Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)
  [Bluetooth] Add RFCOMM role switch support
  [Bluetooth] Allow disabling of credit based flow control
  [Bluetooth] Small cleanup of the L2CAP source code
  [Bluetooth] Use real devices for host controllers
  [Bluetooth] Add platform device for virtual and serial devices
  [Bluetooth] Add automatic sniff mode support
  [Bluetooth] Correct SCO buffer size on request
  [Bluetooth] Add suspend/resume support to the HCI USB driver
  [Bluetooth] Use raw mode for the Frontline sniffer device
  [BRIDGE]: br_dump_ifinfo index fix
  [ATM]: add+use poison defines
  [NET]: add+use poison defines
  [IOAT]: fix kernel-doc in source files
  [IOAT]: fix header file kernel-doc
  [TG3]: Add ipv6 TSO feature
  [IPV6]: Fix ipv6 GSO payload length
  [TIPC] Fixed sk_buff panic caused by tipc_link_bundle_buf (REVISED)
  [NET]: Verify gso_type too in gso_segment
  [IPVS]: Add sysctl documentation
  [ROSE]: Try all routes when establishing a ROSE connections.
  ...

6 files changed, 137 insertions, 69 deletions

diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 272010a6078a..c94d8f1d62e5 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -44,7 +44,7 @@ enum dma_event {
 };
 
 /**
- * typedef dma_cookie_t
+ * typedef dma_cookie_t - an opaque DMA cookie
  *
  * if dma_cookie_t is >0 it's a DMA request cookie, <0 it's an error code
  */
@@ -80,14 +80,14 @@ struct dma_chan_percpu {
 
 /**
  * struct dma_chan - devices supply DMA channels, clients use them
- * @client: ptr to the client user of this chan, will be NULL when unused
- * @device: ptr to the dma device who supplies this channel, always !NULL
+ * @client: ptr to the client user of this chan, will be %NULL when unused
+ * @device: ptr to the dma device who supplies this channel, always !%NULL
  * @cookie: last cookie value returned to client
- * @chan_id:
- * @class_dev:
+ * @chan_id: channel ID for sysfs
+ * @class_dev: class device for sysfs
  * @refcount: kref, used in "bigref" slow-mode
- * @slow_ref:
- * @rcu:
+ * @slow_ref: indicates that the DMA channel is free
+ * @rcu: the DMA channel's RCU head
  * @client_node: used to add this to the client chan list
  * @device_node: used to add this to the device chan list
  * @local: per-cpu pointer to a struct dma_chan_percpu
@@ -162,10 +162,17 @@ struct dma_client {
  * @chancnt: how many DMA channels are supported
  * @channels: the list of struct dma_chan
  * @global_node: list_head for global dma_device_list
- * @refcount:
- * @done:
- * @dev_id:
- * Other func ptrs: used to make use of this device's capabilities
+ * @refcount: reference count
+ * @done: IO completion struct
+ * @dev_id: unique device ID
+ * @device_alloc_chan_resources: allocate resources and return the
+ *      number of allocated descriptors
+ * @device_free_chan_resources: release DMA channel's resources
+ * @device_memcpy_buf_to_buf: memcpy buf pointer to buf pointer
+ * @device_memcpy_buf_to_pg: memcpy buf pointer to struct page
+ * @device_memcpy_pg_to_pg: memcpy struct page/offset to struct page/offset
+ * @device_memcpy_complete: poll the status of an IOAT DMA transaction
+ * @device_memcpy_issue_pending: push appended descriptors to hardware
  */
 struct dma_device {
 
@@ -211,7 +218,7 @@ void dma_async_client_chan_request(struct dma_client *client,
  * Both @dest and @src must be mappable to a bus address according to the
  * DMA mapping API rules for streaming mappings.
  * Both @dest and @src must stay memory resident (kernel memory or locked
- * user space pages)
+ * user space pages).
  */
 static inline dma_cookie_t dma_async_memcpy_buf_to_buf(struct dma_chan *chan,
         void *dest, void *src, size_t len)
@@ -225,7 +232,7 @@ static inline dma_cookie_t dma_async_memcpy_buf_to_buf(struct dma_chan *chan,
 }
 
 /**
- * dma_async_memcpy_buf_to_pg - offloaded copy
+ * dma_async_memcpy_buf_to_pg - offloaded copy from address to page
  * @chan: DMA channel to offload copy to
  * @page: destination page
  * @offset: offset in page to copy to
@@ -250,18 +257,18 @@ static inline dma_cookie_t dma_async_memcpy_buf_to_pg(struct dma_chan *chan,
 }
 
 /**
- * dma_async_memcpy_buf_to_pg - offloaded copy
+ * dma_async_memcpy_pg_to_pg - offloaded copy from page to page
  * @chan: DMA channel to offload copy to
- * @dest_page: destination page
+ * @dest_pg: destination page
  * @dest_off: offset in page to copy to
- * @src_page: source page
+ * @src_pg: source page
  * @src_off: offset in page to copy from
  * @len: length
  *
  * Both @dest_page/@dest_off and @src_page/@src_off must be mappable to a bus
  * address according to the DMA mapping API rules for streaming mappings.
  * Both @dest_page/@dest_off and @src_page/@src_off must stay memory resident
- * (kernel memory or locked user space pages)
+ * (kernel memory or locked user space pages).
  */
 static inline dma_cookie_t dma_async_memcpy_pg_to_pg(struct dma_chan *chan,
         struct page *dest_pg, unsigned int dest_off, struct page *src_pg,
@@ -278,7 +285,7 @@ static inline dma_cookie_t dma_async_memcpy_pg_to_pg(struct dma_chan *chan,
 
 /**
  * dma_async_memcpy_issue_pending - flush pending copies to HW
- * @chan:
+ * @chan: target DMA channel
  *
  * This allows drivers to push copies to HW in batches,
  * reducing MMIO writes where possible.
diff --git a/include/linux/poison.h b/include/linux/poison.h
index a5347c02432e..3e628f990fdf 100644
--- a/include/linux/poison.h
+++ b/include/linux/poison.h
@@ -44,6 +44,11 @@
 
 /********** drivers/atm/ **********/
 #define ATM_POISON_FREE         0x12
+#define ATM_POISON              0xdeadbeef
+
+/********** net/ **********/
+#define NEIGHBOR_DEAD           0xdeadbeef
+#define NETFILTER_LINK_POISON   0xdead57ac
 
 /********** kernel/mutexes **********/
 #define MUTEX_DEBUG_INIT        0x11
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 7cd528e9d668..69374cd1a857 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -182,14 +182,26 @@ typedef struct {
 
 typedef struct ax25_route {
         struct ax25_route       *next;
-        atomic_t                ref;
+        atomic_t                refcount;
         ax25_address            callsign;
         struct net_device       *dev;
         ax25_digi               *digipeat;
         char                    ip_mode;
-        struct timer_list       timer;
 } ax25_route;
 
+static inline void ax25_hold_route(ax25_route *ax25_rt)
+{
+        atomic_inc(&ax25_rt->refcount);
+}
+
+extern void __ax25_put_route(ax25_route *ax25_rt);
+
+static inline void ax25_put_route(ax25_route *ax25_rt)
+{
+        if (atomic_dec_and_test(&ax25_rt->refcount))
+                __ax25_put_route(ax25_rt);
+}
+
 typedef struct {
         char                    slave;                  /* slave_mode?   */
         struct timer_list       slave_timer;            /* timeout timer */
@@ -348,17 +360,11 @@ extern int  ax25_check_iframes_acked(ax25_cb *, unsigned short);
 extern void ax25_rt_device_down(struct net_device *);
 extern int  ax25_rt_ioctl(unsigned int, void __user *);
 extern struct file_operations ax25_route_fops;
+extern ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev);
 extern int  ax25_rt_autobind(ax25_cb *, ax25_address *);
-extern ax25_route *ax25_rt_find_route(ax25_route *, ax25_address *,
-        struct net_device *);
 extern struct sk_buff *ax25_rt_build_path(struct sk_buff *, ax25_address *, ax25_address *, ax25_digi *);
 extern void ax25_rt_free(void);
 
-static inline void ax25_put_route(ax25_route *ax25_rt)
-{
-        atomic_dec(&ax25_rt->ref);
-}
-
 /* ax25_std_in.c */
 extern int  ax25_std_frame_in(ax25_cb *, struct sk_buff *, int);
 
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 911ceb5cd263..771d17783c18 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -175,6 +175,6 @@ extern int hci_sock_cleanup(void);
 extern int bt_sysfs_init(void);
 extern void bt_sysfs_cleanup(void);
 
-extern struct class bt_class;
+extern struct class *bt_class;
 
 #endif /* __BLUETOOTH_H */
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index b06a2d2f63d2..b2bdb1aa0429 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -54,7 +54,8 @@
 /* HCI device quirks */
 enum {
         HCI_QUIRK_RESET_ON_INIT,
-        HCI_QUIRK_RAW_DEVICE
+        HCI_QUIRK_RAW_DEVICE,
+        HCI_QUIRK_FIXUP_BUFFER_SIZE
 };
 
 /* HCI device flags */
@@ -100,9 +101,10 @@ enum {
 #define HCIINQUIRY      _IOR('H', 240, int)
 
 /* HCI timeouts */
-#define HCI_CONN_TIMEOUT        (HZ * 40)
-#define HCI_DISCONN_TIMEOUT     (HZ * 2)
-#define HCI_CONN_IDLE_TIMEOUT   (HZ * 60)
+#define HCI_CONNECT_TIMEOUT     (40000) /* 40 seconds */
+#define HCI_DISCONN_TIMEOUT     (2000)  /* 2 seconds */
+#define HCI_IDLE_TIMEOUT        (6000)  /* 6 seconds */
+#define HCI_INIT_TIMEOUT        (10000) /* 10 seconds */
 
 /* HCI Packet types */
 #define HCI_COMMAND_PKT         0x01
@@ -144,7 +146,7 @@ enum {
 #define LMP_TACCURACY   0x10
 #define LMP_RSWITCH     0x20
 #define LMP_HOLD        0x40
-#define LMP_SNIF        0x80
+#define LMP_SNIFF       0x80
 
 #define LMP_PARK        0x01
 #define LMP_RSSI        0x02
@@ -159,13 +161,21 @@ enum {
 #define LMP_PSCHEME     0x02
 #define LMP_PCONTROL    0x04
 
+#define LMP_SNIFF_SUBR  0x02
+
+/* Connection modes */
+#define HCI_CM_ACTIVE   0x0000
+#define HCI_CM_HOLD     0x0001
+#define HCI_CM_SNIFF    0x0002
+#define HCI_CM_PARK     0x0003
+
 /* Link policies */
 #define HCI_LP_RSWITCH  0x0001
 #define HCI_LP_HOLD     0x0002
 #define HCI_LP_SNIFF    0x0004
 #define HCI_LP_PARK     0x0008
 
-/* Link mode */
+/* Link modes */
 #define HCI_LM_ACCEPT   0x8000
 #define HCI_LM_MASTER   0x0001
 #define HCI_LM_AUTH     0x0002
@@ -191,7 +201,7 @@ struct hci_rp_read_loc_version {
 } __attribute__ ((packed));
 
 #define OCF_READ_LOCAL_FEATURES 0x0003
-struct hci_rp_read_loc_features {
+struct hci_rp_read_local_features {
         __u8 status;
         __u8 features[8];
 } __attribute__ ((packed));
@@ -375,17 +385,32 @@ struct hci_cp_change_conn_link_key {
 } __attribute__ ((packed));
 
 #define OCF_READ_REMOTE_FEATURES 0x001B
-struct hci_cp_read_rmt_features {
+struct hci_cp_read_remote_features {
         __le16   handle;
 } __attribute__ ((packed));
 
 #define OCF_READ_REMOTE_VERSION 0x001D
-struct hci_cp_read_rmt_version {
+struct hci_cp_read_remote_version {
         __le16   handle;
 } __attribute__ ((packed));
 
 /* Link Policy */
-#define OGF_LINK_POLICY  0x02   
+#define OGF_LINK_POLICY 0x02   
+
+#define OCF_SNIFF_MODE          0x0003
+struct hci_cp_sniff_mode {
+        __le16   handle;
+        __le16   max_interval;
+        __le16   min_interval;
+        __le16   attempt;
+        __le16   timeout;
+} __attribute__ ((packed));
+
+#define OCF_EXIT_SNIFF_MODE     0x0004
+struct hci_cp_exit_sniff_mode {
+        __le16   handle;
+} __attribute__ ((packed));
+
 #define OCF_ROLE_DISCOVERY      0x0009
 struct hci_cp_role_discovery {
         __le16   handle;
@@ -406,7 +431,7 @@ struct hci_rp_read_link_policy {
         __le16   policy;
 } __attribute__ ((packed));
 
-#define OCF_SWITCH_ROLE 0x000B
+#define OCF_SWITCH_ROLE         0x000B
 struct hci_cp_switch_role {
         bdaddr_t bdaddr;
         __u8     role;
@@ -422,6 +447,14 @@ struct hci_rp_write_link_policy {
         __le16   handle;
 } __attribute__ ((packed));
 
+#define OCF_SNIFF_SUBRATE       0x0011
+struct hci_cp_sniff_subrate {
+        __le16   handle;
+        __le16   max_latency;
+        __le16   min_remote_timeout;
+        __le16   min_local_timeout;
+} __attribute__ ((packed));
+
 /* Status params */
 #define OGF_STATUS_PARAM        0x05
 
@@ -581,15 +614,15 @@ struct hci_ev_link_key_notify {
         __u8     key_type;
 } __attribute__ ((packed));
 
-#define HCI_EV_RMT_FEATURES     0x0B
-struct hci_ev_rmt_features {
+#define HCI_EV_REMOTE_FEATURES  0x0B
+struct hci_ev_remote_features {
         __u8     status;
         __le16   handle;
         __u8     features[8];
 } __attribute__ ((packed));
 
-#define HCI_EV_RMT_VERSION      0x0C
-struct hci_ev_rmt_version {
+#define HCI_EV_REMOTE_VERSION   0x0C
+struct hci_ev_remote_version {
         __u8     status;
         __le16   handle;
         __u8     lmp_ver;
@@ -610,6 +643,16 @@ struct hci_ev_pscan_rep_mode {
         __u8     pscan_rep_mode;
 } __attribute__ ((packed));
 
+#define HCI_EV_SNIFF_SUBRATE    0x2E
+struct hci_ev_sniff_subrate {
+        __u8     status;
+        __le16   handle;
+        __le16   max_tx_latency;
+        __le16   max_rx_latency;
+        __le16   max_remote_timeout;
+        __le16   max_local_timeout;
+} __attribute__ ((packed));
+
 /* Internal events generated by Bluetooth stack */
 #define HCI_EV_STACK_INTERNAL   0xFD
 struct hci_ev_stack_internal {
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index bb9f81dc8723..d84855fe7336 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -31,10 +31,7 @@
 #define HCI_PROTO_L2CAP 0
 #define HCI_PROTO_SCO   1
 
-#define HCI_INIT_TIMEOUT (HZ * 10)
-
 /* HCI Core structures */
-
 struct inquiry_data {
         bdaddr_t        bdaddr;
         __u8            pscan_rep_mode;
@@ -81,6 +78,10 @@ struct hci_dev {
         __u16           link_policy;
         __u16           link_mode;
 
+        __u32           idle_timeout;
+        __u16           sniff_min_interval;
+        __u16           sniff_max_interval;
+
         unsigned long   quirks;
 
         atomic_t        cmd_cnt;
@@ -123,7 +124,8 @@ struct hci_dev {
 
         atomic_t                promisc;
 
-        struct class_device     class_dev;
+        struct device           *parent;
+        struct device           dev;
 
         struct module           *owner;
 
@@ -145,18 +147,24 @@ struct hci_conn {
         bdaddr_t         dst;
         __u16            handle;
         __u16            state;
+        __u8             mode;
         __u8             type;
         __u8             out;
         __u8             dev_class[3];
+        __u8             features[8];
+        __u16            interval;
+        __u16            link_policy;
         __u32            link_mode;
+        __u8             power_save;
         unsigned long    pend;
-        
+
         unsigned int     sent;
-        
+
         struct sk_buff_head data_q;
 
-        struct timer_list timer;
-        
+        struct timer_list disc_timer;
+        struct timer_list idle_timer;
+
         struct hci_dev  *hdev;
         void            *l2cap_data;
         void            *sco_data;
@@ -211,7 +219,8 @@ void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data);
 enum {
         HCI_CONN_AUTH_PEND,
         HCI_CONN_ENCRYPT_PEND,
-        HCI_CONN_RSWITCH_PEND
+        HCI_CONN_RSWITCH_PEND,
+        HCI_CONN_MODE_CHANGE_PEND,
 };
 
 static inline void hci_conn_hash_init(struct hci_dev *hdev)
@@ -286,31 +295,27 @@ int hci_conn_encrypt(struct hci_conn *conn);
 int hci_conn_change_link_key(struct hci_conn *conn);
 int hci_conn_switch_role(struct hci_conn *conn, uint8_t role);
 
-static inline void hci_conn_set_timer(struct hci_conn *conn, unsigned long timeout)
-{
-        mod_timer(&conn->timer, jiffies + timeout);
-}
-
-static inline void hci_conn_del_timer(struct hci_conn *conn)
-{
-        del_timer(&conn->timer);
-}
+void hci_conn_enter_active_mode(struct hci_conn *conn);
+void hci_conn_enter_sniff_mode(struct hci_conn *conn);
 
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
         atomic_inc(&conn->refcnt);
-        hci_conn_del_timer(conn);
+        del_timer(&conn->disc_timer);
 }
 
 static inline void hci_conn_put(struct hci_conn *conn)
 {
         if (atomic_dec_and_test(&conn->refcnt)) {
+                unsigned long timeo;
                 if (conn->type == ACL_LINK) {
-                        unsigned long timeo = (conn->out) ?
-                                HCI_DISCONN_TIMEOUT : HCI_DISCONN_TIMEOUT * 2;
-                        hci_conn_set_timer(conn, timeo);
+                        timeo = msecs_to_jiffies(HCI_DISCONN_TIMEOUT);
+                        if (!conn->out)
+                                timeo *= 2;
+                        del_timer(&conn->idle_timer);
                 } else
-                        hci_conn_set_timer(conn, HZ / 100);
+                        timeo = msecs_to_jiffies(10);
+                mod_timer(&conn->disc_timer, jiffies + timeo);
         }
 }
 
@@ -408,11 +413,13 @@ static inline int hci_recv_frame(struct sk_buff *skb)
 int hci_register_sysfs(struct hci_dev *hdev);
 void hci_unregister_sysfs(struct hci_dev *hdev);
 
-#define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->class_dev.dev = (pdev))
+#define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->parent = (pdev))
 
 /* ----- LMP capabilities ----- */
-#define lmp_rswitch_capable(dev) (dev->features[0] & LMP_RSWITCH)
-#define lmp_encrypt_capable(dev) (dev->features[0] & LMP_ENCRYPT)
+#define lmp_rswitch_capable(dev)   ((dev)->features[0] & LMP_RSWITCH)
+#define lmp_encrypt_capable(dev)   ((dev)->features[0] & LMP_ENCRYPT)
+#define lmp_sniff_capable(dev)     ((dev)->features[0] & LMP_SNIFF)
+#define lmp_sniffsubr_capable(dev) ((dev)->features[5] & LMP_SNIFF_SUBR)
 
 /* ----- HCI protocols ----- */
 struct hci_proto {