Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull more networking updates from David Miller:
 "Ok, everything from here on out will be bug fixes."

1) One final sync of wireless and bluetooth stuff from John Linville.
   These changes have all been in his tree for more than a week, and
   therefore have had the necessary -next exposure.  John was just away
   on a trip and didn't have a change to send the pull request until a
   day or two ago.

2) Put back some defines in user exposed header file areas that were
   removed during the tokenring purge.  From Stephen Hemminger and Paul
   Gortmaker.

3) A bug fix for UDP hash table allocation got lost in the pile due to
   one of those "you got it..  no I've got it.." situations.  :-)

   From Tim Bird.

4) SKB coalescing in TCP needs to have stricter checks, otherwise we'll
   try to coalesce overlapping frags and crash.  Fix from Eric Dumazet.

5) RCU routing table lookups can race with free_fib_info(), causing
   crashes when we deref the device pointers in the route.  Fix by
   releasing the net device in the RCU callback.  From Yanmin Zhang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (293 commits)
  tcp: take care of overlaps in tcp_try_coalesce()
  ipv4: fix the rcu race between free_fib_info and ip_route_output_slow
  mm: add a low limit to alloc_large_system_hash
  ipx: restore token ring define to include/linux/ipx.h
  if: restore token ring ARP type to header
  xen: do not disable netfront in dom0
  phy/micrel: Fix ID of KSZ9021
  mISDN: Add X-Tensions USB ISDN TA XC-525
  gianfar:don't add FCB length to hard_header_len
  Bluetooth: Report proper error number in disconnection
  Bluetooth: Create flags for bt_sk()
  Bluetooth: report the right security level in getsockopt
  Bluetooth: Lock the L2CAP channel when sending
  Bluetooth: Restore locking semantics when looking up L2CAP channels
  Bluetooth: Fix a redundant and problematic incoming MTU check
  Bluetooth: Add support for Foxconn/Hon Hai AR5BBU22 0489:E03C
  Bluetooth: Fix EIR data generation for mgmt_device_found
  Bluetooth: Fix Inquiry with RSSI event mask
  Bluetooth: improve readability of l2cap_seq_list code
  Bluetooth: Fix skb length calculation
  ...

11 files changed, 184 insertions, 72 deletions

diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index a65910bda381..961669b648fd 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -163,6 +163,11 @@ typedef struct {
         __u8 b[6];
 } __packed bdaddr_t;
 
+/* BD Address type */
+#define BDADDR_BREDR            0x00
+#define BDADDR_LE_PUBLIC        0x01
+#define BDADDR_LE_RANDOM        0x02
+
 #define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0}})
 #define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff}})
 
@@ -178,7 +183,6 @@ static inline void bacpy(bdaddr_t *dst, bdaddr_t *src)
 
 void baswap(bdaddr_t *dst, bdaddr_t *src);
 char *batostr(bdaddr_t *ba);
-bdaddr_t *strtoba(char *str);
 
 /* Common socket structures and functions */
 
@@ -190,8 +194,12 @@ struct bt_sock {
         bdaddr_t    dst;
         struct list_head accept_q;
         struct sock *parent;
-        u32 defer_setup;
-        bool suspended;
+        unsigned long flags;
+};
+
+enum {
+        BT_SK_DEFER_SETUP,
+        BT_SK_SUSPEND,
 };
 
 struct bt_sock_list {
@@ -216,14 +224,24 @@ void bt_accept_unlink(struct sock *sk);
 struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
 
 /* Skb helpers */
+struct l2cap_ctrl {
+        unsigned int    sframe  : 1,
+                        poll    : 1,
+                        final   : 1,
+                        fcs     : 1,
+                        sar     : 2,
+                        super   : 2;
+        __u16           reqseq;
+        __u16           txseq;
+        __u8            retries;
+};
+
 struct bt_skb_cb {
         __u8 pkt_type;
         __u8 incoming;
         __u16 expect;
-        __u16 tx_seq;
-        __u8 retries;
-        __u8 sar;
         __u8 force_active;
+        struct l2cap_ctrl control;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
 
@@ -243,12 +261,10 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk,
 {
         struct sk_buff *skb;
 
-        release_sock(sk);
         if ((skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err))) {
                 skb_reserve(skb, BT_SKB_RESERVE);
                 bt_cb(skb)->incoming  = 0;
         }
-        lock_sock(sk);
 
         if (!skb && *err)
                 return NULL;
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index d47e523c9d83..66a7b579e31c 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -102,6 +102,7 @@ enum {
         HCI_DISCOVERABLE,
         HCI_LINK_SECURITY,
         HCI_PENDING_CLASS,
+        HCI_PERIODIC_INQ,
 };
 
 /* HCI ioctl defines */
@@ -324,6 +325,8 @@ struct hci_cp_inquiry {
 
 #define HCI_OP_INQUIRY_CANCEL           0x0402
 
+#define HCI_OP_PERIODIC_INQ             0x0403
+
 #define HCI_OP_EXIT_PERIODIC_INQ        0x0404
 
 #define HCI_OP_CREATE_CONN              0x0405
@@ -717,6 +720,10 @@ struct hci_rp_read_local_oob_data {
 } __packed;
 
 #define HCI_OP_READ_INQ_RSP_TX_POWER    0x0c58
+struct hci_rp_read_inq_rsp_tx_power {
+        __u8     status;
+        __s8     tx_power;
+} __packed;
 
 #define HCI_OP_READ_FLOW_CONTROL_MODE   0x0c66
 struct hci_rp_read_flow_control_mode {
@@ -1431,6 +1438,5 @@ struct hci_inquiry_req {
 #define IREQ_CACHE_FLUSH 0x0001
 
 extern bool enable_hs;
-extern bool enable_le;
 
 #endif /* __HCI_H */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index db1c5df45224..9fc7728f94e4 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -155,9 +155,14 @@ struct hci_dev {
         __u16           hci_rev;
         __u8            lmp_ver;
         __u16           manufacturer;
-        __le16          lmp_subver;
+        __u16           lmp_subver;
         __u16           voice_setting;
         __u8            io_capability;
+        __s8            inq_tx_power;
+        __u16           devid_source;
+        __u16           devid_vendor;
+        __u16           devid_product;
+        __u16           devid_version;
 
         __u16           pkt_type;
         __u16           esco_type;
@@ -250,9 +255,6 @@ struct hci_dev {
 
         struct list_head        remote_oob_data;
 
-        struct list_head        adv_entries;
-        struct delayed_work     adv_work;
-
         struct hci_dev_stats    stat;
 
         struct sk_buff_head     driver_init;
@@ -263,7 +265,6 @@ struct hci_dev {
 
         struct dentry           *debugfs;
 
-        struct device           *parent;
         struct device           dev;
 
         struct rfkill           *rfkill;
@@ -571,7 +572,7 @@ int hci_chan_del(struct hci_chan *chan);
 void hci_chan_list_flush(struct hci_conn *conn);
 
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
-                                                __u8 sec_level, __u8 auth_type);
+                             __u8 dst_type, __u8 sec_level, __u8 auth_type);
 int hci_conn_check_link_mode(struct hci_conn *conn);
 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type);
@@ -673,8 +674,8 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                      bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
 int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
-                int new_key, u8 authenticated, u8 tk[16], u8 enc_size, u16 ediv,
-                u8 rand[8]);
+                int new_key, u8 authenticated, u8 tk[16], u8 enc_size,
+                __le16 ediv, u8 rand[8]);
 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                      u8 addr_type);
 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr);
@@ -688,14 +689,6 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
                                                                 u8 *randomizer);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
-#define ADV_CLEAR_TIMEOUT (3*60*HZ) /* Three minutes */
-int hci_adv_entries_clear(struct hci_dev *hdev);
-struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr);
-int hci_add_adv_entry(struct hci_dev *hdev,
-                                        struct hci_ev_le_advertising_info *ev);
-
-void hci_del_off_timer(struct hci_dev *hdev);
-
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
 
 int hci_recv_frame(struct sk_buff *skb);
@@ -709,7 +702,7 @@ void hci_conn_init_sysfs(struct hci_conn *conn);
 void hci_conn_add_sysfs(struct hci_conn *conn);
 void hci_conn_del_sysfs(struct hci_conn *conn);
 
-#define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->parent = (pdev))
+#define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->dev.parent = (pdev))
 
 /* ----- LMP capabilities ----- */
 #define lmp_rswitch_capable(dev)   ((dev)->features[0] & LMP_RSWITCH)
@@ -933,6 +926,23 @@ static inline bool eir_has_data_type(u8 *data, size_t data_len, u8 type)
         return false;
 }
 
+static inline size_t eir_get_length(u8 *eir, size_t eir_len)
+{
+        size_t parsed = 0;
+
+        while (parsed < eir_len) {
+                u8 field_len = eir[0];
+
+                if (field_len == 0)
+                        return parsed;
+
+                parsed += field_len + 1;
+                eir += field_len + 1;
+        }
+
+        return eir_len;
+}
+
 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
                                   u8 data_len)
 {
@@ -961,17 +971,12 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb);
 void hci_sock_dev_event(struct hci_dev *hdev, int event);
 
 /* Management interface */
-#define MGMT_ADDR_BREDR                 0x00
-#define MGMT_ADDR_LE_PUBLIC             0x01
-#define MGMT_ADDR_LE_RANDOM             0x02
-#define MGMT_ADDR_INVALID               0xff
-
-#define DISCOV_TYPE_BREDR               (BIT(MGMT_ADDR_BREDR))
-#define DISCOV_TYPE_LE                  (BIT(MGMT_ADDR_LE_PUBLIC) | \
-                                                BIT(MGMT_ADDR_LE_RANDOM))
-#define DISCOV_TYPE_INTERLEAVED         (BIT(MGMT_ADDR_BREDR) | \
-                                                BIT(MGMT_ADDR_LE_PUBLIC) | \
-                                                BIT(MGMT_ADDR_LE_RANDOM))
+#define DISCOV_TYPE_BREDR               (BIT(BDADDR_BREDR))
+#define DISCOV_TYPE_LE                  (BIT(BDADDR_LE_PUBLIC) | \
+                                         BIT(BDADDR_LE_RANDOM))
+#define DISCOV_TYPE_INTERLEAVED         (BIT(BDADDR_BREDR) | \
+                                         BIT(BDADDR_LE_PUBLIC) | \
+                                         BIT(BDADDR_LE_RANDOM))
 
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
 int mgmt_index_added(struct hci_dev *hdev);
@@ -1067,12 +1072,12 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
                                                         __u8 ltk[16]);
-void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]);
-void hci_le_ltk_neg_reply(struct hci_conn *conn);
-
 int hci_do_inquiry(struct hci_dev *hdev, u8 length);
 int hci_cancel_inquiry(struct hci_dev *hdev);
 int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
                 int timeout);
+int hci_cancel_le_scan(struct hci_dev *hdev);
+
+u8 bdaddr_to_le(u8 bdaddr_type);
 
 #endif /* __HCI_CORE_H */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 9b242c6bf55b..1c7d1cd5e679 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -44,6 +44,7 @@
 #define L2CAP_DEFAULT_MAX_SDU_SIZE      0xFFFF
 #define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
 #define L2CAP_DEFAULT_ACC_LAT           0xFFFFFFFF
+#define L2CAP_BREDR_MAX_PAYLOAD         1019    /* 3-DH5 packet */
 
 #define L2CAP_DISC_TIMEOUT              msecs_to_jiffies(100)
 #define L2CAP_DISC_REJ_TIMEOUT          msecs_to_jiffies(5000)
@@ -57,6 +58,7 @@ struct sockaddr_l2 {
         __le16          l2_psm;
         bdaddr_t        l2_bdaddr;
         __le16          l2_cid;
+        __u8            l2_bdaddr_type;
 };
 
 /* L2CAP socket options */
@@ -139,6 +141,8 @@ struct l2cap_conninfo {
 
 #define L2CAP_CTRL_TXSEQ_SHIFT          1
 #define L2CAP_CTRL_SUPER_SHIFT          2
+#define L2CAP_CTRL_POLL_SHIFT           4
+#define L2CAP_CTRL_FINAL_SHIFT          7
 #define L2CAP_CTRL_REQSEQ_SHIFT         8
 #define L2CAP_CTRL_SAR_SHIFT            14
 
@@ -152,9 +156,11 @@ struct l2cap_conninfo {
 #define L2CAP_EXT_CTRL_FINAL            0x00000002
 #define L2CAP_EXT_CTRL_FRAME_TYPE       0x00000001 /* I- or S-Frame */
 
+#define L2CAP_EXT_CTRL_FINAL_SHIFT      1
 #define L2CAP_EXT_CTRL_REQSEQ_SHIFT     2
 #define L2CAP_EXT_CTRL_SAR_SHIFT        16
 #define L2CAP_EXT_CTRL_SUPER_SHIFT      16
+#define L2CAP_EXT_CTRL_POLL_SHIFT       18
 #define L2CAP_EXT_CTRL_TXSEQ_SHIFT      18
 
 /* L2CAP Supervisory Function */
@@ -186,6 +192,8 @@ struct l2cap_hdr {
 #define L2CAP_FCS_SIZE          2
 #define L2CAP_SDULEN_SIZE       2
 #define L2CAP_PSMLEN_SIZE       2
+#define L2CAP_ENH_CTRL_SIZE     2
+#define L2CAP_EXT_CTRL_SIZE     4
 
 struct l2cap_cmd_hdr {
         __u8       code;
@@ -401,6 +409,16 @@ struct l2cap_conn_param_update_rsp {
 #define L2CAP_CONN_PARAM_REJECTED       0x0001
 
 /* ----- L2CAP channels and connections ----- */
+struct l2cap_seq_list {
+        __u16   head;
+        __u16   tail;
+        __u16   mask;
+        __u16   *list;
+};
+
+#define L2CAP_SEQ_LIST_CLEAR    0xFFFF
+#define L2CAP_SEQ_LIST_TAIL     0x8000
+
 struct srej_list {
         __u16   tx_seq;
         struct list_head list;
@@ -446,6 +464,9 @@ struct l2cap_chan {
         __u16           monitor_timeout;
         __u16           mps;
 
+        __u8            tx_state;
+        __u8            rx_state;
+
         unsigned long   conf_state;
         unsigned long   conn_state;
         unsigned long   flags;
@@ -456,9 +477,11 @@ struct l2cap_chan {
         __u16           buffer_seq;
         __u16           buffer_seq_srej;
         __u16           srej_save_reqseq;
+        __u16           last_acked_seq;
         __u16           frames_sent;
         __u16           unacked_frames;
         __u8            retry_count;
+        __u16           srej_queue_next;
         __u8            num_acked;
         __u16           sdu_len;
         struct sk_buff  *sdu;
@@ -490,6 +513,8 @@ struct l2cap_chan {
         struct sk_buff          *tx_send_head;
         struct sk_buff_head     tx_q;
         struct sk_buff_head     srej_q;
+        struct l2cap_seq_list   srej_list;
+        struct l2cap_seq_list   retrans_list;
         struct list_head        srej_l;
 
         struct list_head        list;
@@ -508,8 +533,7 @@ struct l2cap_ops {
         void                    (*close) (void *data);
         void                    (*state_change) (void *data, int state);
         struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
-                                        unsigned long len, int nb, int *err);
-
+                                               unsigned long len, int nb);
 };
 
 struct l2cap_conn {
@@ -600,6 +624,44 @@ enum {
         FLAG_EFS_ENABLE,
 };
 
+enum {
+        L2CAP_TX_STATE_XMIT,
+        L2CAP_TX_STATE_WAIT_F,
+};
+
+enum {
+        L2CAP_RX_STATE_RECV,
+        L2CAP_RX_STATE_SREJ_SENT,
+};
+
+enum {
+        L2CAP_TXSEQ_EXPECTED,
+        L2CAP_TXSEQ_EXPECTED_SREJ,
+        L2CAP_TXSEQ_UNEXPECTED,
+        L2CAP_TXSEQ_UNEXPECTED_SREJ,
+        L2CAP_TXSEQ_DUPLICATE,
+        L2CAP_TXSEQ_DUPLICATE_SREJ,
+        L2CAP_TXSEQ_INVALID,
+        L2CAP_TXSEQ_INVALID_IGNORE,
+};
+
+enum {
+        L2CAP_EV_DATA_REQUEST,
+        L2CAP_EV_LOCAL_BUSY_DETECTED,
+        L2CAP_EV_LOCAL_BUSY_CLEAR,
+        L2CAP_EV_RECV_REQSEQ_AND_FBIT,
+        L2CAP_EV_RECV_FBIT,
+        L2CAP_EV_RETRANS_TO,
+        L2CAP_EV_MONITOR_TO,
+        L2CAP_EV_EXPLICIT_POLL,
+        L2CAP_EV_RECV_IFRAME,
+        L2CAP_EV_RECV_RR,
+        L2CAP_EV_RECV_REJ,
+        L2CAP_EV_RECV_RNR,
+        L2CAP_EV_RECV_SREJ,
+        L2CAP_EV_RECV_FRAME,
+};
+
 static inline void l2cap_chan_hold(struct l2cap_chan *c)
 {
         atomic_inc(&c->refcnt);
@@ -622,21 +684,26 @@ static inline void l2cap_chan_unlock(struct l2cap_chan *chan)
 }
 
 static inline void l2cap_set_timer(struct l2cap_chan *chan,
-                                        struct delayed_work *work, long timeout)
+                                   struct delayed_work *work, long timeout)
 {
         BT_DBG("chan %p state %s timeout %ld", chan,
-                                        state_to_string(chan->state), timeout);
+               state_to_string(chan->state), timeout);
 
+        /* If delayed work cancelled do not hold(chan)
+           since it is already done with previous set_timer */
         if (!cancel_delayed_work(work))
                 l2cap_chan_hold(chan);
+
         schedule_delayed_work(work, timeout);
 }
 
 static inline bool l2cap_clear_timer(struct l2cap_chan *chan,
-                                        struct delayed_work *work)
+                                     struct delayed_work *work)
 {
         bool ret;
 
+        /* put(chan) if delayed work cancelled otherwise it
+           is done in delayed work function */
         ret = cancel_delayed_work(work);
         if (ret)
                 l2cap_chan_put(chan);
@@ -658,13 +725,10 @@ static inline bool l2cap_clear_timer(struct l2cap_chan *chan,
 
 static inline int __seq_offset(struct l2cap_chan *chan, __u16 seq1, __u16 seq2)
 {
-        int offset;
-
-        offset = (seq1 - seq2) % (chan->tx_win_max + 1);
-        if (offset < 0)
-                offset += (chan->tx_win_max + 1);
-
-        return offset;
+        if (seq1 >= seq2)
+                return seq1 - seq2;
+        else
+                return chan->tx_win_max + 1 - seq2 + seq1;
 }
 
 static inline __u16 __next_seq(struct l2cap_chan *chan, __u16 seq)
@@ -852,14 +916,15 @@ int __l2cap_wait_ack(struct sock *sk);
 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm);
 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
 
-struct l2cap_chan *l2cap_chan_create(struct sock *sk);
+struct l2cap_chan *l2cap_chan_create(void);
 void l2cap_chan_close(struct l2cap_chan *chan, int reason);
 void l2cap_chan_destroy(struct l2cap_chan *chan);
 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
-                                                                bdaddr_t *dst);
+                       bdaddr_t *dst, u8 dst_type);
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
                                                                 u32 priority);
 void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
 int l2cap_chan_check_security(struct l2cap_chan *chan);
+void l2cap_chan_set_defaults(struct l2cap_chan *chan);
 
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index ebfd91fc20f8..23fd0546fccb 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -341,6 +341,15 @@ struct mgmt_cp_unblock_device {
 } __packed;
 #define MGMT_UNBLOCK_DEVICE_SIZE        MGMT_ADDR_INFO_SIZE
 
+#define MGMT_OP_SET_DEVICE_ID           0x0028
+struct mgmt_cp_set_device_id {
+        __le16  source;
+        __le16  vendor;
+        __le16  product;
+        __le16  version;
+} __packed;
+#define MGMT_SET_DEVICE_ID_SIZE         8
+
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
         __le16  opcode;
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
index 7b3acdd29134..ca356a734920 100644
--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -77,7 +77,7 @@ struct smp_cmd_encrypt_info {
 
 #define SMP_CMD_MASTER_IDENT    0x07
 struct smp_cmd_master_ident {
-        __u16   ediv;
+        __le16  ediv;
         __u8    rand[8];
 } __packed;
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index adb2320bccdf..0289d4ce7070 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -3365,9 +3365,9 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
  * @chan: main channel
  * @channel_type: HT mode
  */
-int cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
-                                 struct ieee80211_channel *chan,
-                                 enum nl80211_channel_type channel_type);
+bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
+                                  struct ieee80211_channel *chan,
+                                  enum nl80211_channel_type channel_type);
 
 /*
  * cfg80211_ch_switch_notify - update wdev channel and notify userspace
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 4d6e6c6818d0..1937c7d98304 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -667,6 +667,9 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  * @RX_FLAG_SHORT_GI: Short guard interval was used
  * @RX_FLAG_NO_SIGNAL_VAL: The signal strength value is not present.
  *      Valid only for data frames (mainly A-MPDU)
+ * @RX_FLAG_HT_GF: This frame was received in a HT-greenfield transmission, if
+ *      the driver fills this value it should add %IEEE80211_RADIOTAP_MCS_HAVE_FMT
+ *      to hw.radiotap_mcs_details to advertise that fact
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR      = 1<<0,
@@ -681,6 +684,7 @@ enum mac80211_rx_flags {
         RX_FLAG_40MHZ           = 1<<10,
         RX_FLAG_SHORT_GI        = 1<<11,
         RX_FLAG_NO_SIGNAL_VAL   = 1<<12,
+        RX_FLAG_HT_GF           = 1<<13,
 };
 
 /**
@@ -939,7 +943,7 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
  *      CCMP key if it requires CCMP encryption of management frames (MFP) to
  *      be done in software.
  * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
- *      for a CCMP key if space should be prepared for the IV, but the IV
+ *      if space should be prepared for the IV, but the IV
  *      itself should not be generated. Do not set together with
  *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
  */
@@ -1288,6 +1292,11 @@ enum ieee80211_hw_flags {
  *
  * @offchannel_tx_hw_queue: HW queue ID to use for offchannel TX
  *      (if %IEEE80211_HW_QUEUE_CONTROL is set)
+ *
+ * @radiotap_mcs_details: lists which MCS information can the HW
+ *      reports, by default it is set to _MCS, _GI and _BW but doesn't
+ *      include _FMT. Use %IEEE80211_RADIOTAP_MCS_HAVE_* values, only
+ *      adding _BW is supported today.
  */
 struct ieee80211_hw {
         struct ieee80211_conf conf;
@@ -1309,6 +1318,7 @@ struct ieee80211_hw {
         u8 max_rx_aggregation_subframes;
         u8 max_tx_aggregation_subframes;
         u8 offchannel_tx_hw_queue;
+        u8 radiotap_mcs_details;
 };
 
 /**
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index aca65a5a9d0d..4467c9460857 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -39,6 +39,8 @@ struct nfc_hci_ops {
         int (*data_exchange) (struct nfc_hci_dev *hdev,
                               struct nfc_target *target,
                               struct sk_buff *skb, struct sk_buff **res_skb);
+        int (*check_presence)(struct nfc_hci_dev *hdev,
+                              struct nfc_target *target);
 };
 
 #define NFC_HCI_MAX_CUSTOM_GATES        15
@@ -82,10 +84,6 @@ struct nfc_hci_dev {
 
         u8 gate2pipe[NFC_HCI_MAX_GATES];
 
-        bool poll_started;
-        struct nfc_target *targets;
-        int target_count;
-
         u8 sw_romlib;
         u8 sw_patch;
         u8 sw_flashlib_major;
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 9a2505a5b8de..b7ca4a2a1d72 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -48,26 +48,28 @@ struct nfc_dev;
 typedef void (*data_exchange_cb_t)(void *context, struct sk_buff *skb,
                                                                 int err);
 
+struct nfc_target;
+
 struct nfc_ops {
         int (*dev_up)(struct nfc_dev *dev);
         int (*dev_down)(struct nfc_dev *dev);
         int (*start_poll)(struct nfc_dev *dev, u32 protocols);
         void (*stop_poll)(struct nfc_dev *dev);
-        int (*dep_link_up)(struct nfc_dev *dev, int target_idx, u8 comm_mode,
-                           u8 *gb, size_t gb_len);
+        int (*dep_link_up)(struct nfc_dev *dev, struct nfc_target *target,
+                           u8 comm_mode, u8 *gb, size_t gb_len);
         int (*dep_link_down)(struct nfc_dev *dev);
-        int (*activate_target)(struct nfc_dev *dev, u32 target_idx,
+        int (*activate_target)(struct nfc_dev *dev, struct nfc_target *target,
                                u32 protocol);
-        void (*deactivate_target)(struct nfc_dev *dev, u32 target_idx);
-        int (*data_exchange)(struct nfc_dev *dev, u32 target_idx,
+        void (*deactivate_target)(struct nfc_dev *dev,
+                                  struct nfc_target *target);
+        int (*data_exchange)(struct nfc_dev *dev, struct nfc_target *target,
                              struct sk_buff *skb, data_exchange_cb_t cb,
                              void *cb_context);
-        int (*check_presence)(struct nfc_dev *dev, u32 target_idx);
+        int (*check_presence)(struct nfc_dev *dev, struct nfc_target *target);
 };
 
 #define NFC_TARGET_IDX_ANY -1
 #define NFC_MAX_GT_LEN 48
-#define NFC_TARGET_IDX_NONE 0xffffffff
 
 struct nfc_target {
         u32 idx;
@@ -95,11 +97,10 @@ struct nfc_dev {
         struct nfc_target *targets;
         int n_targets;
         int targets_generation;
-        spinlock_t targets_lock;
         struct device dev;
         bool dev_up;
         bool polling;
-        u32 activated_target_idx;
+        struct nfc_target *active_target;
         bool dep_link_up;
         u32 dep_rf_mode;
         struct nfc_genl_data genl_data;
diff --git a/include/net/nfc/shdlc.h b/include/net/nfc/shdlc.h
index 1071987d0408..ab06afd462da 100644
--- a/include/net/nfc/shdlc.h
+++ b/include/net/nfc/shdlc.h
@@ -35,6 +35,8 @@ struct nfc_shdlc_ops {
         int (*data_exchange) (struct nfc_shdlc *shdlc,
                               struct nfc_target *target,
                               struct sk_buff *skb, struct sk_buff **res_skb);
+        int (*check_presence)(struct nfc_shdlc *shdlc,
+                              struct nfc_target *target);
 };
 
 enum shdlc_state {