11 files changed, 316 insertions, 68 deletions

diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 03b2f30d2ace..1954a4e305a3 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -7,6 +7,7 @@
 #include <linux/bcma/bcma_driver_chipcommon.h>
 #include <linux/bcma/bcma_driver_pci.h>
 #include <linux/bcma/bcma_driver_mips.h>
+#include <linux/bcma/bcma_driver_gmac_cmn.h>
 #include <linux/ssb/ssb.h> /* SPROM sharing */
 
 #include "bcma_regs.h"
@@ -252,6 +253,7 @@ struct bcma_bus {
         struct bcma_drv_cc drv_cc;
         struct bcma_drv_pci drv_pci;
         struct bcma_drv_mips drv_mips;
+        struct bcma_drv_gmac_cmn drv_gmac_cmn;
 
         /* We decided to share SPROM struct with SSB as long as we do not need
          * any hacks for BCMA. This simplifies drivers code. */
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index fbd0d49dc4d2..3c80885fa829 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -24,7 +24,7 @@
 #define   BCMA_CC_FLASHT_NONE           0x00000000      /* No flash */
 #define   BCMA_CC_FLASHT_STSER          0x00000100      /* ST serial flash */
 #define   BCMA_CC_FLASHT_ATSER          0x00000200      /* Atmel serial flash */
-#define   BCMA_CC_FLASHT_NFLASH         0x00000200
+#define   BCMA_CC_FLASHT_NFLASH         0x00000200      /* NAND flash */
 #define   BCMA_CC_FLASHT_PARA           0x00000700      /* Parallel flash */
 #define  BCMA_CC_CAP_PLLT               0x00038000      /* PLL Type */
 #define   BCMA_PLLTYPE_NONE             0x00000000
@@ -45,6 +45,7 @@
 #define  BCMA_CC_CAP_PMU                0x10000000      /* PMU available (rev >= 20) */
 #define  BCMA_CC_CAP_ECI                0x20000000      /* ECI available (rev >= 20) */
 #define  BCMA_CC_CAP_SPROM              0x40000000      /* SPROM present */
+#define  BCMA_CC_CAP_NFLASH             0x80000000      /* NAND flash present (rev >= 35 or BCM4706?) */
 #define BCMA_CC_CORECTL                 0x0008
 #define  BCMA_CC_CORECTL_UARTCLK0       0x00000001      /* Drive UART with internal clock */
 #define  BCMA_CC_CORECTL_SE             0x00000002      /* sync clk out enable (corerev >= 3) */
@@ -122,10 +123,58 @@
 #define  BCMA_CC_JCTL_EXT_EN            2               /* Enable external targets */
 #define  BCMA_CC_JCTL_EN                1               /* Enable Jtag master */
 #define BCMA_CC_FLASHCTL                0x0040
+/* Start/busy bit in flashcontrol */
+#define  BCMA_CC_FLASHCTL_OPCODE        0x000000ff
+#define  BCMA_CC_FLASHCTL_ACTION        0x00000700
+#define  BCMA_CC_FLASHCTL_CS_ACTIVE     0x00001000      /* Chip Select Active, rev >= 20 */
 #define  BCMA_CC_FLASHCTL_START         0x80000000
 #define  BCMA_CC_FLASHCTL_BUSY          BCMA_CC_FLASHCTL_START
+/* Flashcontrol action + opcodes for ST flashes */
+#define  BCMA_CC_FLASHCTL_ST_WREN       0x0006          /* Write Enable */
+#define  BCMA_CC_FLASHCTL_ST_WRDIS      0x0004          /* Write Disable */
+#define  BCMA_CC_FLASHCTL_ST_RDSR       0x0105          /* Read Status Register */
+#define  BCMA_CC_FLASHCTL_ST_WRSR       0x0101          /* Write Status Register */
+#define  BCMA_CC_FLASHCTL_ST_READ       0x0303          /* Read Data Bytes */
+#define  BCMA_CC_FLASHCTL_ST_PP         0x0302          /* Page Program */
+#define  BCMA_CC_FLASHCTL_ST_SE         0x02d8          /* Sector Erase */
+#define  BCMA_CC_FLASHCTL_ST_BE         0x00c7          /* Bulk Erase */
+#define  BCMA_CC_FLASHCTL_ST_DP         0x00b9          /* Deep Power-down */
+#define  BCMA_CC_FLASHCTL_ST_RES        0x03ab          /* Read Electronic Signature */
+#define  BCMA_CC_FLASHCTL_ST_CSA        0x1000          /* Keep chip select asserted */
+#define  BCMA_CC_FLASHCTL_ST_SSE        0x0220          /* Sub-sector Erase */
+/* Flashcontrol action + opcodes for Atmel flashes */
+#define  BCMA_CC_FLASHCTL_AT_READ                       0x07e8
+#define  BCMA_CC_FLASHCTL_AT_PAGE_READ                  0x07d2
+#define  BCMA_CC_FLASHCTL_AT_STATUS                     0x01d7
+#define  BCMA_CC_FLASHCTL_AT_BUF1_WRITE                 0x0384
+#define  BCMA_CC_FLASHCTL_AT_BUF2_WRITE                 0x0387
+#define  BCMA_CC_FLASHCTL_AT_BUF1_ERASE_PROGRAM         0x0283
+#define  BCMA_CC_FLASHCTL_AT_BUF2_ERASE_PROGRAM         0x0286
+#define  BCMA_CC_FLASHCTL_AT_BUF1_PROGRAM               0x0288
+#define  BCMA_CC_FLASHCTL_AT_BUF2_PROGRAM               0x0289
+#define  BCMA_CC_FLASHCTL_AT_PAGE_ERASE                 0x0281
+#define  BCMA_CC_FLASHCTL_AT_BLOCK_ERASE                0x0250
+#define  BCMA_CC_FLASHCTL_AT_BUF1_WRITE_ERASE_PROGRAM   0x0382
+#define  BCMA_CC_FLASHCTL_AT_BUF2_WRITE_ERASE_PROGRAM   0x0385
+#define  BCMA_CC_FLASHCTL_AT_BUF1_LOAD                  0x0253
+#define  BCMA_CC_FLASHCTL_AT_BUF2_LOAD                  0x0255
+#define  BCMA_CC_FLASHCTL_AT_BUF1_COMPARE               0x0260
+#define  BCMA_CC_FLASHCTL_AT_BUF2_COMPARE               0x0261
+#define  BCMA_CC_FLASHCTL_AT_BUF1_REPROGRAM             0x0258
+#define  BCMA_CC_FLASHCTL_AT_BUF2_REPROGRAM             0x0259
 #define BCMA_CC_FLASHADDR               0x0044
 #define BCMA_CC_FLASHDATA               0x0048
+/* Status register bits for ST flashes */
+#define  BCMA_CC_FLASHDATA_ST_WIP       0x01            /* Write In Progress */
+#define  BCMA_CC_FLASHDATA_ST_WEL       0x02            /* Write Enable Latch */
+#define  BCMA_CC_FLASHDATA_ST_BP_MASK   0x1c            /* Block Protect */
+#define  BCMA_CC_FLASHDATA_ST_BP_SHIFT  2
+#define  BCMA_CC_FLASHDATA_ST_SRWD      0x80            /* Status Register Write Disable */
+/* Status register bits for Atmel flashes */
+#define  BCMA_CC_FLASHDATA_AT_READY     0x80
+#define  BCMA_CC_FLASHDATA_AT_MISMATCH  0x40
+#define  BCMA_CC_FLASHDATA_AT_ID_MASK   0x38
+#define  BCMA_CC_FLASHDATA_AT_ID_SHIFT  3
 #define BCMA_CC_BCAST_ADDR              0x0050
 #define BCMA_CC_BCAST_DATA              0x0054
 #define BCMA_CC_GPIOPULLUP              0x0058          /* Rev >= 20 only */
diff --git a/include/linux/bcma/bcma_driver_gmac_cmn.h b/include/linux/bcma/bcma_driver_gmac_cmn.h
new file mode 100644
index 000000000000..def894b83b0d
--- /dev/null
+++ b/include/linux/bcma/bcma_driver_gmac_cmn.h
@@ -0,0 +1,100 @@
+#ifndef LINUX_BCMA_DRIVER_GMAC_CMN_H_
+#define LINUX_BCMA_DRIVER_GMAC_CMN_H_
+
+#include <linux/types.h>
+
+#define BCMA_GMAC_CMN_STAG0             0x000
+#define BCMA_GMAC_CMN_STAG1             0x004
+#define BCMA_GMAC_CMN_STAG2             0x008
+#define BCMA_GMAC_CMN_STAG3             0x00C
+#define BCMA_GMAC_CMN_PARSER_CTL        0x020
+#define BCMA_GMAC_CMN_MIB_MAX_LEN       0x024
+#define BCMA_GMAC_CMN_PHY_ACCESS        0x100
+#define  BCMA_GMAC_CMN_PA_DATA_MASK     0x0000ffff
+#define  BCMA_GMAC_CMN_PA_ADDR_MASK     0x001f0000
+#define  BCMA_GMAC_CMN_PA_ADDR_SHIFT    16
+#define  BCMA_GMAC_CMN_PA_REG_MASK      0x1f000000
+#define  BCMA_GMAC_CMN_PA_REG_SHIFT     24
+#define  BCMA_GMAC_CMN_PA_WRITE         0x20000000
+#define  BCMA_GMAC_CMN_PA_START         0x40000000
+#define BCMA_GMAC_CMN_PHY_CTL           0x104
+#define  BCMA_GMAC_CMN_PC_EPA_MASK      0x0000001f
+#define  BCMA_GMAC_CMN_PC_MCT_MASK      0x007f0000
+#define  BCMA_GMAC_CMN_PC_MCT_SHIFT     16
+#define  BCMA_GMAC_CMN_PC_MTE           0x00800000
+#define BCMA_GMAC_CMN_GMAC0_RGMII_CTL   0x110
+#define BCMA_GMAC_CMN_CFP_ACCESS        0x200
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA0    0x210
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA1    0x214
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA2    0x218
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA3    0x21C
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA4    0x220
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA5    0x224
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA6    0x228
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA7    0x22C
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK0    0x230
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK1    0x234
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK2    0x238
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK3    0x23C
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK4    0x240
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK5    0x244
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK6    0x248
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK7    0x24C
+#define BCMA_GMAC_CMN_CFP_ACTION_DATA   0x250
+#define BCMA_GMAC_CMN_TCAM_BIST_CTL     0x2A0
+#define BCMA_GMAC_CMN_TCAM_BIST_STATUS  0x2A4
+#define BCMA_GMAC_CMN_TCAM_CMP_STATUS   0x2A8
+#define BCMA_GMAC_CMN_TCAM_DISABLE      0x2AC
+#define BCMA_GMAC_CMN_TCAM_TEST_CTL     0x2F0
+#define BCMA_GMAC_CMN_UDF_0_A3_A0       0x300
+#define BCMA_GMAC_CMN_UDF_0_A7_A4       0x304
+#define BCMA_GMAC_CMN_UDF_0_A8          0x308
+#define BCMA_GMAC_CMN_UDF_1_A3_A0       0x310
+#define BCMA_GMAC_CMN_UDF_1_A7_A4       0x314
+#define BCMA_GMAC_CMN_UDF_1_A8          0x318
+#define BCMA_GMAC_CMN_UDF_2_A3_A0       0x320
+#define BCMA_GMAC_CMN_UDF_2_A7_A4       0x324
+#define BCMA_GMAC_CMN_UDF_2_A8          0x328
+#define BCMA_GMAC_CMN_UDF_0_B3_B0       0x330
+#define BCMA_GMAC_CMN_UDF_0_B7_B4       0x334
+#define BCMA_GMAC_CMN_UDF_0_B8          0x338
+#define BCMA_GMAC_CMN_UDF_1_B3_B0       0x340
+#define BCMA_GMAC_CMN_UDF_1_B7_B4       0x344
+#define BCMA_GMAC_CMN_UDF_1_B8          0x348
+#define BCMA_GMAC_CMN_UDF_2_B3_B0       0x350
+#define BCMA_GMAC_CMN_UDF_2_B7_B4       0x354
+#define BCMA_GMAC_CMN_UDF_2_B8          0x358
+#define BCMA_GMAC_CMN_UDF_0_C3_C0       0x360
+#define BCMA_GMAC_CMN_UDF_0_C7_C4       0x364
+#define BCMA_GMAC_CMN_UDF_0_C8          0x368
+#define BCMA_GMAC_CMN_UDF_1_C3_C0       0x370
+#define BCMA_GMAC_CMN_UDF_1_C7_C4       0x374
+#define BCMA_GMAC_CMN_UDF_1_C8          0x378
+#define BCMA_GMAC_CMN_UDF_2_C3_C0       0x380
+#define BCMA_GMAC_CMN_UDF_2_C7_C4       0x384
+#define BCMA_GMAC_CMN_UDF_2_C8          0x388
+#define BCMA_GMAC_CMN_UDF_0_D3_D0       0x390
+#define BCMA_GMAC_CMN_UDF_0_D7_D4       0x394
+#define BCMA_GMAC_CMN_UDF_0_D11_D8      0x394
+
+struct bcma_drv_gmac_cmn {
+        struct bcma_device *core;
+
+        /* Drivers accessing BCMA_GMAC_CMN_PHY_ACCESS and
+         * BCMA_GMAC_CMN_PHY_CTL need to take that mutex first. */
+        struct mutex phy_mutex;
+};
+
+/* Register access */
+#define gmac_cmn_read16(gc, offset)             bcma_read16((gc)->core, offset)
+#define gmac_cmn_read32(gc, offset)             bcma_read32((gc)->core, offset)
+#define gmac_cmn_write16(gc, offset, val)       bcma_write16((gc)->core, offset, val)
+#define gmac_cmn_write32(gc, offset, val)       bcma_write32((gc)->core, offset, val)
+
+#ifdef CONFIG_BCMA_DRIVER_GMAC_CMN
+extern void __devinit bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc);
+#else
+static inline void bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc) { }
+#endif
+
+#endif /* LINUX_BCMA_DRIVER_GMAC_CMN_H_ */
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index db961a59247f..2f3878806403 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -771,6 +771,9 @@ enum nl80211_commands {
  * @NL80211_ATTR_IFNAME: network interface name
  * @NL80211_ATTR_IFTYPE: type of virtual interface, see &enum nl80211_iftype
  *
+ * @NL80211_ATTR_WDEV: wireless device identifier, used for pseudo-devices
+ *      that don't have a netdev (u64)
+ *
  * @NL80211_ATTR_MAC: MAC address (various uses)
  *
  * @NL80211_ATTR_KEY_DATA: (temporal) key data; for TKIP this consists of
@@ -1242,6 +1245,12 @@ enum nl80211_commands {
  * @NL80211_ATTR_BG_SCAN_PERIOD: Background scan period in seconds
  *      or 0 to disable background scan.
  *
+ * @NL80211_ATTR_USER_REG_HINT_TYPE: type of regulatory hint passed from
+ *      userspace. If unset it is assumed the hint comes directly from
+ *      a user. If set code could specify exactly what type of source
+ *      was used to provide the hint. For the different types of
+ *      allowed user regulatory hints see nl80211_user_reg_hint_type.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1493,6 +1502,10 @@ enum nl80211_attrs {
 
         NL80211_ATTR_BG_SCAN_PERIOD,
 
+        NL80211_ATTR_WDEV,
+
+        NL80211_ATTR_USER_REG_HINT_TYPE,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1545,6 +1558,8 @@ enum nl80211_attrs {
 /* default RSSI threshold for scan results if none specified. */
 #define NL80211_SCAN_RSSI_THOLD_OFF             -300
 
+#define NL80211_CQM_TXE_MAX_INTVL               1800
+
 /**
  * enum nl80211_iftype - (virtual) interface types
  *
@@ -2054,6 +2069,26 @@ enum nl80211_dfs_regions {
 };
 
 /**
+ * enum nl80211_user_reg_hint_type - type of user regulatory hint
+ *
+ * @NL80211_USER_REG_HINT_USER: a user sent the hint. This is always
+ *      assumed if the attribute is not set.
+ * @NL80211_USER_REG_HINT_CELL_BASE: the hint comes from a cellular
+ *      base station. Device drivers that have been tested to work
+ *      properly to support this type of hint can enable these hints
+ *      by setting the NL80211_FEATURE_CELL_BASE_REG_HINTS feature
+ *      capability on the struct wiphy. The wireless core will
+ *      ignore all cell base station hints until at least one device
+ *      present has been registered with the wireless core that
+ *      has listed NL80211_FEATURE_CELL_BASE_REG_HINTS as a
+ *      supported feature.
+ */
+enum nl80211_user_reg_hint_type {
+        NL80211_USER_REG_HINT_USER      = 0,
+        NL80211_USER_REG_HINT_CELL_BASE = 1,
+};
+
+/**
  * enum nl80211_survey_info - survey information
  *
  * These attribute types are used with %NL80211_ATTR_SURVEY_INFO
@@ -2584,6 +2619,17 @@ enum nl80211_ps_state {
  * @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT: RSSI threshold event
  * @NL80211_ATTR_CQM_PKT_LOSS_EVENT: a u32 value indicating that this many
  *      consecutive packets were not acknowledged by the peer
+ * @NL80211_ATTR_CQM_TXE_RATE: TX error rate in %. Minimum % of TX failures
+ *      during the given %NL80211_ATTR_CQM_TXE_INTVL before an
+ *      %NL80211_CMD_NOTIFY_CQM with reported %NL80211_ATTR_CQM_TXE_RATE and
+ *      %NL80211_ATTR_CQM_TXE_PKTS is generated.
+ * @NL80211_ATTR_CQM_TXE_PKTS: number of attempted packets in a given
+ *      %NL80211_ATTR_CQM_TXE_INTVL before %NL80211_ATTR_CQM_TXE_RATE is
+ *      checked.
+ * @NL80211_ATTR_CQM_TXE_INTVL: interval in seconds. Specifies the periodic
+ *      interval in which %NL80211_ATTR_CQM_TXE_PKTS and
+ *      %NL80211_ATTR_CQM_TXE_RATE must be satisfied before generating an
+ *      %NL80211_CMD_NOTIFY_CQM. Set to 0 to turn off TX error reporting.
  * @__NL80211_ATTR_CQM_AFTER_LAST: internal
  * @NL80211_ATTR_CQM_MAX: highest key attribute
  */
@@ -2593,6 +2639,9 @@ enum nl80211_attr_cqm {
         NL80211_ATTR_CQM_RSSI_HYST,
         NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
         NL80211_ATTR_CQM_PKT_LOSS_EVENT,
+        NL80211_ATTR_CQM_TXE_RATE,
+        NL80211_ATTR_CQM_TXE_PKTS,
+        NL80211_ATTR_CQM_TXE_INTVL,
 
         /* keep last */
         __NL80211_ATTR_CQM_AFTER_LAST,
@@ -2942,11 +2991,15 @@ enum nl80211_ap_sme_features {
  * @NL80211_FEATURE_HT_IBSS: This driver supports IBSS with HT datarates.
  * @NL80211_FEATURE_INACTIVITY_TIMER: This driver takes care of freeing up
  *      the connected inactive stations in AP mode.
+ * @NL80211_FEATURE_CELL_BASE_REG_HINTS: This driver has been tested
+ *      to work properly to suppport receiving regulatory hints from
+ *      cellular base stations.
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS    = 1 << 0,
         NL80211_FEATURE_HT_IBSS         = 1 << 1,
         NL80211_FEATURE_INACTIVITY_TIMER = 1 << 2,
+        NL80211_FEATURE_CELL_BASE_REG_HINTS = 1 << 3,
 };
 
 /**
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 2a6b0b8b7120..ccd723e0f783 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -139,11 +139,12 @@ enum {
 #define HCIINQUIRY      _IOR('H', 240, int)
 
 /* HCI timeouts */
-#define HCI_DISCONN_TIMEOUT     (2000)  /* 2 seconds */
-#define HCI_PAIRING_TIMEOUT     (60000) /* 60 seconds */
-#define HCI_INIT_TIMEOUT        (10000) /* 10 seconds */
-#define HCI_CMD_TIMEOUT         (1000)  /* 1 seconds */
-#define HCI_ACL_TX_TIMEOUT      (45000) /* 45 seconds */
+#define HCI_DISCONN_TIMEOUT     msecs_to_jiffies(2000)  /* 2 seconds */
+#define HCI_PAIRING_TIMEOUT     msecs_to_jiffies(60000) /* 60 seconds */
+#define HCI_INIT_TIMEOUT        msecs_to_jiffies(10000) /* 10 seconds */
+#define HCI_CMD_TIMEOUT         msecs_to_jiffies(1000)  /* 1 second */
+#define HCI_ACL_TX_TIMEOUT      msecs_to_jiffies(45000) /* 45 seconds */
+#define HCI_AUTO_OFF_TIMEOUT    msecs_to_jiffies(2000)  /* 2 seconds */
 
 /* HCI data types */
 #define HCI_COMMAND_PKT         0x01
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 20fd57367ddc..475b8c04ba52 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -587,18 +587,24 @@ void hci_conn_put_device(struct hci_conn *conn);
 
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
+        BT_DBG("hcon %p refcnt %d -> %d", conn, atomic_read(&conn->refcnt),
+               atomic_read(&conn->refcnt) + 1);
+
         atomic_inc(&conn->refcnt);
         cancel_delayed_work(&conn->disc_work);
 }
 
 static inline void hci_conn_put(struct hci_conn *conn)
 {
+        BT_DBG("hcon %p refcnt %d -> %d", conn, atomic_read(&conn->refcnt),
+               atomic_read(&conn->refcnt) - 1);
+
         if (atomic_dec_and_test(&conn->refcnt)) {
                 unsigned long timeo;
                 if (conn->type == ACL_LINK || conn->type == LE_LINK) {
                         del_timer(&conn->idle_timer);
                         if (conn->state == BT_CONNECTED) {
-                                timeo = msecs_to_jiffies(conn->disc_timeout);
+                                timeo = conn->disc_timeout;
                                 if (!conn->out)
                                         timeo *= 2;
                         } else {
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index d80e3f0691b4..a7679f8913d2 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -464,6 +464,7 @@ struct l2cap_chan {
 
         __u16           tx_win;
         __u16           tx_win_max;
+        __u16           ack_win;
         __u8            max_tx;
         __u16           retrans_timeout;
         __u16           monitor_timeout;
@@ -672,11 +673,15 @@ enum {
 
 static inline void l2cap_chan_hold(struct l2cap_chan *c)
 {
+        BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
+
         atomic_inc(&c->refcnt);
 }
 
 static inline void l2cap_chan_put(struct l2cap_chan *c)
 {
+        BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
+
         if (atomic_dec_and_test(&c->refcnt))
                 kfree(c);
 }
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 23fd0546fccb..4348ee8bda69 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -444,7 +444,7 @@ struct mgmt_ev_auth_failed {
 struct mgmt_ev_device_found {
         struct mgmt_addr_info addr;
         __s8    rssi;
-        __u8    flags[4];
+        __le32  flags;
         __le16  eir_len;
         __u8    eir[0];
 } __packed;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 51f67a9003a9..493fa0c79005 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -999,7 +999,7 @@ struct cfg80211_ssid {
  * @ie_len: length of ie in octets
  * @rates: bitmap of rates to advertise for each band
  * @wiphy: the wiphy this was for
- * @dev: the interface
+ * @wdev: the wireless device to scan for
  * @aborted: (internal) scan request was notified as aborted
  * @no_cck: used to send probe requests at non CCK rate in 2GHz band
  */
@@ -1012,9 +1012,10 @@ struct cfg80211_scan_request {
 
         u32 rates[IEEE80211_NUM_BANDS];
 
+        struct wireless_dev *wdev;
+
         /* internal */
         struct wiphy *wiphy;
-        struct net_device *dev;
         bool aborted;
         bool no_cck;
 
@@ -1435,10 +1436,10 @@ struct cfg80211_gtk_rekey_data {
  *
  * @add_virtual_intf: create a new virtual interface with the given name,
  *      must set the struct wireless_dev's iftype. Beware: You must create
- *      the new netdev in the wiphy's network namespace! Returns the netdev,
- *      or an ERR_PTR.
+ *      the new netdev in the wiphy's network namespace! Returns the struct
+ *      wireless_dev, or an ERR_PTR.
  *
- * @del_virtual_intf: remove the virtual interface determined by ifindex.
+ * @del_virtual_intf: remove the virtual interface
  *
  * @change_virtual_intf: change type/configuration of virtual interface,
  *      keep the struct wireless_dev's iftype updated.
@@ -1503,8 +1504,6 @@ struct cfg80211_gtk_rekey_data {
  *      interfaces are active this callback should reject the configuration.
  *      If no interfaces are active or the device is down, the channel should
  *      be stored for when a monitor interface becomes active.
- * @set_monitor_enabled: Notify driver that there are only monitor
- *      interfaces running.
  *
  * @scan: Request to do a scan. If returning zero, the scan request is given
  *      the driver, and will be valid until passed to cfg80211_scan_done().
@@ -1574,6 +1573,8 @@ struct cfg80211_gtk_rekey_data {
  * @set_power_mgmt: Configure WLAN power management. A timeout value of -1
  *      allows the driver to adjust the dynamic ps timeout value.
  * @set_cqm_rssi_config: Configure connection quality monitor RSSI threshold.
+ * @set_cqm_txe_config: Configure connection quality monitor TX error
+ *      thresholds.
  * @sched_scan_start: Tell the driver to start a scheduled scan.
  * @sched_scan_stop: Tell the driver to stop an ongoing scheduled
  *      scan.  The driver_initiated flag specifies whether the driver
@@ -1611,18 +1612,23 @@ struct cfg80211_gtk_rekey_data {
  * @get_et_strings:  Ethtool API to get a set of strings to describe stats
  *      and perhaps other supported types of ethtool data-sets.
  *      See @ethtool_ops.get_strings
+ *
+ * @get_channel: Get the current operating channel for the virtual interface.
+ *      For monitor interfaces, it should return %NULL unless there's a single
+ *      current monitoring channel.
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
         int     (*resume)(struct wiphy *wiphy);
         void    (*set_wakeup)(struct wiphy *wiphy, bool enabled);
 
-        struct net_device * (*add_virtual_intf)(struct wiphy *wiphy,
-                                                char *name,
-                                                enum nl80211_iftype type,
-                                                u32 *flags,
-                                                struct vif_params *params);
-        int     (*del_virtual_intf)(struct wiphy *wiphy, struct net_device *dev);
+        struct wireless_dev * (*add_virtual_intf)(struct wiphy *wiphy,
+                                                  char *name,
+                                                  enum nl80211_iftype type,
+                                                  u32 *flags,
+                                                  struct vif_params *params);
+        int     (*del_virtual_intf)(struct wiphy *wiphy,
+                                    struct wireless_dev *wdev);
         int     (*change_virtual_intf)(struct wiphy *wiphy,
                                        struct net_device *dev,
                                        enum nl80211_iftype type, u32 *flags,
@@ -1699,7 +1705,7 @@ struct cfg80211_ops {
                                        struct ieee80211_channel *chan,
                                        enum nl80211_channel_type channel_type);
 
-        int     (*scan)(struct wiphy *wiphy, struct net_device *dev,
+        int     (*scan)(struct wiphy *wiphy,
                         struct cfg80211_scan_request *request);
 
         int     (*auth)(struct wiphy *wiphy, struct net_device *dev,
@@ -1753,23 +1759,23 @@ struct cfg80211_ops {
         int     (*flush_pmksa)(struct wiphy *wiphy, struct net_device *netdev);
 
         int     (*remain_on_channel)(struct wiphy *wiphy,
-                                     struct net_device *dev,
+                                     struct wireless_dev *wdev,
                                      struct ieee80211_channel *chan,
                                      enum nl80211_channel_type channel_type,
                                      unsigned int duration,
                                      u64 *cookie);
         int     (*cancel_remain_on_channel)(struct wiphy *wiphy,
-                                            struct net_device *dev,
+                                            struct wireless_dev *wdev,
                                             u64 cookie);
 
-        int     (*mgmt_tx)(struct wiphy *wiphy, struct net_device *dev,
+        int     (*mgmt_tx)(struct wiphy *wiphy, struct wireless_dev *wdev,
                           struct ieee80211_channel *chan, bool offchan,
                           enum nl80211_channel_type channel_type,
                           bool channel_type_valid, unsigned int wait,
                           const u8 *buf, size_t len, bool no_cck,
                           bool dont_wait_for_ack, u64 *cookie);
         int     (*mgmt_tx_cancel_wait)(struct wiphy *wiphy,
-                                       struct net_device *dev,
+                                       struct wireless_dev *wdev,
                                        u64 cookie);
 
         int     (*set_power_mgmt)(struct wiphy *wiphy, struct net_device *dev,
@@ -1779,8 +1785,12 @@ struct cfg80211_ops {
                                        struct net_device *dev,
                                        s32 rssi_thold, u32 rssi_hyst);
 
+        int     (*set_cqm_txe_config)(struct wiphy *wiphy,
+                                      struct net_device *dev,
+                                      u32 rate, u32 pkts, u32 intvl);
+
         void    (*mgmt_frame_register)(struct wiphy *wiphy,
-                                       struct net_device *dev,
+                                       struct wireless_dev *wdev,
                                        u16 frame_type, bool reg);
 
         int     (*set_antenna)(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant);
@@ -1818,7 +1828,10 @@ struct cfg80211_ops {
         void    (*get_et_strings)(struct wiphy *wiphy, struct net_device *dev,
                                   u32 sset, u8 *data);
 
-        void (*set_monitor_enabled)(struct wiphy *wiphy, bool enabled);
+        struct ieee80211_channel *
+                (*get_channel)(struct wiphy *wiphy,
+                               struct wireless_dev *wdev,
+                               enum nl80211_channel_type *type);
 };
 
 /*
@@ -2341,17 +2354,25 @@ struct cfg80211_internal_bss;
 struct cfg80211_cached_keys;
 
 /**
- * struct wireless_dev - wireless per-netdev state
+ * struct wireless_dev - wireless device state
+ *
+ * For netdevs, this structure must be allocated by the driver
+ * that uses the ieee80211_ptr field in struct net_device (this
+ * is intentional so it can be allocated along with the netdev.)
+ * It need not be registered then as netdev registration will
+ * be intercepted by cfg80211 to see the new wireless device.
  *
- * This structure must be allocated by the driver/stack
- * that uses the ieee80211_ptr field in struct net_device
- * (this is intentional so it can be allocated along with
- * the netdev.)
+ * For non-netdev uses, it must also be allocated by the driver
+ * in response to the cfg80211 callbacks that require it, as
+ * there's no netdev registration in that case it may not be
+ * allocated outside of callback operations that return it.
  *
  * @wiphy: pointer to hardware description
  * @iftype: interface type
  * @list: (private) Used to collect the interfaces
- * @netdev: (private) Used to reference back to the netdev
+ * @netdev: (private) Used to reference back to the netdev, may be %NULL
+ * @identifier: (private) Identifier used in nl80211 to identify this
+ *      wireless device if it has no netdev
  * @current_bss: (private) Used by the internal configuration code
  * @channel: (private) Used by the internal configuration code to track
  *      the user-set AP, monitor and WDS channel
@@ -2383,6 +2404,8 @@ struct wireless_dev {
         struct list_head list;
         struct net_device *netdev;
 
+        u32 identifier;
+
         struct list_head mgmt_registrations;
         spinlock_t mgmt_registrations_lock;
 
@@ -3269,7 +3292,7 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
 
 /**
  * cfg80211_ready_on_channel - notification of remain_on_channel start
- * @dev: network device
+ * @wdev: wireless device
  * @cookie: the request cookie
  * @chan: The current channel (from remain_on_channel request)
  * @channel_type: Channel type
@@ -3277,21 +3300,20 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
  *      channel
  * @gfp: allocation flags
  */
-void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
+void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
                                struct ieee80211_channel *chan,
                                enum nl80211_channel_type channel_type,
                                unsigned int duration, gfp_t gfp);
 
 /**
  * cfg80211_remain_on_channel_expired - remain_on_channel duration expired
- * @dev: network device
+ * @wdev: wireless device
  * @cookie: the request cookie
  * @chan: The current channel (from remain_on_channel request)
  * @channel_type: Channel type
  * @gfp: allocation flags
  */
-void cfg80211_remain_on_channel_expired(struct net_device *dev,
-                                        u64 cookie,
+void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
                                         struct ieee80211_channel *chan,
                                         enum nl80211_channel_type channel_type,
                                         gfp_t gfp);
@@ -3319,7 +3341,7 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
 
 /**
  * cfg80211_rx_mgmt - notification of received, unprocessed management frame
- * @dev: network device
+ * @wdev: wireless device receiving the frame
  * @freq: Frequency on which the frame was received in MHz
  * @sig_dbm: signal strength in mBm, or 0 if unknown
  * @buf: Management frame (header + body)
@@ -3334,12 +3356,12 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
  * This function is called whenever an Action frame is received for a station
  * mode interface, but is not processed in kernel.
  */
-bool cfg80211_rx_mgmt(struct net_device *dev, int freq, int sig_dbm,
+bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_dbm,
                       const u8 *buf, size_t len, gfp_t gfp);
 
 /**
  * cfg80211_mgmt_tx_status - notification of TX status for management frame
- * @dev: network device
+ * @wdev: wireless device receiving the frame
  * @cookie: Cookie returned by cfg80211_ops::mgmt_tx()
  * @buf: Management frame (header + body)
  * @len: length of the frame data
@@ -3350,7 +3372,7 @@ bool cfg80211_rx_mgmt(struct net_device *dev, int freq, int sig_dbm,
  * transmitted with cfg80211_ops::mgmt_tx() to report the TX status of the
  * transmission attempt.
  */
-void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
+void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
                              const u8 *buf, size_t len, bool ack, gfp_t gfp);
 
 
@@ -3380,6 +3402,21 @@ void cfg80211_cqm_pktloss_notify(struct net_device *dev,
                                  const u8 *peer, u32 num_packets, gfp_t gfp);
 
 /**
+ * cfg80211_cqm_txe_notify - TX error rate event
+ * @dev: network device
+ * @peer: peer's MAC address
+ * @num_packets: how many packets were lost
+ * @rate: % of packets which failed transmission
+ * @intvl: interval (in s) over which the TX failure threshold was breached.
+ * @gfp: context flags
+ *
+ * Notify userspace when configured % TX failures over number of packets in a
+ * given interval is exceeded.
+ */
+void cfg80211_cqm_txe_notify(struct net_device *dev, const u8 *peer,
+                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp);
+
+/**
  * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
  * @dev: network device
  * @bssid: BSSID of AP (to avoid races)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index e3fa90ce9ecb..bb86aa6f98dd 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -233,8 +233,10 @@ enum ieee80211_rssi_event {
  *      valid in station mode only while @assoc is true and if also
  *      requested by %IEEE80211_HW_NEED_DTIM_PERIOD (cf. also hw conf
  *      @ps_dtim_period)
- * @last_tsf: last beacon's/probe response's TSF timestamp (could be old
+ * @sync_tsf: last beacon's/probe response's TSF timestamp (could be old
  *      as it may have been received during scanning long ago)
+ * @sync_device_ts: the device timestamp corresponding to the sync_tsf,
+ *      the driver/device can use this to calculate synchronisation
  * @beacon_int: beacon interval
  * @assoc_capability: capabilities taken from assoc resp
  * @basic_rates: bitmap of basic rates, each bit stands for an
@@ -281,7 +283,8 @@ struct ieee80211_bss_conf {
         u8 dtim_period;
         u16 beacon_int;
         u16 assoc_capability;
-        u64 last_tsf;
+        u64 sync_tsf;
+        u32 sync_device_ts;
         u32 basic_rates;
         int mcast_rate[IEEE80211_NUM_BANDS];
         u16 ht_operation_mode;
@@ -696,6 +699,8 @@ enum mac80211_rx_flags {
  *
  * @mactime: value in microseconds of the 64-bit Time Synchronization Function
  *      (TSF) timer when the first data symbol (MPDU) arrived at the hardware.
+ * @device_timestamp: arbitrary timestamp for the device, mac80211 doesn't use
+ *      it but can store it and pass it back to the driver for synchronisation
  * @band: the active band when this frame was received
  * @freq: frequency the radio was tuned to when receiving this frame, in MHz
  * @signal: signal strength when receiving this frame, either in dBm, in dB or
@@ -709,13 +714,14 @@ enum mac80211_rx_flags {
  */
 struct ieee80211_rx_status {
         u64 mactime;
-        enum ieee80211_band band;
-        int freq;
-        int signal;
-        int antenna;
-        int rate_idx;
-        int flag;
-        unsigned int rx_flags;
+        u32 device_timestamp;
+        u16 flag;
+        u16 freq;
+        u8 rate_idx;
+        u8 rx_flags;
+        u8 band;
+        u8 antenna;
+        s8 signal;
 };
 
 /**
@@ -3592,22 +3598,6 @@ void ieee80211_request_smps(struct ieee80211_vif *vif,
                             enum ieee80211_smps_mode smps_mode);
 
 /**
- * ieee80211_key_removed - disable hw acceleration for key
- * @key_conf: The key hw acceleration should be disabled for
- *
- * This allows drivers to indicate that the given key has been
- * removed from hardware acceleration, due to a new key that
- * was added. Don't use this if the key can continue to be used
- * for TX, if the key restriction is on RX only it is permitted
- * to keep the key for TX only and not call this function.
- *
- * Due to locking constraints, it may only be called during
- * @set_key. This function must be allowed to sleep, and the
- * key it tries to disable may still be used until it returns.
- */
-void ieee80211_key_removed(struct ieee80211_key_conf *key_conf);
-
-/**
  * ieee80211_ready_on_channel - notification of remain-on-channel start
  * @hw: pointer as obtained from ieee80211_alloc_hw()
  */
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index a5f79933e211..7dcaa2794fde 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -52,6 +52,10 @@ enum environment_cap {
  *      DFS master operation on a known DFS region (NL80211_DFS_*),
  *      dfs_region represents that region. Drivers can use this and the
  *      @alpha2 to adjust their device's DFS parameters as required.
+ * @user_reg_hint_type: if the @initiator was of type
+ *      %NL80211_REGDOM_SET_BY_USER, this classifies the type
+ *      of hint passed. This could be any of the %NL80211_USER_REG_HINT_*
+ *      types.
  * @intersect: indicates whether the wireless core should intersect
  *      the requested regulatory domain with the presently set regulatory
  *      domain.
@@ -70,6 +74,7 @@ enum environment_cap {
 struct regulatory_request {
         int wiphy_idx;
         enum nl80211_reg_initiator initiator;
+        enum nl80211_user_reg_hint_type user_reg_hint_type;
         char alpha2[2];
         u8 dfs_region;
         bool intersect;