Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
	drivers/net/wireless/b43/dma.c
	drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c

8 files changed, 309 insertions, 271 deletions

diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 980e59f37d4f..abaad6ed9b83 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -250,32 +250,10 @@ extern void bt_sysfs_cleanup(void);
 
 extern struct dentry *bt_debugfs;
 
-#ifdef CONFIG_BT_L2CAP
 int l2cap_init(void);
 void l2cap_exit(void);
-#else
-static inline int l2cap_init(void)
-{
-        return 0;
-}
-
-static inline void l2cap_exit(void)
-{
-}
-#endif
 
-#ifdef CONFIG_BT_SCO
 int sco_init(void);
 void sco_exit(void);
-#else
-static inline int sco_init(void)
-{
-        return 0;
-}
-
-static inline void sco_exit(void)
-{
-}
-#endif
 
 #endif /* __BLUETOOTH_H */
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 67ad98430348..5b2fed5eebf2 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -210,6 +210,7 @@ enum {
 
 #define LMP_EV4         0x01
 #define LMP_EV5         0x02
+#define LMP_NO_BREDR    0x20
 #define LMP_LE          0x40
 
 #define LMP_SNIFF_SUBR  0x02
@@ -279,6 +280,10 @@ enum {
 #define HCI_ERROR_LOCAL_HOST_TERM       0x16
 #define HCI_ERROR_PAIRING_NOT_ALLOWED   0x18
 
+/* Flow control modes */
+#define HCI_FLOW_CTL_MODE_PACKET_BASED  0x00
+#define HCI_FLOW_CTL_MODE_BLOCK_BASED   0x01
+
 /* -----  HCI Commands ---- */
 #define HCI_OP_NOP                      0x0000
 
@@ -745,6 +750,14 @@ struct hci_rp_read_bd_addr {
         bdaddr_t bdaddr;
 } __packed;
 
+#define HCI_OP_READ_DATA_BLOCK_SIZE     0x100a
+struct hci_rp_read_data_block_size {
+        __u8     status;
+        __le16   max_acl_len;
+        __le16   block_len;
+        __le16   num_blocks;
+} __packed;
+
 #define HCI_OP_WRITE_PAGE_SCAN_ACTIVITY 0x0c1c
 struct hci_cp_write_page_scan_activity {
         __le16   interval;
@@ -791,6 +804,9 @@ struct hci_cp_le_set_scan_param {
         __u8    filter_policy;
 } __packed;
 
+#define LE_SCANNING_DISABLED            0x00
+#define LE_SCANNING_ENABLED             0x01
+
 #define HCI_OP_LE_SET_SCAN_ENABLE       0x200c
 struct hci_cp_le_set_scan_enable {
         __u8     enable;
@@ -966,9 +982,14 @@ struct hci_ev_role_change {
 } __packed;
 
 #define HCI_EV_NUM_COMP_PKTS            0x13
+struct hci_comp_pkts_info {
+        __le16   handle;
+        __le16   count;
+} __packed;
+
 struct hci_ev_num_comp_pkts {
         __u8     num_hndl;
-        /* variable length part */
+        struct hci_comp_pkts_info handles[0];
 } __packed;
 
 #define HCI_EV_MODE_CHANGE              0x14
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ea4395f1d260..5e2e98458496 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -28,10 +28,6 @@
 #include <linux/interrupt.h>
 #include <net/bluetooth/hci.h>
 
-/* HCI upper protocols */
-#define HCI_PROTO_L2CAP 0
-#define HCI_PROTO_SCO   1
-
 /* HCI priority */
 #define HCI_PRIO_MAX    7
 
@@ -54,25 +50,17 @@ struct inquiry_entry {
 };
 
 struct inquiry_cache {
-        spinlock_t              lock;
         __u32                   timestamp;
         struct inquiry_entry    *list;
 };
 
 struct hci_conn_hash {
         struct list_head list;
-        spinlock_t       lock;
         unsigned int     acl_num;
         unsigned int     sco_num;
         unsigned int     le_num;
 };
 
-struct hci_chan_hash {
-        struct list_head list;
-        spinlock_t       lock;
-        unsigned int     num;
-};
-
 struct bdaddr_list {
         struct list_head list;
         bdaddr_t bdaddr;
@@ -124,7 +112,7 @@ struct adv_entry {
 #define NUM_REASSEMBLY 4
 struct hci_dev {
         struct list_head list;
-        spinlock_t      lock;
+        struct mutex    lock;
         atomic_t        refcnt;
 
         char            name[8];
@@ -188,6 +176,11 @@ struct hci_dev {
         unsigned int    sco_pkts;
         unsigned int    le_pkts;
 
+        __u16           block_len;
+        __u16           block_mtu;
+        __u16           num_blocks;
+        __u16           block_cnt;
+
         unsigned long   acl_last_tx;
         unsigned long   sco_last_tx;
         unsigned long   le_last_tx;
@@ -200,10 +193,13 @@ struct hci_dev {
         __u16                   discov_timeout;
         struct delayed_work     discov_off;
 
+        struct delayed_work     service_cache;
+
         struct timer_list       cmd_timer;
-        struct tasklet_struct   cmd_task;
-        struct tasklet_struct   rx_task;
-        struct tasklet_struct   tx_task;
+
+        struct work_struct      rx_work;
+        struct work_struct      cmd_work;
+        struct work_struct      tx_work;
 
         struct sk_buff_head     rx_q;
         struct sk_buff_head     raw_q;
@@ -232,7 +228,7 @@ struct hci_dev {
         struct list_head        remote_oob_data;
 
         struct list_head        adv_entries;
-        struct timer_list       adv_timer;
+        struct delayed_work     adv_work;
 
         struct hci_dev_stats    stat;
 
@@ -301,21 +297,19 @@ struct hci_conn {
         unsigned int    sent;
 
         struct sk_buff_head data_q;
-        struct hci_chan_hash chan_hash;
+        struct list_head chan_list;
 
-        struct timer_list disc_timer;
+        struct delayed_work disc_work;
         struct timer_list idle_timer;
         struct timer_list auto_accept_timer;
 
-        struct work_struct work_add;
-        struct work_struct work_del;
-
         struct device   dev;
         atomic_t        devref;
 
         struct hci_dev  *hdev;
         void            *l2cap_data;
         void            *sco_data;
+        void            *smp_conn;
 
         struct hci_conn *link;
 
@@ -332,25 +326,31 @@ struct hci_chan {
         unsigned int    sent;
 };
 
-extern struct hci_proto *hci_proto[];
 extern struct list_head hci_dev_list;
 extern struct list_head hci_cb_list;
 extern rwlock_t hci_dev_list_lock;
 extern rwlock_t hci_cb_list_lock;
 
+/* ----- HCI interface to upper protocols ----- */
+extern int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
+extern int l2cap_connect_cfm(struct hci_conn *hcon, u8 status);
+extern int l2cap_disconn_ind(struct hci_conn *hcon);
+extern int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason);
+extern int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt);
+extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags);
+
+extern int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
+extern int sco_connect_cfm(struct hci_conn *hcon, __u8 status);
+extern int sco_disconn_cfm(struct hci_conn *hcon, __u8 reason);
+extern int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb);
+
 /* ----- Inquiry cache ----- */
 #define INQUIRY_CACHE_AGE_MAX   (HZ*30)   /* 30 seconds */
 #define INQUIRY_ENTRY_AGE_MAX   (HZ*60)   /* 60 seconds */
 
-#define inquiry_cache_lock(c)           spin_lock(&c->lock)
-#define inquiry_cache_unlock(c)         spin_unlock(&c->lock)
-#define inquiry_cache_lock_bh(c)        spin_lock_bh(&c->lock)
-#define inquiry_cache_unlock_bh(c)      spin_unlock_bh(&c->lock)
-
 static inline void inquiry_cache_init(struct hci_dev *hdev)
 {
         struct inquiry_cache *c = &hdev->inq_cache;
-        spin_lock_init(&c->lock);
         c->list = NULL;
 }
 
@@ -390,15 +390,15 @@ static inline void hci_conn_hash_init(struct hci_dev *hdev)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         INIT_LIST_HEAD(&h->list);
-        spin_lock_init(&h->lock);
         h->acl_num = 0;
         h->sco_num = 0;
+        h->le_num = 0;
 }
 
 static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
-        list_add(&c->list, &h->list);
+        list_add_rcu(&c->list, &h->list);
         switch (c->type) {
         case ACL_LINK:
                 h->acl_num++;
@@ -416,7 +416,10 @@ static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
 static inline void hci_conn_hash_del(struct hci_dev *hdev, struct hci_conn *c)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
-        list_del(&c->list);
+
+        list_del_rcu(&c->list);
+        synchronize_rcu();
+
         switch (c->type) {
         case ACL_LINK:
                 h->acl_num--;
@@ -451,14 +454,18 @@ static inline struct hci_conn *hci_conn_hash_lookup_handle(struct hci_dev *hdev,
                                                                 __u16 handle)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
-        struct list_head *p;
         struct hci_conn  *c;
 
-        list_for_each(p, &h->list) {
-                c = list_entry(p, struct hci_conn, list);
-                if (c->handle == handle)
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(c, &h->list, list) {
+                if (c->handle == handle) {
+                        rcu_read_unlock();
                         return c;
+                }
         }
+        rcu_read_unlock();
+
         return NULL;
 }
 
@@ -466,14 +473,19 @@ static inline struct hci_conn *hci_conn_hash_lookup_ba(struct hci_dev *hdev,
                                                         __u8 type, bdaddr_t *ba)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
-        struct list_head *p;
         struct hci_conn  *c;
 
-        list_for_each(p, &h->list) {
-                c = list_entry(p, struct hci_conn, list);
-                if (c->type == type && !bacmp(&c->dst, ba))
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(c, &h->list, list) {
+                if (c->type == type && !bacmp(&c->dst, ba)) {
+                        rcu_read_unlock();
                         return c;
+                }
         }
+
+        rcu_read_unlock();
+
         return NULL;
 }
 
@@ -481,37 +493,20 @@ static inline struct hci_conn *hci_conn_hash_lookup_state(struct hci_dev *hdev,
                                                         __u8 type, __u16 state)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
-        struct list_head *p;
         struct hci_conn  *c;
 
-        list_for_each(p, &h->list) {
-                c = list_entry(p, struct hci_conn, list);
-                if (c->type == type && c->state == state)
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(c, &h->list, list) {
+                if (c->type == type && c->state == state) {
+                        rcu_read_unlock();
                         return c;
+                }
         }
-        return NULL;
-}
 
-static inline void hci_chan_hash_init(struct hci_conn *c)
-{
-        struct hci_chan_hash *h = &c->chan_hash;
-        INIT_LIST_HEAD(&h->list);
-        spin_lock_init(&h->lock);
-        h->num = 0;
-}
+        rcu_read_unlock();
 
-static inline void hci_chan_hash_add(struct hci_conn *c, struct hci_chan *chan)
-{
-        struct hci_chan_hash *h = &c->chan_hash;
-        list_add(&chan->list, &h->list);
-        h->num++;
-}
-
-static inline void hci_chan_hash_del(struct hci_conn *c, struct hci_chan *chan)
-{
-        struct hci_chan_hash *h = &c->chan_hash;
-        list_del(&chan->list);
-        h->num--;
+        return NULL;
 }
 
 void hci_acl_connect(struct hci_conn *conn);
@@ -527,7 +522,7 @@ void hci_conn_check_pending(struct hci_dev *hdev);
 
 struct hci_chan *hci_chan_create(struct hci_conn *conn);
 int hci_chan_del(struct hci_chan *chan);
-void hci_chan_hash_flush(struct hci_conn *conn);
+void hci_chan_list_flush(struct hci_conn *conn);
 
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
                                                 __u8 sec_level, __u8 auth_type);
@@ -538,7 +533,6 @@ int hci_conn_change_link_key(struct hci_conn *conn);
 int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 
 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
-void hci_conn_enter_sniff_mode(struct hci_conn *conn);
 
 void hci_conn_hold_device(struct hci_conn *conn);
 void hci_conn_put_device(struct hci_conn *conn);
@@ -546,7 +540,7 @@ void hci_conn_put_device(struct hci_conn *conn);
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
         atomic_inc(&conn->refcnt);
-        del_timer(&conn->disc_timer);
+        cancel_delayed_work_sync(&conn->disc_work);
 }
 
 static inline void hci_conn_put(struct hci_conn *conn)
@@ -565,7 +559,9 @@ static inline void hci_conn_put(struct hci_conn *conn)
                 } else {
                         timeo = msecs_to_jiffies(10);
                 }
-                mod_timer(&conn->disc_timer, jiffies + timeo);
+                cancel_delayed_work_sync(&conn->disc_work);
+                queue_delayed_work(conn->hdev->workqueue,
+                                        &conn->disc_work, jiffies + timeo);
         }
 }
 
@@ -597,10 +593,8 @@ static inline struct hci_dev *__hci_dev_hold(struct hci_dev *d)
         try_module_get(d->owner) ? __hci_dev_hold(d) : NULL;    \
 })
 
-#define hci_dev_lock(d)         spin_lock(&d->lock)
-#define hci_dev_unlock(d)       spin_unlock(&d->lock)
-#define hci_dev_lock_bh(d)      spin_lock_bh(&d->lock)
-#define hci_dev_unlock_bh(d)    spin_unlock_bh(&d->lock)
+#define hci_dev_lock(d)         mutex_lock(&d->lock)
+#define hci_dev_unlock(d)       mutex_unlock(&d->lock)
 
 struct hci_dev *hci_dev_get(int index);
 struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
@@ -685,53 +679,40 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define lmp_host_le_capable(dev)   ((dev)->extfeatures[0] & LMP_HOST_LE)
 
 /* ----- HCI protocols ----- */
-struct hci_proto {
-        char            *name;
-        unsigned int    id;
-        unsigned long   flags;
-
-        void            *priv;
-
-        int (*connect_ind)      (struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                __u8 type);
-        int (*connect_cfm)      (struct hci_conn *conn, __u8 status);
-        int (*disconn_ind)      (struct hci_conn *conn);
-        int (*disconn_cfm)      (struct hci_conn *conn, __u8 reason);
-        int (*recv_acldata)     (struct hci_conn *conn, struct sk_buff *skb,
-                                                                __u16 flags);
-        int (*recv_scodata)     (struct hci_conn *conn, struct sk_buff *skb);
-        int (*security_cfm)     (struct hci_conn *conn, __u8 status,
-                                                                __u8 encrypt);
-};
-
 static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                                                 __u8 type)
 {
-        register struct hci_proto *hp;
-        int mask = 0;
-
-        hp = hci_proto[HCI_PROTO_L2CAP];
-        if (hp && hp->connect_ind)
-                mask |= hp->connect_ind(hdev, bdaddr, type);
+        switch (type) {
+        case ACL_LINK:
+                return l2cap_connect_ind(hdev, bdaddr);
 
-        hp = hci_proto[HCI_PROTO_SCO];
-        if (hp && hp->connect_ind)
-                mask |= hp->connect_ind(hdev, bdaddr, type);
+        case SCO_LINK:
+        case ESCO_LINK:
+                return sco_connect_ind(hdev, bdaddr);
 
-        return mask;
+        default:
+                BT_ERR("unknown link type %d", type);
+                return -EINVAL;
+        }
 }
 
 static inline void hci_proto_connect_cfm(struct hci_conn *conn, __u8 status)
 {
-        register struct hci_proto *hp;
+        switch (conn->type) {
+        case ACL_LINK:
+        case LE_LINK:
+                l2cap_connect_cfm(conn, status);
+                break;
 
-        hp = hci_proto[HCI_PROTO_L2CAP];
-        if (hp && hp->connect_cfm)
-                hp->connect_cfm(conn, status);
+        case SCO_LINK:
+        case ESCO_LINK:
+                sco_connect_cfm(conn, status);
+                break;
 
-        hp = hci_proto[HCI_PROTO_SCO];
-        if (hp && hp->connect_cfm)
-                hp->connect_cfm(conn, status);
+        default:
+                BT_ERR("unknown link type %d", conn->type);
+                break;
+        }
 
         if (conn->connect_cfm_cb)
                 conn->connect_cfm_cb(conn, status);
@@ -739,31 +720,29 @@ static inline void hci_proto_connect_cfm(struct hci_conn *conn, __u8 status)
 
 static inline int hci_proto_disconn_ind(struct hci_conn *conn)
 {
-        register struct hci_proto *hp;
-        int reason = HCI_ERROR_REMOTE_USER_TERM;
-
-        hp = hci_proto[HCI_PROTO_L2CAP];
-        if (hp && hp->disconn_ind)
-                reason = hp->disconn_ind(conn);
+        if (conn->type != ACL_LINK && conn->type != LE_LINK)
+                return HCI_ERROR_REMOTE_USER_TERM;
 
-        hp = hci_proto[HCI_PROTO_SCO];
-        if (hp && hp->disconn_ind)
-                reason = hp->disconn_ind(conn);
-
-        return reason;
+        return l2cap_disconn_ind(conn);
 }
 
 static inline void hci_proto_disconn_cfm(struct hci_conn *conn, __u8 reason)
 {
-        register struct hci_proto *hp;
+        switch (conn->type) {
+        case ACL_LINK:
+        case LE_LINK:
+                l2cap_disconn_cfm(conn, reason);
+                break;
 
-        hp = hci_proto[HCI_PROTO_L2CAP];
-        if (hp && hp->disconn_cfm)
-                hp->disconn_cfm(conn, reason);
+        case SCO_LINK:
+        case ESCO_LINK:
+                sco_disconn_cfm(conn, reason);
+                break;
 
-        hp = hci_proto[HCI_PROTO_SCO];
-        if (hp && hp->disconn_cfm)
-                hp->disconn_cfm(conn, reason);
+        default:
+                BT_ERR("unknown link type %d", conn->type);
+                break;
+        }
 
         if (conn->disconn_cfm_cb)
                 conn->disconn_cfm_cb(conn, reason);
@@ -771,21 +750,16 @@ static inline void hci_proto_disconn_cfm(struct hci_conn *conn, __u8 reason)
 
 static inline void hci_proto_auth_cfm(struct hci_conn *conn, __u8 status)
 {
-        register struct hci_proto *hp;
         __u8 encrypt;
 
+        if (conn->type != ACL_LINK && conn->type != LE_LINK)
+                return;
+
         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
                 return;
 
         encrypt = (conn->link_mode & HCI_LM_ENCRYPT) ? 0x01 : 0x00;
-
-        hp = hci_proto[HCI_PROTO_L2CAP];
-        if (hp && hp->security_cfm)
-                hp->security_cfm(conn, status, encrypt);
-
-        hp = hci_proto[HCI_PROTO_SCO];
-        if (hp && hp->security_cfm)
-                hp->security_cfm(conn, status, encrypt);
+        l2cap_security_cfm(conn, status, encrypt);
 
         if (conn->security_cfm_cb)
                 conn->security_cfm_cb(conn, status);
@@ -794,23 +768,15 @@ static inline void hci_proto_auth_cfm(struct hci_conn *conn, __u8 status)
 static inline void hci_proto_encrypt_cfm(struct hci_conn *conn, __u8 status,
                                                                 __u8 encrypt)
 {
-        register struct hci_proto *hp;
-
-        hp = hci_proto[HCI_PROTO_L2CAP];
-        if (hp && hp->security_cfm)
-                hp->security_cfm(conn, status, encrypt);
+        if (conn->type != ACL_LINK && conn->type != LE_LINK)
+                return;
 
-        hp = hci_proto[HCI_PROTO_SCO];
-        if (hp && hp->security_cfm)
-                hp->security_cfm(conn, status, encrypt);
+        l2cap_security_cfm(conn, status, encrypt);
 
         if (conn->security_cfm_cb)
                 conn->security_cfm_cb(conn, status);
 }
 
-int hci_register_proto(struct hci_proto *hproto);
-int hci_unregister_proto(struct hci_proto *hproto);
-
 /* ----- HCI callbacks ----- */
 struct hci_cb {
         struct list_head list;
@@ -835,13 +801,13 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
 
         encrypt = (conn->link_mode & HCI_LM_ENCRYPT) ? 0x01 : 0x00;
 
-        read_lock_bh(&hci_cb_list_lock);
+        read_lock(&hci_cb_list_lock);
         list_for_each(p, &hci_cb_list) {
                 struct hci_cb *cb = list_entry(p, struct hci_cb, list);
                 if (cb->security_cfm)
                         cb->security_cfm(conn, status, encrypt);
         }
-        read_unlock_bh(&hci_cb_list_lock);
+        read_unlock(&hci_cb_list_lock);
 }
 
 static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
@@ -857,26 +823,26 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
 
         hci_proto_encrypt_cfm(conn, status, encrypt);
 
-        read_lock_bh(&hci_cb_list_lock);
+        read_lock(&hci_cb_list_lock);
         list_for_each(p, &hci_cb_list) {
                 struct hci_cb *cb = list_entry(p, struct hci_cb, list);
                 if (cb->security_cfm)
                         cb->security_cfm(conn, status, encrypt);
         }
-        read_unlock_bh(&hci_cb_list_lock);
+        read_unlock(&hci_cb_list_lock);
 }
 
 static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
 {
         struct list_head *p;
 
-        read_lock_bh(&hci_cb_list_lock);
+        read_lock(&hci_cb_list_lock);
         list_for_each(p, &hci_cb_list) {
                 struct hci_cb *cb = list_entry(p, struct hci_cb, list);
                 if (cb->key_change_cfm)
                         cb->key_change_cfm(conn, status);
         }
-        read_unlock_bh(&hci_cb_list_lock);
+        read_unlock(&hci_cb_list_lock);
 }
 
 static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
@@ -884,13 +850,13 @@ static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
 {
         struct list_head *p;
 
-        read_lock_bh(&hci_cb_list_lock);
+        read_lock(&hci_cb_list_lock);
         list_for_each(p, &hci_cb_list) {
                 struct hci_cb *cb = list_entry(p, struct hci_cb, list);
                 if (cb->role_switch_cfm)
                         cb->role_switch_cfm(conn, status, role);
         }
-        read_unlock_bh(&hci_cb_list_lock);
+        read_unlock(&hci_cb_list_lock);
 }
 
 int hci_register_cb(struct hci_cb *hcb);
@@ -960,12 +926,16 @@ int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr);
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
 
+/* HCI socket flags */
+#define HCI_PI_MGMT_INIT        0
+
 struct hci_pinfo {
         struct bt_sock    bt;
         struct hci_dev    *hdev;
         struct hci_filter filter;
         __u32             cmsg_mask;
         unsigned short   channel;
+        unsigned long     flags;
 };
 
 /* HCI security filter */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 72632f155e43..68f589150692 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -482,10 +482,11 @@ struct l2cap_chan {
         __u32           remote_acc_lat;
         __u32           remote_flush_to;
 
-        struct timer_list       chan_timer;
-        struct timer_list       retrans_timer;
-        struct timer_list       monitor_timer;
-        struct timer_list       ack_timer;
+        struct delayed_work     chan_timer;
+        struct delayed_work     retrans_timer;
+        struct delayed_work     monitor_timer;
+        struct delayed_work     ack_timer;
+
         struct sk_buff          *tx_send_head;
         struct sk_buff_head     tx_q;
         struct sk_buff_head     srej_q;
@@ -521,7 +522,7 @@ struct l2cap_conn {
         __u8            info_state;
         __u8            info_ident;
 
-        struct timer_list info_timer;
+        struct delayed_work info_timer;
 
         spinlock_t      lock;
 
@@ -531,11 +532,11 @@ struct l2cap_conn {
 
         __u8            disc_reason;
 
-        struct timer_list security_timer;
+        struct delayed_work  security_timer;
         struct smp_chan *smp_chan;
 
         struct list_head chan_l;
-        rwlock_t        chan_lock;
+        struct mutex    chan_lock;
 };
 
 #define L2CAP_INFO_CL_MTU_REQ_SENT      0x01
@@ -594,6 +595,34 @@ enum {
         FLAG_EFS_ENABLE,
 };
 
+static inline void l2cap_chan_hold(struct l2cap_chan *c)
+{
+        atomic_inc(&c->refcnt);
+}
+
+static inline void l2cap_chan_put(struct l2cap_chan *c)
+{
+        if (atomic_dec_and_test(&c->refcnt))
+                kfree(c);
+}
+
+static inline void l2cap_set_timer(struct l2cap_chan *chan,
+                                        struct delayed_work *work, long timeout)
+{
+        BT_DBG("chan %p state %d timeout %ld", chan, chan->state, timeout);
+
+        if (!__cancel_delayed_work(work))
+                l2cap_chan_hold(chan);
+        schedule_delayed_work(work, timeout);
+}
+
+static inline void l2cap_clear_timer(struct l2cap_chan *chan,
+                                        struct delayed_work *work)
+{
+        if (__cancel_delayed_work(work))
+                l2cap_chan_put(chan);
+}
+
 #define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
 #define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
 #define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
@@ -805,7 +834,8 @@ int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
 struct l2cap_chan *l2cap_chan_create(struct sock *sk);
 void l2cap_chan_close(struct l2cap_chan *chan, int reason);
 void l2cap_chan_destroy(struct l2cap_chan *chan);
-int l2cap_chan_connect(struct l2cap_chan *chan);
+inline int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
+                                                                bdaddr_t *dst);
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
                                                                 u32 priority);
 void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 3b6880690a78..be65d3417883 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -61,22 +61,29 @@ struct mgmt_rp_read_index_list {
 /* Reserve one extra byte for names in management messages so that they
  * are always guaranteed to be nul-terminated */
 #define MGMT_MAX_NAME_LENGTH            (HCI_MAX_NAME_LENGTH + 1)
+#define MGMT_MAX_SHORT_NAME_LENGTH      (10 + 1)
+
+#define MGMT_SETTING_POWERED            0x00000001
+#define MGMT_SETTING_CONNECTABLE        0x00000002
+#define MGMT_SETTING_FAST_CONNECTABLE   0x00000004
+#define MGMT_SETTING_DISCOVERABLE       0x00000008
+#define MGMT_SETTING_PAIRABLE           0x00000010
+#define MGMT_SETTING_LINK_SECURITY      0x00000020
+#define MGMT_SETTING_SSP                0x00000040
+#define MGMT_SETTING_BREDR              0x00000080
+#define MGMT_SETTING_HS                 0x00000100
+#define MGMT_SETTING_LE                 0x00000200
 
 #define MGMT_OP_READ_INFO               0x0004
 struct mgmt_rp_read_info {
-        __u8 type;
-        __u8 powered;
-        __u8 connectable;
-        __u8 discoverable;
-        __u8 pairable;
-        __u8 sec_mode;
         bdaddr_t bdaddr;
+        __u8 version;
+        __le16 manufacturer;
+        __le32 supported_settings;
+        __le32 current_settings;
         __u8 dev_class[3];
-        __u8 features[8];
-        __u16 manufacturer;
-        __u8 hci_ver;
-        __u16 hci_rev;
         __u8 name[MGMT_MAX_NAME_LENGTH];
+        __u8 short_name[MGMT_MAX_SHORT_NAME_LENGTH];
 } __packed;
 
 struct mgmt_mode {
@@ -93,28 +100,38 @@ struct mgmt_cp_set_discoverable {
 
 #define MGMT_OP_SET_CONNECTABLE         0x0007
 
-#define MGMT_OP_SET_PAIRABLE            0x0008
+#define MGMT_OP_SET_FAST_CONNECTABLE    0x0008
 
-#define MGMT_OP_ADD_UUID                0x0009
-struct mgmt_cp_add_uuid {
-        __u8 uuid[16];
-        __u8 svc_hint;
-} __packed;
+#define MGMT_OP_SET_PAIRABLE            0x0009
 
-#define MGMT_OP_REMOVE_UUID             0x000A
-struct mgmt_cp_remove_uuid {
-        __u8 uuid[16];
-} __packed;
+#define MGMT_OP_SET_LINK_SECURITY       0x000A
 
-#define MGMT_OP_SET_DEV_CLASS           0x000B
+#define MGMT_OP_SET_SSP                 0x000B
+
+#define MGMT_OP_SET_HS                  0x000C
+
+#define MGMT_OP_SET_LE                  0x000D
+
+#define MGMT_OP_SET_DEV_CLASS           0x000E
 struct mgmt_cp_set_dev_class {
         __u8 major;
         __u8 minor;
 } __packed;
 
-#define MGMT_OP_SET_SERVICE_CACHE       0x000C
-struct mgmt_cp_set_service_cache {
-        __u8 enable;
+#define MGMT_OP_SET_LOCAL_NAME          0x000F
+struct mgmt_cp_set_local_name {
+        __u8 name[MGMT_MAX_NAME_LENGTH];
+} __packed;
+
+#define MGMT_OP_ADD_UUID                0x0010
+struct mgmt_cp_add_uuid {
+        __u8 uuid[16];
+        __u8 svc_hint;
+} __packed;
+
+#define MGMT_OP_REMOVE_UUID             0x0011
+struct mgmt_cp_remove_uuid {
+        __u8 uuid[16];
 } __packed;
 
 struct mgmt_link_key_info {
@@ -124,14 +141,14 @@ struct mgmt_link_key_info {
         u8 pin_len;
 } __packed;
 
-#define MGMT_OP_LOAD_LINK_KEYS          0x000D
+#define MGMT_OP_LOAD_LINK_KEYS          0x0012
 struct mgmt_cp_load_link_keys {
         __u8 debug_keys;
         __le16 key_count;
         struct mgmt_link_key_info keys[0];
 } __packed;
 
-#define MGMT_OP_REMOVE_KEYS             0x000E
+#define MGMT_OP_REMOVE_KEYS             0x0013
 struct mgmt_cp_remove_keys {
         bdaddr_t bdaddr;
         __u8 disconnect;
@@ -141,7 +158,7 @@ struct mgmt_rp_remove_keys {
         __u8 status;
 };
 
-#define MGMT_OP_DISCONNECT              0x000F
+#define MGMT_OP_DISCONNECT              0x0014
 struct mgmt_cp_disconnect {
         bdaddr_t bdaddr;
 } __packed;
@@ -160,13 +177,13 @@ struct mgmt_addr_info {
         __u8 type;
 } __packed;
 
-#define MGMT_OP_GET_CONNECTIONS         0x0010
+#define MGMT_OP_GET_CONNECTIONS         0x0015
 struct mgmt_rp_get_connections {
         __le16 conn_count;
         struct mgmt_addr_info addr[0];
 } __packed;
 
-#define MGMT_OP_PIN_CODE_REPLY          0x0011
+#define MGMT_OP_PIN_CODE_REPLY          0x0016
 struct mgmt_cp_pin_code_reply {
         bdaddr_t bdaddr;
         __u8 pin_len;
@@ -177,17 +194,17 @@ struct mgmt_rp_pin_code_reply {
         uint8_t status;
 } __packed;
 
-#define MGMT_OP_PIN_CODE_NEG_REPLY      0x0012
+#define MGMT_OP_PIN_CODE_NEG_REPLY      0x0017
 struct mgmt_cp_pin_code_neg_reply {
         bdaddr_t bdaddr;
 } __packed;
 
-#define MGMT_OP_SET_IO_CAPABILITY       0x0013
+#define MGMT_OP_SET_IO_CAPABILITY       0x0018
 struct mgmt_cp_set_io_capability {
         __u8 io_capability;
 } __packed;
 
-#define MGMT_OP_PAIR_DEVICE             0x0014
+#define MGMT_OP_PAIR_DEVICE             0x0019
 struct mgmt_cp_pair_device {
         struct mgmt_addr_info addr;
         __u8 io_cap;
@@ -197,7 +214,7 @@ struct mgmt_rp_pair_device {
         __u8 status;
 } __packed;
 
-#define MGMT_OP_USER_CONFIRM_REPLY      0x0015
+#define MGMT_OP_USER_CONFIRM_REPLY      0x001A
 struct mgmt_cp_user_confirm_reply {
         bdaddr_t bdaddr;
 } __packed;
@@ -206,61 +223,68 @@ struct mgmt_rp_user_confirm_reply {
         __u8 status;
 } __packed;
 
-#define MGMT_OP_USER_CONFIRM_NEG_REPLY  0x0016
+#define MGMT_OP_USER_CONFIRM_NEG_REPLY  0x001B
+struct mgmt_cp_user_confirm_neg_reply {
+        bdaddr_t bdaddr;
+} __packed;
 
-#define MGMT_OP_SET_LOCAL_NAME          0x0017
-struct mgmt_cp_set_local_name {
-        __u8 name[MGMT_MAX_NAME_LENGTH];
+#define MGMT_OP_USER_PASSKEY_REPLY      0x001C
+struct mgmt_cp_user_passkey_reply {
+        bdaddr_t bdaddr;
+        __le32 passkey;
+} __packed;
+struct mgmt_rp_user_passkey_reply {
+        bdaddr_t bdaddr;
+        __u8 status;
 } __packed;
 
-#define MGMT_OP_READ_LOCAL_OOB_DATA     0x0018
+#define MGMT_OP_USER_PASSKEY_NEG_REPLY  0x001D
+struct mgmt_cp_user_passkey_neg_reply {
+        bdaddr_t bdaddr;
+} __packed;
+
+#define MGMT_OP_READ_LOCAL_OOB_DATA     0x001E
 struct mgmt_rp_read_local_oob_data {
         __u8 hash[16];
         __u8 randomizer[16];
 } __packed;
 
-#define MGMT_OP_ADD_REMOTE_OOB_DATA     0x0019
+#define MGMT_OP_ADD_REMOTE_OOB_DATA     0x001F
 struct mgmt_cp_add_remote_oob_data {
         bdaddr_t bdaddr;
         __u8 hash[16];
         __u8 randomizer[16];
 } __packed;
 
-#define MGMT_OP_REMOVE_REMOTE_OOB_DATA  0x001A
+#define MGMT_OP_REMOVE_REMOTE_OOB_DATA  0x0020
 struct mgmt_cp_remove_remote_oob_data {
         bdaddr_t bdaddr;
 } __packed;
 
-#define MGMT_OP_START_DISCOVERY         0x001B
+#define MGMT_OP_START_DISCOVERY         0x0021
 struct mgmt_cp_start_discovery {
         __u8 type;
 } __packed;
 
-#define MGMT_OP_STOP_DISCOVERY          0x001C
+#define MGMT_OP_STOP_DISCOVERY          0x0022
 
-#define MGMT_OP_BLOCK_DEVICE            0x001D
-struct mgmt_cp_block_device {
+#define MGMT_OP_CONFIRM_NAME            0x0023
+struct mgmt_cp_confirm_name {
         bdaddr_t bdaddr;
+        __u8 name_known;
 } __packed;
-
-#define MGMT_OP_UNBLOCK_DEVICE          0x001E
-struct mgmt_cp_unblock_device {
+struct mgmt_rp_confirm_name {
         bdaddr_t bdaddr;
+        __u8 status;
 } __packed;
 
-#define MGMT_OP_SET_FAST_CONNECTABLE    0x001F
-struct mgmt_cp_set_fast_connectable {
-        __u8 enable;
-} __packed;
-
-#define MGMT_OP_USER_PASSKEY_REPLY      0x0020
-struct mgmt_cp_user_passkey_reply {
+#define MGMT_OP_BLOCK_DEVICE            0x0024
+struct mgmt_cp_block_device {
         bdaddr_t bdaddr;
-        __le32 passkey;
 } __packed;
 
-#define MGMT_OP_USER_PASSKEY_NEG_REPLY  0x0021
-struct mgmt_cp_user_passkey_neg_reply {
+#define MGMT_OP_UNBLOCK_DEVICE          0x0025
+struct mgmt_cp_unblock_device {
         bdaddr_t bdaddr;
 } __packed;
 
@@ -285,81 +309,82 @@ struct mgmt_ev_controller_error {
 
 #define MGMT_EV_INDEX_REMOVED           0x0005
 
-#define MGMT_EV_POWERED                 0x0006
+#define MGMT_EV_NEW_SETTINGS            0x0006
 
-#define MGMT_EV_DISCOVERABLE            0x0007
-
-#define MGMT_EV_CONNECTABLE             0x0008
+#define MGMT_EV_CLASS_OF_DEV_CHANGED    0x0007
+struct mgmt_ev_class_of_dev_changed {
+        __u8 dev_class[3];
+};
 
-#define MGMT_EV_PAIRABLE                0x0009
+#define MGMT_EV_LOCAL_NAME_CHANGED      0x0008
+struct mgmt_ev_local_name_changed {
+        __u8 name[MGMT_MAX_NAME_LENGTH];
+        __u8 short_name[MGMT_MAX_SHORT_NAME_LENGTH];
+} __packed;
 
-#define MGMT_EV_NEW_LINK_KEY            0x000A
+#define MGMT_EV_NEW_LINK_KEY            0x0009
 struct mgmt_ev_new_link_key {
         __u8 store_hint;
         struct mgmt_link_key_info key;
 } __packed;
 
-#define MGMT_EV_CONNECTED               0x000B
+#define MGMT_EV_CONNECTED               0x000A
 
-#define MGMT_EV_DISCONNECTED            0x000C
+#define MGMT_EV_DISCONNECTED            0x000B
 
-#define MGMT_EV_CONNECT_FAILED          0x000D
+#define MGMT_EV_CONNECT_FAILED          0x000C
 struct mgmt_ev_connect_failed {
         struct mgmt_addr_info addr;
         __u8 status;
 } __packed;
 
-#define MGMT_EV_PIN_CODE_REQUEST        0x000E
+#define MGMT_EV_PIN_CODE_REQUEST        0x000D
 struct mgmt_ev_pin_code_request {
         bdaddr_t bdaddr;
         __u8 secure;
 } __packed;
 
-#define MGMT_EV_USER_CONFIRM_REQUEST    0x000F
+#define MGMT_EV_USER_CONFIRM_REQUEST    0x000E
 struct mgmt_ev_user_confirm_request {
         bdaddr_t bdaddr;
         __u8 confirm_hint;
         __le32 value;
 } __packed;
 
+#define MGMT_EV_USER_PASSKEY_REQUEST    0x000F
+struct mgmt_ev_user_passkey_request {
+        bdaddr_t bdaddr;
+} __packed;
+
 #define MGMT_EV_AUTH_FAILED             0x0010
 struct mgmt_ev_auth_failed {
         bdaddr_t bdaddr;
         __u8 status;
 } __packed;
 
-#define MGMT_EV_LOCAL_NAME_CHANGED      0x0011
-struct mgmt_ev_local_name_changed {
-        __u8 name[MGMT_MAX_NAME_LENGTH];
-} __packed;
-
-#define MGMT_EV_DEVICE_FOUND            0x0012
+#define MGMT_EV_DEVICE_FOUND            0x0011
 struct mgmt_ev_device_found {
         struct mgmt_addr_info addr;
         __u8 dev_class[3];
         __s8 rssi;
+        __u8 confirm_name;
         __u8 eir[HCI_MAX_EIR_LENGTH];
 } __packed;
 
-#define MGMT_EV_REMOTE_NAME             0x0013
+#define MGMT_EV_REMOTE_NAME             0x0012
 struct mgmt_ev_remote_name {
         bdaddr_t bdaddr;
         __u8 name[MGMT_MAX_NAME_LENGTH];
 } __packed;
 
-#define MGMT_EV_DISCOVERING             0x0014
+#define MGMT_EV_DISCOVERING             0x0013
 
-#define MGMT_EV_DEVICE_BLOCKED          0x0015
+#define MGMT_EV_DEVICE_BLOCKED          0x0014
 struct mgmt_ev_device_blocked {
         bdaddr_t bdaddr;
 } __packed;
 
-#define MGMT_EV_DEVICE_UNBLOCKED        0x0016
+#define MGMT_EV_DEVICE_UNBLOCKED        0x0015
 struct mgmt_ev_device_unblocked {
         bdaddr_t bdaddr;
 } __packed;
-
-#define MGMT_EV_USER_PASSKEY_REQUEST    0x0017
-struct mgmt_ev_user_passkey_request {
-        bdaddr_t bdaddr;
-} __packed;
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
index 15b97d549441..aeaf5fa2b9f1 100644
--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -115,6 +115,10 @@ struct smp_cmd_security_req {
 #define SMP_MIN_ENC_KEY_SIZE            7
 #define SMP_MAX_ENC_KEY_SIZE            16
 
+#define SMP_FLAG_TK_VALID       1
+#define SMP_FLAG_CFM_PENDING    2
+#define SMP_FLAG_MITM_AUTH      3
+
 struct smp_chan {
         struct l2cap_conn *conn;
         u8              preq[7]; /* SMP Pairing Request */
@@ -124,6 +128,7 @@ struct smp_chan {
         u8              pcnf[16]; /* SMP Pairing Confirm */
         u8              tk[16]; /* SMP Temporary Key */
         u8              smp_key_size;
+        unsigned long   smp_flags;
         struct crypto_blkcipher *tfm;
         struct work_struct confirm;
         struct work_struct random;
@@ -134,6 +139,7 @@ struct smp_chan {
 int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level);
 int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
 int smp_distribute_keys(struct l2cap_conn *conn, __u8 force);
+int smp_user_confirm_reply(struct hci_conn *conn, u16 mgmt_op, __le32 passkey);
 
 void smp_chan_destroy(struct l2cap_conn *conn);
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 9f85fca0b676..15f4be7d768e 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -505,6 +505,7 @@ struct station_parameters {
  * @STATION_INFO_CONNECTED_TIME: @connected_time filled
  * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
  * @STATION_INFO_STA_FLAGS: @sta_flags filled
+ * @STATION_INFO_BEACON_LOSS_COUNT: @beacon_loss_count filled
  */
 enum station_info_flags {
         STATION_INFO_INACTIVE_TIME      = 1<<0,
@@ -525,7 +526,8 @@ enum station_info_flags {
         STATION_INFO_BSS_PARAM          = 1<<15,
         STATION_INFO_CONNECTED_TIME     = 1<<16,
         STATION_INFO_ASSOC_REQ_IES      = 1<<17,
-        STATION_INFO_STA_FLAGS          = 1<<18
+        STATION_INFO_STA_FLAGS          = 1<<18,
+        STATION_INFO_BEACON_LOSS_COUNT  = 1<<19
 };
 
 /**
@@ -623,6 +625,7 @@ struct sta_bss_parameters {
  *      the cfg80211_new_sta() calls to notify user space of the IEs.
  * @assoc_req_ies_len: Length of assoc_req_ies buffer in octets.
  * @sta_flags: station flags mask & values
+ * @beacon_loss_count: Number of times beacon loss event has triggered.
  */
 struct station_info {
         u32 filled;
@@ -650,6 +653,8 @@ struct station_info {
         const u8 *assoc_req_ies;
         size_t assoc_req_ies_len;
 
+        u32 beacon_loss_count;
+
         /*
          * Note: Add a new enum station_info_flags value for each new field and
          * use it to check which fields are initialized.
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 5b5c8a7e26d7..2a7523edd9b5 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3502,9 +3502,12 @@ void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn);
  *
  * @IEEE80211_RC_HT_CHANGED: The HT parameters of the operating channel have
  *      changed, rate control algorithm can update its internal state if needed.
+ * @IEEE80211_RC_SMPS_CHANGED: The SMPS state of the station changed, the rate
+ *      control algorithm needs to adjust accordingly.
  */
 enum rate_control_changed {
-        IEEE80211_RC_HT_CHANGED = BIT(0)
+        IEEE80211_RC_HT_CHANGED         = BIT(0),
+        IEEE80211_RC_SMPS_CHANGED       = BIT(1),
 };
 
 /**