Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

John W. Linville says:

====================
Yet one more pull request for wireless updates intended for 3.11...

For the mac80211 bits, Johannes says:

"Here we have a few memory leak fixes related to BSS struct handling
mostly from Ben, including a fix for a more theoretical problem
(associating while a BSS struct times out) from myself, a compilation
warning fix from Arend, mesh fixes from Thomas, tracking the beacon
bitrate (Alex), a bandwidth change event fix (Ilan) and some initial
work for 5/10 MHz channels from Simon."

Regarding the iwlwifi bits, Johannes says:

"Emmanuel removed some unneeded/unsupported module parameters and adds a
Bluetooth 1x1 lookup-table for some upcoming products. From Alex I have
an older patch to add low-power receive support, this depended on a
mac80211 commit that only just came in with the merge from wireless-next
I did. Ilan made beacon timings better, and Eytan added some debug
statements for thermal throttling. I have a few cleanups, a fix for a
long-standing but rare warning, and, arguably the most important patch
here, the firmware API version bump for the 7260/3160 devices."

Also included is a Bluetooth pull -- Gustavo says:

"Here goes a set of patches to 3.11. The biggest work here is from Andre Guedes
on the move of the Discovery to use the new request framework. Other than that
Johan provided a bunch of fixes to the L2CAP code. The rest are just small
fixes and clean ups."

On top of all that, there are a variety of updates and fixes to
brcmfmac, rt2x00, wil6210, ath9k, ath10k, and a few others here and
there.  This also includes a pull of the wireless tree, in order to
prevent some merge conflicts.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

9 files changed, 117 insertions, 28 deletions

diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 2e34db82a643..622fc505d3e1 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -144,6 +144,7 @@ struct bcma_host_ops {
 
 /* Chip IDs of PCIe devices */
 #define BCMA_CHIP_ID_BCM4313    0x4313
+#define BCMA_CHIP_ID_BCM43142   43142
 #define BCMA_CHIP_ID_BCM43224   43224
 #define  BCMA_PKG_ID_BCM43224_FAB_CSM   0x8
 #define  BCMA_PKG_ID_BCM43224_FAB_SMIC  0xa
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index b8b09eac60a4..c49e1a159e6e 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -330,6 +330,8 @@
 #define BCMA_CC_PMU_CAP                 0x0604 /* PMU capabilities */
 #define  BCMA_CC_PMU_CAP_REVISION       0x000000FF /* Revision mask */
 #define BCMA_CC_PMU_STAT                0x0608 /* PMU status */
+#define  BCMA_CC_PMU_STAT_EXT_LPO_AVAIL 0x00000100
+#define  BCMA_CC_PMU_STAT_WDRESET       0x00000080
 #define  BCMA_CC_PMU_STAT_INTPEND       0x00000040 /* Interrupt pending */
 #define  BCMA_CC_PMU_STAT_SBCLKST       0x00000030 /* Backplane clock status? */
 #define  BCMA_CC_PMU_STAT_HAVEALP       0x00000008 /* ALP available */
@@ -355,6 +357,11 @@
 #define BCMA_CC_REGCTL_DATA             0x065C
 #define BCMA_CC_PLLCTL_ADDR             0x0660
 #define BCMA_CC_PLLCTL_DATA             0x0664
+#define BCMA_CC_PMU_STRAPOPT            0x0668 /* (corerev >= 28) */
+#define BCMA_CC_PMU_XTAL_FREQ           0x066C /* (pmurev >= 10) */
+#define  BCMA_CC_PMU_XTAL_FREQ_ILPCTL_MASK      0x00001FFF
+#define  BCMA_CC_PMU_XTAL_FREQ_MEASURE_MASK     0x80000000
+#define  BCMA_CC_PMU_XTAL_FREQ_MEASURE_SHIFT    31
 #define BCMA_CC_SPROM                   0x0800 /* SPROM beginning */
 /* NAND flash MLC controller registers (corerev >= 38) */
 #define BCMA_CC_NAND_REVISION           0x0C00
@@ -435,6 +442,23 @@
 #define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_MASK  0x00000007
 #define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_SHIFT 0
 
+/* PMU rev 15 */
+#define BCMA_CC_PMU15_PLL_PLLCTL0       0
+#define  BCMA_CC_PMU15_PLL_PC0_CLKSEL_MASK      0x00000003
+#define  BCMA_CC_PMU15_PLL_PC0_CLKSEL_SHIFT     0
+#define  BCMA_CC_PMU15_PLL_PC0_FREQTGT_MASK     0x003FFFFC
+#define  BCMA_CC_PMU15_PLL_PC0_FREQTGT_SHIFT    2
+#define  BCMA_CC_PMU15_PLL_PC0_PRESCALE_MASK    0x00C00000
+#define  BCMA_CC_PMU15_PLL_PC0_PRESCALE_SHIFT   22
+#define  BCMA_CC_PMU15_PLL_PC0_KPCTRL_MASK      0x07000000
+#define  BCMA_CC_PMU15_PLL_PC0_KPCTRL_SHIFT     24
+#define  BCMA_CC_PMU15_PLL_PC0_FCNTCTRL_MASK    0x38000000
+#define  BCMA_CC_PMU15_PLL_PC0_FCNTCTRL_SHIFT   27
+#define  BCMA_CC_PMU15_PLL_PC0_FDCMODE_MASK     0x40000000
+#define  BCMA_CC_PMU15_PLL_PC0_FDCMODE_SHIFT    30
+#define  BCMA_CC_PMU15_PLL_PC0_CTRLBIAS_MASK    0x80000000
+#define  BCMA_CC_PMU15_PLL_PC0_CTRLBIAS_SHIFT   31
+
 /* ALP clock on pre-PMU chips */
 #define BCMA_CC_PMU_ALP_CLOCK           20000000
 /* HT clock for systems with PMU-enabled chipcommon */
@@ -507,6 +531,37 @@
 #define BCMA_CHIPCTL_5357_I2S_PINS_ENABLE       BIT(18)
 #define BCMA_CHIPCTL_5357_I2CSPI_PINS_ENABLE    BIT(19)
 
+#define BCMA_RES_4314_LPLDO_PU                  BIT(0)
+#define BCMA_RES_4314_PMU_SLEEP_DIS             BIT(1)
+#define BCMA_RES_4314_PMU_BG_PU                 BIT(2)
+#define BCMA_RES_4314_CBUCK_LPOM_PU             BIT(3)
+#define BCMA_RES_4314_CBUCK_PFM_PU              BIT(4)
+#define BCMA_RES_4314_CLDO_PU                   BIT(5)
+#define BCMA_RES_4314_LPLDO2_LVM                BIT(6)
+#define BCMA_RES_4314_WL_PMU_PU                 BIT(7)
+#define BCMA_RES_4314_LNLDO_PU                  BIT(8)
+#define BCMA_RES_4314_LDO3P3_PU                 BIT(9)
+#define BCMA_RES_4314_OTP_PU                    BIT(10)
+#define BCMA_RES_4314_XTAL_PU                   BIT(11)
+#define BCMA_RES_4314_WL_PWRSW_PU               BIT(12)
+#define BCMA_RES_4314_LQ_AVAIL                  BIT(13)
+#define BCMA_RES_4314_LOGIC_RET                 BIT(14)
+#define BCMA_RES_4314_MEM_SLEEP                 BIT(15)
+#define BCMA_RES_4314_MACPHY_RET                BIT(16)
+#define BCMA_RES_4314_WL_CORE_READY             BIT(17)
+#define BCMA_RES_4314_ILP_REQ                   BIT(18)
+#define BCMA_RES_4314_ALP_AVAIL                 BIT(19)
+#define BCMA_RES_4314_MISC_PWRSW_PU             BIT(20)
+#define BCMA_RES_4314_SYNTH_PWRSW_PU            BIT(21)
+#define BCMA_RES_4314_RX_PWRSW_PU               BIT(22)
+#define BCMA_RES_4314_RADIO_PU                  BIT(23)
+#define BCMA_RES_4314_VCO_LDO_PU                BIT(24)
+#define BCMA_RES_4314_AFE_LDO_PU                BIT(25)
+#define BCMA_RES_4314_RX_LDO_PU                 BIT(26)
+#define BCMA_RES_4314_TX_LDO_PU                 BIT(27)
+#define BCMA_RES_4314_HT_AVAIL                  BIT(28)
+#define BCMA_RES_4314_MACPHY_CLK_AVAIL          BIT(29)
+
 /* Data for the PMU, if available.
  * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
  */
diff --git a/include/linux/platform_data/brcmfmac-sdio.h b/include/linux/platform_data/brcmfmac-sdio.h
index 1ade657d5fc1..b7174998c24a 100644
--- a/include/linux/platform_data/brcmfmac-sdio.h
+++ b/include/linux/platform_data/brcmfmac-sdio.h
@@ -90,6 +90,10 @@ void __init brcmfmac_init_pdata(void)
  * oob_irq_nr, oob_irq_flags: the OOB interrupt information. The values are
  * used for registering the irq using request_irq function.
  *
+ * broken_sg_support: flag for broken sg list support of SDIO host controller.
+ * Set this to true if the SDIO host controller has higher align requirement
+ * than 32 bytes for each scatterlist item.
+ *
  * power_on: This function is called by the brcmfmac when the module gets
  * loaded. This can be particularly useful for low power devices. The platform
  * spcific routine may for example decide to power up the complete device.
@@ -116,6 +120,7 @@ struct brcmfmac_sdio_platform_data {
         bool oob_irq_supported;
         unsigned int oob_irq_nr;
         unsigned long oob_irq_flags;
+        bool broken_sg_support;
         void (*power_on)(void);
         void (*power_off)(void);
         void (*reset)(void);
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index e0512aaef4b8..3c592cf473da 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -107,7 +107,6 @@ enum {
         HCI_MGMT,
         HCI_PAIRABLE,
         HCI_SERVICE_CACHE,
-        HCI_LINK_KEYS,
         HCI_DEBUG_KEYS,
         HCI_UNREGISTER,
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 7cb6d360d147..f77885ea78c2 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -117,13 +117,6 @@ struct oob_data {
         u8 randomizer[16];
 };
 
-struct le_scan_params {
-        u8 type;
-        u16 interval;
-        u16 window;
-        int timeout;
-};
-
 #define HCI_MAX_SHORT_NAME_LENGTH       10
 
 struct amp_assoc {
@@ -283,9 +276,6 @@ struct hci_dev {
 
         struct delayed_work     le_scan_disable;
 
-        struct work_struct      le_scan;
-        struct le_scan_params   le_scan_params;
-
         __s8                    adv_tx_power;
         __u8                    adv_data[HCI_MAX_AD_LENGTH];
         __u8                    adv_data_len;
@@ -432,6 +422,7 @@ void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
                                       struct inquiry_entry *ie);
 bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
                               bool name_known, bool *ssp);
+void hci_inquiry_cache_flush(struct hci_dev *hdev);
 
 /* ----- HCI Connections ----- */
 enum {
@@ -1114,6 +1105,16 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event);
                                          BIT(BDADDR_LE_PUBLIC) | \
                                          BIT(BDADDR_LE_RANDOM))
 
+/* These LE scan and inquiry parameters were chosen according to LE General
+ * Discovery Procedure specification.
+ */
+#define DISCOV_LE_SCAN_WIN              0x12
+#define DISCOV_LE_SCAN_INT              0x12
+#define DISCOV_LE_TIMEOUT               msecs_to_jiffies(10240)
+#define DISCOV_INTERLEAVED_TIMEOUT      msecs_to_jiffies(5120)
+#define DISCOV_INTERLEAVED_INQUIRY_LEN  0x04
+#define DISCOV_BREDR_INQUIRY_LEN        0x08
+
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
 int mgmt_index_added(struct hci_dev *hdev);
 int mgmt_index_removed(struct hci_dev *hdev);
@@ -1169,10 +1170,7 @@ int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                       u8 ssp, u8 *eir, u16 eir_len);
 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                      u8 addr_type, s8 rssi, u8 *name, u8 name_len);
-int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status);
-int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status);
 int mgmt_discovering(struct hci_dev *hdev, u8 discovering);
-int mgmt_interleaved_discovery(struct hci_dev *hdev);
 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 bool mgmt_valid_hdev(struct hci_dev *hdev);
@@ -1212,11 +1210,6 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
                                                         __u8 ltk[16]);
-int hci_do_inquiry(struct hci_dev *hdev, u8 length);
-int hci_cancel_inquiry(struct hci_dev *hdev);
-int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
-                int timeout);
-int hci_cancel_le_scan(struct hci_dev *hdev);
 
 u8 bdaddr_to_le(u8 bdaddr_type);
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index fb94cf13c777..1a966afbbfa8 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -242,7 +242,7 @@ struct l2cap_conn_rsp {
 #define L2CAP_CID_SIGNALING     0x0001
 #define L2CAP_CID_CONN_LESS     0x0002
 #define L2CAP_CID_A2MP          0x0003
-#define L2CAP_CID_LE_DATA       0x0004
+#define L2CAP_CID_ATT           0x0004
 #define L2CAP_CID_LE_SIGNALING  0x0005
 #define L2CAP_CID_SMP           0x0006
 #define L2CAP_CID_DYN_START     0x0040
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 6a43c34ce96f..7b0730aeb892 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -188,6 +188,8 @@ struct ieee80211_channel {
  *      when used with 802.11g (on the 2.4 GHz band); filled by the
  *      core code when registering the wiphy.
  * @IEEE80211_RATE_ERP_G: This is an ERP rate in 802.11g mode.
+ * @IEEE80211_RATE_SUPPORTS_5MHZ: Rate can be used in 5 MHz mode
+ * @IEEE80211_RATE_SUPPORTS_10MHZ: Rate can be used in 10 MHz mode
  */
 enum ieee80211_rate_flags {
         IEEE80211_RATE_SHORT_PREAMBLE   = 1<<0,
@@ -195,6 +197,8 @@ enum ieee80211_rate_flags {
         IEEE80211_RATE_MANDATORY_B      = 1<<2,
         IEEE80211_RATE_MANDATORY_G      = 1<<3,
         IEEE80211_RATE_ERP_G            = 1<<4,
+        IEEE80211_RATE_SUPPORTS_5MHZ    = 1<<5,
+        IEEE80211_RATE_SUPPORTS_10MHZ   = 1<<6,
 };
 
 /**
@@ -433,6 +437,30 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                              u32 prohibited_flags);
 
 /**
+ * ieee80211_chandef_rate_flags - returns rate flags for a channel
+ *
+ * In some channel types, not all rates may be used - for example CCK
+ * rates may not be used in 5/10 MHz channels.
+ *
+ * @chandef: channel definition for the channel
+ *
+ * Returns: rate flags which apply for this channel
+ */
+static inline enum ieee80211_rate_flags
+ieee80211_chandef_rate_flags(struct cfg80211_chan_def *chandef)
+{
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_5:
+                return IEEE80211_RATE_SUPPORTS_5MHZ;
+        case NL80211_CHAN_WIDTH_10:
+                return IEEE80211_RATE_SUPPORTS_10MHZ;
+        default:
+                break;
+        }
+        return 0;
+}
+
+/**
  * enum survey_info_flags - survey information flags
  *
  * @SURVEY_INFO_NOISE_DBM: noise (in dBm) was filled in
@@ -1431,7 +1459,8 @@ const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
  * This structure provides information needed to complete IEEE 802.11
  * authentication.
  *
- * @bss: The BSS to authenticate with.
+ * @bss: The BSS to authenticate with, the callee must obtain a reference
+ *      to it if it needs to keep it.
  * @auth_type: Authentication type (algorithm)
  * @ie: Extra IEs to add to Authentication frame or %NULL
  * @ie_len: Length of ie buffer in octets
@@ -1469,11 +1498,10 @@ enum cfg80211_assoc_req_flags {
  *
  * This structure provides information needed to complete IEEE 802.11
  * (re)association.
- * @bss: The BSS to associate with. If the call is successful the driver
- *      is given a reference that it must release, normally via a call to
- *      cfg80211_send_rx_assoc(), or, if association timed out, with a
- *      call to cfg80211_put_bss() (in addition to calling
- *      cfg80211_send_assoc_timeout())
+ * @bss: The BSS to associate with. If the call is successful the driver is
+ *      given a reference that it must give back to cfg80211_send_rx_assoc()
+ *      or to cfg80211_assoc_timeout(). To ensure proper refcounting, new
+ *      association requests while already associating must be rejected.
  * @ie: Extra IEs to add to (Re)Association Request frame or %NULL
  * @ie_len: Length of ie buffer in octets
  * @use_mfp: Use management frame protection (IEEE 802.11w) in this association
@@ -2342,6 +2370,7 @@ struct cfg80211_ops {
  *      responds to probe-requests in hardware.
  * @WIPHY_FLAG_OFFCHAN_TX: Device supports direct off-channel TX.
  * @WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL: Device supports remain-on-channel call.
+ * @WIPHY_FLAG_SUPPORTS_5_10_MHZ: Device supports 5 MHz and 10 MHz channels.
  */
 enum wiphy_flags {
         WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
@@ -2365,6 +2394,7 @@ enum wiphy_flags {
         WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD        = BIT(19),
         WIPHY_FLAG_OFFCHAN_TX                   = BIT(20),
         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL        = BIT(21),
+        WIPHY_FLAG_SUPPORTS_5_10_MHZ            = BIT(22),
 };
 
 /**
@@ -3492,11 +3522,11 @@ void cfg80211_rx_assoc_resp(struct net_device *dev,
 /**
  * cfg80211_assoc_timeout - notification of timed out association
  * @dev: network device
- * @addr: The MAC address of the device with which the association timed out
+ * @bss: The BSS entry with which association timed out.
  *
  * This function may sleep. The caller must hold the corresponding wdev's mutex.
  */
-void cfg80211_assoc_timeout(struct net_device *dev, const u8 *addr);
+void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);
 
 /**
  * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index a405a7a9775c..5b7a3dadadde 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -305,6 +305,7 @@ enum ieee80211_rssi_event {
  * @basic_rates: bitmap of basic rates, each bit stands for an
  *      index into the rate table configured by the driver in
  *      the current band.
+ * @beacon_rate: associated AP's beacon TX rate
  * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
  * @bssid: The BSSID for this BSS
  * @enable_beacon: whether beaconing should be enabled or not
@@ -352,6 +353,7 @@ struct ieee80211_bss_conf {
         u32 sync_device_ts;
         u8 sync_dtim_count;
         u32 basic_rates;
+        struct ieee80211_rate *beacon_rate;
         int mcast_rate[IEEE80211_NUM_BANDS];
         u16 ht_operation_mode;
         s32 cqm_rssi_thold;
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index ca6facf4df0c..861e5eba3953 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -2758,6 +2758,8 @@ enum nl80211_channel_type {
  *      and %NL80211_ATTR_CENTER_FREQ2 attributes must be provided as well
  * @NL80211_CHAN_WIDTH_160: 160 MHz channel, the %NL80211_ATTR_CENTER_FREQ1
  *      attribute must be provided as well
+ * @NL80211_CHAN_WIDTH_5: 5 MHz OFDM channel
+ * @NL80211_CHAN_WIDTH_10: 10 MHz OFDM channel
  */
 enum nl80211_chan_width {
         NL80211_CHAN_WIDTH_20_NOHT,
@@ -2766,6 +2768,8 @@ enum nl80211_chan_width {
         NL80211_CHAN_WIDTH_80,
         NL80211_CHAN_WIDTH_80P80,
         NL80211_CHAN_WIDTH_160,
+        NL80211_CHAN_WIDTH_5,
+        NL80211_CHAN_WIDTH_10,
 };
 
 /**