22 files changed, 277 insertions, 84 deletions

diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 74af192ef7ae..4cd59b95858f 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -270,6 +270,7 @@ header-y += netfilter_ipv4.h
 header-y += netfilter_ipv6.h
 header-y += netlink.h
 header-y += netrom.h
+header-y += nfc.h
 header-y += nfs.h
 header-y += nfs2.h
 header-y += nfs3.h
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 98bb2901d7b7..8deaf6d050c3 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -26,6 +26,11 @@ struct bcma_chipinfo {
         u8 pkg;
 };
 
+struct bcma_boardinfo {
+        u16 vendor;
+        u16 type;
+};
+
 enum bcma_clkmode {
         BCMA_CLKMODE_FAST,
         BCMA_CLKMODE_DYNAMIC,
@@ -199,6 +204,8 @@ struct bcma_bus {
 
         struct bcma_chipinfo chipinfo;
 
+        struct bcma_boardinfo boardinfo;
+
         struct bcma_device *mapped_core;
         struct list_head cores;
         u8 nr_cores;
diff --git a/include/linux/bcma/bcma_driver_pci.h b/include/linux/bcma/bcma_driver_pci.h
index 46c71e27d31f..41da581e1612 100644
--- a/include/linux/bcma/bcma_driver_pci.h
+++ b/include/linux/bcma/bcma_driver_pci.h
@@ -87,6 +87,13 @@ struct pci_dev;
 #define BCMA_CORE_PCI_PCICFG2                   0x0600  /* PCI config space 2 (rev >= 8) */
 #define BCMA_CORE_PCI_PCICFG3                   0x0700  /* PCI config space 3 (rev >= 8) */
 #define BCMA_CORE_PCI_SPROM(wordoffset)         (0x0800 + ((wordoffset) * 2)) /* SPROM shadow area (72 bytes) */
+#define  BCMA_CORE_PCI_SPROM_PI_OFFSET          0       /* first word */
+#define   BCMA_CORE_PCI_SPROM_PI_MASK           0xf000  /* bit 15:12 */
+#define   BCMA_CORE_PCI_SPROM_PI_SHIFT          12      /* bit 15:12 */
+#define  BCMA_CORE_PCI_SPROM_MISC_CONFIG        5       /* word 5 */
+#define   BCMA_CORE_PCI_SPROM_L23READY_EXIT_NOPERST     0x8000  /* bit 15 */
+#define   BCMA_CORE_PCI_SPROM_CLKREQ_OFFSET_REV5        20      /* word 20 for srom rev <= 5 */
+#define   BCMA_CORE_PCI_SPROM_CLKREQ_ENB        0x0800  /* bit 11 */
 
 /* SBtoPCIx */
 #define BCMA_CORE_PCI_SBTOPCI_MEM               0x00000000
@@ -133,6 +140,7 @@ struct pci_dev;
 #define BCMA_CORE_PCI_DLLP_LRREG                0x120   /* Link Replay */
 #define BCMA_CORE_PCI_DLLP_LACKTOREG            0x124   /* Link Ack Timeout */
 #define BCMA_CORE_PCI_DLLP_PMTHRESHREG          0x128   /* Power Management Threshold */
+#define  BCMA_CORE_PCI_ASPMTIMER_EXTEND         0x01000000 /* > rev7: enable extend ASPM timer */
 #define BCMA_CORE_PCI_DLLP_RTRYWPREG            0x12C   /* Retry buffer write ptr */
 #define BCMA_CORE_PCI_DLLP_RTRYRPREG            0x130   /* Retry buffer Read ptr */
 #define BCMA_CORE_PCI_DLLP_RTRYPPREG            0x134   /* Retry buffer Purged ptr */
@@ -201,12 +209,15 @@ struct bcma_drv_pci {
 };
 
 /* Register access */
+#define pcicore_read16(pc, offset)              bcma_read16((pc)->core, offset)
 #define pcicore_read32(pc, offset)              bcma_read32((pc)->core, offset)
+#define pcicore_write16(pc, offset, val)        bcma_write16((pc)->core, offset, val)
 #define pcicore_write32(pc, offset, val)        bcma_write32((pc)->core, offset, val)
 
 extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
 extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
                                  struct bcma_device *core, bool enable);
+extern void bcma_core_pci_extend_L1timer(struct bcma_drv_pci *pc, bool extend);
 
 extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
 extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index 66d3e954eb6c..1a0cd270bb7a 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -154,7 +154,8 @@ extern void *alloc_large_system_hash(const char *tablename,
                                      int flags,
                                      unsigned int *_hash_shift,
                                      unsigned int *_hash_mask,
-                                     unsigned long limit);
+                                     unsigned long low_limit,
+                                     unsigned long high_limit);
 
 #define HASH_EARLY      0x00000001      /* Allocating during early boot? */
 #define HASH_SMALL      0x00000002      /* sub-page allocation allowed, min
diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
index 26cb3c2c5c71..f0e69c6e8208 100644
--- a/include/linux/if_arp.h
+++ b/include/linux/if_arp.h
@@ -82,7 +82,7 @@
 #define ARPHRD_FCPL     786             /* Fibrechannel public loop     */
 #define ARPHRD_FCFABRIC 787             /* Fibrechannel fabric          */
         /* 787->799 reserved for fibrechannel media types */
-/* 800 used to be used for token ring */
+#define ARPHRD_IEEE802_TR 800           /* Magic type ident for TR      */
 #define ARPHRD_IEEE80211 801            /* IEEE 802.11                  */
 #define ARPHRD_IEEE80211_PRISM 802      /* IEEE 802.11 + Prism2 header  */
 #define ARPHRD_IEEE80211_RADIOTAP 803   /* IEEE 802.11 + radiotap header */
diff --git a/include/linux/ipx.h b/include/linux/ipx.h
index 8f0243982eb6..3d48014cdd71 100644
--- a/include/linux/ipx.h
+++ b/include/linux/ipx.h
@@ -38,7 +38,7 @@ struct ipx_interface_definition {
 #define IPX_FRAME_8022          2
 #define IPX_FRAME_ETHERII       3
 #define IPX_FRAME_8023          4
-/* obsolete token ring was      5 */
+#define IPX_FRAME_TR_8022       5 /* obsolete */
         unsigned char ipx_special;
 #define IPX_SPECIAL_NONE        0
 #define IPX_PRIMARY             1
diff --git a/include/linux/micrel_phy.h b/include/linux/micrel_phy.h
index dd8da342a991..61f0905bdc48 100644
--- a/include/linux/micrel_phy.h
+++ b/include/linux/micrel_phy.h
@@ -3,7 +3,7 @@
 
 #define MICREL_PHY_ID_MASK      0x00fffff0
 
-#define PHY_ID_KSZ9021          0x00221611
+#define PHY_ID_KSZ9021          0x00221610
 #define PHY_ID_KS8737           0x00221720
 #define PHY_ID_KS8041           0x00221510
 #define PHY_ID_KS8051           0x00221550
diff --git a/include/linux/nfc/pn544.h b/include/linux/nfc/pn544.h
index 7ab8521f2347..9890bbaf4328 100644
--- a/include/linux/nfc/pn544.h
+++ b/include/linux/nfc/pn544.h
@@ -84,6 +84,12 @@ struct pn544_fw_packet {
 };
 
 #ifdef __KERNEL__
+enum {
+        NFC_GPIO_ENABLE,
+        NFC_GPIO_FW_RESET,
+        NFC_GPIO_IRQ
+};
+
 /* board config */
 struct pn544_nfc_platform_data {
         int (*request_resources) (struct i2c_client *client);
@@ -91,6 +97,7 @@ struct pn544_nfc_platform_data {
         void (*enable) (int fw);
         int (*test) (void);
         void (*disable) (void);
+        int (*get_gpio)(int type);
 };
 #endif /* __KERNEL__ */
 
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 2540e86d99ab..a6959f72745e 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -1594,6 +1594,8 @@ enum nl80211_sta_flags {
         NL80211_STA_FLAG_MAX = __NL80211_STA_FLAG_AFTER_LAST - 1
 };
 
+#define NL80211_STA_FLAG_MAX_OLD_API    NL80211_STA_FLAG_TDLS_PEER
+
 /**
  * struct nl80211_sta_flag_update - station flags mask/set
  * @mask: mask of station flags to set
@@ -1994,9 +1996,9 @@ enum nl80211_reg_rule_flags {
  * enum nl80211_dfs_regions - regulatory DFS regions
  *
  * @NL80211_DFS_UNSET: Country has no DFS master region specified
- * @NL80211_DFS_FCC_: Country follows DFS master rules from FCC
- * @NL80211_DFS_FCC_: Country follows DFS master rules from ETSI
- * @NL80211_DFS_JP_: Country follows DFS master rules from JP/MKK/Telec
+ * @NL80211_DFS_FCC: Country follows DFS master rules from FCC
+ * @NL80211_DFS_ETSI: Country follows DFS master rules from ETSI
+ * @NL80211_DFS_JP: Country follows DFS master rules from JP/MKK/Telec
  */
 enum nl80211_dfs_regions {
         NL80211_DFS_UNSET       = 0,
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index d27683180025..bc14bd738ade 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -188,7 +188,6 @@ struct ssb_sprom {
 struct ssb_boardinfo {
         u16 vendor;
         u16 type;
-        u8  rev;
 };
 
 
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index 40b1ef8595ee..a0525019e1d1 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -228,6 +228,7 @@
 #define  SSB_SPROM1_AGAIN_BG_SHIFT      0
 #define  SSB_SPROM1_AGAIN_A             0xFF00  /* A-PHY */
 #define  SSB_SPROM1_AGAIN_A_SHIFT       8
+#define SSB_SPROM1_CCODE                0x0076
 
 /* SPROM Revision 2 (inherits from rev 1) */
 #define SSB_SPROM2_BFLHI                0x0038  /* Boardflags (high 16 bits) */
@@ -267,6 +268,7 @@
 #define  SSB_SPROM3_OFDMGPO             0x107A  /* G-PHY OFDM Power Offset (4 bytes, BigEndian) */
 
 /* SPROM Revision 4 */
+#define SSB_SPROM4_BOARDREV             0x0042  /* Board revision */
 #define SSB_SPROM4_BFLLO                0x0044  /* Boardflags (low 16 bits) */
 #define SSB_SPROM4_BFLHI                0x0046  /* Board Flags Hi */
 #define SSB_SPROM4_BFL2LO               0x0048  /* Board flags 2 (low 16 bits) */
@@ -389,6 +391,11 @@
 #define  SSB_SPROM8_GPIOB_P2            0x00FF  /* Pin 2 */
 #define  SSB_SPROM8_GPIOB_P3            0xFF00  /* Pin 3 */
 #define  SSB_SPROM8_GPIOB_P3_SHIFT      8
+#define SSB_SPROM8_LEDDC                0x009A
+#define  SSB_SPROM8_LEDDC_ON            0xFF00  /* oncount */
+#define  SSB_SPROM8_LEDDC_ON_SHIFT      8
+#define  SSB_SPROM8_LEDDC_OFF           0x00FF  /* offcount */
+#define  SSB_SPROM8_LEDDC_OFF_SHIFT     0
 #define SSB_SPROM8_ANTAVAIL             0x009C  /* Antenna available bitfields*/
 #define  SSB_SPROM8_ANTAVAIL_A          0xFF00  /* A-PHY bitfield */
 #define  SSB_SPROM8_ANTAVAIL_A_SHIFT    8
@@ -404,6 +411,13 @@
 #define  SSB_SPROM8_AGAIN2_SHIFT        0
 #define  SSB_SPROM8_AGAIN3              0xFF00  /* Antenna 3 */
 #define  SSB_SPROM8_AGAIN3_SHIFT        8
+#define SSB_SPROM8_TXRXC                0x00A2
+#define  SSB_SPROM8_TXRXC_TXCHAIN       0x000f
+#define  SSB_SPROM8_TXRXC_TXCHAIN_SHIFT 0
+#define  SSB_SPROM8_TXRXC_RXCHAIN       0x00f0
+#define  SSB_SPROM8_TXRXC_RXCHAIN_SHIFT 4
+#define  SSB_SPROM8_TXRXC_SWITCH        0xff00
+#define  SSB_SPROM8_TXRXC_SWITCH_SHIFT  8
 #define SSB_SPROM8_RSSIPARM2G           0x00A4  /* RSSI params for 2GHz */
 #define  SSB_SPROM8_RSSISMF2G           0x000F
 #define  SSB_SPROM8_RSSISMC2G           0x00F0
@@ -430,6 +444,7 @@
 #define  SSB_SPROM8_TRI5GH_SHIFT        8
 #define SSB_SPROM8_RXPO                 0x00AC  /* RX power offsets */
 #define  SSB_SPROM8_RXPO2G              0x00FF  /* 2GHz RX power offset */
+#define  SSB_SPROM8_RXPO2G_SHIFT        0
 #define  SSB_SPROM8_RXPO5G              0xFF00  /* 5GHz RX power offset */
 #define  SSB_SPROM8_RXPO5G_SHIFT        8
 #define SSB_SPROM8_FEM2G                0x00AE
@@ -445,10 +460,38 @@
 #define  SSB_SROM8_FEM_ANTSWLUT         0xF800
 #define  SSB_SROM8_FEM_ANTSWLUT_SHIFT   11
 #define SSB_SPROM8_THERMAL              0x00B2
-#define SSB_SPROM8_MPWR_RAWTS           0x00B4
-#define SSB_SPROM8_TS_SLP_OPT_CORRX     0x00B6
-#define SSB_SPROM8_FOC_HWIQ_IQSWP       0x00B8
-#define SSB_SPROM8_PHYCAL_TEMPDELTA     0x00BA
+#define  SSB_SPROM8_THERMAL_OFFSET      0x00ff
+#define  SSB_SPROM8_THERMAL_OFFSET_SHIFT        0
+#define  SSB_SPROM8_THERMAL_TRESH       0xff00
+#define  SSB_SPROM8_THERMAL_TRESH_SHIFT 8
+/* Temp sense related entries */
+#define SSB_SPROM8_RAWTS                0x00B4
+#define  SSB_SPROM8_RAWTS_RAWTEMP       0x01ff
+#define  SSB_SPROM8_RAWTS_RAWTEMP_SHIFT 0
+#define  SSB_SPROM8_RAWTS_MEASPOWER     0xfe00
+#define  SSB_SPROM8_RAWTS_MEASPOWER_SHIFT       9
+#define SSB_SPROM8_OPT_CORRX            0x00B6
+#define  SSB_SPROM8_OPT_CORRX_TEMP_SLOPE        0x00ff
+#define  SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT  0
+#define  SSB_SPROM8_OPT_CORRX_TEMPCORRX 0xfc00
+#define  SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT   10
+#define  SSB_SPROM8_OPT_CORRX_TEMP_OPTION       0x0300
+#define  SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT 8
+/* FOC: freiquency offset correction, HWIQ: H/W IOCAL enable, IQSWP: IQ CAL swap disable */
+#define SSB_SPROM8_HWIQ_IQSWP           0x00B8
+#define  SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR        0x000f
+#define  SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT  0
+#define  SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP        0x0010
+#define  SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT  4
+#define  SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL 0x0020
+#define  SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT   5
+#define SSB_SPROM8_TEMPDELTA            0x00BA
+#define  SSB_SPROM8_TEMPDELTA_PHYCAL    0x00ff
+#define  SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT      0
+#define  SSB_SPROM8_TEMPDELTA_PERIOD    0x0f00
+#define  SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT      8
+#define  SSB_SPROM8_TEMPDELTA_HYSTERESIS        0xf000
+#define  SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT  12
 
 /* There are 4 blocks with power info sharing the same layout */
 #define SSB_SROM8_PWR_INFO_CORE0        0x00C0
@@ -513,6 +556,16 @@
 #define SSB_SPROM8_OFDM5GLPO            0x014A  /* 5.2GHz OFDM power offset */
 #define SSB_SPROM8_OFDM5GHPO            0x014E  /* 5.8GHz OFDM power offset */
 
+#define SSB_SPROM8_2G_MCSPO             0x0152
+#define SSB_SPROM8_5G_MCSPO             0x0162
+#define SSB_SPROM8_5GL_MCSPO            0x0172
+#define SSB_SPROM8_5GH_MCSPO            0x0182
+
+#define SSB_SPROM8_CDDPO                0x0192
+#define SSB_SPROM8_STBCPO               0x0194
+#define SSB_SPROM8_BW40PO               0x0196
+#define SSB_SPROM8_BWDUPPO              0x0198
+
 /* Values for boardflags_lo read from SPROM */
 #define SSB_BFL_BTCOEXIST               0x0001  /* implements Bluetooth coexistance */
 #define SSB_BFL_PACTRL                  0x0002  /* GPIO 9 controlling the PA */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index a65910bda381..961669b648fd 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -163,6 +163,11 @@ typedef struct {
         __u8 b[6];
 } __packed bdaddr_t;
 
+/* BD Address type */
+#define BDADDR_BREDR            0x00
+#define BDADDR_LE_PUBLIC        0x01
+#define BDADDR_LE_RANDOM        0x02
+
 #define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0}})
 #define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff}})
 
@@ -178,7 +183,6 @@ static inline void bacpy(bdaddr_t *dst, bdaddr_t *src)
 
 void baswap(bdaddr_t *dst, bdaddr_t *src);
 char *batostr(bdaddr_t *ba);
-bdaddr_t *strtoba(char *str);
 
 /* Common socket structures and functions */
 
@@ -190,8 +194,12 @@ struct bt_sock {
         bdaddr_t    dst;
         struct list_head accept_q;
         struct sock *parent;
-        u32 defer_setup;
-        bool suspended;
+        unsigned long flags;
+};
+
+enum {
+        BT_SK_DEFER_SETUP,
+        BT_SK_SUSPEND,
 };
 
 struct bt_sock_list {
@@ -216,14 +224,24 @@ void bt_accept_unlink(struct sock *sk);
 struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
 
 /* Skb helpers */
+struct l2cap_ctrl {
+        unsigned int    sframe  : 1,
+                        poll    : 1,
+                        final   : 1,
+                        fcs     : 1,
+                        sar     : 2,
+                        super   : 2;
+        __u16           reqseq;
+        __u16           txseq;
+        __u8            retries;
+};
+
 struct bt_skb_cb {
         __u8 pkt_type;
         __u8 incoming;
         __u16 expect;
-        __u16 tx_seq;
-        __u8 retries;
-        __u8 sar;
         __u8 force_active;
+        struct l2cap_ctrl control;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
 
@@ -243,12 +261,10 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk,
 {
         struct sk_buff *skb;
 
-        release_sock(sk);
         if ((skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err))) {
                 skb_reserve(skb, BT_SKB_RESERVE);
                 bt_cb(skb)->incoming  = 0;
         }
-        lock_sock(sk);
 
         if (!skb && *err)
                 return NULL;
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index d47e523c9d83..66a7b579e31c 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -102,6 +102,7 @@ enum {
         HCI_DISCOVERABLE,
         HCI_LINK_SECURITY,
         HCI_PENDING_CLASS,
+        HCI_PERIODIC_INQ,
 };
 
 /* HCI ioctl defines */
@@ -324,6 +325,8 @@ struct hci_cp_inquiry {
 
 #define HCI_OP_INQUIRY_CANCEL           0x0402
 
+#define HCI_OP_PERIODIC_INQ             0x0403
+
 #define HCI_OP_EXIT_PERIODIC_INQ        0x0404
 
 #define HCI_OP_CREATE_CONN              0x0405
@@ -717,6 +720,10 @@ struct hci_rp_read_local_oob_data {
 } __packed;
 
 #define HCI_OP_READ_INQ_RSP_TX_POWER    0x0c58
+struct hci_rp_read_inq_rsp_tx_power {
+        __u8     status;
+        __s8     tx_power;
+} __packed;
 
 #define HCI_OP_READ_FLOW_CONTROL_MODE   0x0c66
 struct hci_rp_read_flow_control_mode {
@@ -1431,6 +1438,5 @@ struct hci_inquiry_req {
 #define IREQ_CACHE_FLUSH 0x0001
 
 extern bool enable_hs;
-extern bool enable_le;
 
 #endif /* __HCI_H */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index db1c5df45224..9fc7728f94e4 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -155,9 +155,14 @@ struct hci_dev {
         __u16           hci_rev;
         __u8            lmp_ver;
         __u16           manufacturer;
-        __le16          lmp_subver;
+        __u16           lmp_subver;
         __u16           voice_setting;
         __u8            io_capability;
+        __s8            inq_tx_power;
+        __u16           devid_source;
+        __u16           devid_vendor;
+        __u16           devid_product;
+        __u16           devid_version;
 
         __u16           pkt_type;
         __u16           esco_type;
@@ -250,9 +255,6 @@ struct hci_dev {
 
         struct list_head        remote_oob_data;
 
-        struct list_head        adv_entries;
-        struct delayed_work     adv_work;
-
         struct hci_dev_stats    stat;
 
         struct sk_buff_head     driver_init;
@@ -263,7 +265,6 @@ struct hci_dev {
 
         struct dentry           *debugfs;
 
-        struct device           *parent;
         struct device           dev;
 
         struct rfkill           *rfkill;
@@ -571,7 +572,7 @@ int hci_chan_del(struct hci_chan *chan);
 void hci_chan_list_flush(struct hci_conn *conn);
 
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
-                                                __u8 sec_level, __u8 auth_type);
+                             __u8 dst_type, __u8 sec_level, __u8 auth_type);
 int hci_conn_check_link_mode(struct hci_conn *conn);
 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type);
@@ -673,8 +674,8 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                      bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
 int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
-                int new_key, u8 authenticated, u8 tk[16], u8 enc_size, u16 ediv,
-                u8 rand[8]);
+                int new_key, u8 authenticated, u8 tk[16], u8 enc_size,
+                __le16 ediv, u8 rand[8]);
 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                      u8 addr_type);
 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr);
@@ -688,14 +689,6 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
                                                                 u8 *randomizer);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
-#define ADV_CLEAR_TIMEOUT (3*60*HZ) /* Three minutes */
-int hci_adv_entries_clear(struct hci_dev *hdev);
-struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr);
-int hci_add_adv_entry(struct hci_dev *hdev,
-                                        struct hci_ev_le_advertising_info *ev);
-
-void hci_del_off_timer(struct hci_dev *hdev);
-
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
 
 int hci_recv_frame(struct sk_buff *skb);
@@ -709,7 +702,7 @@ void hci_conn_init_sysfs(struct hci_conn *conn);
 void hci_conn_add_sysfs(struct hci_conn *conn);
 void hci_conn_del_sysfs(struct hci_conn *conn);
 
-#define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->parent = (pdev))
+#define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->dev.parent = (pdev))
 
 /* ----- LMP capabilities ----- */
 #define lmp_rswitch_capable(dev)   ((dev)->features[0] & LMP_RSWITCH)
@@ -933,6 +926,23 @@ static inline bool eir_has_data_type(u8 *data, size_t data_len, u8 type)
         return false;
 }
 
+static inline size_t eir_get_length(u8 *eir, size_t eir_len)
+{
+        size_t parsed = 0;
+
+        while (parsed < eir_len) {
+                u8 field_len = eir[0];
+
+                if (field_len == 0)
+                        return parsed;
+
+                parsed += field_len + 1;
+                eir += field_len + 1;
+        }
+
+        return eir_len;
+}
+
 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
                                   u8 data_len)
 {
@@ -961,17 +971,12 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb);
 void hci_sock_dev_event(struct hci_dev *hdev, int event);
 
 /* Management interface */
-#define MGMT_ADDR_BREDR                 0x00
-#define MGMT_ADDR_LE_PUBLIC             0x01
-#define MGMT_ADDR_LE_RANDOM             0x02
-#define MGMT_ADDR_INVALID               0xff
-
-#define DISCOV_TYPE_BREDR               (BIT(MGMT_ADDR_BREDR))
-#define DISCOV_TYPE_LE                  (BIT(MGMT_ADDR_LE_PUBLIC) | \
-                                                BIT(MGMT_ADDR_LE_RANDOM))
-#define DISCOV_TYPE_INTERLEAVED         (BIT(MGMT_ADDR_BREDR) | \
-                                                BIT(MGMT_ADDR_LE_PUBLIC) | \
-                                                BIT(MGMT_ADDR_LE_RANDOM))
+#define DISCOV_TYPE_BREDR               (BIT(BDADDR_BREDR))
+#define DISCOV_TYPE_LE                  (BIT(BDADDR_LE_PUBLIC) | \
+                                         BIT(BDADDR_LE_RANDOM))
+#define DISCOV_TYPE_INTERLEAVED         (BIT(BDADDR_BREDR) | \
+                                         BIT(BDADDR_LE_PUBLIC) | \
+                                         BIT(BDADDR_LE_RANDOM))
 
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
 int mgmt_index_added(struct hci_dev *hdev);
@@ -1067,12 +1072,12 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
                                                         __u8 ltk[16]);
-void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]);
-void hci_le_ltk_neg_reply(struct hci_conn *conn);
-
 int hci_do_inquiry(struct hci_dev *hdev, u8 length);
 int hci_cancel_inquiry(struct hci_dev *hdev);
 int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
                 int timeout);
+int hci_cancel_le_scan(struct hci_dev *hdev);
+
+u8 bdaddr_to_le(u8 bdaddr_type);
 
 #endif /* __HCI_CORE_H */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 9b242c6bf55b..1c7d1cd5e679 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -44,6 +44,7 @@
 #define L2CAP_DEFAULT_MAX_SDU_SIZE      0xFFFF
 #define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
 #define L2CAP_DEFAULT_ACC_LAT           0xFFFFFFFF
+#define L2CAP_BREDR_MAX_PAYLOAD         1019    /* 3-DH5 packet */
 
 #define L2CAP_DISC_TIMEOUT              msecs_to_jiffies(100)
 #define L2CAP_DISC_REJ_TIMEOUT          msecs_to_jiffies(5000)
@@ -57,6 +58,7 @@ struct sockaddr_l2 {
         __le16          l2_psm;
         bdaddr_t        l2_bdaddr;
         __le16          l2_cid;
+        __u8            l2_bdaddr_type;
 };
 
 /* L2CAP socket options */
@@ -139,6 +141,8 @@ struct l2cap_conninfo {
 
 #define L2CAP_CTRL_TXSEQ_SHIFT          1
 #define L2CAP_CTRL_SUPER_SHIFT          2
+#define L2CAP_CTRL_POLL_SHIFT           4
+#define L2CAP_CTRL_FINAL_SHIFT          7
 #define L2CAP_CTRL_REQSEQ_SHIFT         8
 #define L2CAP_CTRL_SAR_SHIFT            14
 
@@ -152,9 +156,11 @@ struct l2cap_conninfo {
 #define L2CAP_EXT_CTRL_FINAL            0x00000002
 #define L2CAP_EXT_CTRL_FRAME_TYPE       0x00000001 /* I- or S-Frame */
 
+#define L2CAP_EXT_CTRL_FINAL_SHIFT      1
 #define L2CAP_EXT_CTRL_REQSEQ_SHIFT     2
 #define L2CAP_EXT_CTRL_SAR_SHIFT        16
 #define L2CAP_EXT_CTRL_SUPER_SHIFT      16
+#define L2CAP_EXT_CTRL_POLL_SHIFT       18
 #define L2CAP_EXT_CTRL_TXSEQ_SHIFT      18
 
 /* L2CAP Supervisory Function */
@@ -186,6 +192,8 @@ struct l2cap_hdr {
 #define L2CAP_FCS_SIZE          2
 #define L2CAP_SDULEN_SIZE       2
 #define L2CAP_PSMLEN_SIZE       2
+#define L2CAP_ENH_CTRL_SIZE     2
+#define L2CAP_EXT_CTRL_SIZE     4
 
 struct l2cap_cmd_hdr {
         __u8       code;
@@ -401,6 +409,16 @@ struct l2cap_conn_param_update_rsp {
 #define L2CAP_CONN_PARAM_REJECTED       0x0001
 
 /* ----- L2CAP channels and connections ----- */
+struct l2cap_seq_list {
+        __u16   head;
+        __u16   tail;
+        __u16   mask;
+        __u16   *list;
+};
+
+#define L2CAP_SEQ_LIST_CLEAR    0xFFFF
+#define L2CAP_SEQ_LIST_TAIL     0x8000
+
 struct srej_list {
         __u16   tx_seq;
         struct list_head list;
@@ -446,6 +464,9 @@ struct l2cap_chan {
         __u16           monitor_timeout;
         __u16           mps;
 
+        __u8            tx_state;
+        __u8            rx_state;
+
         unsigned long   conf_state;
         unsigned long   conn_state;
         unsigned long   flags;
@@ -456,9 +477,11 @@ struct l2cap_chan {
         __u16           buffer_seq;
         __u16           buffer_seq_srej;
         __u16           srej_save_reqseq;
+        __u16           last_acked_seq;
         __u16           frames_sent;
         __u16           unacked_frames;
         __u8            retry_count;
+        __u16           srej_queue_next;
         __u8            num_acked;
         __u16           sdu_len;
         struct sk_buff  *sdu;
@@ -490,6 +513,8 @@ struct l2cap_chan {
         struct sk_buff          *tx_send_head;
         struct sk_buff_head     tx_q;
         struct sk_buff_head     srej_q;
+        struct l2cap_seq_list   srej_list;
+        struct l2cap_seq_list   retrans_list;
         struct list_head        srej_l;
 
         struct list_head        list;
@@ -508,8 +533,7 @@ struct l2cap_ops {
         void                    (*close) (void *data);
         void                    (*state_change) (void *data, int state);
         struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
-                                        unsigned long len, int nb, int *err);
-
+                                               unsigned long len, int nb);
 };
 
 struct l2cap_conn {
@@ -600,6 +624,44 @@ enum {
         FLAG_EFS_ENABLE,
 };
 
+enum {
+        L2CAP_TX_STATE_XMIT,
+        L2CAP_TX_STATE_WAIT_F,
+};
+
+enum {
+        L2CAP_RX_STATE_RECV,
+        L2CAP_RX_STATE_SREJ_SENT,
+};
+
+enum {
+        L2CAP_TXSEQ_EXPECTED,
+        L2CAP_TXSEQ_EXPECTED_SREJ,
+        L2CAP_TXSEQ_UNEXPECTED,
+        L2CAP_TXSEQ_UNEXPECTED_SREJ,
+        L2CAP_TXSEQ_DUPLICATE,
+        L2CAP_TXSEQ_DUPLICATE_SREJ,
+        L2CAP_TXSEQ_INVALID,
+        L2CAP_TXSEQ_INVALID_IGNORE,
+};
+
+enum {
+        L2CAP_EV_DATA_REQUEST,
+        L2CAP_EV_LOCAL_BUSY_DETECTED,
+        L2CAP_EV_LOCAL_BUSY_CLEAR,
+        L2CAP_EV_RECV_REQSEQ_AND_FBIT,
+        L2CAP_EV_RECV_FBIT,
+        L2CAP_EV_RETRANS_TO,
+        L2CAP_EV_MONITOR_TO,
+        L2CAP_EV_EXPLICIT_POLL,
+        L2CAP_EV_RECV_IFRAME,
+        L2CAP_EV_RECV_RR,
+        L2CAP_EV_RECV_REJ,
+        L2CAP_EV_RECV_RNR,
+        L2CAP_EV_RECV_SREJ,
+        L2CAP_EV_RECV_FRAME,
+};
+
 static inline void l2cap_chan_hold(struct l2cap_chan *c)
 {
         atomic_inc(&c->refcnt);
@@ -622,21 +684,26 @@ static inline void l2cap_chan_unlock(struct l2cap_chan *chan)
 }
 
 static inline void l2cap_set_timer(struct l2cap_chan *chan,
-                                        struct delayed_work *work, long timeout)
+                                   struct delayed_work *work, long timeout)
 {
         BT_DBG("chan %p state %s timeout %ld", chan,
-                                        state_to_string(chan->state), timeout);
+               state_to_string(chan->state), timeout);
 
+        /* If delayed work cancelled do not hold(chan)
+           since it is already done with previous set_timer */
         if (!cancel_delayed_work(work))
                 l2cap_chan_hold(chan);
+
         schedule_delayed_work(work, timeout);
 }
 
 static inline bool l2cap_clear_timer(struct l2cap_chan *chan,
-                                        struct delayed_work *work)
+                                     struct delayed_work *work)
 {
         bool ret;
 
+        /* put(chan) if delayed work cancelled otherwise it
+           is done in delayed work function */
         ret = cancel_delayed_work(work);
         if (ret)
                 l2cap_chan_put(chan);
@@ -658,13 +725,10 @@ static inline bool l2cap_clear_timer(struct l2cap_chan *chan,
 
 static inline int __seq_offset(struct l2cap_chan *chan, __u16 seq1, __u16 seq2)
 {
-        int offset;
-
-        offset = (seq1 - seq2) % (chan->tx_win_max + 1);
-        if (offset < 0)
-                offset += (chan->tx_win_max + 1);
-
-        return offset;
+        if (seq1 >= seq2)
+                return seq1 - seq2;
+        else
+                return chan->tx_win_max + 1 - seq2 + seq1;
 }
 
 static inline __u16 __next_seq(struct l2cap_chan *chan, __u16 seq)
@@ -852,14 +916,15 @@ int __l2cap_wait_ack(struct sock *sk);
 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm);
 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
 
-struct l2cap_chan *l2cap_chan_create(struct sock *sk);
+struct l2cap_chan *l2cap_chan_create(void);
 void l2cap_chan_close(struct l2cap_chan *chan, int reason);
 void l2cap_chan_destroy(struct l2cap_chan *chan);
 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
-                                                                bdaddr_t *dst);
+                       bdaddr_t *dst, u8 dst_type);
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
                                                                 u32 priority);
 void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
 int l2cap_chan_check_security(struct l2cap_chan *chan);
+void l2cap_chan_set_defaults(struct l2cap_chan *chan);
 
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index ebfd91fc20f8..23fd0546fccb 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -341,6 +341,15 @@ struct mgmt_cp_unblock_device {
 } __packed;
 #define MGMT_UNBLOCK_DEVICE_SIZE        MGMT_ADDR_INFO_SIZE
 
+#define MGMT_OP_SET_DEVICE_ID           0x0028
+struct mgmt_cp_set_device_id {
+        __le16  source;
+        __le16  vendor;
+        __le16  product;
+        __le16  version;
+} __packed;
+#define MGMT_SET_DEVICE_ID_SIZE         8
+
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
         __le16  opcode;
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
index 7b3acdd29134..ca356a734920 100644
--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -77,7 +77,7 @@ struct smp_cmd_encrypt_info {
 
 #define SMP_CMD_MASTER_IDENT    0x07
 struct smp_cmd_master_ident {
-        __u16   ediv;
+        __le16  ediv;
         __u8    rand[8];
 } __packed;
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index adb2320bccdf..0289d4ce7070 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -3365,9 +3365,9 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
  * @chan: main channel
  * @channel_type: HT mode
  */
-int cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
-                                 struct ieee80211_channel *chan,
-                                 enum nl80211_channel_type channel_type);
+bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
+                                  struct ieee80211_channel *chan,
+                                  enum nl80211_channel_type channel_type);
 
 /*
  * cfg80211_ch_switch_notify - update wdev channel and notify userspace
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 4d6e6c6818d0..1937c7d98304 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -667,6 +667,9 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  * @RX_FLAG_SHORT_GI: Short guard interval was used
  * @RX_FLAG_NO_SIGNAL_VAL: The signal strength value is not present.
  *      Valid only for data frames (mainly A-MPDU)
+ * @RX_FLAG_HT_GF: This frame was received in a HT-greenfield transmission, if
+ *      the driver fills this value it should add %IEEE80211_RADIOTAP_MCS_HAVE_FMT
+ *      to hw.radiotap_mcs_details to advertise that fact
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR      = 1<<0,
@@ -681,6 +684,7 @@ enum mac80211_rx_flags {
         RX_FLAG_40MHZ           = 1<<10,
         RX_FLAG_SHORT_GI        = 1<<11,
         RX_FLAG_NO_SIGNAL_VAL   = 1<<12,
+        RX_FLAG_HT_GF           = 1<<13,
 };
 
 /**
@@ -939,7 +943,7 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
  *      CCMP key if it requires CCMP encryption of management frames (MFP) to
  *      be done in software.
  * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
- *      for a CCMP key if space should be prepared for the IV, but the IV
+ *      if space should be prepared for the IV, but the IV
  *      itself should not be generated. Do not set together with
  *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
  */
@@ -1288,6 +1292,11 @@ enum ieee80211_hw_flags {
  *
  * @offchannel_tx_hw_queue: HW queue ID to use for offchannel TX
  *      (if %IEEE80211_HW_QUEUE_CONTROL is set)
+ *
+ * @radiotap_mcs_details: lists which MCS information can the HW
+ *      reports, by default it is set to _MCS, _GI and _BW but doesn't
+ *      include _FMT. Use %IEEE80211_RADIOTAP_MCS_HAVE_* values, only
+ *      adding _BW is supported today.
  */
 struct ieee80211_hw {
         struct ieee80211_conf conf;
@@ -1309,6 +1318,7 @@ struct ieee80211_hw {
         u8 max_rx_aggregation_subframes;
         u8 max_tx_aggregation_subframes;
         u8 offchannel_tx_hw_queue;
+        u8 radiotap_mcs_details;
 };
 
 /**
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index aca65a5a9d0d..4467c9460857 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -39,6 +39,8 @@ struct nfc_hci_ops {
         int (*data_exchange) (struct nfc_hci_dev *hdev,
                               struct nfc_target *target,
                               struct sk_buff *skb, struct sk_buff **res_skb);
+        int (*check_presence)(struct nfc_hci_dev *hdev,
+                              struct nfc_target *target);
 };
 
 #define NFC_HCI_MAX_CUSTOM_GATES        15
@@ -82,10 +84,6 @@ struct nfc_hci_dev {
 
         u8 gate2pipe[NFC_HCI_MAX_GATES];
 
-        bool poll_started;
-        struct nfc_target *targets;
-        int target_count;
-
         u8 sw_romlib;
         u8 sw_patch;
         u8 sw_flashlib_major;
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 9a2505a5b8de..b7ca4a2a1d72 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -48,26 +48,28 @@ struct nfc_dev;
 typedef void (*data_exchange_cb_t)(void *context, struct sk_buff *skb,
                                                                 int err);
 
+struct nfc_target;
+
 struct nfc_ops {
         int (*dev_up)(struct nfc_dev *dev);
         int (*dev_down)(struct nfc_dev *dev);
         int (*start_poll)(struct nfc_dev *dev, u32 protocols);
         void (*stop_poll)(struct nfc_dev *dev);
-        int (*dep_link_up)(struct nfc_dev *dev, int target_idx, u8 comm_mode,
-                           u8 *gb, size_t gb_len);
+        int (*dep_link_up)(struct nfc_dev *dev, struct nfc_target *target,
+                           u8 comm_mode, u8 *gb, size_t gb_len);
         int (*dep_link_down)(struct nfc_dev *dev);
-        int (*activate_target)(struct nfc_dev *dev, u32 target_idx,
+        int (*activate_target)(struct nfc_dev *dev, struct nfc_target *target,
                                u32 protocol);
-        void (*deactivate_target)(struct nfc_dev *dev, u32 target_idx);
-        int (*data_exchange)(struct nfc_dev *dev, u32 target_idx,
+        void (*deactivate_target)(struct nfc_dev *dev,
+                                  struct nfc_target *target);
+        int (*data_exchange)(struct nfc_dev *dev, struct nfc_target *target,
                              struct sk_buff *skb, data_exchange_cb_t cb,
                              void *cb_context);
-        int (*check_presence)(struct nfc_dev *dev, u32 target_idx);
+        int (*check_presence)(struct nfc_dev *dev, struct nfc_target *target);
 };
 
 #define NFC_TARGET_IDX_ANY -1
 #define NFC_MAX_GT_LEN 48
-#define NFC_TARGET_IDX_NONE 0xffffffff
 
 struct nfc_target {
         u32 idx;
@@ -95,11 +97,10 @@ struct nfc_dev {
         struct nfc_target *targets;
         int n_targets;
         int targets_generation;
-        spinlock_t targets_lock;
         struct device dev;
         bool dev_up;
         bool polling;
-        u32 activated_target_idx;
+        struct nfc_target *active_target;
         bool dep_link_up;
         u32 dep_rf_mode;
         struct nfc_genl_data genl_data;
diff --git a/include/net/nfc/shdlc.h b/include/net/nfc/shdlc.h
index 1071987d0408..ab06afd462da 100644
--- a/include/net/nfc/shdlc.h
+++ b/include/net/nfc/shdlc.h
@@ -35,6 +35,8 @@ struct nfc_shdlc_ops {
         int (*data_exchange) (struct nfc_shdlc *shdlc,
                               struct nfc_target *target,
                               struct sk_buff *skb, struct sk_buff **res_skb);
+        int (*check_presence)(struct nfc_shdlc *shdlc,
+                              struct nfc_target *target);
 };
 
 enum shdlc_state {