Merge tag 'master-2014-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

John W. Linville says:

====================
pull request: wireless-next 2014-07-25

Please pull this batch of updates intended for the 3.17 stream!

For the mac80211 bits, Johannes says:

"We have a lot of TDLS patches, among them a fix that should make hwsim
tests happy again. The rest, this time, is mostly small fixes."

For the Bluetooth bits, Gustavo says:

"Some more patches for 3.17. The most important change here is the move of
the 6lowpan code to net/6lowpan. It has been agreed with Davem that this
change will go through the bluetooth tree. The rest are mostly clean up and
fixes."

and,

"Here follows some more patches for 3.17. These are mostly fixes to what
we've sent to you before for next merge window."

For the iwlwifi bits, Emmanuel says:

"I have the usual amount of BT Coex stuff. Arik continues to work
on TDLS and Ariej contributes a few things for HS2.0. I added a few
more things to the firmware debugging infrastructure. Eran fixes a
small bug - pretty normal content."

And for the Atheros bits, Kalle says:

"For ath6kl me and Jessica added support for ar6004 hw3.0, our latest
version of ar6004.

For ath10k Janusz added a printout so that it's easier to check what
ath10k kconfig options are enabled. He also added a debugfs file to
configure maximum amsdu and ampdu values. Also we had few fixes as
usual."

On top of that is the usual large batch of various driver updates --
brcmfmac, mwifiex, the TI drivers, and wil6210 all get some action.
Rafał has also been very busy with b43 and related updates.

Also, I pulled the wireless tree into this in order to resolve a
merge conflict...

P.S.  The change to fs/compat_ioctl.c reflects a name change in a
Bluetooth header file...
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

9 files changed, 295 insertions, 223 deletions

diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 452286a38b2b..969af0f2bdf9 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -158,6 +158,8 @@ struct bcma_host_ops {
 /* Chip IDs of PCIe devices */
 #define BCMA_CHIP_ID_BCM4313    0x4313
 #define BCMA_CHIP_ID_BCM43142   43142
+#define BCMA_CHIP_ID_BCM43217   43217
+#define BCMA_CHIP_ID_BCM43222   43222
 #define BCMA_CHIP_ID_BCM43224   43224
 #define  BCMA_PKG_ID_BCM43224_FAB_CSM   0x8
 #define  BCMA_PKG_ID_BCM43224_FAB_SMIC  0xa
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 75d17e15da33..63ab3873c5ed 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1001,6 +1001,26 @@ struct ieee80211_vendor_ie {
         u8 oui_type;
 } __packed;
 
+struct ieee80211_wmm_ac_param {
+        u8 aci_aifsn; /* AIFSN, ACM, ACI */
+        u8 cw; /* ECWmin, ECWmax (CW = 2^ECW - 1) */
+        __le16 txop_limit;
+} __packed;
+
+struct ieee80211_wmm_param_ie {
+        u8 element_id; /* Element ID: 221 (0xdd); */
+        u8 len; /* Length: 24 */
+        /* required fields for WMM version 1 */
+        u8 oui[3]; /* 00:50:f2 */
+        u8 oui_type; /* 2 */
+        u8 oui_subtype; /* 1 */
+        u8 version; /* 1 for WMM version 1.0 */
+        u8 qos_info; /* AP/STA specific QoS info */
+        u8 reserved; /* 0 */
+        /* AC_BE, AC_BK, AC_VI, AC_VO */
+        struct ieee80211_wmm_ac_param ac[4];
+} __packed;
+
 /* Control frames */
 struct ieee80211_rts {
         __le16 frame_control;
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index f9f931c89e3e..f7b9100686c3 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -345,6 +345,43 @@
 #define  SSB_SPROM4_TXPID5GH2_SHIFT     0
 #define  SSB_SPROM4_TXPID5GH3           0xFF00
 #define  SSB_SPROM4_TXPID5GH3_SHIFT     8
+
+/* There are 4 blocks with power info sharing the same layout */
+#define SSB_SPROM4_PWR_INFO_CORE0       0x0080
+#define SSB_SPROM4_PWR_INFO_CORE1       0x00AE
+#define SSB_SPROM4_PWR_INFO_CORE2       0x00DC
+#define SSB_SPROM4_PWR_INFO_CORE3       0x010A
+
+#define SSB_SPROM4_2G_MAXP_ITSSI        0x00    /* 2 GHz ITSSI and 2 GHz Max Power */
+#define  SSB_SPROM4_2G_MAXP             0x00FF
+#define  SSB_SPROM4_2G_ITSSI            0xFF00
+#define  SSB_SPROM4_2G_ITSSI_SHIFT      8
+#define SSB_SPROM4_2G_PA_0              0x02    /* 2 GHz power amp */
+#define SSB_SPROM4_2G_PA_1              0x04
+#define SSB_SPROM4_2G_PA_2              0x06
+#define SSB_SPROM4_2G_PA_3              0x08
+#define SSB_SPROM4_5G_MAXP_ITSSI        0x0A    /* 5 GHz ITSSI and 5.3 GHz Max Power */
+#define  SSB_SPROM4_5G_MAXP             0x00FF
+#define  SSB_SPROM4_5G_ITSSI            0xFF00
+#define  SSB_SPROM4_5G_ITSSI_SHIFT      8
+#define SSB_SPROM4_5GHL_MAXP            0x0C    /* 5.2 GHz and 5.8 GHz Max Power */
+#define  SSB_SPROM4_5GH_MAXP            0x00FF
+#define  SSB_SPROM4_5GL_MAXP            0xFF00
+#define  SSB_SPROM4_5GL_MAXP_SHIFT      8
+#define SSB_SPROM4_5G_PA_0              0x0E    /* 5.3 GHz power amp */
+#define SSB_SPROM4_5G_PA_1              0x10
+#define SSB_SPROM4_5G_PA_2              0x12
+#define SSB_SPROM4_5G_PA_3              0x14
+#define SSB_SPROM4_5GL_PA_0             0x16    /* 5.2 GHz power amp */
+#define SSB_SPROM4_5GL_PA_1             0x18
+#define SSB_SPROM4_5GL_PA_2             0x1A
+#define SSB_SPROM4_5GL_PA_3             0x1C
+#define SSB_SPROM4_5GH_PA_0             0x1E    /* 5.8 GHz power amp */
+#define SSB_SPROM4_5GH_PA_1             0x20
+#define SSB_SPROM4_5GH_PA_2             0x22
+#define SSB_SPROM4_5GH_PA_3             0x24
+
+/* TODO: Make it deprecated */
 #define SSB_SPROM4_MAXP_BG              0x0080  /* Max Power BG in path 1 */
 #define  SSB_SPROM4_MAXP_BG_MASK        0x00FF  /* Mask for Max Power BG */
 #define  SSB_SPROM4_ITSSI_BG            0xFF00  /* Mask for path 1 itssi_bg */
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index a01236e2df13..f0a3d8890760 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -202,33 +202,6 @@ enum {
 #define HCI_PERSISTENT_MASK (BIT(HCI_LE_SCAN) | BIT(HCI_PERIODIC_INQ) | \
                               BIT(HCI_FAST_CONNECTABLE) | BIT(HCI_LE_ADV))
 
-/* HCI ioctl defines */
-#define HCIDEVUP        _IOW('H', 201, int)
-#define HCIDEVDOWN      _IOW('H', 202, int)
-#define HCIDEVRESET     _IOW('H', 203, int)
-#define HCIDEVRESTAT    _IOW('H', 204, int)
-
-#define HCIGETDEVLIST   _IOR('H', 210, int)
-#define HCIGETDEVINFO   _IOR('H', 211, int)
-#define HCIGETCONNLIST  _IOR('H', 212, int)
-#define HCIGETCONNINFO  _IOR('H', 213, int)
-#define HCIGETAUTHINFO  _IOR('H', 215, int)
-
-#define HCISETRAW       _IOW('H', 220, int)
-#define HCISETSCAN      _IOW('H', 221, int)
-#define HCISETAUTH      _IOW('H', 222, int)
-#define HCISETENCRYPT   _IOW('H', 223, int)
-#define HCISETPTYPE     _IOW('H', 224, int)
-#define HCISETLINKPOL   _IOW('H', 225, int)
-#define HCISETLINKMODE  _IOW('H', 226, int)
-#define HCISETACLMTU    _IOW('H', 227, int)
-#define HCISETSCOMTU    _IOW('H', 228, int)
-
-#define HCIBLOCKADDR    _IOW('H', 230, int)
-#define HCIUNBLOCKADDR  _IOW('H', 231, int)
-
-#define HCIINQUIRY      _IOR('H', 240, int)
-
 /* HCI timeouts */
 #define HCI_DISCONN_TIMEOUT     msecs_to_jiffies(2000)  /* 2 seconds */
 #define HCI_PAIRING_TIMEOUT     msecs_to_jiffies(60000) /* 60 seconds */
@@ -356,6 +329,7 @@ enum {
 #define LMP_HOST_SC             0x08
 
 /* LE features */
+#define HCI_LE_ENCRYPTION               0x01
 #define HCI_LE_CONN_PARAM_REQ_PROC      0x02
 #define HCI_LE_PING                     0x10
 
@@ -427,6 +401,9 @@ enum {
 /* The core spec defines 127 as the "not available" value */
 #define HCI_TX_POWER_INVALID    127
 
+#define HCI_ROLE_MASTER         0x00
+#define HCI_ROLE_SLAVE          0x01
+
 /* Extended Inquiry Response field types */
 #define EIR_FLAGS               0x01 /* flags */
 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
@@ -1739,9 +1716,6 @@ struct hci_ev_sync_train_complete {
 
 #define HCI_EV_SLAVE_PAGE_RESP_TIMEOUT  0x54
 
-/* Low energy meta events */
-#define LE_CONN_ROLE_MASTER     0x00
-
 #define HCI_EV_LE_CONN_COMPLETE         0x01
 struct hci_ev_le_conn_complete {
         __u8     status;
@@ -1871,126 +1845,4 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
 #define hci_handle(h)           (h & 0x0fff)
 #define hci_flags(h)            (h >> 12)
 
-/* ---- HCI Sockets ---- */
-
-/* Socket options */
-#define HCI_DATA_DIR    1
-#define HCI_FILTER      2
-#define HCI_TIME_STAMP  3
-
-/* CMSG flags */
-#define HCI_CMSG_DIR    0x0001
-#define HCI_CMSG_TSTAMP 0x0002
-
-struct sockaddr_hci {
-        sa_family_t    hci_family;
-        unsigned short hci_dev;
-        unsigned short hci_channel;
-};
-#define HCI_DEV_NONE    0xffff
-
-#define HCI_CHANNEL_RAW         0
-#define HCI_CHANNEL_USER        1
-#define HCI_CHANNEL_MONITOR     2
-#define HCI_CHANNEL_CONTROL     3
-
-struct hci_filter {
-        unsigned long type_mask;
-        unsigned long event_mask[2];
-        __le16 opcode;
-};
-
-struct hci_ufilter {
-        __u32  type_mask;
-        __u32  event_mask[2];
-        __le16 opcode;
-};
-
-#define HCI_FLT_TYPE_BITS       31
-#define HCI_FLT_EVENT_BITS      63
-#define HCI_FLT_OGF_BITS        63
-#define HCI_FLT_OCF_BITS        127
-
-/* ---- HCI Ioctl requests structures ---- */
-struct hci_dev_stats {
-        __u32 err_rx;
-        __u32 err_tx;
-        __u32 cmd_tx;
-        __u32 evt_rx;
-        __u32 acl_tx;
-        __u32 acl_rx;
-        __u32 sco_tx;
-        __u32 sco_rx;
-        __u32 byte_rx;
-        __u32 byte_tx;
-};
-
-struct hci_dev_info {
-        __u16 dev_id;
-        char  name[8];
-
-        bdaddr_t bdaddr;
-
-        __u32 flags;
-        __u8  type;
-
-        __u8  features[8];
-
-        __u32 pkt_type;
-        __u32 link_policy;
-        __u32 link_mode;
-
-        __u16 acl_mtu;
-        __u16 acl_pkts;
-        __u16 sco_mtu;
-        __u16 sco_pkts;
-
-        struct hci_dev_stats stat;
-};
-
-struct hci_conn_info {
-        __u16    handle;
-        bdaddr_t bdaddr;
-        __u8     type;
-        __u8     out;
-        __u16    state;
-        __u32    link_mode;
-};
-
-struct hci_dev_req {
-        __u16  dev_id;
-        __u32  dev_opt;
-};
-
-struct hci_dev_list_req {
-        __u16  dev_num;
-        struct hci_dev_req dev_req[0];  /* hci_dev_req structures */
-};
-
-struct hci_conn_list_req {
-        __u16  dev_id;
-        __u16  conn_num;
-        struct hci_conn_info conn_info[0];
-};
-
-struct hci_conn_info_req {
-        bdaddr_t bdaddr;
-        __u8     type;
-        struct   hci_conn_info conn_info[0];
-};
-
-struct hci_auth_info_req {
-        bdaddr_t bdaddr;
-        __u8     type;
-};
-
-struct hci_inquiry_req {
-        __u16 dev_id;
-        __u16 flags;
-        __u8  lap[3];
-        __u8  length;
-        __u8  num_rsp;
-};
-#define IREQ_CACHE_FLUSH 0x0001
-
 #endif /* __HCI_H */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index e69c2b08c0c6..996ed065b6c2 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -26,6 +26,7 @@
 #define __HCI_CORE_H
 
 #include <net/bluetooth/hci.h>
+#include <net/bluetooth/hci_sock.h>
 
 /* HCI priority */
 #define HCI_PRIO_MAX    7
@@ -82,6 +83,7 @@ struct hci_conn_hash {
         unsigned int     amp_num;
         unsigned int     sco_num;
         unsigned int     le_num;
+        unsigned int     le_num_slave;
 };
 
 struct bdaddr_list {
@@ -370,6 +372,7 @@ struct hci_conn {
         __u16           state;
         __u8            mode;
         __u8            type;
+        __u8            role;
         bool            out;
         __u8            attempt;
         __u8            dev_class[3];
@@ -539,12 +542,12 @@ enum {
         HCI_CONN_POWER_SAVE,
         HCI_CONN_REMOTE_OOB,
         HCI_CONN_FLUSH_KEY,
-        HCI_CONN_MASTER,
         HCI_CONN_ENCRYPT,
         HCI_CONN_AUTH,
         HCI_CONN_SECURE,
         HCI_CONN_FIPS,
         HCI_CONN_STK_ENCRYPT,
+        HCI_CONN_AUTH_INITIATOR,
 };
 
 static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
@@ -574,6 +577,8 @@ static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
                 break;
         case LE_LINK:
                 h->le_num++;
+                if (c->role == HCI_ROLE_SLAVE)
+                        h->le_num_slave++;
                 break;
         case SCO_LINK:
         case ESCO_LINK:
@@ -598,6 +603,8 @@ static inline void hci_conn_hash_del(struct hci_dev *hdev, struct hci_conn *c)
                 break;
         case LE_LINK:
                 h->le_num--;
+                if (c->role == HCI_ROLE_SLAVE)
+                        h->le_num_slave--;
                 break;
         case SCO_LINK:
         case ESCO_LINK:
@@ -694,7 +701,8 @@ void hci_disconnect(struct hci_conn *conn, __u8 reason);
 bool hci_setup_sync(struct hci_conn *conn, __u16 handle);
 void hci_sco_setup(struct hci_conn *conn, __u8 status);
 
-struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst);
+struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
+                              u8 role);
 int hci_conn_del(struct hci_conn *conn);
 void hci_conn_hash_flush(struct hci_dev *hdev);
 void hci_conn_check_pending(struct hci_dev *hdev);
@@ -706,14 +714,15 @@ struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle);
 
 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
                                 u8 dst_type, u8 sec_level, u16 conn_timeout,
-                                bool master);
+                                u8 role);
 struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
                                  u8 sec_level, u8 auth_type);
 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
                                  __u16 setting);
 int hci_conn_check_link_mode(struct hci_conn *conn);
 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
-int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type);
+int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
+                      bool initiator);
 int hci_conn_change_link_key(struct hci_conn *conn);
 int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 
@@ -880,12 +889,12 @@ struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
                                   bdaddr_t *bdaddr, u8 *val, u8 type,
                                   u8 pin_len, bool *persistent);
 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, __le64 rand,
-                             bool master);
+                             u8 role);
 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
                             u8 addr_type, u8 type, u8 authenticated,
                             u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand);
 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                     u8 addr_type, bool master);
+                                     u8 addr_type, u8 role);
 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type);
 void hci_smp_ltks_clear(struct hci_dev *hdev);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
@@ -1239,6 +1248,7 @@ void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
                     const void *param, u8 event);
 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status);
+bool hci_req_pending(struct hci_dev *hdev);
 
 void hci_req_add_le_scan_disable(struct hci_request *req);
 void hci_req_add_le_passive_scan(struct hci_request *req);
@@ -1286,10 +1296,8 @@ void mgmt_index_added(struct hci_dev *hdev);
 void mgmt_index_removed(struct hci_dev *hdev);
 void mgmt_set_powered_failed(struct hci_dev *hdev, int err);
 int mgmt_powered(struct hci_dev *hdev, u8 powered);
+int mgmt_update_adv_data(struct hci_dev *hdev);
 void mgmt_discoverable_timeout(struct hci_dev *hdev);
-void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable);
-void mgmt_connectable(struct hci_dev *hdev, u8 connectable);
-void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status);
 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
                        bool persistent);
 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
@@ -1350,34 +1358,6 @@ void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
 void mgmt_reenable_advertising(struct hci_dev *hdev);
 void mgmt_smp_complete(struct hci_conn *conn, bool complete);
 
-/* HCI info for socket */
-#define hci_pi(sk) ((struct hci_pinfo *) sk)
-
-struct hci_pinfo {
-        struct bt_sock    bt;
-        struct hci_dev    *hdev;
-        struct hci_filter filter;
-        __u32             cmsg_mask;
-        unsigned short   channel;
-};
-
-/* HCI security filter */
-#define HCI_SFLT_MAX_OGF  5
-
-struct hci_sec_filter {
-        __u32 type_mask;
-        __u32 event_mask[2];
-        __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4];
-};
-
-/* ----- HCI requests ----- */
-#define HCI_REQ_DONE      0
-#define HCI_REQ_PEND      1
-#define HCI_REQ_CANCELED  2
-
-#define hci_req_lock(d)         mutex_lock(&d->req_lock)
-#define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
-
 u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
                       u16 to_multiplier);
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
diff --git a/include/net/bluetooth/hci_sock.h b/include/net/bluetooth/hci_sock.h
new file mode 100644
index 000000000000..9a46d665c1b5
--- /dev/null
+++ b/include/net/bluetooth/hci_sock.h
@@ -0,0 +1,175 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#ifndef __HCI_SOCK_H
+#define __HCI_SOCK_H
+
+/* Socket options */
+#define HCI_DATA_DIR    1
+#define HCI_FILTER      2
+#define HCI_TIME_STAMP  3
+
+/* CMSG flags */
+#define HCI_CMSG_DIR    0x0001
+#define HCI_CMSG_TSTAMP 0x0002
+
+struct sockaddr_hci {
+        sa_family_t    hci_family;
+        unsigned short hci_dev;
+        unsigned short hci_channel;
+};
+#define HCI_DEV_NONE    0xffff
+
+#define HCI_CHANNEL_RAW         0
+#define HCI_CHANNEL_USER        1
+#define HCI_CHANNEL_MONITOR     2
+#define HCI_CHANNEL_CONTROL     3
+
+struct hci_filter {
+        unsigned long type_mask;
+        unsigned long event_mask[2];
+        __le16 opcode;
+};
+
+struct hci_ufilter {
+        __u32  type_mask;
+        __u32  event_mask[2];
+        __le16 opcode;
+};
+
+#define HCI_FLT_TYPE_BITS       31
+#define HCI_FLT_EVENT_BITS      63
+#define HCI_FLT_OGF_BITS        63
+#define HCI_FLT_OCF_BITS        127
+
+/* Ioctl defines */
+#define HCIDEVUP        _IOW('H', 201, int)
+#define HCIDEVDOWN      _IOW('H', 202, int)
+#define HCIDEVRESET     _IOW('H', 203, int)
+#define HCIDEVRESTAT    _IOW('H', 204, int)
+
+#define HCIGETDEVLIST   _IOR('H', 210, int)
+#define HCIGETDEVINFO   _IOR('H', 211, int)
+#define HCIGETCONNLIST  _IOR('H', 212, int)
+#define HCIGETCONNINFO  _IOR('H', 213, int)
+#define HCIGETAUTHINFO  _IOR('H', 215, int)
+
+#define HCISETRAW       _IOW('H', 220, int)
+#define HCISETSCAN      _IOW('H', 221, int)
+#define HCISETAUTH      _IOW('H', 222, int)
+#define HCISETENCRYPT   _IOW('H', 223, int)
+#define HCISETPTYPE     _IOW('H', 224, int)
+#define HCISETLINKPOL   _IOW('H', 225, int)
+#define HCISETLINKMODE  _IOW('H', 226, int)
+#define HCISETACLMTU    _IOW('H', 227, int)
+#define HCISETSCOMTU    _IOW('H', 228, int)
+
+#define HCIBLOCKADDR    _IOW('H', 230, int)
+#define HCIUNBLOCKADDR  _IOW('H', 231, int)
+
+#define HCIINQUIRY      _IOR('H', 240, int)
+
+/* Ioctl requests structures */
+struct hci_dev_stats {
+        __u32 err_rx;
+        __u32 err_tx;
+        __u32 cmd_tx;
+        __u32 evt_rx;
+        __u32 acl_tx;
+        __u32 acl_rx;
+        __u32 sco_tx;
+        __u32 sco_rx;
+        __u32 byte_rx;
+        __u32 byte_tx;
+};
+
+struct hci_dev_info {
+        __u16 dev_id;
+        char  name[8];
+
+        bdaddr_t bdaddr;
+
+        __u32 flags;
+        __u8  type;
+
+        __u8  features[8];
+
+        __u32 pkt_type;
+        __u32 link_policy;
+        __u32 link_mode;
+
+        __u16 acl_mtu;
+        __u16 acl_pkts;
+        __u16 sco_mtu;
+        __u16 sco_pkts;
+
+        struct hci_dev_stats stat;
+};
+
+struct hci_conn_info {
+        __u16    handle;
+        bdaddr_t bdaddr;
+        __u8     type;
+        __u8     out;
+        __u16    state;
+        __u32    link_mode;
+};
+
+struct hci_dev_req {
+        __u16  dev_id;
+        __u32  dev_opt;
+};
+
+struct hci_dev_list_req {
+        __u16  dev_num;
+        struct hci_dev_req dev_req[0];  /* hci_dev_req structures */
+};
+
+struct hci_conn_list_req {
+        __u16  dev_id;
+        __u16  conn_num;
+        struct hci_conn_info conn_info[0];
+};
+
+struct hci_conn_info_req {
+        bdaddr_t bdaddr;
+        __u8     type;
+        struct   hci_conn_info conn_info[0];
+};
+
+struct hci_auth_info_req {
+        bdaddr_t bdaddr;
+        __u8     type;
+};
+
+struct hci_inquiry_req {
+        __u16 dev_id;
+        __u16 flags;
+        __u8  lap[3];
+        __u8  length;
+        __u8  num_rsp;
+};
+#define IREQ_CACHE_FLUSH 0x0001
+
+#endif /* __HCI_SOCK_H */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index e0c6a9abdb62..8df15ad0d43f 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -134,9 +134,12 @@ struct l2cap_conninfo {
 #define L2CAP_FCS_CRC16         0x01
 
 /* L2CAP fixed channels */
-#define L2CAP_FC_L2CAP          0x02
+#define L2CAP_FC_SIG_BREDR      0x02
 #define L2CAP_FC_CONNLESS       0x04
 #define L2CAP_FC_A2MP           0x08
+#define L2CAP_FC_ATT            0x10
+#define L2CAP_FC_SIG_LE         0x20
+#define L2CAP_FC_SMP_LE         0x40
 
 /* L2CAP Control Field bit masks */
 #define L2CAP_CTRL_SAR                  0xC000
@@ -622,11 +625,10 @@ struct l2cap_conn {
 
         struct delayed_work     info_timer;
 
-        spinlock_t              lock;
-
         struct sk_buff          *rx_skb;
         __u32                   rx_len;
         __u8                    tx_ident;
+        struct mutex            ident_lock;
 
         struct sk_buff_head     pending_rx;
         struct work_struct      pending_rx_work;
@@ -903,7 +905,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
                        bdaddr_t *dst, u8 dst_type);
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
 void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
-int l2cap_chan_check_security(struct l2cap_chan *chan);
+int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator);
 void l2cap_chan_set_defaults(struct l2cap_chan *chan);
 int l2cap_ertm_init(struct l2cap_chan *chan);
 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
diff --git a/include/net/bluetooth/sco.h b/include/net/bluetooth/sco.h
index 2019d1a0996a..f40ddb4264fc 100644
--- a/include/net/bluetooth/sco.h
+++ b/include/net/bluetooth/sco.h
@@ -27,11 +27,6 @@
 
 /* SCO defaults */
 #define SCO_DEFAULT_MTU         500
-#define SCO_DEFAULT_FLUSH_TO    0xFFFF
-
-#define SCO_CONN_TIMEOUT        (HZ * 40)
-#define SCO_DISCONN_TIMEOUT     (HZ * 2)
-#define SCO_CONN_IDLE_TIMEOUT   (HZ * 60)
 
 /* SCO socket address */
 struct sockaddr_sco {
@@ -51,29 +46,4 @@ struct sco_conninfo {
         __u8  dev_class[3];
 };
 
-/* ---- SCO connections ---- */
-struct sco_conn {
-        struct hci_conn *hcon;
-
-        spinlock_t      lock;
-        struct sock     *sk;
-
-        unsigned int    mtu;
-};
-
-#define sco_conn_lock(c)        spin_lock(&c->lock);
-#define sco_conn_unlock(c)      spin_unlock(&c->lock);
-
-/* ----- SCO socket info ----- */
-#define sco_pi(sk) ((struct sco_pinfo *) sk)
-
-struct sco_pinfo {
-        struct bt_sock  bt;
-        bdaddr_t        src;
-        bdaddr_t        dst;
-        __u32           flags;
-        __u16           setting;
-        struct sco_conn *conn;
-};
-
 #endif /* __SCO_H */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 9ce5cb17ed82..dae2e24616e1 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -4552,6 +4552,40 @@ void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
  */
 void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn);
 
+/**
+ * ieee80211_start_rx_ba_session_offl - start a Rx BA session
+ *
+ * Some device drivers may offload part of the Rx aggregation flow including
+ * AddBa/DelBa negotiation but may otherwise be incapable of full Rx
+ * reordering.
+ *
+ * Create structures responsible for reordering so device drivers may call here
+ * when they complete AddBa negotiation.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback
+ * @addr: station mac address
+ * @tid: the rx tid
+ */
+void ieee80211_start_rx_ba_session_offl(struct ieee80211_vif *vif,
+                                        const u8 *addr, u16 tid);
+
+/**
+ * ieee80211_stop_rx_ba_session_offl - stop a Rx BA session
+ *
+ * Some device drivers may offload part of the Rx aggregation flow including
+ * AddBa/DelBa negotiation but may otherwise be incapable of full Rx
+ * reordering.
+ *
+ * Destroy structures responsible for reordering so device drivers may call here
+ * when they complete DelBa negotiation.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback
+ * @addr: station mac address
+ * @tid: the rx tid
+ */
+void ieee80211_stop_rx_ba_session_offl(struct ieee80211_vif *vif,
+                                       const u8 *addr, u16 tid);
+
 /* Rate control API */
 
 /**