * @NL80211_CMD_FRAME_WAIT_CANCEL: When an off-channel TX was requested, this
1498   *     command may be used with the corresponding cookie to cancel the wait
1499   *     time if it is known that it is no longer necessary.
1500 @@ -1525,10 +1528,10 @@ enum nl80211_commands {
1501   *     operation).
1502   * @NL80211_ATTR_CSA_IES: Nested set of attributes containing the IE information
1503   *     for the time while performing a channel switch.
1504 - * @NL80211_ATTR_CSA_C_OFF_BEACON: Offset of the channel switch counter
1505 - *     field in the beacons tail (%NL80211_ATTR_BEACON_TAIL).
1506 - * @NL80211_ATTR_CSA_C_OFF_PRESP: Offset of the channel switch counter
1507 - *     field in the probe response (%NL80211_ATTR_PROBE_RESP).
1508 + * @NL80211_ATTR_CSA_C_OFF_BEACON: An array of offsets (u16) to the channel
1509 + *     switch counters in the beacons tail (%NL80211_ATTR_BEACON_TAIL).
1510 + * @NL80211_ATTR_CSA_C_OFF_PRESP: An array of offsets (u16) to the channel
1511 + *     switch counters in the probe response (%NL80211_ATTR_PROBE_RESP).
1512   *
1513   * @NL80211_ATTR_RXMGMT_FLAGS: flags for nl80211_send_mgmt(), u32.
1514   *     As specified in the &enum nl80211_rxmgmt_flags.
1515 @@ -1576,6 +1579,11 @@ enum nl80211_commands {
1516   *     advertise values that cannot always be met. In such cases, an attempt
1517   *     to add a new station entry with @NL80211_CMD_NEW_STATION may fail.
1518   *
1519 + * @NL80211_ATTR_CSA_C_OFFSETS_TX: An array of csa counter offsets (u16) which
1520 + *     should be updated when the frame is transmitted.
1521 + * @NL80211_ATTR_MAX_CSA_COUNTERS: U8 attribute used to advertise the maximum
1522 + *     supported number of csa counters.
1523 + *
1524   * @NL80211_ATTR_TDLS_PEER_CAPABILITY: flags for TDLS peer capabilities, u32.
1525   *     As specified in the &enum nl80211_tdls_peer_capability.
1526   *
1527 @@ -1920,6 +1928,9 @@ enum nl80211_attrs {
1528
1529         NL80211_ATTR_IFACE_SOCKET_OWNER,
1530
1531 +       NL80211_ATTR_CSA_C_OFFSETS_TX,
1532 +       NL80211_ATTR_MAX_CSA_COUNTERS,
1533 +
1534         /* add attributes here, update the policy in nl80211.c */
1535
1536         __NL80211_ATTR_AFTER_LAST,
1537 @@ -3688,6 +3699,8 @@ enum nl80211_iface_limit_attrs {
1538   *     different channels may be used within this group.
1539   * @NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS: u32 attribute containing the bitmap
1540   *     of supported channel widths for radar detection.
1541 + * @NL80211_IFACE_COMB_RADAR_DETECT_REGIONS: u32 attribute containing the bitmap
1542 + *     of supported regulatory regions for radar detection.
1543   * @NUM_NL80211_IFACE_COMB: number of attributes
1544   * @MAX_NL80211_IFACE_COMB: highest attribute number
1545   *
1546 @@ -3721,6 +3734,7 @@ enum nl80211_if_combination_attrs {
1547         NL80211_IFACE_COMB_STA_AP_BI_MATCH,
1548         NL80211_IFACE_COMB_NUM_CHANNELS,
1549         NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1550 +       NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1551
1552         /* keep last */
1553         NUM_NL80211_IFACE_COMB,
1554 --- a/net/mac80211/Makefile
1555 +++ b/net/mac80211/Makefile
1556 @@ -25,7 +25,8 @@ mac80211-y := \
1557         wme.o \
1558         event.o \
1559         chan.o \
1560 -       trace.o mlme.o
1561 +       trace.o mlme.o \
1562 +       tdls.o
1563
1564  mac80211-$(CPTCFG_MAC80211_LEDS) += led.o
1565  mac80211-$(CPTCFG_MAC80211_DEBUGFS) += \
1566 --- a/net/mac80211/cfg.c
1567 +++ b/net/mac80211/cfg.c
1568 @@ -777,7 +777,7 @@ static void ieee80211_get_et_strings(str
1569  }
1570
1571  static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
1572 -                                int idx, u8 *mac, struct station_info *sinfo)
1573 +                                 int idx, u8 *mac, struct station_info *sinfo)
1574  {
1575         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1576         struct ieee80211_local *local = sdata->local;
1577 @@ -807,7 +807,7 @@ static int ieee80211_dump_survey(struct
1578  }
1579
1580  static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
1581 -                                u8 *mac, struct station_info *sinfo)
1582 +                                const u8 *mac, struct station_info *sinfo)
1583  {
1584         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1585         struct ieee80211_local *local = sdata->local;
1586 @@ -1084,6 +1084,31 @@ static int ieee80211_change_beacon(struc
1587         return 0;
1588  }
1589
1590 +bool ieee80211_csa_needs_block_tx(struct ieee80211_local *local)
1591 +{
1592 +       struct ieee80211_sub_if_data *sdata;
1593 +
1594 +       lockdep_assert_held(&local->mtx);
1595 +
1596 +       rcu_read_lock();
1597 +       list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1598 +               if (!ieee80211_sdata_running(sdata))
1599 +                       continue;
1600 +
1601 +               if (!sdata->vif.csa_active)
1602 +                       continue;
1603 +
1604 +               if (!sdata->csa_block_tx)
1605 +                       continue;
1606 +
1607 +               rcu_read_unlock();
1608 +               return true;
1609 +       }
1610 +       rcu_read_unlock();
1611 +
1612 +       return false;
1613 +}
1614 +
1615  static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
1616  {
1617         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1618 @@ -1101,7 +1126,14 @@ static int ieee80211_stop_ap(struct wiph
1619         old_probe_resp = sdata_dereference(sdata->u.ap.probe_resp, sdata);
1620
1621         /* abort any running channel switch */
1622 +       mutex_lock(&local->mtx);
1623         sdata->vif.csa_active = false;
1624 +       if (!ieee80211_csa_needs_block_tx(local))
1625 +               ieee80211_wake_queues_by_reason(&local->hw,
1626 +                                       IEEE80211_MAX_QUEUE_MAP,
1627 +                                       IEEE80211_QUEUE_STOP_REASON_CSA);
1628 +       mutex_unlock(&local->mtx);
1629 +
1630         kfree(sdata->u.ap.next_beacon);
1631         sdata->u.ap.next_beacon = NULL;
1632
1633 @@ -1425,7 +1457,8 @@ static int sta_apply_parameters(struct i
1634  }
1635
1636  static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
1637 -                                u8 *mac, struct station_parameters *params)
1638 +                                const u8 *mac,
1639 +                                struct station_parameters *params)
1640  {
1641         struct ieee80211_local *local = wiphy_priv(wiphy);
1642         struct sta_info *sta;
1643 @@ -1459,6 +1492,8 @@ static int ieee80211_add_station(struct
1644         if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) {
1645                 sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
1646                 sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
1647 +       } else {
1648 +               sta->sta.tdls = true;
1649         }
1650
1651         err = sta_apply_parameters(local, sta, params);
1652 @@ -1492,7 +1527,7 @@ static int ieee80211_add_station(struct
1653  }
1654
1655  static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
1656 -                                u8 *mac)
1657 +                                const u8 *mac)
1658  {
1659         struct ieee80211_sub_if_data *sdata;
1660
1661 @@ -1506,7 +1541,7 @@ static int ieee80211_del_station(struct
1662  }
1663
1664  static int ieee80211_change_station(struct wiphy *wiphy,
1665 -                                   struct net_device *dev, u8 *mac,
1666 +                                   struct net_device *dev, const u8 *mac,
1667                                     struct station_parameters *params)
1668  {
1669         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1670 @@ -1631,7 +1666,7 @@ out_err:
1671
1672  #ifdef CPTCFG_MAC80211_MESH
1673  static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
1674 -                                u8 *dst, u8 *next_hop)
1675 +                              const u8 *dst, const u8 *next_hop)
1676  {
1677         struct ieee80211_sub_if_data *sdata;
1678         struct mesh_path *mpath;
1679 @@ -1659,7 +1694,7 @@ static int ieee80211_add_mpath(struct wi
1680  }
1681
1682  static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev,
1683 -                              u8 *dst)
1684 +                              const u8 *dst)
1685  {
1686         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1687
1688 @@ -1670,9 +1705,8 @@ static int ieee80211_del_mpath(struct wi
1689         return 0;
1690  }
1691
1692 -static int ieee80211_change_mpath(struct wiphy *wiphy,
1693 -                                   struct net_device *dev,
1694 -                                   u8 *dst, u8 *next_hop)
1695 +static int ieee80211_change_mpath(struct wiphy *wiphy, struct net_device *dev,
1696 +                                 const u8 *dst, const u8 *next_hop)
1697  {
1698         struct ieee80211_sub_if_data *sdata;
1699         struct mesh_path *mpath;
1700 @@ -1764,8 +1798,8 @@ static int ieee80211_get_mpath(struct wi
1701  }
1702
1703  static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
1704 -                                int idx, u8 *dst, u8 *next_hop,
1705 -                                struct mpath_info *pinfo)
1706 +                               int idx, u8 *dst, u8 *next_hop,
1707 +                               struct mpath_info *pinfo)
1708  {
1709         struct ieee80211_sub_if_data *sdata;
1710         struct mesh_path *mpath;
1711 @@ -3019,26 +3053,11 @@ void ieee80211_csa_finish(struct ieee802
1712  }
1713  EXPORT_SYMBOL(ieee80211_csa_finish);
1714
1715 -static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
1716 +static int ieee80211_set_after_csa_beacon(struct ieee80211_sub_if_data *sdata,
1717 +                                         u32 *changed)
1718  {
1719 -       struct ieee80211_local *local = sdata->local;
1720 -       int err, changed = 0;
1721 -
1722 -       sdata_assert_lock(sdata);
1723 -
1724 -       mutex_lock(&local->mtx);
1725 -       sdata->radar_required = sdata->csa_radar_required;
1726 -       err = ieee80211_vif_change_channel(sdata, &changed);
1727 -       mutex_unlock(&local->mtx);
1728 -       if (WARN_ON(err < 0))
1729 -               return;
1730 -
1731 -       if (!local->use_chanctx) {
1732 -               local->_oper_chandef = sdata->csa_chandef;
1733 -               ieee80211_hw_config(local, 0);
1734 -       }
1735 +       int err;
1736
1737 -       sdata->vif.csa_active = false;
1738         switch (sdata->vif.type) {
1739         case NL80211_IFTYPE_AP:
1740                 err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
1741 @@ -3046,35 +3065,75 @@ static void ieee80211_csa_finalize(struc
1742                 sdata->u.ap.next_beacon = NULL;
1743
1744                 if (err < 0)
1745 -                       return;
1746 -               changed |= err;
1747 +                       return err;
1748 +               *changed |= err;
1749                 break;
1750         case NL80211_IFTYPE_ADHOC:
1751                 err = ieee80211_ibss_finish_csa(sdata);
1752                 if (err < 0)
1753 -                       return;
1754 -               changed |= err;
1755 +                       return err;
1756 +               *changed |= err;
1757                 break;
1758  #ifdef CPTCFG_MAC80211_MESH
1759         case NL80211_IFTYPE_MESH_POINT:
1760                 err = ieee80211_mesh_finish_csa(sdata);
1761                 if (err < 0)
1762 -                       return;
1763 -               changed |= err;
1764 +                       return err;
1765 +               *changed |= err;
1766                 break;
1767  #endif
1768         default:
1769                 WARN_ON(1);
1770 -               return;
1771 +               return -EINVAL;
1772         }
1773
1774 +
1775 +       return 0;
1776 +}
1777 +
1778 +static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
1779 +{
1780 +       struct ieee80211_local *local = sdata->local;
1781 +       u32 changed = 0;
1782 +       int err;
1783 +
1784 +       sdata_assert_lock(sdata);
1785 +       lockdep_assert_held(&local->mtx);
1786 +
1787 +       sdata->radar_required = sdata->csa_radar_required;
1788 +       err = ieee80211_vif_change_channel(sdata, &changed);
1789 +       if (err < 0)
1790 +               return err;
1791 +
1792 +       if (!local->use_chanctx) {
1793 +               local->_oper_chandef = sdata->csa_chandef;
1794 +               ieee80211_hw_config(local, 0);
1795 +       }
1796 +
1797 +       sdata->vif.csa_active = false;
1798 +
1799 +       err = ieee80211_set_after_csa_beacon(sdata, &changed);
1800 +       if (err)
1801 +               return err;
1802 +
1803         ieee80211_bss_info_change_notify(sdata, changed);
1804 +       cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
1805
1806 -       ieee80211_wake_queues_by_reason(&sdata->local->hw,
1807 +       if (!ieee80211_csa_needs_block_tx(local))
1808 +               ieee80211_wake_queues_by_reason(&local->hw,
1809                                         IEEE80211_MAX_QUEUE_MAP,
1810                                         IEEE80211_QUEUE_STOP_REASON_CSA);
1811
1812 -       cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
1813 +       return 0;
1814 +}
1815 +
1816 +static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
1817 +{
1818 +       if (__ieee80211_csa_finalize(sdata)) {
1819 +               sdata_info(sdata, "failed to finalize CSA, disconnecting\n");
1820 +               cfg80211_stop_iface(sdata->local->hw.wiphy, &sdata->wdev,
1821 +                                   GFP_KERNEL);
1822 +       }
1823  }
1824
1825  void ieee80211_csa_finalize_work(struct work_struct *work)
1826 @@ -3082,8 +3141,11 @@ void ieee80211_csa_finalize_work(struct
1827         struct ieee80211_sub_if_data *sdata =
1828                 container_of(work, struct ieee80211_sub_if_data,
1829                              csa_finalize_work);
1830 +       struct ieee80211_local *local = sdata->local;
1831
1832         sdata_lock(sdata);
1833 +       mutex_lock(&local->mtx);
1834 +
1835         /* AP might have been stopped while waiting for the lock. */
1836         if (!sdata->vif.csa_active)
1837                 goto unlock;
1838 @@ -3094,6 +3156,7 @@ void ieee80211_csa_finalize_work(struct
1839         ieee80211_csa_finalize(sdata);
1840
1841  unlock:
1842 +       mutex_unlock(&local->mtx);
1843         sdata_unlock(sdata);
1844  }
1845
1846 @@ -3129,9 +3192,25 @@ static int ieee80211_set_csa_beacon(stru
1847                 if (params->count <= 1)
1848                         break;
1849
1850 -               sdata->csa_counter_offset_beacon =
1851 -                       params->counter_offset_beacon;
1852 -               sdata->csa_counter_offset_presp = params->counter_offset_presp;
1853 +               if ((params->n_counter_offsets_beacon >
1854 +                    IEEE80211_MAX_CSA_COUNTERS_NUM) ||
1855 +                   (params->n_counter_offsets_presp >
1856 +                    IEEE80211_MAX_CSA_COUNTERS_NUM))
1857 +                       return -EINVAL;
1858 +
1859 +               /* make sure we don't have garbage in other counters */
1860 +               memset(sdata->csa_counter_offset_beacon, 0,
1861 +                      sizeof(sdata->csa_counter_offset_beacon));
1862 +               memset(sdata->csa_counter_offset_presp, 0,
1863 +                      sizeof(sdata->csa_counter_offset_presp));
1864 +
1865 +               memcpy(sdata->csa_counter_offset_beacon,
1866 +                      params->counter_offsets_beacon,
1867 +                      params->n_counter_offsets_beacon * sizeof(u16));
1868 +               memcpy(sdata->csa_counter_offset_presp,
1869 +                      params->counter_offsets_presp,
1870 +                      params->n_counter_offsets_presp * sizeof(u16));
1871 +
1872                 err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
1873                 if (err < 0) {
1874                         kfree(sdata->u.ap.next_beacon);
1875 @@ -3220,8 +3299,9 @@ static int ieee80211_set_csa_beacon(stru
1876         return 0;
1877  }
1878
1879 -int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
1880 -                            struct cfg80211_csa_settings *params)
1881 +static int
1882 +__ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
1883 +                          struct cfg80211_csa_settings *params)
1884  {
1885         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1886         struct ieee80211_local *local = sdata->local;
1887 @@ -3230,6 +3310,7 @@ int ieee80211_channel_switch(struct wiph
1888         int err, num_chanctx, changed = 0;
1889
1890         sdata_assert_lock(sdata);
1891 +       lockdep_assert_held(&local->mtx);
1892
1893         if (!list_empty(&local->roc_list) || local->scanning)
1894                 return -EBUSY;
1895 @@ -3272,15 +3353,16 @@ int ieee80211_channel_switch(struct wiph
1896                 return err;
1897
1898         sdata->csa_radar_required = params->radar_required;
1899 -
1900 -       if (params->block_tx)
1901 -               ieee80211_stop_queues_by_reason(&local->hw,
1902 -                               IEEE80211_MAX_QUEUE_MAP,
1903 -                               IEEE80211_QUEUE_STOP_REASON_CSA);
1904 -
1905         sdata->csa_chandef = params->chandef;
1906 +       sdata->csa_block_tx = params->block_tx;
1907 +       sdata->csa_current_counter = params->count;
1908         sdata->vif.csa_active = true;
1909
1910 +       if (sdata->csa_block_tx)
1911 +               ieee80211_stop_queues_by_reason(&local->hw,
1912 +                                       IEEE80211_MAX_QUEUE_MAP,
1913 +                                       IEEE80211_QUEUE_STOP_REASON_CSA);
1914 +
1915         if (changed) {
1916                 ieee80211_bss_info_change_notify(sdata, changed);
1917                 drv_channel_switch_beacon(sdata, &params->chandef);
1918 @@ -3292,6 +3374,20 @@ int ieee80211_channel_switch(struct wiph
1919         return 0;
1920  }
1921
1922 +int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
1923 +                            struct cfg80211_csa_settings *params)
1924 +{
1925 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1926 +       struct ieee80211_local *local = sdata->local;
1927 +       int err;
1928 +
1929 +       mutex_lock(&local->mtx);
1930 +       err = __ieee80211_channel_switch(wiphy, dev, params);
1931 +       mutex_unlock(&local->mtx);
1932 +
1933 +       return err;
1934 +}
1935 +
1936  static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
1937                              struct cfg80211_mgmt_tx_params *params,
1938                              u64 *cookie)
1939 @@ -3304,6 +3400,7 @@ static int ieee80211_mgmt_tx(struct wiph
1940         bool need_offchan = false;
1941         u32 flags;
1942         int ret;
1943 +       u8 *data;
1944
1945         if (params->dont_wait_for_ack)
1946                 flags = IEEE80211_TX_CTL_NO_ACK;
1947 @@ -3397,7 +3494,20 @@ static int ieee80211_mgmt_tx(struct wiph
1948         }
1949         skb_reserve(skb, local->hw.extra_tx_headroom);
1950
1951 -       memcpy(skb_put(skb, params->len), params->buf, params->len);
1952 +       data = skb_put(skb, params->len);
1953 +       memcpy(data, params->buf, params->len);
1954 +
1955 +       /* Update CSA counters */
1956 +       if (sdata->vif.csa_active &&
1957 +           (sdata->vif.type == NL80211_IFTYPE_AP ||
1958 +            sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
1959 +           params->n_csa_offsets) {
1960 +               int i;
1961 +               u8 c = sdata->csa_current_counter;
1962 +
1963 +               for (i = 0; i < params->n_csa_offsets; i++)
1964 +                       data[params->csa_offsets[i]] = c;
1965 +       }
1966
1967         IEEE80211_SKB_CB(skb)->flags = flags;
1968
1969 @@ -3506,320 +3616,6 @@ static int ieee80211_set_rekey_data(stru
1970         return 0;
1971  }
1972
1973 -static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb)
1974 -{
1975 -       u8 *pos = (void *)skb_put(skb, 7);
1976 -
1977 -       *pos++ = WLAN_EID_EXT_CAPABILITY;
1978 -       *pos++ = 5; /* len */
1979 -       *pos++ = 0x0;
1980 -       *pos++ = 0x0;
1981 -       *pos++ = 0x0;
1982 -       *pos++ = 0x0;
1983 -       *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED;
1984 -}
1985 -
1986 -static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata)
1987 -{
1988 -       struct ieee80211_local *local = sdata->local;
1989 -       u16 capab;
1990 -
1991 -       capab = 0;
1992 -       if (ieee80211_get_sdata_band(sdata) != IEEE80211_BAND_2GHZ)
1993 -               return capab;
1994 -
1995 -       if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
1996 -               capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
1997 -       if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
1998 -               capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
1999 -
2000 -       return capab;
2001 -}
2002 -
2003 -static void ieee80211_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr,
2004 -                                      u8 *peer, u8 *bssid)
2005 -{
2006 -       struct ieee80211_tdls_lnkie *lnkid;
2007 -
2008 -       lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie));
2009 -
2010 -       lnkid->ie_type = WLAN_EID_LINK_ID;
2011 -       lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2;
2012 -
2013 -       memcpy(lnkid->bssid, bssid, ETH_ALEN);
2014 -       memcpy(lnkid->init_sta, src_addr, ETH_ALEN);
2015 -       memcpy(lnkid->resp_sta, peer, ETH_ALEN);
2016 -}
2017 -
2018 -static int
2019 -ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
2020 -                              u8 *peer, u8 action_code, u8 dialog_token,
2021 -                              u16 status_code, struct sk_buff *skb)
2022 -{
2023 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2024 -       enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
2025 -       struct ieee80211_tdls_data *tf;
2026 -
2027 -       tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
2028 -
2029 -       memcpy(tf->da, peer, ETH_ALEN);
2030 -       memcpy(tf->sa, sdata->vif.addr, ETH_ALEN);
2031 -       tf->ether_type = cpu_to_be16(ETH_P_TDLS);
2032 -       tf->payload_type = WLAN_TDLS_SNAP_RFTYPE;
2033 -
2034 -       switch (action_code) {
2035 -       case WLAN_TDLS_SETUP_REQUEST:
2036 -               tf->category = WLAN_CATEGORY_TDLS;
2037 -               tf->action_code = WLAN_TDLS_SETUP_REQUEST;
2038 -
2039 -               skb_put(skb, sizeof(tf->u.setup_req));
2040 -               tf->u.setup_req.dialog_token = dialog_token;
2041 -               tf->u.setup_req.capability =
2042 -                       cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
2043 -
2044 -               ieee80211_add_srates_ie(sdata, skb, false, band);
2045 -               ieee80211_add_ext_srates_ie(sdata, skb, false, band);
2046 -               ieee80211_tdls_add_ext_capab(skb);
2047 -               break;
2048 -       case WLAN_TDLS_SETUP_RESPONSE:
2049 -               tf->category = WLAN_CATEGORY_TDLS;
2050 -               tf->action_code = WLAN_TDLS_SETUP_RESPONSE;
2051 -
2052 -               skb_put(skb, sizeof(tf->u.setup_resp));
2053 -               tf->u.setup_resp.status_code = cpu_to_le16(status_code);
2054 -               tf->u.setup_resp.dialog_token = dialog_token;
2055 -               tf->u.setup_resp.capability =
2056 -                       cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
2057 -
2058 -               ieee80211_add_srates_ie(sdata, skb, false, band);
2059 -               ieee80211_add_ext_srates_ie(sdata, skb, false, band);
2060 -               ieee80211_tdls_add_ext_capab(skb);
2061 -               break;
2062 -       case WLAN_TDLS_SETUP_CONFIRM:
2063 -               tf->category = WLAN_CATEGORY_TDLS;
2064 -               tf->action_code = WLAN_TDLS_SETUP_CONFIRM;
2065 -
2066 -               skb_put(skb, sizeof(tf->u.setup_cfm));
2067 -               tf->u.setup_cfm.status_code = cpu_to_le16(status_code);
2068 -               tf->u.setup_cfm.dialog_token = dialog_token;
2069 -               break;
2070 -       case WLAN_TDLS_TEARDOWN:
2071 -               tf->category = WLAN_CATEGORY_TDLS;
2072 -               tf->action_code = WLAN_TDLS_TEARDOWN;
2073 -
2074 -               skb_put(skb, sizeof(tf->u.teardown));
2075 -               tf->u.teardown.reason_code = cpu_to_le16(status_code);
2076 -               break;
2077 -       case WLAN_TDLS_DISCOVERY_REQUEST:
2078 -               tf->category = WLAN_CATEGORY_TDLS;
2079 -               tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST;
2080 -
2081 -               skb_put(skb, sizeof(tf->u.discover_req));
2082 -               tf->u.discover_req.dialog_token = dialog_token;
2083 -               break;
2084 -       default:
2085 -               return -EINVAL;
2086 -       }
2087 -
2088 -       return 0;
2089 -}
2090 -
2091 -static int
2092 -ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
2093 -                          u8 *peer, u8 action_code, u8 dialog_token,
2094 -                          u16 status_code, struct sk_buff *skb)
2095 -{
2096 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2097 -       enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
2098 -       struct ieee80211_mgmt *mgmt;
2099 -
2100 -       mgmt = (void *)skb_put(skb, 24);
2101 -       memset(mgmt, 0, 24);
2102 -       memcpy(mgmt->da, peer, ETH_ALEN);
2103 -       memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
2104 -       memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2105 -
2106 -       mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2107 -                                         IEEE80211_STYPE_ACTION);
2108 -
2109 -       switch (action_code) {
2110 -       case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
2111 -               skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
2112 -               mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
2113 -               mgmt->u.action.u.tdls_discover_resp.action_code =
2114 -                       WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
2115 -               mgmt->u.action.u.tdls_discover_resp.dialog_token =
2116 -                       dialog_token;
2117 -               mgmt->u.action.u.tdls_discover_resp.capability =
2118 -                       cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
2119 -
2120 -               ieee80211_add_srates_ie(sdata, skb, false, band);
2121 -               ieee80211_add_ext_srates_ie(sdata, skb, false, band);
2122 -               ieee80211_tdls_add_ext_capab(skb);
2123 -               break;
2124 -       default:
2125 -               return -EINVAL;
2126 -       }
2127 -
2128 -       return 0;
2129 -}
2130 -
2131 -static int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
2132 -                              u8 *peer, u8 action_code, u8 dialog_token,
2133 -                              u16 status_code, u32 peer_capability,
2134 -                              const u8 *extra_ies, size_t extra_ies_len)
2135 -{
2136 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2137 -       struct ieee80211_local *local = sdata->local;
2138 -       struct sk_buff *skb = NULL;
2139 -       bool send_direct;
2140 -       int ret;
2141 -
2142 -       if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
2143 -               return -ENOTSUPP;
2144 -
2145 -       /* make sure we are in managed mode, and associated */
2146 -       if (sdata->vif.type != NL80211_IFTYPE_STATION ||
2147 -           !sdata->u.mgd.associated)
2148 -               return -EINVAL;
2149 -
2150 -       tdls_dbg(sdata, "TDLS mgmt action %d peer %pM\n",
2151 -                action_code, peer);
2152 -
2153 -       skb = dev_alloc_skb(local->hw.extra_tx_headroom +
2154 -                           max(sizeof(struct ieee80211_mgmt),
2155 -                               sizeof(struct ieee80211_tdls_data)) +
2156 -                           50 + /* supported rates */
2157 -                           7 + /* ext capab */
2158 -                           extra_ies_len +
2159 -                           sizeof(struct ieee80211_tdls_lnkie));
2160 -       if (!skb)
2161 -               return -ENOMEM;
2162 -
2163 -       skb_reserve(skb, local->hw.extra_tx_headroom);
2164 -
2165 -       switch (action_code) {
2166 -       case WLAN_TDLS_SETUP_REQUEST:
2167 -       case WLAN_TDLS_SETUP_RESPONSE:
2168 -       case WLAN_TDLS_SETUP_CONFIRM:
2169 -       case WLAN_TDLS_TEARDOWN:
2170 -       case WLAN_TDLS_DISCOVERY_REQUEST:
2171 -               ret = ieee80211_prep_tdls_encap_data(wiphy, dev, peer,
2172 -                                                    action_code, dialog_token,
2173 -                                                    status_code, skb);
2174 -               send_direct = false;
2175 -               break;
2176 -       case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
2177 -               ret = ieee80211_prep_tdls_direct(wiphy, dev, peer, action_code,
2178 -                                                dialog_token, status_code,
2179 -                                                skb);
2180 -               send_direct = true;
2181 -               break;
2182 -       default:
2183 -               ret = -ENOTSUPP;
2184 -               break;
2185 -       }
2186 -
2187 -       if (ret < 0)
2188 -               goto fail;
2189 -
2190 -       if (extra_ies_len)
2191 -               memcpy(skb_put(skb, extra_ies_len), extra_ies, extra_ies_len);
2192 -
2193 -       /* the TDLS link IE is always added last */
2194 -       switch (action_code) {
2195 -       case WLAN_TDLS_SETUP_REQUEST:
2196 -       case WLAN_TDLS_SETUP_CONFIRM:
2197 -       case WLAN_TDLS_TEARDOWN:
2198 -       case WLAN_TDLS_DISCOVERY_REQUEST:
2199 -               /* we are the initiator */
2200 -               ieee80211_tdls_add_link_ie(skb, sdata->vif.addr, peer,
2201 -                                          sdata->u.mgd.bssid);
2202 -               break;
2203 -       case WLAN_TDLS_SETUP_RESPONSE:
2204 -       case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
2205 -               /* we are the responder */
2206 -               ieee80211_tdls_add_link_ie(skb, peer, sdata->vif.addr,
2207 -                                          sdata->u.mgd.bssid);
2208 -               break;
2209 -       default:
2210 -               ret = -ENOTSUPP;
2211 -               goto fail;
2212 -       }
2213 -
2214 -       if (send_direct) {
2215 -               ieee80211_tx_skb(sdata, skb);
2216 -               return 0;
2217 -       }
2218 -
2219 -       /*
2220 -        * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
2221 -        * we should default to AC_VI.
2222 -        */
2223 -       switch (action_code) {
2224 -       case WLAN_TDLS_SETUP_REQUEST:
2225 -       case WLAN_TDLS_SETUP_RESPONSE:
2226 -               skb_set_queue_mapping(skb, IEEE80211_AC_BK);
2227 -               skb->priority = 2;
2228 -               break;
2229 -       default:
2230 -               skb_set_queue_mapping(skb, IEEE80211_AC_VI);
2231 -               skb->priority = 5;
2232 -               break;
2233 -       }
2234 -
2235 -       /* disable bottom halves when entering the Tx path */
2236 -       local_bh_disable();
2237 -       ret = ieee80211_subif_start_xmit(skb, dev);
2238 -       local_bh_enable();
2239 -
2240 -       return ret;
2241 -
2242 -fail:
2243 -       dev_kfree_skb(skb);
2244 -       return ret;
2245 -}
2246 -
2247 -static int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
2248 -                              u8 *peer, enum nl80211_tdls_operation oper)
2249 -{
2250 -       struct sta_info *sta;
2251 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2252 -
2253 -       if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
2254 -               return -ENOTSUPP;
2255 -
2256 -       if (sdata->vif.type != NL80211_IFTYPE_STATION)
2257 -               return -EINVAL;
2258 -
2259 -       tdls_dbg(sdata, "TDLS oper %d peer %pM\n", oper, peer);
2260 -
2261 -       switch (oper) {
2262 -       case NL80211_TDLS_ENABLE_LINK:
2263 -               rcu_read_lock();
2264 -               sta = sta_info_get(sdata, peer);
2265 -               if (!sta) {
2266 -                       rcu_read_unlock();
2267 -                       return -ENOLINK;
2268 -               }
2269 -
2270 -               set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
2271 -               rcu_read_unlock();
2272 -               break;
2273 -       case NL80211_TDLS_DISABLE_LINK:
2274 -               return sta_info_destroy_addr(sdata, peer);
2275 -       case NL80211_TDLS_TEARDOWN:
2276 -       case NL80211_TDLS_SETUP:
2277 -       case NL80211_TDLS_DISCOVERY_REQ:
2278 -               /* We don't support in-driver setup/teardown/discovery */
2279 -               return -ENOTSUPP;
2280 -       default:
2281 -               return -ENOTSUPP;
2282 -       }
2283 -
2284 -       return 0;
2285 -}
2286 -
2287  static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
2288                                   const u8 *peer, u64 *cookie)
2289  {
2290 --- a/net/mac80211/chan.c
2291 +++ b/net/mac80211/chan.c
2292 @@ -855,7 +855,7 @@ static void
2293  __ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
2294                                       bool clear)
2295  {
2296 -       struct ieee80211_local *local = sdata->local;
2297 +       struct ieee80211_local *local __maybe_unused = sdata->local;
2298         struct ieee80211_sub_if_data *vlan;
2299         struct ieee80211_chanctx_conf *conf;
2300
2301 @@ -871,7 +871,7 @@ __ieee80211_vif_copy_chanctx_to_vlans(st
2302          * to a channel context that has already been freed.
2303          */
2304         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
2305 -                               lockdep_is_held(&local->chanctx_mtx));
2306 +                                        lockdep_is_held(&local->chanctx_mtx));
2307         WARN_ON(!conf);
2308
2309         if (clear)
2310 --- a/net/mac80211/driver-ops.h
2311 +++ b/net/mac80211/driver-ops.h
2312 @@ -5,11 +5,11 @@
2313  #include "ieee80211_i.h"
2314  #include "trace.h"
2315
2316 -static inline void check_sdata_in_driver(struct ieee80211_sub_if_data *sdata)
2317 +static inline bool check_sdata_in_driver(struct ieee80211_sub_if_data *sdata)
2318  {
2319 -       WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER),
2320 -            "%s:  Failed check-sdata-in-driver check, flags: 0x%x\n",
2321 -            sdata->dev ? sdata->dev->name : sdata->name, sdata->flags);
2322 +       return !WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER),
2323 +                    "%s:  Failed check-sdata-in-driver check, flags: 0x%x\n",
2324 +                    sdata->dev ? sdata->dev->name : sdata->name, sdata->flags);
2325  }
2326
2327  static inline struct ieee80211_sub_if_data *
2328 @@ -168,7 +168,8 @@ static inline int drv_change_interface(s
2329
2330         might_sleep();
2331
2332 -       check_sdata_in_driver(sdata);
2333 +       if (!check_sdata_in_driver(sdata))
2334 +               return -EIO;
2335
2336         trace_drv_change_interface(local, sdata, type, p2p);
2337         ret = local->ops->change_interface(&local->hw, &sdata->vif, type, p2p);
2338 @@ -181,7 +182,8 @@ static inline void drv_remove_interface(
2339  {
2340         might_sleep();
2341
2342 -       check_sdata_in_driver(sdata);
2343 +       if (!check_sdata_in_driver(sdata))
2344 +               return;
2345
2346         trace_drv_remove_interface(local, sdata);
2347         local->ops->remove_interface(&local->hw, &sdata->vif);
2348 @@ -219,7 +221,8 @@ static inline void drv_bss_info_changed(
2349                          sdata->vif.type == NL80211_IFTYPE_MONITOR))
2350                 return;
2351
2352 -       check_sdata_in_driver(sdata);
2353 +       if (!check_sdata_in_driver(sdata))
2354 +               return;
2355
2356         trace_drv_bss_info_changed(local, sdata, info, changed);
2357         if (local->ops->bss_info_changed)
2358 @@ -278,7 +281,8 @@ static inline int drv_set_key(struct iee
2359         might_sleep();
2360
2361         sdata = get_bss_sdata(sdata);
2362 -       check_sdata_in_driver(sdata);
2363 +       if (!check_sdata_in_driver(sdata))
2364 +               return -EIO;
2365
2366         trace_drv_set_key(local, cmd, sdata, sta, key);
2367         ret = local->ops->set_key(&local->hw, cmd, &sdata->vif, sta, key);
2368 @@ -298,7 +302,8 @@ static inline void drv_update_tkip_key(s
2369                 ista = &sta->sta;
2370
2371         sdata = get_bss_sdata(sdata);
2372 -       check_sdata_in_driver(sdata);
2373 +       if (!check_sdata_in_driver(sdata))
2374 +               return;
2375
2376         trace_drv_update_tkip_key(local, sdata, conf, ista, iv32);
2377         if (local->ops->update_tkip_key)
2378 @@ -315,7 +320,8 @@ static inline int drv_hw_scan(struct iee
2379
2380         might_sleep();
2381
2382 -       check_sdata_in_driver(sdata);
2383 +       if (!check_sdata_in_driver(sdata))
2384 +               return -EIO;
2385
2386         trace_drv_hw_scan(local, sdata);
2387         ret = local->ops->hw_scan(&local->hw, &sdata->vif, req);
2388 @@ -328,7 +334,8 @@ static inline void drv_cancel_hw_scan(st
2389  {
2390         might_sleep();
2391
2392 -       check_sdata_in_driver(sdata);
2393 +       if (!check_sdata_in_driver(sdata))
2394 +               return;
2395
2396         trace_drv_cancel_hw_scan(local, sdata);
2397         local->ops->cancel_hw_scan(&local->hw, &sdata->vif);
2398 @@ -345,7 +352,8 @@ drv_sched_scan_start(struct ieee80211_lo
2399
2400         might_sleep();
2401
2402 -       check_sdata_in_driver(sdata);
2403 +       if (!check_sdata_in_driver(sdata))
2404 +               return -EIO;
2405
2406         trace_drv_sched_scan_start(local, sdata);
2407         ret = local->ops->sched_scan_start(&local->hw, &sdata->vif,
2408 @@ -361,7 +369,8 @@ static inline int drv_sched_scan_stop(st
2409
2410         might_sleep();
2411
2412 -       check_sdata_in_driver(sdata);
2413 +       if (!check_sdata_in_driver(sdata))
2414 +               return -EIO;
2415
2416         trace_drv_sched_scan_stop(local, sdata);
2417         ret = local->ops->sched_scan_stop(&local->hw, &sdata->vif);
2418 @@ -462,7 +471,8 @@ static inline void drv_sta_notify(struct
2419                                   struct ieee80211_sta *sta)
2420  {
2421         sdata = get_bss_sdata(sdata);
2422 -       check_sdata_in_driver(sdata);
2423 +       if (!check_sdata_in_driver(sdata))
2424 +               return;
2425
2426         trace_drv_sta_notify(local, sdata, cmd, sta);
2427         if (local->ops->sta_notify)
2428 @@ -479,7 +489,8 @@ static inline int drv_sta_add(struct iee
2429         might_sleep();
2430
2431         sdata = get_bss_sdata(sdata);
2432 -       check_sdata_in_driver(sdata);
2433 +       if (!check_sdata_in_driver(sdata))
2434 +               return -EIO;
2435
2436         trace_drv_sta_add(local, sdata, sta);
2437         if (local->ops->sta_add)
2438 @@ -497,7 +508,8 @@ static inline void drv_sta_remove(struct
2439         might_sleep();
2440
2441         sdata = get_bss_sdata(sdata);
2442 -       check_sdata_in_driver(sdata);
2443 +       if (!check_sdata_in_driver(sdata))
2444 +               return;
2445
2446         trace_drv_sta_remove(local, sdata, sta);
2447         if (local->ops->sta_remove)
2448 @@ -515,7 +527,8 @@ static inline void drv_sta_add_debugfs(s
2449         might_sleep();
2450
2451         sdata = get_bss_sdata(sdata);
2452 -       check_sdata_in_driver(sdata);
2453 +       if (!check_sdata_in_driver(sdata))
2454 +               return;
2455
2456         if (local->ops->sta_add_debugfs)
2457                 local->ops->sta_add_debugfs(&local->hw, &sdata->vif,
2458 @@ -545,7 +558,8 @@ static inline void drv_sta_pre_rcu_remov
2459         might_sleep();
2460
2461         sdata = get_bss_sdata(sdata);
2462 -       check_sdata_in_driver(sdata);
2463 +       if (!check_sdata_in_driver(sdata))
2464 +               return;
2465
2466         trace_drv_sta_pre_rcu_remove(local, sdata, &sta->sta);
2467         if (local->ops->sta_pre_rcu_remove)
2468 @@ -566,7 +580,8 @@ int drv_sta_state(struct ieee80211_local
2469         might_sleep();
2470
2471         sdata = get_bss_sdata(sdata);
2472 -       check_sdata_in_driver(sdata);
2473 +       if (!check_sdata_in_driver(sdata))
2474 +               return -EIO;
2475
2476         trace_drv_sta_state(local, sdata, &sta->sta, old_state, new_state);
2477         if (local->ops->sta_state) {
2478 @@ -590,7 +605,8 @@ static inline void drv_sta_rc_update(str
2479                                      struct ieee80211_sta *sta, u32 changed)
2480  {
2481         sdata = get_bss_sdata(sdata);
2482 -       check_sdata_in_driver(sdata);
2483 +       if (!check_sdata_in_driver(sdata))
2484 +               return;
2485
2486         WARN_ON(changed & IEEE80211_RC_SUPP_RATES_CHANGED &&
2487                 (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2488 @@ -612,7 +628,8 @@ static inline int drv_conf_tx(struct iee
2489
2490         might_sleep();
2491
2492 -       check_sdata_in_driver(sdata);
2493 +       if (!check_sdata_in_driver(sdata))
2494 +               return -EIO;
2495
2496         trace_drv_conf_tx(local, sdata, ac, params);
2497         if (local->ops->conf_tx)
2498 @@ -629,7 +646,8 @@ static inline u64 drv_get_tsf(struct iee
2499
2500         might_sleep();
2501
2502 -       check_sdata_in_driver(sdata);
2503 +       if (!check_sdata_in_driver(sdata))
2504 +               return ret;
2505
2506         trace_drv_get_tsf(local, sdata);
2507         if (local->ops->get_tsf)
2508 @@ -644,7 +662,8 @@ static inline void drv_set_tsf(struct ie
2509  {
2510         might_sleep();
2511
2512 -       check_sdata_in_driver(sdata);
2513 +       if (!check_sdata_in_driver(sdata))
2514 +               return;
2515
2516         trace_drv_set_tsf(local, sdata, tsf);
2517         if (local->ops->set_tsf)
2518 @@ -657,7 +676,8 @@ static inline void drv_reset_tsf(struct
2519  {
2520         might_sleep();
2521
2522 -       check_sdata_in_driver(sdata);
2523 +       if (!check_sdata_in_driver(sdata))
2524 +               return;
2525
2526         trace_drv_reset_tsf(local, sdata);
2527         if (local->ops->reset_tsf)
2528 @@ -689,7 +709,8 @@ static inline int drv_ampdu_action(struc
2529         might_sleep();
2530
2531         sdata = get_bss_sdata(sdata);
2532 -       check_sdata_in_driver(sdata);
2533 +       if (!check_sdata_in_driver(sdata))
2534 +               return -EIO;
2535
2536         trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn, buf_size);
2537
2538 @@ -733,8 +754,8 @@ static inline void drv_flush(struct ieee
2539
2540         might_sleep();
2541
2542 -       if (sdata)
2543 -               check_sdata_in_driver(sdata);
2544 +       if (sdata && !check_sdata_in_driver(sdata))
2545 +               return;
2546
2547         trace_drv_flush(local, queues, drop);
2548         if (local->ops->flush)
2549 @@ -854,7 +875,8 @@ static inline int drv_set_bitrate_mask(s
2550
2551         might_sleep();
2552
2553 -       check_sdata_in_driver(sdata);
2554 +       if (!check_sdata_in_driver(sdata))
2555 +               return -EIO;
2556
2557         trace_drv_set_bitrate_mask(local, sdata, mask);
2558         if (local->ops->set_bitrate_mask)
2559 @@ -869,7 +891,8 @@ static inline void drv_set_rekey_data(st
2560                                       struct ieee80211_sub_if_data *sdata,
2561                                       struct cfg80211_gtk_rekey_data *data)
2562  {
2563 -       check_sdata_in_driver(sdata);
2564 +       if (!check_sdata_in_driver(sdata))
2565 +               return;
2566
2567         trace_drv_set_rekey_data(local, sdata, data);
2568         if (local->ops->set_rekey_data)
2569 @@ -937,7 +960,8 @@ static inline void drv_mgd_prepare_tx(st
2570  {
2571         might_sleep();
2572
2573 -       check_sdata_in_driver(sdata);
2574 +       if (!check_sdata_in_driver(sdata))
2575 +               return;
2576         WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_STATION);
2577
2578         trace_drv_mgd_prepare_tx(local, sdata);
2579 @@ -964,6 +988,9 @@ static inline int drv_add_chanctx(struct
2580  static inline void drv_remove_chanctx(struct ieee80211_local *local,
2581                                       struct ieee80211_chanctx *ctx)
2582  {
2583 +       if (WARN_ON(!ctx->driver_present))
2584 +               return;
2585 +
2586         trace_drv_remove_chanctx(local, ctx);
2587         if (local->ops->remove_chanctx)
2588                 local->ops->remove_chanctx(&local->hw, &ctx->conf);
2589 @@ -989,7 +1016,8 @@ static inline int drv_assign_vif_chanctx
2590  {
2591         int ret = 0;
2592
2593 -       check_sdata_in_driver(sdata);
2594 +       if (!check_sdata_in_driver(sdata))
2595 +               return -EIO;
2596
2597         trace_drv_assign_vif_chanctx(local, sdata, ctx);
2598         if (local->ops->assign_vif_chanctx) {
2599 @@ -1007,7 +1035,8 @@ static inline void drv_unassign_vif_chan
2600                                             struct ieee80211_sub_if_data *sdata,
2601                                             struct ieee80211_chanctx *ctx)
2602  {
2603 -       check_sdata_in_driver(sdata);
2604 +       if (!check_sdata_in_driver(sdata))
2605 +               return;
2606
2607         trace_drv_unassign_vif_chanctx(local, sdata, ctx);
2608         if (local->ops->unassign_vif_chanctx) {
2609 @@ -1024,7 +1053,8 @@ static inline int drv_start_ap(struct ie
2610  {
2611         int ret = 0;
2612
2613 -       check_sdata_in_driver(sdata);
2614 +       if (!check_sdata_in_driver(sdata))
2615 +               return -EIO;
2616
2617         trace_drv_start_ap(local, sdata, &sdata->vif.bss_conf);
2618         if (local->ops->start_ap)
2619 @@ -1036,7 +1066,8 @@ static inline int drv_start_ap(struct ie
2620  static inline void drv_stop_ap(struct ieee80211_local *local,
2621                                struct ieee80211_sub_if_data *sdata)
2622  {
2623 -       check_sdata_in_driver(sdata);
2624 +       if (!check_sdata_in_driver(sdata))
2625 +               return;
2626
2627         trace_drv_stop_ap(local, sdata);
2628         if (local->ops->stop_ap)
2629 @@ -1059,7 +1090,8 @@ drv_set_default_unicast_key(struct ieee8
2630                             struct ieee80211_sub_if_data *sdata,
2631                             int key_idx)
2632  {
2633 -       check_sdata_in_driver(sdata);
2634 +       if (!check_sdata_in_driver(sdata))
2635 +               return;
2636
2637         WARN_ON_ONCE(key_idx < -1 || key_idx > 3);
2638
2639 @@ -1101,7 +1133,8 @@ static inline int drv_join_ibss(struct i
2640         int ret = 0;
2641
2642         might_sleep();
2643 -       check_sdata_in_driver(sdata);
2644 +       if (!check_sdata_in_driver(sdata))
2645 +               return -EIO;
2646
2647         trace_drv_join_ibss(local, sdata, &sdata->vif.bss_conf);
2648         if (local->ops->join_ibss)
2649 @@ -1114,7 +1147,8 @@ static inline void drv_leave_ibss(struct
2650                                   struct ieee80211_sub_if_data *sdata)
2651  {
2652         might_sleep();
2653 -       check_sdata_in_driver(sdata);
2654 +       if (!check_sdata_in_driver(sdata))
2655 +               return;
2656
2657         trace_drv_leave_ibss(local, sdata);
2658         if (local->ops->leave_ibss)
2659 --- a/net/mac80211/ibss.c
2660 +++ b/net/mac80211/ibss.c
2661 @@ -143,7 +143,7 @@ ieee80211_ibss_build_presp(struct ieee80
2662                 *pos++ = csa_settings->block_tx ? 1 : 0;
2663                 *pos++ = ieee80211_frequency_to_channel(
2664                                 csa_settings->chandef.chan->center_freq);
2665 -               sdata->csa_counter_offset_beacon = (pos - presp->head);
2666 +               sdata->csa_counter_offset_beacon[0] = (pos - presp->head);
2667                 *pos++ = csa_settings->count;
2668         }
2669
2670 --- a/net/mac80211/ieee80211_i.h
2671 +++ b/net/mac80211/ieee80211_i.h
2672 @@ -754,9 +754,10 @@ struct ieee80211_sub_if_data {
2673         struct mac80211_qos_map __rcu *qos_map;
2674
2675         struct work_struct csa_finalize_work;
2676 -       int csa_counter_offset_beacon;
2677 -       int csa_counter_offset_presp;
2678 +       u16 csa_counter_offset_beacon[IEEE80211_MAX_CSA_COUNTERS_NUM];
2679 +       u16 csa_counter_offset_presp[IEEE80211_MAX_CSA_COUNTERS_NUM];
2680         bool csa_radar_required;
2681 +       bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
2682         struct cfg80211_chan_def csa_chandef;
2683
2684         struct list_head assigned_chanctx_list; /* protected by chanctx_mtx */
2685 @@ -766,6 +767,7 @@ struct ieee80211_sub_if_data {
2686         struct ieee80211_chanctx *reserved_chanctx;
2687         struct cfg80211_chan_def reserved_chandef;
2688         bool reserved_radar_required;
2689 +       u8 csa_current_counter;
2690
2691         /* used to reconfigure hardware SM PS */
2692         struct work_struct recalc_smps;
2693 @@ -1462,6 +1464,7 @@ __ieee80211_request_sched_scan_start(str
2694  int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
2695                                        struct cfg80211_sched_scan_request *req);
2696  int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
2697 +void ieee80211_sched_scan_end(struct ieee80211_local *local);
2698  void ieee80211_sched_scan_stopped_work(struct work_struct *work);
2699
2700  /* off-channel helpers */
2701 @@ -1476,6 +1479,7 @@ void ieee80211_sw_roc_work(struct work_s
2702  void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
2703
2704  /* channel switch handling */
2705 +bool ieee80211_csa_needs_block_tx(struct ieee80211_local *local);
2706  void ieee80211_csa_finalize_work(struct work_struct *work);
2707  int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
2708                              struct cfg80211_csa_settings *params);
2709 @@ -1837,6 +1841,15 @@ int ieee80211_check_combinations(struct
2710                                  u8 radar_detect);
2711  int ieee80211_max_num_channels(struct ieee80211_local *local);
2712
2713 +/* TDLS */
2714 +int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
2715 +                       const u8 *peer, u8 action_code, u8 dialog_token,
2716 +                       u16 status_code, u32 peer_capability,
2717 +                       const u8 *extra_ies, size_t extra_ies_len);
2718 +int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
2719 +                       const u8 *peer, enum nl80211_tdls_operation oper);
2720 +
2721 +
2722  #ifdef CPTCFG_MAC80211_NOINLINE
2723  #define debug_noinline noinline
2724  #else
2725 --- a/net/mac80211/iface.c
2726 +++ b/net/mac80211/iface.c
2727 @@ -838,8 +838,15 @@ static void ieee80211_do_stop(struct iee
2728
2729         cancel_work_sync(&sdata->recalc_smps);
2730         sdata_lock(sdata);
2731 +       mutex_lock(&local->mtx);
2732         sdata->vif.csa_active = false;
2733 +       if (!ieee80211_csa_needs_block_tx(local))
2734 +               ieee80211_wake_queues_by_reason(&local->hw,
2735 +                                       IEEE80211_MAX_QUEUE_MAP,
2736 +                                       IEEE80211_QUEUE_STOP_REASON_CSA);
2737 +       mutex_unlock(&local->mtx);
2738         sdata_unlock(sdata);
2739 +
2740         cancel_work_sync(&sdata->csa_finalize_work);
2741
2742         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
2743 --- a/net/mac80211/key.c
2744 +++ b/net/mac80211/key.c
2745 @@ -325,7 +325,8 @@ ieee80211_key_alloc(u32 cipher, int idx,
2746         struct ieee80211_key *key;
2747         int i, j, err;
2748
2749 -       BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
2750 +       if (WARN_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS))
2751 +               return ERR_PTR(-EINVAL);
2752
2753         key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
2754         if (!key)
2755 @@ -481,8 +482,8 @@ int ieee80211_key_link(struct ieee80211_
2756         int idx, ret;
2757         bool pairwise;
2758
2759 -       BUG_ON(!sdata);
2760 -       BUG_ON(!key);
2761 +       if (WARN_ON(!sdata || !key))
2762 +               return -EINVAL;
2763
2764         pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
2765         idx = key->conf.keyidx;
2766 --- a/net/mac80211/main.c
2767 +++ b/net/mac80211/main.c
2768 @@ -956,6 +956,8 @@ int ieee80211_register_hw(struct ieee802
2769         if (local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)
2770                 local->hw.wiphy->flags |= WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
2771
2772 +       local->hw.wiphy->max_num_csa_counters = IEEE80211_MAX_CSA_COUNTERS_NUM;
2773 +
2774         result = wiphy_register(local->hw.wiphy);
2775         if (result < 0)
2776                 goto fail_wiphy_register;
2777 --- a/net/mac80211/mesh.c
2778 +++ b/net/mac80211/mesh.c
2779 @@ -679,7 +679,7 @@ ieee80211_mesh_build_beacon(struct ieee8
2780                 *pos++ = 0x0;
2781                 *pos++ = ieee80211_frequency_to_channel(
2782                                 csa->settings.chandef.chan->center_freq);
2783 -               sdata->csa_counter_offset_beacon = hdr_len + 6;
2784 +               sdata->csa_counter_offset_beacon[0] = hdr_len + 6;
2785                 *pos++ = csa->settings.count;
2786                 *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
2787                 *pos++ = 6;
2788 --- a/net/mac80211/mesh_pathtbl.c
2789 +++ b/net/mac80211/mesh_pathtbl.c
2790 @@ -287,8 +287,10 @@ static void mesh_path_move_to_queue(stru
2791         struct sk_buff_head failq;
2792         unsigned long flags;
2793
2794 -       BUG_ON(gate_mpath == from_mpath);
2795 -       BUG_ON(!gate_mpath->next_hop);
2796 +       if (WARN_ON(gate_mpath == from_mpath))
2797 +               return;
2798 +       if (WARN_ON(!gate_mpath->next_hop))
2799 +               return;
2800
2801         __skb_queue_head_init(&failq);
2802
2803 --- a/net/mac80211/mesh_sync.c
2804 +++ b/net/mac80211/mesh_sync.c
2805 @@ -171,7 +171,7 @@ static void mesh_sync_offset_adjust_tbtt
2806         u8 cap;
2807
2808         WARN_ON(ifmsh->mesh_sp_id != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET);
2809 -       BUG_ON(!rcu_read_lock_held());
2810 +       WARN_ON(!rcu_read_lock_held());
2811         cap = beacon->meshconf->meshconf_cap;
2812
2813         spin_lock_bh(&ifmsh->sync_offset_lock);
2814 --- a/net/mac80211/mlme.c
2815 +++ b/net/mac80211/mlme.c
2816 @@ -975,16 +975,23 @@ static void ieee80211_chswitch_work(stru
2817         /* XXX: shouldn't really modify cfg80211-owned data! */
2818         ifmgd->associated->channel = sdata->csa_chandef.chan;
2819
2820 +       ieee80211_bss_info_change_notify(sdata, changed);
2821 +
2822 +       mutex_lock(&local->mtx);
2823 +       sdata->vif.csa_active = false;
2824         /* XXX: wait for a beacon first? */
2825 -       ieee80211_wake_queues_by_reason(&local->hw,
2826 +       if (!ieee80211_csa_needs_block_tx(local))
2827 +               ieee80211_wake_queues_by_reason(&local->hw,
2828                                         IEEE80211_MAX_QUEUE_MAP,
2829                                         IEEE80211_QUEUE_STOP_REASON_CSA);
2830 +       mutex_unlock(&local->mtx);
2831
2832 -       ieee80211_bss_info_change_notify(sdata, changed);
2833 -
2834 - out:
2835 -       sdata->vif.csa_active = false;
2836         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
2837 +
2838 +       ieee80211_sta_reset_beacon_monitor(sdata);
2839 +       ieee80211_sta_reset_conn_monitor(sdata);
2840 +
2841 +out:
2842         sdata_unlock(sdata);
2843  }
2844
2845 @@ -1100,12 +1107,16 @@ ieee80211_sta_process_chanswitch(struct
2846         mutex_unlock(&local->chanctx_mtx);
2847
2848         sdata->csa_chandef = csa_ie.chandef;
2849 +
2850 +       mutex_lock(&local->mtx);
2851         sdata->vif.csa_active = true;
2852 +       sdata->csa_block_tx = csa_ie.mode;
2853
2854 -       if (csa_ie.mode)
2855 +       if (sdata->csa_block_tx)
2856                 ieee80211_stop_queues_by_reason(&local->hw,
2857 -                               IEEE80211_MAX_QUEUE_MAP,
2858 -                               IEEE80211_QUEUE_STOP_REASON_CSA);
2859 +                                       IEEE80211_MAX_QUEUE_MAP,
2860 +                                       IEEE80211_QUEUE_STOP_REASON_CSA);
2861 +       mutex_unlock(&local->mtx);
2862
2863         if (local->ops->channel_switch) {
2864                 /* use driver's channel switch callback */
2865 @@ -1817,6 +1828,12 @@ static void ieee80211_set_disassoc(struc
2866         ifmgd->flags = 0;
2867         mutex_lock(&local->mtx);
2868         ieee80211_vif_release_channel(sdata);
2869 +
2870 +       sdata->vif.csa_active = false;
2871 +       if (!ieee80211_csa_needs_block_tx(local))
2872 +               ieee80211_wake_queues_by_reason(&local->hw,
2873 +                                       IEEE80211_MAX_QUEUE_MAP,
2874 +                                       IEEE80211_QUEUE_STOP_REASON_CSA);
2875         mutex_unlock(&local->mtx);
2876
2877         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2878 @@ -2045,6 +2062,7 @@ EXPORT_SYMBOL(ieee80211_ap_probereq_get)
2879
2880  static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2881  {
2882 +       struct ieee80211_local *local = sdata->local;
2883         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2884         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2885
2886 @@ -2058,10 +2076,14 @@ static void __ieee80211_disconnect(struc
2887                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2888                                true, frame_buf);
2889         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
2890 +
2891 +       mutex_lock(&local->mtx);
2892         sdata->vif.csa_active = false;
2893 -       ieee80211_wake_queues_by_reason(&sdata->local->hw,
2894 +       if (!ieee80211_csa_needs_block_tx(local))
2895 +               ieee80211_wake_queues_by_reason(&local->hw,
2896                                         IEEE80211_MAX_QUEUE_MAP,
2897                                         IEEE80211_QUEUE_STOP_REASON_CSA);
2898 +       mutex_unlock(&local->mtx);
2899
2900         cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
2901                               IEEE80211_DEAUTH_FRAME_LEN);
2902 @@ -3546,6 +3568,9 @@ static void ieee80211_sta_bcn_mon_timer(
2903         if (local->quiescing)
2904                 return;
2905
2906 +       if (sdata->vif.csa_active)
2907 +               return;
2908 +
2909         sdata->u.mgd.connection_loss = false;
2910         ieee80211_queue_work(&sdata->local->hw,
2911                              &sdata->u.mgd.beacon_connection_loss_work);
2912 @@ -3561,6 +3586,9 @@ static void ieee80211_sta_conn_mon_timer
2913         if (local->quiescing)
2914                 return;
2915
2916 +       if (sdata->vif.csa_active)
2917 +               return;
2918 +
2919         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
2920  }
2921
2922 --- a/net/mac80211/rc80211_minstrel_ht.c
2923 +++ b/net/mac80211/rc80211_minstrel_ht.c
2924 @@ -22,7 +22,7 @@
2925  #define MCS_NBITS (AVG_PKT_SIZE << 3)
2926
2927  /* Number of symbols for a packet with (bps) bits per symbol */
2928 -#define MCS_NSYMS(bps) ((MCS_NBITS + (bps) - 1) / (bps))
2929 +#define MCS_NSYMS(bps) DIV_ROUND_UP(MCS_NBITS, (bps))
2930
2931  /* Transmission time (nanoseconds) for a packet containing (syms) symbols */
2932  #define MCS_SYMBOL_TIME(sgi, syms)                                     \
2933 @@ -226,8 +226,9 @@ minstrel_ht_calc_tp(struct minstrel_ht_s
2934                 nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
2935
2936         nsecs += minstrel_mcs_groups[group].duration[rate];
2937 -       tp = 1000000 * ((prob * 1000) / nsecs);
2938
2939 +       /* prob is scaled - see MINSTREL_FRAC above */
2940 +       tp = 1000000 * ((prob * 1000) / nsecs);
2941         mr->cur_tp = MINSTREL_TRUNC(tp);
2942  }
2943
2944 --- a/net/mac80211/scan.c
2945 +++ b/net/mac80211/scan.c
2946 @@ -1076,12 +1076,8 @@ void ieee80211_sched_scan_results(struct
2947  }
2948  EXPORT_SYMBOL(ieee80211_sched_scan_results);
2949
2950 -void ieee80211_sched_scan_stopped_work(struct work_struct *work)
2951 +void ieee80211_sched_scan_end(struct ieee80211_local *local)
2952  {
2953 -       struct ieee80211_local *local =
2954 -               container_of(work, struct ieee80211_local,
2955 -                            sched_scan_stopped_work);
2956 -
2957         mutex_lock(&local->mtx);
2958
2959         if (!rcu_access_pointer(local->sched_scan_sdata)) {
2960 @@ -1099,6 +1095,15 @@ void ieee80211_sched_scan_stopped_work(s
2961         cfg80211_sched_scan_stopped(local->hw.wiphy);
2962  }
2963
2964 +void ieee80211_sched_scan_stopped_work(struct work_struct *work)
2965 +{
2966 +       struct ieee80211_local *local =
2967 +               container_of(work, struct ieee80211_local,
2968 +                            sched_scan_stopped_work);
2969 +
2970 +       ieee80211_sched_scan_end(local);
2971 +}
2972 +
2973  void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
2974  {
2975         struct ieee80211_local *local = hw_to_local(hw);
2976 --- /dev/null
2977 +++ b/net/mac80211/tdls.c
2978 @@ -0,0 +1,325 @@
2979 +/*
2980 + * mac80211 TDLS handling code
2981 + *
2982 + * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
2983 + * Copyright 2014, Intel Corporation
2984 + *
2985 + * This file is GPLv2 as found in COPYING.
2986 + */
2987 +
2988 +#include <linux/ieee80211.h>
2989 +#include "ieee80211_i.h"
2990 +
2991 +static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb)
2992 +{
2993 +       u8 *pos = (void *)skb_put(skb, 7);
2994 +
2995 +       *pos++ = WLAN_EID_EXT_CAPABILITY;
2996 +       *pos++ = 5; /* len */
2997 +       *pos++ = 0x0;
2998 +       *pos++ = 0x0;
2999 +       *pos++ = 0x0;
3000 +       *pos++ = 0x0;
3001 +       *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED;
3002 +}
3003 +
3004 +static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata)
3005 +{
3006 +       struct ieee80211_local *local = sdata->local;
3007 +       u16 capab;
3008 +
3009 +       capab = 0;
3010 +       if (ieee80211_get_sdata_band(sdata) != IEEE80211_BAND_2GHZ)
3011 +               return capab;
3012 +
3013 +       if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
3014 +               capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
3015 +       if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
3016 +               capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
3017 +
3018 +       return capab;
3019 +}
3020 +
3021 +static void ieee80211_tdls_add_link_ie(struct sk_buff *skb, const u8 *src_addr,
3022 +                                      const u8 *peer, const u8 *bssid)
3023 +{
3024 +       struct ieee80211_tdls_lnkie *lnkid;
3025 +
3026 +       lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie));
3027 +
3028 +       lnkid->ie_type = WLAN_EID_LINK_ID;
3029 +       lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2;
3030 +
3031 +       memcpy(lnkid->bssid, bssid, ETH_ALEN);
3032 +       memcpy(lnkid->init_sta, src_addr, ETH_ALEN);
3033 +       memcpy(lnkid->resp_sta, peer, ETH_ALEN);
3034 +}
3035 +
3036 +static int
3037 +ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
3038 +                              const u8 *peer, u8 action_code, u8 dialog_token,
3039 +                              u16 status_code, struct sk_buff *skb)
3040 +{
3041 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3042 +       enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
3043 +       struct ieee80211_tdls_data *tf;
3044 +
3045 +       tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
3046 +
3047 +       memcpy(tf->da, peer, ETH_ALEN);
3048 +       memcpy(tf->sa, sdata->vif.addr, ETH_ALEN);
3049 +       tf->ether_type = cpu_to_be16(ETH_P_TDLS);
3050 +       tf->payload_type = WLAN_TDLS_SNAP_RFTYPE;
3051 +
3052 +       switch (action_code) {
3053 +       case WLAN_TDLS_SETUP_REQUEST:
3054 +               tf->category = WLAN_CATEGORY_TDLS;
3055 +               tf->action_code = WLAN_TDLS_SETUP_REQUEST;
3056 +
3057 +               skb_put(skb, sizeof(tf->u.setup_req));
3058 +               tf->u.setup_req.dialog_token = dialog_token;
3059 +               tf->u.setup_req.capability =
3060 +                       cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
3061 +
3062 +               ieee80211_add_srates_ie(sdata, skb, false, band);
3063 +               ieee80211_add_ext_srates_ie(sdata, skb, false, band);
3064 +               ieee80211_tdls_add_ext_capab(skb);
3065 +               break;
3066 +       case WLAN_TDLS_SETUP_RESPONSE:
3067 +               tf->category = WLAN_CATEGORY_TDLS;
3068 +               tf->action_code = WLAN_TDLS_SETUP_RESPONSE;
3069 +
3070 +               skb_put(skb, sizeof(tf->u.setup_resp));
3071 +               tf->u.setup_resp.status_code = cpu_to_le16(status_code);
3072 +               tf->u.setup_resp.dialog_token = dialog_token;
3073 +               tf->u.setup_resp.capability =
3074 +                       cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
3075 +
3076 +               ieee80211_add_srates_ie(sdata, skb, false, band);
3077 +               ieee80211_add_ext_srates_ie(sdata, skb, false, band);
3078 +               ieee80211_tdls_add_ext_capab(skb);
3079 +               break;
3080 +       case WLAN_TDLS_SETUP_CONFIRM:
3081 +               tf->category = WLAN_CATEGORY_TDLS;
3082 +               tf->action_code = WLAN_TDLS_SETUP_CONFIRM;
3083 +
3084 +               skb_put(skb, sizeof(tf->u.setup_cfm));
3085 +               tf->u.setup_cfm.status_code = cpu_to_le16(status_code);
3086 +               tf->u.setup_cfm.dialog_token = dialog_token;
3087 +               break;
3088 +       case WLAN_TDLS_TEARDOWN:
3089 +               tf->category = WLAN_CATEGORY_TDLS;
3090 +               tf->action_code = WLAN_TDLS_TEARDOWN;
3091 +
3092 +               skb_put(skb, sizeof(tf->u.teardown));
3093 +               tf->u.teardown.reason_code = cpu_to_le16(status_code);
3094 +               break;
3095 +       case WLAN_TDLS_DISCOVERY_REQUEST:
3096 +               tf->category = WLAN_CATEGORY_TDLS;
3097 +               tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST;
3098 +
3099 +               skb_put(skb, sizeof(tf->u.discover_req));
3100 +               tf->u.discover_req.dialog_token = dialog_token;
3101 +               break;
3102 +       default:
3103 +               return -EINVAL;
3104 +       }
3105 +
3106 +       return 0;
3107 +}
3108 +
3109 +static int
3110 +ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
3111 +                          const u8 *peer, u8 action_code, u8 dialog_token,
3112 +                          u16 status_code, struct sk_buff *skb)
3113 +{
3114 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3115 +       enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
3116 +       struct ieee80211_mgmt *mgmt;
3117 +
3118 +       mgmt = (void *)skb_put(skb, 24);
3119 +       memset(mgmt, 0, 24);
3120 +       memcpy(mgmt->da, peer, ETH_ALEN);
3121 +       memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
3122 +       memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
3123 +
3124 +       mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3125 +                                         IEEE80211_STYPE_ACTION);
3126 +
3127 +       switch (action_code) {
3128 +       case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
3129 +               skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
3130 +               mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
3131 +               mgmt->u.action.u.tdls_discover_resp.action_code =
3132 +                       WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
3133 +               mgmt->u.action.u.tdls_discover_resp.dialog_token =
3134 +                       dialog_token;
3135 +               mgmt->u.action.u.tdls_discover_resp.capability =
3136 +                       cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
3137 +
3138 +               ieee80211_add_srates_ie(sdata, skb, false, band);
3139 +               ieee80211_add_ext_srates_ie(sdata, skb, false, band);
3140 +               ieee80211_tdls_add_ext_capab(skb);
3141 +               break;
3142 +       default:
3143 +               return -EINVAL;
3144 +       }
3145 +
3146 +       return 0;
3147 +}
3148 +
3149 +int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
3150 +                       const u8 *peer, u8 action_code, u8 dialog_token,
3151 +                       u16 status_code, u32 peer_capability,
3152 +                       const u8 *extra_ies, size_t extra_ies_len)
3153 +{
3154 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3155 +       struct ieee80211_local *local = sdata->local;
3156 +       struct sk_buff *skb = NULL;
3157 +       bool send_direct;
3158 +       int ret;
3159 +
3160 +       if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
3161 +               return -ENOTSUPP;
3162 +
3163 +       /* make sure we are in managed mode, and associated */
3164 +       if (sdata->vif.type != NL80211_IFTYPE_STATION ||
3165 +           !sdata->u.mgd.associated)
3166 +               return -EINVAL;
3167 +
3168 +       tdls_dbg(sdata, "TDLS mgmt action %d peer %pM\n",
3169 +                action_code, peer);
3170 +
3171 +       skb = dev_alloc_skb(local->hw.extra_tx_headroom +
3172 +                           max(sizeof(struct ieee80211_mgmt),
3173 +                               sizeof(struct ieee80211_tdls_data)) +
3174 +                           50 + /* supported rates */
3175 +                           7 + /* ext capab */
3176 +                           extra_ies_len +
3177 +                           sizeof(struct ieee80211_tdls_lnkie));
3178 +       if (!skb)
3179 +               return -ENOMEM;
3180 +
3181 +       skb_reserve(skb, local->hw.extra_tx_headroom);
3182 +
3183 +       switch (action_code) {
3184 +       case WLAN_TDLS_SETUP_REQUEST:
3185 +       case WLAN_TDLS_SETUP_RESPONSE:
3186 +       case WLAN_TDLS_SETUP_CONFIRM:
3187 +       case WLAN_TDLS_TEARDOWN:
3188 +       case WLAN_TDLS_DISCOVERY_REQUEST:
3189 +               ret = ieee80211_prep_tdls_encap_data(wiphy, dev, peer,
3190 +                                                    action_code, dialog_token,
3191 +                                                    status_code, skb);
3192 +               send_direct = false;
3193 +               break;
3194 +       case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
3195 +               ret = ieee80211_prep_tdls_direct(wiphy, dev, peer, action_code,
3196 +                                                dialog_token, status_code,
3197 +                                                skb);
3198 +               send_direct = true;
3199 +               break;
3200 +       default:
3201 +               ret = -ENOTSUPP;
3202 +               break;
3203 +       }
3204 +
3205 +       if (ret < 0)
3206 +               goto fail;
3207 +
3208 +       if (extra_ies_len)
3209 +               memcpy(skb_put(skb, extra_ies_len), extra_ies, extra_ies_len);
3210 +
3211 +       /* the TDLS link IE is always added last */
3212 +       switch (action_code) {
3213 +       case WLAN_TDLS_SETUP_REQUEST:
3214 +       case WLAN_TDLS_SETUP_CONFIRM:
3215 +       case WLAN_TDLS_TEARDOWN:
3216 +       case WLAN_TDLS_DISCOVERY_REQUEST:
3217 +               /* we are the initiator */
3218 +               ieee80211_tdls_add_link_ie(skb, sdata->vif.addr, peer,
3219 +                                          sdata->u.mgd.bssid);
3220 +               break;
3221 +       case WLAN_TDLS_SETUP_RESPONSE:
3222 +       case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
3223 +               /* we are the responder */
3224 +               ieee80211_tdls_add_link_ie(skb, peer, sdata->vif.addr,
3225 +                                          sdata->u.mgd.bssid);
3226 +               break;
3227 +       default:
3228 +               ret = -ENOTSUPP;
3229 +               goto fail;
3230 +       }
3231 +
3232 +       if (send_direct) {
3233 +               ieee80211_tx_skb(sdata, skb);
3234 +               return 0;
3235 +       }
3236 +
3237 +       /*
3238 +        * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
3239 +        * we should default to AC_VI.
3240 +        */
3241 +       switch (action_code) {
3242 +       case WLAN_TDLS_SETUP_REQUEST:
3243 +       case WLAN_TDLS_SETUP_RESPONSE:
3244 +               skb_set_queue_mapping(skb, IEEE80211_AC_BK);
3245 +               skb->priority = 2;
3246 +               break;
3247 +       default:
3248 +               skb_set_queue_mapping(skb, IEEE80211_AC_VI);
3249 +               skb->priority = 5;
3250 +               break;
3251 +       }
3252 +
3253 +       /* disable bottom halves when entering the Tx path */
3254 +       local_bh_disable();
3255 +       ret = ieee80211_subif_start_xmit(skb, dev);
3256 +       local_bh_enable();
3257 +
3258 +       return ret;
3259 +
3260 +fail:
3261 +       dev_kfree_skb(skb);
3262 +       return ret;
3263 +}
3264 +
3265 +int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
3266 +                       const u8 *peer, enum nl80211_tdls_operation oper)
3267 +{
3268 +       struct sta_info *sta;
3269 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3270 +
3271 +       if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
3272 +               return -ENOTSUPP;
3273 +
3274 +       if (sdata->vif.type != NL80211_IFTYPE_STATION)
3275 +               return -EINVAL;
3276 +
3277 +       tdls_dbg(sdata, "TDLS oper %d peer %pM\n", oper, peer);
3278 +
3279 +       switch (oper) {
3280 +       case NL80211_TDLS_ENABLE_LINK:
3281 +               rcu_read_lock();
3282 +               sta = sta_info_get(sdata, peer);
3283 +               if (!sta) {
3284 +                       rcu_read_unlock();
3285 +                       return -ENOLINK;
3286 +               }
3287 +
3288 +               set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
3289 +               rcu_read_unlock();
3290 +               break;
3291 +       case NL80211_TDLS_DISABLE_LINK:
3292 +               return sta_info_destroy_addr(sdata, peer);
3293 +       case NL80211_TDLS_TEARDOWN:
3294 +       case NL80211_TDLS_SETUP:
3295 +       case NL80211_TDLS_DISCOVERY_REQ:
3296 +               /* We don't support in-driver setup/teardown/discovery */
3297 +               return -ENOTSUPP;
3298 +       default:
3299 +               return -ENOTSUPP;
3300 +       }
3301 +
3302 +       return 0;
3303 +}
3304 --- a/net/mac80211/tx.c
3305 +++ b/net/mac80211/tx.c
3306 @@ -2330,7 +2330,8 @@ void ieee80211_tx_pending(unsigned long
3307  /* functions for drivers to get certain frames */
3308
3309  static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
3310 -                                      struct ps_data *ps, struct sk_buff *skb)
3311 +                                      struct ps_data *ps, struct sk_buff *skb,
3312 +                                      bool is_template)
3313  {
3314         u8 *pos, *tim;
3315         int aid0 = 0;
3316 @@ -2343,11 +2344,12 @@ static void __ieee80211_beacon_add_tim(s
3317                  * checking byte-for-byte */
3318                 have_bits = !bitmap_empty((unsigned long *)ps->tim,
3319                                           IEEE80211_MAX_AID+1);
3320 -
3321 -       if (ps->dtim_count == 0)
3322 -               ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
3323 -       else
3324 -               ps->dtim_count--;
3325 +       if (!is_template) {
3326 +               if (ps->dtim_count == 0)
3327 +                       ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
3328 +               else
3329 +                       ps->dtim_count--;
3330 +       }
3331
3332         tim = pos = (u8 *) skb_put(skb, 6);
3333         *pos++ = WLAN_EID_TIM;
3334 @@ -2393,7 +2395,8 @@ static void __ieee80211_beacon_add_tim(s
3335  }
3336
3337  static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
3338 -                                   struct ps_data *ps, struct sk_buff *skb)
3339 +                                   struct ps_data *ps, struct sk_buff *skb,
3340 +                                   bool is_template)
3341  {
3342         struct ieee80211_local *local = sdata->local;
3343
3344 @@ -2405,24 +2408,24 @@ static int ieee80211_beacon_add_tim(stru
3345          * of the tim bitmap in mac80211 and the driver.
3346          */
3347         if (local->tim_in_locked_section) {
3348 -               __ieee80211_beacon_add_tim(sdata, ps, skb);
3349 +               __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
3350         } else {
3351                 spin_lock_bh(&local->tim_lock);
3352 -               __ieee80211_beacon_add_tim(sdata, ps, skb);
3353 +               __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
3354                 spin_unlock_bh(&local->tim_lock);
3355         }
3356
3357         return 0;
3358  }
3359
3360 -static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
3361 -                                struct beacon_data *beacon)
3362 +static void ieee80211_set_csa(struct ieee80211_sub_if_data *sdata,
3363 +                             struct beacon_data *beacon)
3364  {
3365         struct probe_resp *resp;
3366 -       int counter_offset_beacon = sdata->csa_counter_offset_beacon;
3367 -       int counter_offset_presp = sdata->csa_counter_offset_presp;
3368         u8 *beacon_data;
3369         size_t beacon_data_len;
3370 +       int i;
3371 +       u8 count = sdata->csa_current_counter;
3372
3373         switch (sdata->vif.type) {
3374         case NL80211_IFTYPE_AP:
3375 @@ -2440,40 +2443,57 @@ static void ieee80211_update_csa(struct
3376         default:
3377                 return;
3378         }
3379 -       if (WARN_ON(counter_offset_beacon >= beacon_data_len))
3380 -               return;
3381
3382 -       /* Warn if the driver did not check for/react to csa
3383 -        * completeness.  A beacon with CSA counter set to 0 should
3384 -        * never occur, because a counter of 1 means switch just
3385 -        * before the next beacon.
3386 -        */
3387 -       if (WARN_ON(beacon_data[counter_offset_beacon] == 1))
3388 -               return;
3389 +       for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
3390 +               u16 counter_offset_beacon =
3391 +                       sdata->csa_counter_offset_beacon[i];
3392 +               u16 counter_offset_presp = sdata->csa_counter_offset_presp[i];
3393 +
3394 +               if (counter_offset_beacon) {
3395 +                       if (WARN_ON(counter_offset_beacon >= beacon_data_len))
3396 +                               return;
3397
3398 -       beacon_data[counter_offset_beacon]--;
3399 +                       beacon_data[counter_offset_beacon] = count;
3400 +               }
3401
3402 -       if (sdata->vif.type == NL80211_IFTYPE_AP && counter_offset_presp) {
3403 -               rcu_read_lock();
3404 -               resp = rcu_dereference(sdata->u.ap.probe_resp);
3405 +               if (sdata->vif.type == NL80211_IFTYPE_AP &&
3406 +                   counter_offset_presp) {
3407 +                       rcu_read_lock();
3408 +                       resp = rcu_dereference(sdata->u.ap.probe_resp);
3409
3410 -               /* if nl80211 accepted the offset, this should not happen. */
3411 -               if (WARN_ON(!resp)) {
3412 +                       /* If nl80211 accepted the offset, this should
3413 +                        * not happen.
3414 +                        */
3415 +                       if (WARN_ON(!resp)) {
3416 +                               rcu_read_unlock();
3417 +                               return;
3418 +                       }
3419 +                       resp->data[counter_offset_presp] = count;
3420                         rcu_read_unlock();
3421 -                       return;
3422                 }
3423 -               resp->data[counter_offset_presp]--;
3424 -               rcu_read_unlock();
3425         }
3426  }
3427
3428 +u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
3429 +{
3430 +       struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3431 +
3432 +       sdata->csa_current_counter--;
3433 +
3434 +       /* the counter should never reach 0 */
3435 +       WARN_ON(!sdata->csa_current_counter);
3436 +
3437 +       return sdata->csa_current_counter;
3438 +}
3439 +EXPORT_SYMBOL(ieee80211_csa_update_counter);
3440 +
3441  bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
3442  {
3443         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3444         struct beacon_data *beacon = NULL;
3445         u8 *beacon_data;
3446         size_t beacon_data_len;
3447 -       int counter_beacon = sdata->csa_counter_offset_beacon;
3448 +       int counter_beacon = sdata->csa_counter_offset_beacon[0];
3449         int ret = false;
3450
3451         if (!ieee80211_sdata_running(sdata))
3452 @@ -2523,9 +2543,11 @@ bool ieee80211_csa_is_complete(struct ie
3453  }
3454  EXPORT_SYMBOL(ieee80211_csa_is_complete);
3455
3456 -struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
3457 -                                        struct ieee80211_vif *vif,
3458 -                                        u16 *tim_offset, u16 *tim_length)
3459 +static struct sk_buff *
3460 +__ieee80211_beacon_get(struct ieee80211_hw *hw,
3461 +                      struct ieee80211_vif *vif,
3462 +                      struct ieee80211_mutable_offsets *offs,
3463 +                      bool is_template)
3464  {
3465         struct ieee80211_local *local = hw_to_local(hw);
3466         struct sk_buff *skb = NULL;
3467 @@ -2534,6 +2556,7 @@ struct sk_buff *ieee80211_beacon_get_tim
3468         enum ieee80211_band band;
3469         struct ieee80211_tx_rate_control txrc;
3470         struct ieee80211_chanctx_conf *chanctx_conf;
3471 +       int csa_off_base = 0;
3472
3473         rcu_read_lock();
3474
3475 @@ -2543,18 +2566,20 @@ struct sk_buff *ieee80211_beacon_get_tim
3476         if (!ieee80211_sdata_running(sdata) || !chanctx_conf)
3477                 goto out;
3478
3479 -       if (tim_offset)
3480 -               *tim_offset = 0;
3481 -       if (tim_length)
3482 -               *tim_length = 0;
3483 +       if (offs)
3484 +               memset(offs, 0, sizeof(*offs));
3485
3486         if (sdata->vif.type == NL80211_IFTYPE_AP) {
3487                 struct ieee80211_if_ap *ap = &sdata->u.ap;
3488                 struct beacon_data *beacon = rcu_dereference(ap->beacon);
3489
3490                 if (beacon) {
3491 -                       if (sdata->vif.csa_active)
3492 -                               ieee80211_update_csa(sdata, beacon);
3493 +                       if (sdata->vif.csa_active) {
3494 +                               if (!is_template)
3495 +                                       ieee80211_csa_update_counter(vif);
3496 +
3497 +                               ieee80211_set_csa(sdata, beacon);
3498 +                       }
3499
3500                         /*
3501                          * headroom, head length,
3502 @@ -2571,12 +2596,16 @@ struct sk_buff *ieee80211_beacon_get_tim
3503                         memcpy(skb_put(skb, beacon->head_len), beacon->head,
3504                                beacon->head_len);
3505
3506 -                       ieee80211_beacon_add_tim(sdata, &ap->ps, skb);
3507 +                       ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
3508 +                                                is_template);
3509 +
3510 +                       if (offs) {
3511 +                               offs->tim_offset = beacon->head_len;
3512 +                               offs->tim_length = skb->len - beacon->head_len;
3513
3514 -                       if (tim_offset)
3515 -                               *tim_offset = beacon->head_len;
3516 -                       if (tim_length)
3517 -                               *tim_length = skb->len - beacon->head_len;
3518 +                               /* for AP the csa offsets are from tail */
3519 +                               csa_off_base = skb->len;
3520 +                       }
3521
3522                         if (beacon->tail)
3523                                 memcpy(skb_put(skb, beacon->tail_len),
3524 @@ -2591,9 +2620,12 @@ struct sk_buff *ieee80211_beacon_get_tim
3525                 if (!presp)
3526                         goto out;
3527
3528 -               if (sdata->vif.csa_active)
3529 -                       ieee80211_update_csa(sdata, presp);
3530 +               if (sdata->vif.csa_active) {
3531 +                       if (!is_template)
3532 +                               ieee80211_csa_update_counter(vif);
3533
3534 +                       ieee80211_set_csa(sdata, presp);
3535 +               }
3536
3537                 skb = dev_alloc_skb(local->tx_headroom + presp->head_len +
3538                                     local->hw.extra_beacon_tailroom);
3539 @@ -2613,8 +2645,17 @@ struct sk_buff *ieee80211_beacon_get_tim
3540                 if (!bcn)
3541                         goto out;
3542
3543 -               if (sdata->vif.csa_active)
3544 -                       ieee80211_update_csa(sdata, bcn);
3545 +               if (sdata->vif.csa_active) {
3546 +                       if (!is_template)
3547 +                               /* TODO: For mesh csa_counter is in TU, so
3548 +                                * decrementing it by one isn't correct, but
3549 +                                * for now we leave it consistent with overall
3550 +                                * mac80211's behavior.
3551 +                                */
3552 +                               ieee80211_csa_update_counter(vif);
3553 +
3554 +                       ieee80211_set_csa(sdata, bcn);
3555 +               }
3556
3557                 if (ifmsh->sync_ops)
3558                         ifmsh->sync_ops->adjust_tbtt(sdata, bcn);
3559 @@ -2628,13 +2669,33 @@ struct sk_buff *ieee80211_beacon_get_tim
3560                         goto out;
3561                 skb_reserve(skb, local->tx_headroom);
3562                 memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len);
3563 -               ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb);
3564 +               ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
3565 +
3566 +               if (offs) {
3567 +                       offs->tim_offset = bcn->head_len;
3568 +                       offs->tim_length = skb->len - bcn->head_len;
3569 +               }
3570 +
3571                 memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len);
3572         } else {
3573                 WARN_ON(1);
3574                 goto out;
3575         }
3576
3577 +       /* CSA offsets */
3578 +       if (offs) {
3579 +               int i;
3580 +
3581 +               for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
3582 +                       u16 csa_off = sdata->csa_counter_offset_beacon[i];
3583 +
3584 +                       if (!csa_off)
3585 +                               continue;
3586 +
3587 +                       offs->csa_counter_offs[i] = csa_off_base + csa_off;
3588 +               }
3589 +       }
3590 +
3591         band = chanctx_conf->def.chan->band;
3592
3593         info = IEEE80211_SKB_CB(skb);
3594 @@ -2665,6 +2726,32 @@ struct sk_buff *ieee80211_beacon_get_tim
3595   out:
3596         rcu_read_unlock();
3597         return skb;
3598 +
3599 +}
3600 +
3601 +struct sk_buff *
3602 +ieee80211_beacon_get_template(struct ieee80211_hw *hw,
3603 +                             struct ieee80211_vif *vif,
3604 +                             struct ieee80211_mutable_offsets *offs)
3605 +{
3606 +       return __ieee80211_beacon_get(hw, vif, offs, true);
3607 +}
3608 +EXPORT_SYMBOL(ieee80211_beacon_get_template);
3609 +
3610 +struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
3611 +                                        struct ieee80211_vif *vif,
3612 +                                        u16 *tim_offset, u16 *tim_length)
3613 +{
3614 +       struct ieee80211_mutable_offsets offs = {};
3615 +       struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false);
3616 +
3617 +       if (tim_offset)
3618 +               *tim_offset = offs.tim_offset;
3619 +
3620 +       if (tim_length)
3621 +               *tim_length = offs.tim_length;
3622 +
3623 +       return bcn;
3624  }
3625  EXPORT_SYMBOL(ieee80211_beacon_get_tim);
3626
3627 --- a/net/mac80211/util.c
3628 +++ b/net/mac80211/util.c
3629 @@ -1457,6 +1457,44 @@ void ieee80211_stop_device(struct ieee80
3630         drv_stop(local);
3631  }
3632
3633 +static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
3634 +{
3635 +       struct ieee80211_sub_if_data *sdata;
3636 +       struct ieee80211_chanctx *ctx;
3637 +
3638 +       /*
3639 +        * We get here if during resume the device can't be restarted properly.
3640 +        * We might also get here if this happens during HW reset, which is a
3641 +        * slightly different situation and we need to drop all connections in
3642 +        * the latter case.
3643 +        *
3644 +        * Ask cfg80211 to turn off all interfaces, this will result in more
3645 +        * warnings but at least we'll then get into a clean stopped state.
3646 +        */
3647 +
3648 +       local->resuming = false;
3649 +       local->suspended = false;
3650 +       local->started = false;
3651 +
3652 +       /* scheduled scan clearly can't be running any more, but tell
3653 +        * cfg80211 and clear local state
3654 +        */
3655 +       ieee80211_sched_scan_end(local);
3656 +
3657 +       list_for_each_entry(sdata, &local->interfaces, list)
3658 +               sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
3659 +
3660 +       /* Mark channel contexts as not being in the driver any more to avoid
3661 +        * removing them from the driver during the shutdown process...
3662 +        */
3663 +       mutex_lock(&local->chanctx_mtx);
3664 +       list_for_each_entry(ctx, &local->chanctx_list, list)
3665 +               ctx->driver_present = false;
3666 +       mutex_unlock(&local->chanctx_mtx);
3667 +
3668 +       cfg80211_shutdown_all_interfaces(local->hw.wiphy);
3669 +}
3670 +
3671  static void ieee80211_assign_chanctx(struct ieee80211_local *local,
3672                                      struct ieee80211_sub_if_data *sdata)
3673  {
3674 @@ -1520,9 +1558,11 @@ int ieee80211_reconfig(struct ieee80211_
3675          */
3676         res = drv_start(local);
3677         if (res) {
3678 -               WARN(local->suspended, "Hardware became unavailable "
3679 -                    "upon resume. This could be a software issue "
3680 -                    "prior to suspend or a hardware issue.\n");
3681 +               if (local->suspended)
3682 +                       WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n");
3683 +               else
3684 +                       WARN(1, "Hardware became unavailable during restart.\n");
3685 +               ieee80211_handle_reconfig_failure(local);
3686                 return res;
3687         }
3688
3689 --- a/net/wireless/ap.c
3690 +++ b/net/wireless/ap.c
3691 @@ -6,8 +6,8 @@
3692  #include "rdev-ops.h"
3693
3694
3695 -static int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
3696 -                             struct net_device *dev, bool notify)
3697 +int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
3698 +                      struct net_device *dev, bool notify)
3699  {
3700         struct wireless_dev *wdev = dev->ieee80211_ptr;
3701         int err;
3702 --- a/net/wireless/chan.c
3703 +++ b/net/wireless/chan.c
3704 @@ -370,8 +370,8 @@ int cfg80211_chandef_dfs_required(struct
3705         case NL80211_IFTYPE_AP_VLAN:
3706         case NL80211_IFTYPE_WDS:
3707         case NL80211_IFTYPE_P2P_DEVICE:
3708 -       case NL80211_IFTYPE_UNSPECIFIED:
3709                 break;
3710 +       case NL80211_IFTYPE_UNSPECIFIED:
3711         case NUM_NL80211_IFTYPES:
3712                 WARN_ON(1);
3713         }
3714 @@ -796,8 +796,7 @@ bool cfg80211_reg_can_beacon(struct wiph
3715             !cfg80211_go_permissive_chan(rdev, chandef->chan))
3716                 prohibited_flags |= IEEE80211_CHAN_NO_IR;
3717
3718 -       if (cfg80211_chandef_dfs_required(wiphy, chandef,
3719 -                                         NL80211_IFTYPE_UNSPECIFIED) > 0 &&
3720 +       if (cfg80211_chandef_dfs_required(wiphy, chandef, iftype) > 0 &&
3721             cfg80211_chandef_dfs_available(wiphy, chandef)) {
3722                 /* We can skip IEEE80211_CHAN_NO_IR if chandef dfs available */
3723                 prohibited_flags = IEEE80211_CHAN_DISABLED;
3724 --- a/net/wireless/core.c
3725 +++ b/net/wireless/core.c
3726 @@ -210,15 +210,12 @@ void cfg80211_stop_p2p_device(struct cfg
3727         }
3728  }
3729
3730 -static int cfg80211_rfkill_set_block(void *data, bool blocked)
3731 +void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy)
3732  {
3733 -       struct cfg80211_registered_device *rdev = data;
3734 +       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3735         struct wireless_dev *wdev;
3736
3737 -       if (!blocked)
3738 -               return 0;
3739 -
3740 -       rtnl_lock();
3741 +       ASSERT_RTNL();
3742
3743         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3744                 if (wdev->netdev) {
3745 @@ -234,7 +231,18 @@ static int cfg80211_rfkill_set_block(voi
3746                         break;
3747                 }
3748         }
3749 +}
3750 +EXPORT_SYMBOL_GPL(cfg80211_shutdown_all_interfaces);
3751
3752 +static int cfg80211_rfkill_set_block(void *data, bool blocked)
3753 +{
3754 +       struct cfg80211_registered_device *rdev = data;
3755 +
3756 +       if (!blocked)
3757 +               return 0;
3758 +
3759 +       rtnl_lock();
3760 +       cfg80211_shutdown_all_interfaces(&rdev->wiphy);
3761         rtnl_unlock();
3762
3763         return 0;
3764 @@ -401,6 +409,8 @@ struct wiphy *wiphy_new(const struct cfg
3765         rdev->wiphy.rts_threshold = (u32) -1;
3766         rdev->wiphy.coverage_class = 0;
3767
3768 +       rdev->wiphy.max_num_csa_counters = 1;
3769 +
3770         return &rdev->wiphy;
3771  }
3772  EXPORT_SYMBOL(wiphy_new);
3773 @@ -697,7 +707,7 @@ void wiphy_unregister(struct wiphy *wiph
3774         rtnl_lock();
3775         rdev->wiphy.registered = false;
3776
3777 -       BUG_ON(!list_empty(&rdev->wdev_list));
3778 +       WARN_ON(!list_empty(&rdev->wdev_list));
3779
3780         /*
3781          * First remove the hardware from everywhere, this makes
3782 @@ -799,23 +809,23 @@ void cfg80211_update_iface_num(struct cf
3783                 rdev->num_running_monitor_ifaces += num;
3784  }
3785
3786 -void cfg80211_leave(struct cfg80211_registered_device *rdev,
3787 -                   struct wireless_dev *wdev)
3788 +void __cfg80211_leave(struct cfg80211_registered_device *rdev,
3789 +                     struct wireless_dev *wdev)
3790  {
3791         struct net_device *dev = wdev->netdev;
3792
3793         ASSERT_RTNL();
3794 +       ASSERT_WDEV_LOCK(wdev);
3795
3796         switch (wdev->iftype) {
3797         case NL80211_IFTYPE_ADHOC:
3798 -               cfg80211_leave_ibss(rdev, dev, true);
3799 +               __cfg80211_leave_ibss(rdev, dev, true);
3800                 break;
3801         case NL80211_IFTYPE_P2P_CLIENT:
3802         case NL80211_IFTYPE_STATION:
3803                 if (rdev->sched_scan_req && dev == rdev->sched_scan_req->dev)
3804                         __cfg80211_stop_sched_scan(rdev, false);
3805
3806 -               wdev_lock(wdev);
3807  #ifdef CPTCFG_CFG80211_WEXT
3808                 kfree(wdev->wext.ie);
3809                 wdev->wext.ie = NULL;
3810 @@ -824,20 +834,49 @@ void cfg80211_leave(struct cfg80211_regi
3811  #endif
3812                 cfg80211_disconnect(rdev, dev,
3813                                     WLAN_REASON_DEAUTH_LEAVING, true);
3814 -               wdev_unlock(wdev);
3815                 break;
3816         case NL80211_IFTYPE_MESH_POINT:
3817 -               cfg80211_leave_mesh(rdev, dev);
3818 +               __cfg80211_leave_mesh(rdev, dev);
3819                 break;
3820         case NL80211_IFTYPE_AP:
3821         case NL80211_IFTYPE_P2P_GO:
3822 -               cfg80211_stop_ap(rdev, dev, true);
3823 +               __cfg80211_stop_ap(rdev, dev, true);
3824                 break;
3825         default:
3826                 break;
3827         }
3828  }
3829
3830 +void cfg80211_leave(struct cfg80211_registered_device *rdev,
3831 +                   struct wireless_dev *wdev)
3832 +{
3833 +       wdev_lock(wdev);
3834 +       __cfg80211_leave(rdev, wdev);
3835 +       wdev_unlock(wdev);
3836 +}
3837 +
3838 +void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev,
3839 +                        gfp_t gfp)
3840 +{
3841 +       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3842 +       struct cfg80211_event *ev;
3843 +       unsigned long flags;
3844 +
3845 +       trace_cfg80211_stop_iface(wiphy, wdev);
3846 +
3847 +       ev = kzalloc(sizeof(*ev), gfp);
3848 +       if (!ev)
3849 +               return;
3850 +
3851 +       ev->type = EVENT_STOPPED;
3852 +
3853 +       spin_lock_irqsave(&wdev->event_lock, flags);
3854 +       list_add_tail(&ev->list, &wdev->event_list);
3855 +       spin_unlock_irqrestore(&wdev->event_lock, flags);
3856 +       queue_work(cfg80211_wq, &rdev->event_work);
3857 +}
3858 +EXPORT_SYMBOL(cfg80211_stop_iface);
3859 +
3860  static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
3861                                          unsigned long state, void *ptr)
3862  {
3863 --- a/net/wireless/core.h
3864 +++ b/net/wireless/core.h
3865 @@ -185,6 +185,7 @@ enum cfg80211_event_type {
3866         EVENT_ROAMED,
3867         EVENT_DISCONNECTED,
3868         EVENT_IBSS_JOINED,
3869 +       EVENT_STOPPED,
3870  };
3871
3872  struct cfg80211_event {
3873 @@ -281,6 +282,8 @@ int cfg80211_join_mesh(struct cfg80211_r
3874                        struct net_device *dev,
3875                        struct mesh_setup *setup,
3876                        const struct mesh_config *conf);
3877 +int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
3878 +                         struct net_device *dev);
3879  int cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
3880                         struct net_device *dev);
3881  int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
3882 @@ -288,6 +291,8 @@ int cfg80211_set_mesh_channel(struct cfg
3883                               struct cfg80211_chan_def *chandef);
3884
3885  /* AP */
3886 +int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
3887 +                      struct net_device *dev, bool notify);
3888  int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
3889                      struct net_device *dev, bool notify);
3890
3891 @@ -441,6 +446,8 @@ int cfg80211_validate_beacon_int(struct
3892  void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
3893                                enum nl80211_iftype iftype, int num);
3894
3895 +void __cfg80211_leave(struct cfg80211_registered_device *rdev,
3896 +                     struct wireless_dev *wdev);
3897  void cfg80211_leave(struct cfg80211_registered_device *rdev,
3898                     struct wireless_dev *wdev);
3899
3900 --- a/net/wireless/ibss.c
3901 +++ b/net/wireless/ibss.c
3902 @@ -420,8 +420,8 @@ int cfg80211_ibss_wext_siwessid(struct n
3903         if (len > 0 && ssid[len - 1] == '\0')
3904                 len--;
3905
3906 +       memcpy(wdev->ssid, ssid, len);
3907         wdev->wext.ibss.ssid = wdev->ssid;
3908 -       memcpy(wdev->wext.ibss.ssid, ssid, len);
3909         wdev->wext.ibss.ssid_len = len;
3910
3911         wdev_lock(wdev);
3912 --- a/net/wireless/mesh.c
3913 +++ b/net/wireless/mesh.c
3914 @@ -238,8 +238,8 @@ int cfg80211_set_mesh_channel(struct cfg
3915         return 0;
3916  }
3917
3918 -static int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
3919 -                                struct net_device *dev)
3920 +int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
3921 +                         struct net_device *dev)
3922  {
3923         struct wireless_dev *wdev = dev->ieee80211_ptr;
3924         int err;
3925 --- a/net/wireless/nl80211.c
3926 +++ b/net/wireless/nl80211.c
3927 @@ -371,8 +371,8 @@ static const struct nla_policy nl80211_p
3928         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
3929         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
3930         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
3931 -       [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
3932 -       [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
3933 +       [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
3934 +       [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
3935         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
3936         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
3937         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
3938 @@ -386,6 +386,7 @@ static const struct nla_policy nl80211_p
3939         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
3940         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
3941         [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
3942 +       [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
3943  };
3944
3945  /* policy for the key attributes */
3946 @@ -970,8 +971,10 @@ static int nl80211_put_iface_combination
3947                                 c->max_interfaces))
3948                         goto nla_put_failure;
3949                 if (large &&
3950 -                   nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
3951 -                               c->radar_detect_widths))
3952 +                   (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
3953 +                               c->radar_detect_widths) ||
3954 +                    nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
3955 +                               c->radar_detect_regions)))
3956                         goto nla_put_failure;
3957
3958                 nla_nest_end(msg, nl_combi);
3959 @@ -1667,6 +1670,13 @@ static int nl80211_send_wiphy(struct cfg
3960                         }
3961                         nla_nest_end(msg, nested);
3962                 }
3963 +               state->split_start++;
3964 +               break;
3965 +       case 12:
3966 +               if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
3967 +                   nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
3968 +                              rdev->wiphy.max_num_csa_counters))
3969 +                       goto nla_put_failure;
3970
3971                 /* done */
3972                 state->split_start = 0;
3973 @@ -5825,7 +5835,7 @@ static int nl80211_start_radar_detection
3974                 return -EBUSY;
3975
3976         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
3977 -                                           NL80211_IFTYPE_UNSPECIFIED);
3978 +                                           wdev->iftype);
3979         if (err < 0)
3980                 return err;
3981
3982 @@ -5866,6 +5876,7 @@ static int nl80211_channel_switch(struct
3983         u8 radar_detect_width = 0;
3984         int err;
3985         bool need_new_beacon = false;
3986 +       int len, i;
3987
3988         if (!rdev->ops->channel_switch ||
3989             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
3990 @@ -5924,26 +5935,55 @@ static int nl80211_channel_switch(struct
3991         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
3992                 return -EINVAL;
3993
3994 -       params.counter_offset_beacon =
3995 -               nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
3996 -       if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
3997 +       len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
3998 +       if (!len || (len % sizeof(u16)))
3999                 return -EINVAL;
4000
4001 -       /* sanity check - counters should be the same */
4002 -       if (params.beacon_csa.tail[params.counter_offset_beacon] !=
4003 -           params.count)
4004 +       params.n_counter_offsets_beacon = len / sizeof(u16);
4005 +       if (rdev->wiphy.max_num_csa_counters &&
4006 +           (params.n_counter_offsets_beacon >
4007 +            rdev->wiphy.max_num_csa_counters))
4008                 return -EINVAL;
4009
4010 +       params.counter_offsets_beacon =
4011 +               nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
4012 +
4013 +       /* sanity checks - counters should fit and be the same */
4014 +       for (i = 0; i < params.n_counter_offsets_beacon; i++) {
4015 +               u16 offset = params.counter_offsets_beacon[i];
4016 +
4017 +               if (offset >= params.beacon_csa.tail_len)
4018 +                       return -EINVAL;
4019 +
4020 +               if (params.beacon_csa.tail[offset] != params.count)
4021 +                       return -EINVAL;
4022 +       }
4023 +
4024         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
4025 -               params.counter_offset_presp =
4026 -                       nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
4027 -               if (params.counter_offset_presp >=
4028 -                   params.beacon_csa.probe_resp_len)
4029 +               len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
4030 +               if (!len || (len % sizeof(u16)))
4031                         return -EINVAL;
4032
4033 -               if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
4034 -                   params.count)
4035 +               params.n_counter_offsets_presp = len / sizeof(u16);
4036 +               if (rdev->wiphy.max_num_csa_counters &&
4037 +                   (params.n_counter_offsets_beacon >
4038 +                    rdev->wiphy.max_num_csa_counters))
4039                         return -EINVAL;
4040 +
4041 +               params.counter_offsets_presp =
4042 +                       nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
4043 +
4044 +               /* sanity checks - counters should fit and be the same */
4045 +               for (i = 0; i < params.n_counter_offsets_presp; i++) {
4046 +                       u16 offset = params.counter_offsets_presp[i];
4047 +
4048 +                       if (offset >= params.beacon_csa.probe_resp_len)
4049 +                               return -EINVAL;
4050 +
4051 +                       if (params.beacon_csa.probe_resp[offset] !=
4052 +                           params.count)
4053 +                               return -EINVAL;
4054 +               }
4055         }
4056
4057  skip_beacons:
4058 @@ -7793,6 +7833,27 @@ static int nl80211_tx_mgmt(struct sk_buf
4059         if (!chandef.chan && params.offchan)
4060                 return -EINVAL;
4061
4062 +       params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
4063 +       params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
4064 +
4065 +       if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
4066 +               int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
4067 +               int i;
4068 +
4069 +               if (len % sizeof(u16))
4070 +                       return -EINVAL;
4071 +
4072 +               params.n_csa_offsets = len / sizeof(u16);
4073 +               params.csa_offsets =
4074 +                       nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
4075 +
4076 +               /* check that all the offsets fit the frame */
4077 +               for (i = 0; i < params.n_csa_offsets; i++) {
4078 +                       if (params.csa_offsets[i] >= params.len)
4079 +                               return -EINVAL;
4080 +               }
4081 +       }
4082 +
4083         if (!params.dont_wait_for_ack) {
4084                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4085                 if (!msg)
4086 @@ -7807,8 +7868,6 @@ static int nl80211_tx_mgmt(struct sk_buf
4087                 }
4088         }
4089
4090 -       params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
4091 -       params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
4092         params.chan = chandef.chan;
4093         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
4094         if (err)
4095 @@ -8507,6 +8566,8 @@ static int nl80211_set_wowlan(struct sk_
4096
4097                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
4098                                     rem) {
4099 +                       u8 *mask_pat;
4100 +
4101                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
4102                                   nla_len(pat), NULL);
4103                         err = -EINVAL;
4104 @@ -8530,19 +8591,18 @@ static int nl80211_set_wowlan(struct sk_
4105                                 goto error;
4106                         new_triggers.patterns[i].pkt_offset = pkt_offset;
4107
4108 -                       new_triggers.patterns[i].mask =
4109 -                               kmalloc(mask_len + pat_len, GFP_KERNEL);
4110 -                       if (!new_triggers.patterns[i].mask) {
4111 +                       mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
4112 +                       if (!mask_pat) {
4113                                 err = -ENOMEM;
4114                                 goto error;
4115                         }
4116 -                       new_triggers.patterns[i].pattern =
4117 -                               new_triggers.patterns[i].mask + mask_len;
4118 -                       memcpy(new_triggers.patterns[i].mask,
4119 -                              nla_data(pat_tb[NL80211_PKTPAT_MASK]),
4120 +                       new_triggers.patterns[i].mask = mask_pat;
4121 +                       memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
4122                                mask_len);
4123 +                       mask_pat += mask_len;
4124 +                       new_triggers.patterns[i].pattern = mask_pat;
4125                         new_triggers.patterns[i].pattern_len = pat_len;
4126 -                       memcpy(new_triggers.patterns[i].pattern,
4127 +                       memcpy(mask_pat,
4128                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
4129                                pat_len);
4130                         i++;
4131 @@ -8735,6 +8795,8 @@ static int nl80211_parse_coalesce_rule(s
4132
4133         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
4134                             rem) {
4135 +               u8 *mask_pat;
4136 +
4137                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
4138                           nla_len(pat), NULL);
4139                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
4140 @@ -8756,17 +8818,19 @@ static int nl80211_parse_coalesce_rule(s
4141                         return -EINVAL;
4142                 new_rule->patterns[i].pkt_offset = pkt_offset;
4143
4144 -               new_rule->patterns[i].mask =
4145 -                       kmalloc(mask_len + pat_len, GFP_KERNEL);
4146 -               if (!new_rule->patterns[i].mask)
4147 +               mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
4148 +               if (!mask_pat)
4149                         return -ENOMEM;
4150 -               new_rule->patterns[i].pattern =
4151 -                       new_rule->patterns[i].mask + mask_len;
4152 -               memcpy(new_rule->patterns[i].mask,
4153 -                      nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
4154 +
4155 +               new_rule->patterns[i].mask = mask_pat;
4156 +               memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
4157 +                      mask_len);
4158 +
4159 +               mask_pat += mask_len;
4160 +               new_rule->patterns[i].pattern = mask_pat;
4161                 new_rule->patterns[i].pattern_len = pat_len;
4162 -               memcpy(new_rule->patterns[i].pattern,
4163 -                      nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
4164 +               memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
4165 +                      pat_len);
4166                 i++;
4167         }
4168
4169 --- a/net/wireless/sme.c
4170 +++ b/net/wireless/sme.c
4171 @@ -149,7 +149,8 @@ static int cfg80211_conn_do_work(struct
4172         case CFG80211_CONN_SCAN_AGAIN:
4173                 return cfg80211_conn_scan(wdev);
4174         case CFG80211_CONN_AUTHENTICATE_NEXT:
4175 -               BUG_ON(!rdev->ops->auth);
4176 +               if (WARN_ON(!rdev->ops->auth))
4177 +                       return -EOPNOTSUPP;
4178                 wdev->conn->state = CFG80211_CONN_AUTHENTICATING;
4179                 return cfg80211_mlme_auth(rdev, wdev->netdev,
4180                                           params->channel, params->auth_type,
4181 @@ -161,7 +162,8 @@ static int cfg80211_conn_do_work(struct
4182         case CFG80211_CONN_AUTH_FAILED:
4183                 return -ENOTCONN;
4184         case CFG80211_CONN_ASSOCIATE_NEXT:
4185 -               BUG_ON(!rdev->ops->assoc);
4186 +               if (WARN_ON(!rdev->ops->assoc))
4187 +                       return -EOPNOTSUPP;
4188                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
4189                 if (wdev->conn->prev_bssid_valid)
4190                         req.prev_bssid = wdev->conn->prev_bssid;
4191 @@ -877,7 +879,7 @@ void __cfg80211_disconnected(struct net_
4192  }
4193
4194  void cfg80211_disconnected(struct net_device *dev, u16 reason,
4195 -                          u8 *ie, size_t ie_len, gfp_t gfp)
4196 +                          const u8 *ie, size_t ie_len, gfp_t gfp)
4197  {
4198         struct wireless_dev *wdev = dev->ieee80211_ptr;
4199         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
4200 --- a/net/wireless/trace.h
4201 +++ b/net/wireless/trace.h
4202 @@ -1876,29 +1876,33 @@ TRACE_EVENT(rdev_channel_switch,
4203                 WIPHY_ENTRY
4204                 NETDEV_ENTRY
4205                 CHAN_DEF_ENTRY
4206 -               __field(u16, counter_offset_beacon)
4207 -               __field(u16, counter_offset_presp)
4208                 __field(bool, radar_required)
4209                 __field(bool, block_tx)
4210                 __field(u8, count)
4211 +               __dynamic_array(u16, bcn_ofs, params->n_counter_offsets_beacon)
4212 +               __dynamic_array(u16, pres_ofs, params->n_counter_offsets_presp)
4213         ),
4214         TP_fast_assign(
4215                 WIPHY_ASSIGN;
4216                 NETDEV_ASSIGN;
4217                 CHAN_DEF_ASSIGN(&params->chandef);
4218 -               __entry->counter_offset_beacon = params->counter_offset_beacon;
4219 -               __entry->counter_offset_presp = params->counter_offset_presp;
4220                 __entry->radar_required = params->radar_required;
4221                 __entry->block_tx = params->block_tx;
4222                 __entry->count = params->count;
4223 +               memcpy(__get_dynamic_array(bcn_ofs),
4224 +                      params->counter_offsets_beacon,
4225 +                      params->n_counter_offsets_beacon * sizeof(u16));
4226 +
4227 +               /* probe response offsets are optional */
4228 +               if (params->n_counter_offsets_presp)
4229 +                       memcpy(__get_dynamic_array(pres_ofs),
4230 +                              params->counter_offsets_presp,
4231 +                              params->n_counter_offsets_presp * sizeof(u16));
4232         ),
4233         TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT
4234 -                 ", block_tx: %d, count: %u, radar_required: %d"
4235 -                 ", counter offsets (beacon/presp): %u/%u",
4236 +                 ", block_tx: %d, count: %u, radar_required: %d",
4237                   WIPHY_PR_ARG, NETDEV_PR_ARG, CHAN_DEF_PR_ARG,
4238 -                 __entry->block_tx, __entry->count, __entry->radar_required,
4239 -                 __entry->counter_offset_beacon,
4240 -                 __entry->counter_offset_presp)
4241 +                 __entry->block_tx, __entry->count, __entry->radar_required)
4242  );
4243
4244  TRACE_EVENT(rdev_set_qos_map,
4245 @@ -2636,6 +2640,21 @@ TRACE_EVENT(cfg80211_ft_event,
4246                   WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(target_ap))
4247  );
4248
4249 +TRACE_EVENT(cfg80211_stop_iface,
4250 +       TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
4251 +       TP_ARGS(wiphy, wdev),
4252 +       TP_STRUCT__entry(
4253 +               WIPHY_ENTRY
4254 +               WDEV_ENTRY
4255 +       ),
4256 +       TP_fast_assign(
4257 +               WIPHY_ASSIGN;
4258 +               WDEV_ASSIGN;
4259 +       ),
4260 +       TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT,
4261 +                 WIPHY_PR_ARG, WDEV_PR_ARG)
4262 +);
4263 +
4264  #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
4265
4266  #undef TRACE_INCLUDE_PATH
4267 --- a/net/wireless/util.c
4268 +++ b/net/wireless/util.c
4269 @@ -476,7 +476,8 @@ int ieee80211_data_to_8023(struct sk_buf
4270  EXPORT_SYMBOL(ieee80211_data_to_8023);
4271
4272  int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
4273 -                            enum nl80211_iftype iftype, u8 *bssid, bool qos)
4274 +                            enum nl80211_iftype iftype,
4275 +                            const u8 *bssid, bool qos)
4276  {
4277         struct ieee80211_hdr hdr;
4278         u16 hdrlen, ethertype;
4279 @@ -839,6 +840,9 @@ void cfg80211_process_wdev_events(struct
4280                         __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid,
4281                                                ev->ij.channel);
4282                         break;
4283 +               case EVENT_STOPPED:
4284 +                       __cfg80211_leave(wiphy_to_rdev(wdev->wiphy), wdev);
4285 +                       break;
4286                 }
4287                 wdev_unlock(wdev);
4288
4289 @@ -1271,10 +1275,20 @@ int cfg80211_iter_combinations(struct wi
4290                                             void *data),
4291                                void *data)
4292  {
4293 +       const struct ieee80211_regdomain *regdom;
4294 +       enum nl80211_dfs_regions region = 0;
4295         int i, j, iftype;
4296         int num_interfaces = 0;
4297         u32 used_iftypes = 0;
4298
4299 +       if (radar_detect) {
4300 +               rcu_read_lock();
4301 +               regdom = rcu_dereference(cfg80211_regdomain);
4302 +               if (regdom)
4303 +                       region = regdom->dfs_region;
4304 +               rcu_read_unlock();
4305 +       }
4306 +
4307         for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
4308                 num_interfaces += iftype_num[iftype];
4309                 if (iftype_num[iftype] > 0 &&
4310 @@ -1315,6 +1329,10 @@ int cfg80211_iter_combinations(struct wi
4311                 if (radar_detect != (c->radar_detect_widths & radar_detect))
4312                         goto cont;
4313
4314 +               if (radar_detect && c->radar_detect_regions &&
4315 +                   !(c->radar_detect_regions & BIT(region)))
4316 +                       goto cont;
4317 +
4318                 /* Finally check that all iftypes that we're currently
4319                  * using are actually part of this combination. If they
4320                  * aren't then we can't use this combination and have
4321 --- a/drivers/net/wireless/ath/ath9k/recv.c
4322 +++ b/drivers/net/wireless/ath/ath9k/recv.c
4323 @@ -34,7 +34,8 @@ static inline bool ath9k_check_auto_slee
4324   * buffer (or rx fifo). This can incorrectly acknowledge packets
4325   * to a sender if last desc is self-linked.
4326   */
4327 -static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf)
4328 +static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf,
4329 +                           bool flush)
4330  {
4331         struct ath_hw *ah = sc->sc_ah;
4332         struct ath_common *common = ath9k_hw_common(ah);
4333 @@ -59,18 +60,19 @@ static void ath_rx_buf_link(struct ath_s
4334                              common->rx_bufsize,
4335                              0);
4336
4337 -       if (sc->rx.rxlink == NULL)
4338 -               ath9k_hw_putrxbuf(ah, bf->bf_daddr);
4339 -       else
4340 +       if (sc->rx.rxlink)
4341                 *sc->rx.rxlink = bf->bf_daddr;
4342 +       else if (!flush)
4343 +               ath9k_hw_putrxbuf(ah, bf->bf_daddr);
4344
4345         sc->rx.rxlink = &ds->ds_link;
4346  }
4347
4348 -static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf)
4349 +static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf,
4350 +                             bool flush)
4351  {
4352         if (sc->rx.buf_hold)
4353 -               ath_rx_buf_link(sc, sc->rx.buf_hold);
4354 +               ath_rx_buf_link(sc, sc->rx.buf_hold, flush);
4355
4356         sc->rx.buf_hold = bf;
4357  }
4358 @@ -442,7 +444,7 @@ int ath_startrecv(struct ath_softc *sc)
4359         sc->rx.buf_hold = NULL;
4360         sc->rx.rxlink = NULL;
4361         list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
4362 -               ath_rx_buf_link(sc, bf);
4363 +               ath_rx_buf_link(sc, bf, false);
4364         }
4365
4366         /* We could have deleted elements so the list may be empty now */
4367 @@ -1118,12 +1120,12 @@ requeue_drop_frag:
4368  requeue:
4369                 list_add_tail(&bf->list, &sc->rx.rxbuf);
4370
4371 -               if (edma) {
4372 -                       ath_rx_edma_buf_link(sc, qtype);
4373 -               } else {
4374 -                       ath_rx_buf_relink(sc, bf);
4375 +               if (!edma) {
4376 +                       ath_rx_buf_relink(sc, bf, flush);
4377                         if (!flush)
4378                                 ath9k_hw_rxena(ah);
4379 +               } else if (!flush) {
4380 +                       ath_rx_edma_buf_link(sc, qtype);
4381                 }
4382
4383                 if (!budget--)