Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

John W. Linville says:

====================
Included is a Bluetooth pull -- Gustavo says:

"These are the Bluetooth bits for inclusion in 3.8, there is basically one big
thing here which is the High Speed patches from Andrei, he did a lot of work on
A2MP and management of AMP devices. The rest are mostly clean up and bug
fixes."

Also included is an NFC pull -- Samuel says:

"With this one we have:

- pn544 p2p support.
- pn544 physical and HCI layers separation. We are getting the pn544 driver
  ready to support non i2c physical layers.
- LLCP SNL (Service Name Lookup). This is the NFC p2p service discovery
  protocol.
- LLCP datagram sockets (connection less) support.
- IDR library usage for NFC devices indexes assignement.
- NFC netlink extension for setting and getting LLCP link characteristics.
- Various code style fixes and cleanups spread over the pn533, LLCP, HCI and
  pn544 code."

There are a couple of mac80211 pulls as well -- Johannes says:

"Please pull my mac80211-next tree to get the first round of new features
for 3.8. We have:
 * finally, the mac80211 multi-channel work
 * scan improvements:
   - bg scan
   - scan flush
   - forced AP scan
 * cfg80211 tracing
 * a bit of new code to allow implementing SAE (secure authentication of
   equals) in managed mode

Along with a few random improvements, features and fixes."

and...

"Please pull from mac80211-next (per below pull request) to get a few
updates. Most important is probably the fix for the WDS regression that
my previous pull request introduced. Other than that, I have some
tracing code, two mesh updates and a change to allow drivers to
calculate the AES CMAC subkeys without having to implement the GF_mulx
operation themselves."

On top of that are the usual updates to iwlwifi, ath9k, rt2x00,
brcmfmac, mwifiex, and a few others here and there.  Of note is the
addition of the ar5523 driver, ported from an original FreeBSD driver.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

18 files changed, 425 insertions, 35 deletions

diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 4180eb78d575..fd15d9829705 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -251,7 +251,7 @@ struct bcma_bus {
         u8 num;
 
         struct bcma_drv_cc drv_cc;
-        struct bcma_drv_pci drv_pci;
+        struct bcma_drv_pci drv_pci[2];
         struct bcma_drv_mips drv_mips;
         struct bcma_drv_gmac_cmn drv_gmac_cmn;
 
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 1cf1749440ac..145f3c56227f 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -510,6 +510,7 @@ struct bcma_chipcommon_pmu {
 
 #ifdef CONFIG_BCMA_DRIVER_MIPS
 struct bcma_pflash {
+        bool present;
         u8 buswidth;
         u32 window;
         u32 window_size;
@@ -532,6 +533,7 @@ struct mtd_info;
 
 struct bcma_nflash {
         bool present;
+        bool boot;              /* This is the flash the SoC boots from */
 
         struct mtd_info *mtd;
 };
@@ -552,6 +554,7 @@ struct bcma_drv_cc {
         u32 capabilities;
         u32 capabilities_ext;
         u8 setup_done:1;
+        u8 early_setup_done:1;
         /* Fast Powerup Delay constant */
         u16 fast_pwrup_delay;
         struct bcma_chipcommon_pmu pmu;
@@ -583,6 +586,7 @@ struct bcma_drv_cc {
         bcma_cc_write32(cc, offset, (bcma_cc_read32(cc, offset) & (mask)) | (set))
 
 extern void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
+extern void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
 
 extern void bcma_chipco_suspend(struct bcma_drv_cc *cc);
 extern void bcma_chipco_resume(struct bcma_drv_cc *cc);
@@ -606,6 +610,7 @@ u32 bcma_chipco_gpio_polarity(struct bcma_drv_cc *cc, u32 mask, u32 value);
 
 /* PMU support */
 extern void bcma_pmu_init(struct bcma_drv_cc *cc);
+extern void bcma_pmu_early_init(struct bcma_drv_cc *cc);
 
 extern void bcma_chipco_pll_write(struct bcma_drv_cc *cc, u32 offset,
                                   u32 value);
diff --git a/include/linux/bcma/bcma_driver_mips.h b/include/linux/bcma/bcma_driver_mips.h
index c0043645cdcb..0baf8a56b794 100644
--- a/include/linux/bcma/bcma_driver_mips.h
+++ b/include/linux/bcma/bcma_driver_mips.h
@@ -35,13 +35,16 @@ struct bcma_device;
 struct bcma_drv_mips {
         struct bcma_device *core;
         u8 setup_done:1;
+        u8 early_setup_done:1;
         unsigned int assigned_irqs;
 };
 
 #ifdef CONFIG_BCMA_DRIVER_MIPS
 extern void bcma_core_mips_init(struct bcma_drv_mips *mcore);
+extern void bcma_core_mips_early_init(struct bcma_drv_mips *mcore);
 #else
 static inline void bcma_core_mips_init(struct bcma_drv_mips *mcore) { }
+static inline void bcma_core_mips_early_init(struct bcma_drv_mips *mcore) { }
 #endif
 
 extern u32 bcma_cpu_clock(struct bcma_drv_mips *mcore);
diff --git a/include/linux/bcma/bcma_regs.h b/include/linux/bcma/bcma_regs.h
index 6c9cb93ae3de..7e8104bb7a7e 100644
--- a/include/linux/bcma/bcma_regs.h
+++ b/include/linux/bcma/bcma_regs.h
@@ -85,6 +85,9 @@
                                                          * (2 ZettaBytes), high 32 bits
                                                          */
 
-#define BCMA_SFLASH                     0x1c000000
+#define BCMA_SOC_FLASH1                 0x1fc00000      /* MIPS Flash Region 1 */
+#define BCMA_SOC_FLASH1_SZ              0x00400000      /* MIPS Size of Flash Region 1 */
+#define BCMA_SOC_FLASH2                 0x1c000000      /* Flash Region 2 (region 1 shadowed here) */
+#define BCMA_SOC_FLASH2_SZ              0x02000000      /* Size of Flash Region 2 */
 
 #endif /* LINUX_BCMA_REGS_H_ */
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 2385119f8bb0..85764a900731 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1107,20 +1107,6 @@ struct ieee80211_ht_operation {
 #define WLAN_HT_SMPS_CONTROL_STATIC     1
 #define WLAN_HT_SMPS_CONTROL_DYNAMIC    3
 
-#define VHT_MCS_SUPPORTED_SET_SIZE      8
-
-struct ieee80211_vht_capabilities {
-        __le32 vht_capabilities_info;
-        u8 vht_supported_mcs_set[VHT_MCS_SUPPORTED_SET_SIZE];
-} __packed;
-
-struct ieee80211_vht_operation {
-        u8 vht_op_info_chwidth;
-        u8 vht_op_info_chan_center_freq_seg1_idx;
-        u8 vht_op_info_chan_center_freq_seg2_idx;
-        __le16 vht_basic_mcs_set;
-} __packed;
-
 /**
  * struct ieee80211_vht_mcs_info - VHT MCS information
  * @rx_mcs_map: RX MCS map 2 bits for each stream, total 8 streams
@@ -1141,6 +1127,37 @@ struct ieee80211_vht_mcs_info {
         __le16 tx_highest;
 } __packed;
 
+/**
+ * struct ieee80211_vht_cap - VHT capabilities
+ *
+ * This structure is the "VHT capabilities element" as
+ * described in 802.11ac D3.0 8.4.2.160
+ * @vht_cap_info: VHT capability info
+ * @supp_mcs: VHT MCS supported rates
+ */
+struct ieee80211_vht_cap {
+        __le32 vht_cap_info;
+        struct ieee80211_vht_mcs_info supp_mcs;
+} __packed;
+
+/**
+ * struct ieee80211_vht_operation - VHT operation IE
+ *
+ * This structure is the "VHT operation element" as
+ * described in 802.11ac D3.0 8.4.2.161
+ * @chan_width: Operating channel width
+ * @center_freq_seg1_idx: center freq segment 1 index
+ * @center_freq_seg2_idx: center freq segment 2 index
+ * @basic_mcs_set: VHT Basic MCS rate set
+ */
+struct ieee80211_vht_operation {
+        u8 chan_width;
+        u8 center_freq_seg1_idx;
+        u8 center_freq_seg2_idx;
+        __le16 basic_mcs_set;
+} __packed;
+
+
 #define IEEE80211_VHT_MCS_ZERO_TO_SEVEN_SUPPORT 0
 #define IEEE80211_VHT_MCS_ZERO_TO_EIGHT_SUPPORT 1
 #define IEEE80211_VHT_MCS_ZERO_TO_NINE_SUPPORT  2
@@ -1440,8 +1457,6 @@ enum ieee80211_eid {
 
         WLAN_EID_RSN = 48,
         WLAN_EID_MMIE = 76,
-        WLAN_EID_WPA = 221,
-        WLAN_EID_GENERIC = 221,
         WLAN_EID_VENDOR_SPECIFIC = 221,
         WLAN_EID_QOS_PARAMETER = 222,
 
diff --git a/include/linux/ssb/ssb_driver_mips.h b/include/linux/ssb/ssb_driver_mips.h
index 5f44e9740cd2..07a9c7a2e088 100644
--- a/include/linux/ssb/ssb_driver_mips.h
+++ b/include/linux/ssb/ssb_driver_mips.h
@@ -13,6 +13,12 @@ struct ssb_serial_port {
         unsigned int reg_shift;
 };
 
+struct ssb_pflash {
+        bool present;
+        u8 buswidth;
+        u32 window;
+        u32 window_size;
+};
 
 struct ssb_mipscore {
         struct ssb_device *dev;
@@ -20,9 +26,7 @@ struct ssb_mipscore {
         int nr_serial_ports;
         struct ssb_serial_port serial_ports[4];
 
-        u8 flash_buswidth;
-        u32 flash_window;
-        u32 flash_window_size;
+        struct ssb_pflash pflash;
 };
 
 extern void ssb_mipscore_init(struct ssb_mipscore *mcore);
diff --git a/include/net/bluetooth/a2mp.h b/include/net/bluetooth/a2mp.h
index 6a76e0a0705e..42f21766c538 100644
--- a/include/net/bluetooth/a2mp.h
+++ b/include/net/bluetooth/a2mp.h
@@ -19,13 +19,25 @@
 
 #define A2MP_FEAT_EXT   0x8000
 
+enum amp_mgr_state {
+        READ_LOC_AMP_INFO,
+        READ_LOC_AMP_ASSOC,
+        READ_LOC_AMP_ASSOC_FINAL,
+};
+
 struct amp_mgr {
+        struct list_head        list;
         struct l2cap_conn       *l2cap_conn;
         struct l2cap_chan       *a2mp_chan;
+        struct l2cap_chan       *bredr_chan;
         struct kref             kref;
         __u8                    ident;
         __u8                    handle;
+        enum amp_mgr_state      state;
         unsigned long           flags;
+
+        struct list_head        amp_ctrls;
+        struct mutex            amp_ctrls_lock;
 };
 
 struct a2mp_cmd {
@@ -118,9 +130,19 @@ struct a2mp_physlink_rsp {
 #define A2MP_STATUS_PHYS_LINK_EXISTS            0x05
 #define A2MP_STATUS_SECURITY_VIOLATION          0x06
 
-void amp_mgr_get(struct amp_mgr *mgr);
+extern struct list_head amp_mgr_list;
+extern struct mutex amp_mgr_list_lock;
+
+struct amp_mgr *amp_mgr_get(struct amp_mgr *mgr);
 int amp_mgr_put(struct amp_mgr *mgr);
+u8 __next_ident(struct amp_mgr *mgr);
 struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
                                        struct sk_buff *skb);
+struct amp_mgr *amp_mgr_lookup_by_state(u8 state);
+void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len, void *data);
+void a2mp_discover_amp(struct l2cap_chan *chan);
+void a2mp_send_getinfo_rsp(struct hci_dev *hdev);
+void a2mp_send_getampassoc_rsp(struct hci_dev *hdev, u8 status);
+void a2mp_send_create_phy_link_req(struct hci_dev *hdev, u8 status);
 
 #endif /* __A2MP_H */
diff --git a/include/net/bluetooth/amp.h b/include/net/bluetooth/amp.h
new file mode 100644
index 000000000000..2e7c79ea0463
--- /dev/null
+++ b/include/net/bluetooth/amp.h
@@ -0,0 +1,50 @@
+/*
+   Copyright (c) 2011,2012 Intel Corp.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 and
+   only version 2 as published by the Free Software Foundation.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+*/
+
+#ifndef __AMP_H
+#define __AMP_H
+
+struct amp_ctrl {
+        struct list_head        list;
+        struct kref             kref;
+        __u8                    id;
+        __u16                   assoc_len_so_far;
+        __u16                   assoc_rem_len;
+        __u16                   assoc_len;
+        __u8                    *assoc;
+};
+
+int amp_ctrl_put(struct amp_ctrl *ctrl);
+void amp_ctrl_get(struct amp_ctrl *ctrl);
+struct amp_ctrl *amp_ctrl_add(struct amp_mgr *mgr, u8 id);
+struct amp_ctrl *amp_ctrl_lookup(struct amp_mgr *mgr, u8 id);
+void amp_ctrl_list_flush(struct amp_mgr *mgr);
+
+struct hci_conn *phylink_add(struct hci_dev *hdev, struct amp_mgr *mgr,
+                             u8 remote_id, bool out);
+
+int phylink_gen_key(struct hci_conn *hcon, u8 *data, u8 *len, u8 *type);
+
+void amp_read_loc_info(struct hci_dev *hdev, struct amp_mgr *mgr);
+void amp_read_loc_assoc_frag(struct hci_dev *hdev, u8 phy_handle);
+void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr);
+void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
+                                   struct hci_conn *hcon);
+void amp_create_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
+                        struct hci_conn *hcon);
+void amp_accept_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
+                        struct hci_conn *hcon);
+void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle);
+void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle);
+
+#endif /* __AMP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index ede036977ae8..2554b3f5222a 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -180,7 +180,6 @@ static inline void bacpy(bdaddr_t *dst, bdaddr_t *src)
 }
 
 void baswap(bdaddr_t *dst, bdaddr_t *src);
-char *batostr(bdaddr_t *ba);
 
 /* Common socket structures and functions */
 
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 76b2b6bdcf36..88cbbda61027 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -33,6 +33,8 @@
 #define HCI_LINK_KEY_SIZE       16
 #define HCI_AMP_LINK_KEY_SIZE   (2 * HCI_LINK_KEY_SIZE)
 
+#define HCI_MAX_AMP_ASSOC_SIZE  672
+
 /* HCI dev events */
 #define HCI_DEV_REG                     1
 #define HCI_DEV_UNREG                   2
@@ -196,6 +198,7 @@ enum {
 #define ACL_START_NO_FLUSH      0x00
 #define ACL_CONT                0x01
 #define ACL_START               0x02
+#define ACL_COMPLETE            0x03
 #define ACL_ACTIVE_BCAST        0x04
 #define ACL_PICO_BCAST          0x08
 
@@ -205,6 +208,7 @@ enum {
 #define ESCO_LINK       0x02
 /* Low Energy links do not have defined link type. Use invented one */
 #define LE_LINK         0x80
+#define AMP_LINK        0x81
 
 /* LMP features */
 #define LMP_3SLOT       0x01
@@ -556,12 +560,46 @@ struct hci_cp_accept_phy_link {
         __u8     key[HCI_AMP_LINK_KEY_SIZE];
 } __packed;
 
-#define HCI_OP_DISCONN_PHY_LINK 0x0437
+#define HCI_OP_DISCONN_PHY_LINK         0x0437
 struct hci_cp_disconn_phy_link {
         __u8     phy_handle;
         __u8     reason;
 } __packed;
 
+struct ext_flow_spec {
+        __u8       id;
+        __u8       stype;
+        __le16     msdu;
+        __le32     sdu_itime;
+        __le32     acc_lat;
+        __le32     flush_to;
+} __packed;
+
+#define HCI_OP_CREATE_LOGICAL_LINK      0x0438
+#define HCI_OP_ACCEPT_LOGICAL_LINK      0x0439
+struct hci_cp_create_accept_logical_link {
+        __u8                  phy_handle;
+        struct ext_flow_spec  tx_flow_spec;
+        struct ext_flow_spec  rx_flow_spec;
+} __packed;
+
+#define HCI_OP_DISCONN_LOGICAL_LINK     0x043a
+struct hci_cp_disconn_logical_link {
+        __le16   log_handle;
+} __packed;
+
+#define HCI_OP_LOGICAL_LINK_CANCEL      0x043b
+struct hci_cp_logical_link_cancel {
+        __u8     phy_handle;
+        __u8     flow_spec_id;
+} __packed;
+
+struct hci_rp_logical_link_cancel {
+        __u8     status;
+        __u8     phy_handle;
+        __u8     flow_spec_id;
+} __packed;
+
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
         __le16   handle;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index e7d454609881..9fe8e2dec870 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -73,6 +73,7 @@ struct discovery_state {
 struct hci_conn_hash {
         struct list_head list;
         unsigned int     acl_num;
+        unsigned int     amp_num;
         unsigned int     sco_num;
         unsigned int     le_num;
 };
@@ -124,6 +125,14 @@ struct le_scan_params {
 
 #define HCI_MAX_SHORT_NAME_LENGTH       10
 
+struct amp_assoc {
+        __u16   len;
+        __u16   offset;
+        __u16   rem_len;
+        __u16   len_so_far;
+        __u8    data[HCI_MAX_AMP_ASSOC_SIZE];
+};
+
 #define NUM_REASSEMBLY 4
 struct hci_dev {
         struct list_head list;
@@ -177,6 +186,8 @@ struct hci_dev {
         __u32           amp_max_flush_to;
         __u32           amp_be_flush_to;
 
+        struct amp_assoc        loc_assoc;
+
         __u8            flow_ctl_mode;
 
         unsigned int    auto_accept_delay;
@@ -252,8 +263,6 @@ struct hci_dev {
 
         struct sk_buff_head     driver_init;
 
-        void                    *core_data;
-
         atomic_t                promisc;
 
         struct dentry           *debugfs;
@@ -277,6 +286,8 @@ struct hci_dev {
         int (*ioctl)(struct hci_dev *hdev, unsigned int cmd, unsigned long arg);
 };
 
+#define HCI_PHY_HANDLE(handle)  (handle & 0xff)
+
 struct hci_conn {
         struct list_head list;
 
@@ -310,6 +321,7 @@ struct hci_conn {
 
         __u8            remote_cap;
         __u8            remote_auth;
+        __u8            remote_id;
         bool            flush_key;
 
         unsigned int    sent;
@@ -339,7 +351,7 @@ struct hci_conn {
 
 struct hci_chan {
         struct list_head list;
-
+        __u16 handle;
         struct hci_conn *conn;
         struct sk_buff_head data_q;
         unsigned int    sent;
@@ -438,6 +450,9 @@ static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
         case ACL_LINK:
                 h->acl_num++;
                 break;
+        case AMP_LINK:
+                h->amp_num++;
+                break;
         case LE_LINK:
                 h->le_num++;
                 break;
@@ -459,6 +474,9 @@ static inline void hci_conn_hash_del(struct hci_dev *hdev, struct hci_conn *c)
         case ACL_LINK:
                 h->acl_num--;
                 break;
+        case AMP_LINK:
+                h->amp_num--;
+                break;
         case LE_LINK:
                 h->le_num--;
                 break;
@@ -475,6 +493,8 @@ static inline unsigned int hci_conn_num(struct hci_dev *hdev, __u8 type)
         switch (type) {
         case ACL_LINK:
                 return h->acl_num;
+        case AMP_LINK:
+                return h->amp_num;
         case LE_LINK:
                 return h->le_num;
         case SCO_LINK:
@@ -556,6 +576,7 @@ void hci_conn_check_pending(struct hci_dev *hdev);
 struct hci_chan *hci_chan_create(struct hci_conn *conn);
 void hci_chan_del(struct hci_chan *chan);
 void hci_chan_list_flush(struct hci_conn *conn);
+struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle);
 
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
                              __u8 dst_type, __u8 sec_level, __u8 auth_type);
@@ -584,7 +605,10 @@ static inline void hci_conn_put(struct hci_conn *conn)
 
         if (atomic_dec_and_test(&conn->refcnt)) {
                 unsigned long timeo;
-                if (conn->type == ACL_LINK || conn->type == LE_LINK) {
+
+                switch (conn->type) {
+                case ACL_LINK:
+                case LE_LINK:
                         del_timer(&conn->idle_timer);
                         if (conn->state == BT_CONNECTED) {
                                 timeo = conn->disc_timeout;
@@ -593,12 +617,20 @@ static inline void hci_conn_put(struct hci_conn *conn)
                         } else {
                                 timeo = msecs_to_jiffies(10);
                         }
-                } else {
+                        break;
+
+                case AMP_LINK:
+                        timeo = conn->disc_timeout;
+                        break;
+
+                default:
                         timeo = msecs_to_jiffies(10);
+                        break;
                 }
+
                 cancel_delayed_work(&conn->disc_work);
                 queue_delayed_work(conn->hdev->workqueue,
-                                        &conn->disc_work, timeo);
+                                   &conn->disc_work, timeo);
         }
 }
 
@@ -789,6 +821,10 @@ static inline void hci_proto_disconn_cfm(struct hci_conn *conn, __u8 reason)
                 sco_disconn_cfm(conn, reason);
                 break;
 
+        /* L2CAP would be handled for BREDR chan */
+        case AMP_LINK:
+                break;
+
         default:
                 BT_ERR("unknown link type %d", conn->type);
                 break;
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 7ed8e356425a..6e23afdf65c1 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -32,13 +32,14 @@
 /* L2CAP defaults */
 #define L2CAP_DEFAULT_MTU               672
 #define L2CAP_DEFAULT_MIN_MTU           48
-#define L2CAP_DEFAULT_FLUSH_TO          0xffff
+#define L2CAP_DEFAULT_FLUSH_TO          0xFFFF
+#define L2CAP_EFS_DEFAULT_FLUSH_TO      0xFFFFFFFF
 #define L2CAP_DEFAULT_TX_WINDOW         63
 #define L2CAP_DEFAULT_EXT_WINDOW        0x3FFF
 #define L2CAP_DEFAULT_MAX_TX            3
 #define L2CAP_DEFAULT_RETRANS_TO        2000    /* 2 seconds */
 #define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
-#define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
+#define L2CAP_DEFAULT_MAX_PDU_SIZE      1492    /* Sized for AMP packet */
 #define L2CAP_DEFAULT_ACK_TO            200
 #define L2CAP_DEFAULT_MAX_SDU_SIZE      0xFFFF
 #define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
@@ -508,6 +509,8 @@ struct l2cap_chan {
         __u32           remote_acc_lat;
         __u32           remote_flush_to;
 
+        __u8            ctrl_id;
+
         struct delayed_work     chan_timer;
         struct delayed_work     retrans_timer;
         struct delayed_work     monitor_timer;
@@ -538,6 +541,7 @@ struct l2cap_ops {
         void                    (*state_change) (struct l2cap_chan *chan,
                                                  int state);
         void                    (*ready) (struct l2cap_chan *chan);
+        void                    (*defer) (struct l2cap_chan *chan);
         struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
                                                unsigned long len, int nb);
 };
@@ -745,6 +749,10 @@ static inline void l2cap_chan_no_ready(struct l2cap_chan *chan)
 {
 }
 
+static inline void l2cap_chan_no_defer(struct l2cap_chan *chan)
+{
+}
+
 extern bool disable_ertm;
 
 int l2cap_init_sockets(void);
@@ -767,6 +775,8 @@ int l2cap_chan_check_security(struct l2cap_chan *chan);
 void l2cap_chan_set_defaults(struct l2cap_chan *chan);
 int l2cap_ertm_init(struct l2cap_chan *chan);
 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
+void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
 void l2cap_chan_del(struct l2cap_chan *chan, int err);
+void l2cap_send_conn_req(struct l2cap_chan *chan);
 
 #endif /* __L2CAP_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 7d5b6000378b..c6964572890f 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -498,6 +498,7 @@ enum station_parameters_apply_mask {
  * @plink_action: plink action to take
  * @plink_state: set the peer link state for a station
  * @ht_capa: HT capabilities of station
+ * @vht_capa: VHT capabilities of station
  * @uapsd_queues: bitmap of queues configured for uapsd. same format
  *      as the AC bitmap in the QoS info field
  * @max_sp: max Service Period. same format as the MAX_SP in the
@@ -517,6 +518,7 @@ struct station_parameters {
         u8 plink_action;
         u8 plink_state;
         struct ieee80211_ht_cap *ht_capa;
+        struct ieee80211_vht_cap *vht_capa;
         u8 uapsd_queues;
         u8 max_sp;
 };
@@ -1000,8 +1002,10 @@ struct cfg80211_ssid {
  * @n_channels: total number of channels to scan
  * @ie: optional information element(s) to add into Probe Request or %NULL
  * @ie_len: length of ie in octets
+ * @flags: bit field of flags controlling operation
  * @rates: bitmap of rates to advertise for each band
  * @wiphy: the wiphy this was for
+ * @scan_start: time (in jiffies) when the scan started
  * @wdev: the wireless device to scan for
  * @aborted: (internal) scan request was notified as aborted
  * @no_cck: used to send probe requests at non CCK rate in 2GHz band
@@ -1012,6 +1016,7 @@ struct cfg80211_scan_request {
         u32 n_channels;
         const u8 *ie;
         size_t ie_len;
+        u32 flags;
 
         u32 rates[IEEE80211_NUM_BANDS];
 
@@ -1019,6 +1024,7 @@ struct cfg80211_scan_request {
 
         /* internal */
         struct wiphy *wiphy;
+        unsigned long scan_start;
         bool aborted;
         bool no_cck;
 
@@ -1044,6 +1050,7 @@ struct cfg80211_match_set {
  * @interval: interval between each scheduled scan cycle
  * @ie: optional information element(s) to add into Probe Request or %NULL
  * @ie_len: length of ie in octets
+ * @flags: bit field of flags controlling operation
  * @match_sets: sets of parameters to be matched for a scan result
  *      entry to be considered valid and to be passed to the host
  *      (others are filtered out).
@@ -1061,6 +1068,7 @@ struct cfg80211_sched_scan_request {
         u32 interval;
         const u8 *ie;
         size_t ie_len;
+        u32 flags;
         struct cfg80211_match_set *match_sets;
         int n_match_sets;
         s32 rssi_thold;
@@ -1068,6 +1076,7 @@ struct cfg80211_sched_scan_request {
         /* internal */
         struct wiphy *wiphy;
         struct net_device *dev;
+        unsigned long scan_start;
 
         /* keep last */
         struct ieee80211_channel *channels[0];
@@ -1152,6 +1161,9 @@ const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
  * @key_len: length of WEP key for shared key authentication
  * @key_idx: index of WEP key for shared key authentication
  * @key: WEP key for shared key authentication
+ * @sae_data: Non-IE data to use with SAE or %NULL. This starts with
+ *      Authentication transaction sequence number field.
+ * @sae_data_len: Length of sae_data buffer in octets
  */
 struct cfg80211_auth_request {
         struct cfg80211_bss *bss;
@@ -1160,6 +1172,8 @@ struct cfg80211_auth_request {
         enum nl80211_auth_type auth_type;
         const u8 *key;
         u8 key_len, key_idx;
+        const u8 *sae_data;
+        size_t sae_data_len;
 };
 
 /**
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 82558c8decf8..00b7204708bd 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -144,6 +144,41 @@ struct ieee80211_low_level_stats {
 };
 
 /**
+ * enum ieee80211_chanctx_change - change flag for channel context
+ * @IEEE80211_CHANCTX_CHANGE_CHANNEL_TYPE: The channel type was changed
+ * @IEEE80211_CHANCTX_CHANGE_RX_CHAINS: The number of RX chains changed
+ */
+enum ieee80211_chanctx_change {
+        IEEE80211_CHANCTX_CHANGE_CHANNEL_TYPE   = BIT(0),
+        IEEE80211_CHANCTX_CHANGE_RX_CHAINS      = BIT(1),
+};
+
+/**
+ * struct ieee80211_chanctx_conf - channel context that vifs may be tuned to
+ *
+ * This is the driver-visible part. The ieee80211_chanctx
+ * that contains it is visible in mac80211 only.
+ *
+ * @channel: the channel to tune to
+ * @channel_type: the channel (HT) type
+ * @rx_chains_static: The number of RX chains that must always be
+ *      active on the channel to receive MIMO transmissions
+ * @rx_chains_dynamic: The number of RX chains that must be enabled
+ *      after RTS/CTS handshake to receive SMPS MIMO transmissions;
+ *      this will always be >= @rx_chains_always.
+ * @drv_priv: data area for driver use, will always be aligned to
+ *      sizeof(void *), size is determined in hw information.
+ */
+struct ieee80211_chanctx_conf {
+        struct ieee80211_channel *channel;
+        enum nl80211_channel_type channel_type;
+
+        u8 rx_chains_static, rx_chains_dynamic;
+
+        u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
+};
+
+/**
  * enum ieee80211_bss_change - BSS change notification flags
  *
  * These flags are used with the bss_info_changed() callback
@@ -223,6 +258,7 @@ enum ieee80211_rssi_event {
  * @assoc: association status
  * @ibss_joined: indicates whether this station is part of an IBSS
  *      or not
+ * @ibss_creator: indicates if a new IBSS network is being created
  * @aid: association ID number, valid only when @assoc is true
  * @use_cts_prot: use CTS protection
  * @use_short_preamble: use 802.11b short preamble;
@@ -278,6 +314,7 @@ struct ieee80211_bss_conf {
         const u8 *bssid;
         /* association related data */
         bool assoc, ibss_joined;
+        bool ibss_creator;
         u16 aid;
         /* erp related data */
         bool use_cts_prot;
@@ -794,6 +831,8 @@ enum ieee80211_conf_flags {
  * @IEEE80211_CONF_CHANGE_RETRY_LIMITS: retry limits changed
  * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
  * @IEEE80211_CONF_CHANGE_SMPS: Spatial multiplexing powersave mode changed
+ *      Note that this is only valid if channel contexts are not used,
+ *      otherwise each channel context has the number of chains listed.
  */
 enum ieee80211_conf_changed {
         IEEE80211_CONF_CHANGE_SMPS              = BIT(1),
@@ -859,7 +898,9 @@ enum ieee80211_smps_mode {
  *
  * @smps_mode: spatial multiplexing powersave mode; note that
  *      %IEEE80211_SMPS_STATIC is used when the device is not
- *      configured for an HT channel
+ *      configured for an HT channel.
+ *      Note that this is only valid if channel contexts are not used,
+ *      otherwise each channel context has the number of chains listed.
  */
 struct ieee80211_conf {
         u32 flags;
@@ -931,6 +972,11 @@ enum ieee80211_vif_flags {
  *      at runtime, mac80211 will never touch this field
  * @hw_queue: hardware queue for each AC
  * @cab_queue: content-after-beacon (DTIM beacon really) queue, AP mode only
+ * @chanctx_conf: The channel context this interface is assigned to, or %NULL
+ *      when it is not assigned. This pointer is RCU-protected due to the TX
+ *      path needing to access it; even though the netdev carrier will always
+ *      be off when it is %NULL there can still be races and packets could be
+ *      processed after it switches back to %NULL.
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *).
  */
@@ -943,6 +989,8 @@ struct ieee80211_vif {
         u8 cab_queue;
         u8 hw_queue[IEEE80211_NUM_ACS];
 
+        struct ieee80211_chanctx_conf __rcu *chanctx_conf;
+
         u32 driver_flags;
 
         /* must be last */
@@ -1076,6 +1124,8 @@ enum ieee80211_sta_state {
  * @aid: AID we assigned to the station if we're an AP
  * @supp_rates: Bitmap of supported rates (per band)
  * @ht_cap: HT capabilities of this STA; restricted to our own TX capabilities
+ * @vht_cap: VHT capabilities of this STA; Not restricting any capabilities
+ *      of remote STA. Taking as is.
  * @wme: indicates whether the STA supports WME. Only valid during AP-mode.
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *), size is determined in hw information.
@@ -1088,6 +1138,7 @@ struct ieee80211_sta {
         u8 addr[ETH_ALEN];
         u16 aid;
         struct ieee80211_sta_ht_cap ht_cap;
+        struct ieee80211_sta_vht_cap vht_cap;
         bool wme;
         u8 uapsd_queues;
         u8 max_sp;
@@ -1325,6 +1376,8 @@ enum ieee80211_hw_flags {
  *      within &struct ieee80211_vif.
  * @sta_data_size: size (in bytes) of the drv_priv data area
  *      within &struct ieee80211_sta.
+ * @chanctx_data_size: size (in bytes) of the drv_priv data area
+ *      within &struct ieee80211_chanctx_conf.
  *
  * @max_rates: maximum number of alternate rate retry stages the hw
  *      can handle.
@@ -1369,6 +1422,7 @@ struct ieee80211_hw {
         int channel_change_time;
         int vif_data_size;
         int sta_data_size;
+        int chanctx_data_size;
         int napi_weight;
         u16 queues;
         u16 max_listen_interval;
@@ -2317,6 +2371,16 @@ enum ieee80211_rate_control_changed {
  *      The callback will be called before each transmission and upon return
  *      mac80211 will transmit the frame right away.
  *      The callback is optional and can (should!) sleep.
+ *
+ * @add_chanctx: Notifies device driver about new channel context creation.
+ * @remove_chanctx: Notifies device driver about channel context destruction.
+ * @change_chanctx: Notifies device driver about channel context changes that
+ *      may happen when combining different virtual interfaces on the same
+ *      channel context with different settings
+ * @assign_vif_chanctx: Notifies device driver about channel context being bound
+ *      to vif. Possible use is for hw queue remapping.
+ * @unassign_vif_chanctx: Notifies device driver about channel context being
+ *      unbound from vif.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw,
@@ -2461,6 +2525,20 @@ struct ieee80211_ops {
 
         void    (*mgd_prepare_tx)(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif);
+
+        int (*add_chanctx)(struct ieee80211_hw *hw,
+                           struct ieee80211_chanctx_conf *ctx);
+        void (*remove_chanctx)(struct ieee80211_hw *hw,
+                               struct ieee80211_chanctx_conf *ctx);
+        void (*change_chanctx)(struct ieee80211_hw *hw,
+                               struct ieee80211_chanctx_conf *ctx,
+                               u32 changed);
+        int (*assign_vif_chanctx)(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_chanctx_conf *ctx);
+        void (*unassign_vif_chanctx)(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_chanctx_conf *ctx);
 };
 
 /**
@@ -3145,6 +3223,19 @@ void ieee80211_get_tkip_p2k(struct ieee80211_key_conf *keyconf,
                             struct sk_buff *skb, u8 *p2k);
 
 /**
+ * ieee80211_aes_cmac_calculate_k1_k2 - calculate the AES-CMAC sub keys
+ *
+ * This function computes the two AES-CMAC sub-keys, based on the
+ * previously installed master key.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @k1: a buffer to be filled with the 1st sub-key
+ * @k2: a buffer to be filled with the 2nd sub-key
+ */
+void ieee80211_aes_cmac_calculate_k1_k2(struct ieee80211_key_conf *keyconf,
+                                        u8 *k1, u8 *k2);
+
+/**
  * struct ieee80211_key_seq - key sequence counter
  *
  * @tkip: TKIP data, containing IV32 and IV16 in host byte order
@@ -3524,6 +3615,27 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw,
                          void *iter_data);
 
 /**
+ * ieee80211_iter_chan_contexts_atomic - iterate channel contexts
+ * @hw: pointre obtained from ieee80211_alloc_hw().
+ * @iter: iterator function
+ * @iter_data: data passed to iterator function
+ *
+ * Iterate all active channel contexts. This function is atomic and
+ * doesn't acquire any locks internally that might be held in other
+ * places while calling into the driver.
+ *
+ * The iterator will not find a context that's being added (during
+ * the driver callback to add it) but will find it while it's being
+ * removed.
+ */
+void ieee80211_iter_chan_contexts_atomic(
+        struct ieee80211_hw *hw,
+        void (*iter)(struct ieee80211_hw *hw,
+                     struct ieee80211_chanctx_conf *chanctx_conf,
+                     void *data),
+        void *iter_data);
+
+/**
  * ieee80211_ap_probereq_get - retrieve a Probe Request template
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index e900072950cb..639f50af42df 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -24,6 +24,12 @@
 
 #include <net/nfc/nfc.h>
 
+struct nfc_phy_ops {
+        int (*write)(void *dev_id, struct sk_buff *skb);
+        int (*enable)(void *dev_id);
+        void (*disable)(void *dev_id);
+};
+
 struct nfc_hci_dev;
 
 struct nfc_hci_ops {
@@ -38,15 +44,21 @@ struct nfc_hci_ops {
         int (*xmit) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
         int (*start_poll) (struct nfc_hci_dev *hdev,
                            u32 im_protocols, u32 tm_protocols);
+        int (*dep_link_up)(struct nfc_hci_dev *hdev, struct nfc_target *target,
+                           u8 comm_mode, u8 *gb, size_t gb_len);
+        int (*dep_link_down)(struct nfc_hci_dev *hdev);
         int (*target_from_gate) (struct nfc_hci_dev *hdev, u8 gate,
                                  struct nfc_target *target);
         int (*complete_target_discovered) (struct nfc_hci_dev *hdev, u8 gate,
                                            struct nfc_target *target);
-        int (*data_exchange) (struct nfc_hci_dev *hdev,
+        int (*im_transceive) (struct nfc_hci_dev *hdev,
                               struct nfc_target *target, struct sk_buff *skb,
                               data_exchange_cb_t cb, void *cb_context);
+        int (*tm_send)(struct nfc_hci_dev *hdev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_hci_dev *hdev,
                               struct nfc_target *target);
+        void (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
+                                struct sk_buff *skb);
 };
 
 /* Pipes */
@@ -114,6 +126,9 @@ struct nfc_hci_dev {
         int async_cb_type;
         data_exchange_cb_t async_cb;
         void *async_cb_context;
+
+        u8 *gb;
+        size_t gb_len;
 };
 
 /* hci device allocation */
@@ -219,5 +234,6 @@ int nfc_hci_send_response(struct nfc_hci_dev *hdev, u8 gate, u8 response,
                           const u8 *param, size_t param_len);
 int nfc_hci_send_event(struct nfc_hci_dev *hdev, u8 gate, u8 event,
                        const u8 *param, size_t param_len);
+int nfc_hci_target_discovered(struct nfc_hci_dev *hdev, u8 gate);
 
 #endif /* __NET_HCI_H */
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index f05b10682c9d..fce80b2f9be7 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -95,7 +95,7 @@ struct nfc_genl_data {
 };
 
 struct nfc_dev {
-        unsigned int idx;
+        int idx;
         u32 target_next_idx;
         struct nfc_target *targets;
         int n_targets;
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index d908d17da56d..0e63cee8d810 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -60,6 +60,13 @@
  *      target mode.
  * @NFC_EVENT_DEVICE_DEACTIVATED: event emitted when the adapter is deactivated
  *      from target mode.
+ * @NFC_CMD_LLC_GET_PARAMS: request LTO, RW, and MIUX parameters for a device
+ * @NFC_CMD_LLC_SET_PARAMS: set one or more of LTO, RW, and MIUX parameters for
+ *      a device. LTO must be set before the link is up otherwise -EINPROGRESS
+ *      is returned. RW and MIUX can be set at anytime and will be passed in
+ *      subsequent CONNECT and CC messages.
+ *      If one of the passed parameters is wrong none is set and -EINVAL is
+ *      returned.
  */
 enum nfc_commands {
         NFC_CMD_UNSPEC,
@@ -77,6 +84,8 @@ enum nfc_commands {
         NFC_EVENT_TARGET_LOST,
         NFC_EVENT_TM_ACTIVATED,
         NFC_EVENT_TM_DEACTIVATED,
+        NFC_CMD_LLC_GET_PARAMS,
+        NFC_CMD_LLC_SET_PARAMS,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -102,6 +111,9 @@ enum nfc_commands {
  * @NFC_ATTR_RF_MODE: Initiator or target
  * @NFC_ATTR_IM_PROTOCOLS: Initiator mode protocols to poll for
  * @NFC_ATTR_TM_PROTOCOLS: Target mode protocols to listen for
+ * @NFC_ATTR_LLC_PARAM_LTO: Link TimeOut parameter
+ * @NFC_ATTR_LLC_PARAM_RW: Receive Window size parameter
+ * @NFC_ATTR_LLC_PARAM_MIUX: MIU eXtension parameter
  */
 enum nfc_attrs {
         NFC_ATTR_UNSPEC,
@@ -119,6 +131,9 @@ enum nfc_attrs {
         NFC_ATTR_DEVICE_POWERED,
         NFC_ATTR_IM_PROTOCOLS,
         NFC_ATTR_TM_PROTOCOLS,
+        NFC_ATTR_LLC_PARAM_LTO,
+        NFC_ATTR_LLC_PARAM_RW,
+        NFC_ATTR_LLC_PARAM_MIUX,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 7df9b500c804..617d0fbfc96f 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -1273,6 +1273,14 @@ enum nl80211_commands {
  *      the connection request from a station. nl80211_connect_failed_reason
  *      enum has different reasons of connection failure.
  *
+ * @NL80211_ATTR_SAE_DATA: SAE elements in Authentication frames. This starts
+ *      with the Authentication transaction sequence number field.
+ *
+ * @NL80211_ATTR_VHT_CAPABILITY: VHT Capability information element (from
+ *      association request when used with NL80211_CMD_NEW_STATION)
+ *
+ * @NL80211_ATTR_SCAN_FLAGS: scan request control flags (u32)
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1530,6 +1538,12 @@ enum nl80211_attrs {
 
         NL80211_ATTR_CONN_FAILED_REASON,
 
+        NL80211_ATTR_SAE_DATA,
+
+        NL80211_ATTR_VHT_CAPABILITY,
+
+        NL80211_ATTR_SCAN_FLAGS,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1573,6 +1587,7 @@ enum nl80211_attrs {
 #define NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY     16
 #define NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY     24
 #define NL80211_HT_CAPABILITY_LEN               26
+#define NL80211_VHT_CAPABILITY_LEN              12
 
 #define NL80211_MAX_NR_CIPHER_SUITES            5
 #define NL80211_MAX_NR_AKM_SUITES               2
@@ -2489,6 +2504,7 @@ enum nl80211_bss_status {
  * @NL80211_AUTHTYPE_SHARED_KEY: Shared Key authentication (WEP only)
  * @NL80211_AUTHTYPE_FT: Fast BSS Transition (IEEE 802.11r)
  * @NL80211_AUTHTYPE_NETWORK_EAP: Network EAP (some Cisco APs and mainly LEAP)
+ * @NL80211_AUTHTYPE_SAE: Simultaneous authentication of equals
  * @__NL80211_AUTHTYPE_NUM: internal
  * @NL80211_AUTHTYPE_MAX: maximum valid auth algorithm
  * @NL80211_AUTHTYPE_AUTOMATIC: determine automatically (if necessary by
@@ -2500,6 +2516,7 @@ enum nl80211_auth_type {
         NL80211_AUTHTYPE_SHARED_KEY,
         NL80211_AUTHTYPE_FT,
         NL80211_AUTHTYPE_NETWORK_EAP,
+        NL80211_AUTHTYPE_SAE,
 
         /* keep last */
         __NL80211_AUTHTYPE_NUM,
@@ -3028,6 +3045,12 @@ enum nl80211_ap_sme_features {
  *      in the interface combinations, even when it's only used for scan
  *      and remain-on-channel. This could be due to, for example, the
  *      remain-on-channel implementation requiring a channel context.
+ * @NL80211_FEATURE_SAE: This driver supports simultaneous authentication of
+ *      equals (SAE) with user space SME (NL80211_CMD_AUTHENTICATE) in station
+ *      mode
+ * @NL80211_FEATURE_LOW_PRIORITY_SCAN: This driver supports low priority scan
+ * @NL80211_FEATURE_SCAN_FLUSH: Scan flush is supported
+ * @NL80211_FEATURE_AP_SCAN: Support scanning using an AP vif
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -3035,6 +3058,10 @@ enum nl80211_feature_flags {
         NL80211_FEATURE_INACTIVITY_TIMER                = 1 << 2,
         NL80211_FEATURE_CELL_BASE_REG_HINTS             = 1 << 3,
         NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL        = 1 << 4,
+        NL80211_FEATURE_SAE                             = 1 << 5,
+        NL80211_FEATURE_LOW_PRIORITY_SCAN               = 1 << 6,
+        NL80211_FEATURE_SCAN_FLUSH                      = 1 << 7,
+        NL80211_FEATURE_AP_SCAN                         = 1 << 8,
 };
 
 /**
@@ -3069,4 +3096,25 @@ enum nl80211_connect_failed_reason {
         NL80211_CONN_FAIL_BLOCKED_CLIENT,
 };
 
+/**
+ * enum nl80211_scan_flags -  scan request control flags
+ *
+ * Scan request control flags are used to control the handling
+ * of NL80211_CMD_TRIGGER_SCAN and NL80211_CMD_START_SCHED_SCAN
+ * requests.
+ *
+ * @NL80211_SCAN_FLAG_LOW_PRIORITY: scan request has low priority
+ * @NL80211_SCAN_FLAG_FLUSH: flush cache before scanning
+ * @NL80211_SCAN_FLAG_AP: force a scan even if the interface is configured
+ *      as AP and the beaconing has already been configured. This attribute is
+ *      dangerous because will destroy stations performance as a lot of frames
+ *      will be lost while scanning off-channel, therefore it must be used only
+ *      when really needed
+ */
+enum nl80211_scan_flags {
+        NL80211_SCAN_FLAG_LOW_PRIORITY                  = 1<<0,
+        NL80211_SCAN_FLAG_FLUSH                         = 1<<1,
+        NL80211_SCAN_FLAG_AP                            = 1<<2,
+};
+
 #endif /* __LINUX_NL80211_H */