105 files changed, 3013 insertions, 608 deletions
diff --git a/include/linux/atalk.h b/include/linux/atalk.h
index d34c187432ed..f57c36881c48 100644
--- a/include/linux/atalk.h
+++ b/include/linux/atalk.h
@@ -3,6 +3,7 @@
 #include <linux/types.h>
 #include <asm/byteorder.h>
+#include <linux/socket.h>
 /*
 * AppleTalk networking structures
@@ -28,7 +29,7 @@ struct atalk_addr {
 };
 struct sockaddr_at {
-        sa_family_t       sat_family;
+        __kernel_sa_family_t sat_family;
        __u8              sat_port;
        struct atalk_addr sat_addr;
        char              sat_zero[8];
diff --git a/include/linux/ax25.h b/include/linux/ax25.h
index 56c11f0dbd80..74c89a41732d 100644
--- a/include/linux/ax25.h
+++ b/include/linux/ax25.h
@@ -47,7 +47,7 @@ typedef struct {
 } ax25_address;
 struct sockaddr_ax25 {
-        sa_family_t     sax25_family;
+        __kernel_sa_family_t sax25_family;
        ax25_address    sax25_call;
        int             sax25_ndigis;
        /* Digipeater ax25_address sets follow */
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 8c96654bef16..5dbd7055cb86 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -6,6 +6,7 @@
 #include <linux/bcma/bcma_driver_chipcommon.h>
 #include <linux/bcma/bcma_driver_pci.h>
+#include <linux/bcma/bcma_driver_mips.h>
 #include <linux/ssb/ssb.h> /* SPROM sharing */
 #include "bcma_regs.h"
@@ -14,9 +15,9 @@ struct bcma_device;
 struct bcma_bus;
 enum bcma_hosttype {
-        BCMA_HOSTTYPE_NONE,
        BCMA_HOSTTYPE_PCI,
        BCMA_HOSTTYPE_SDIO,
+        BCMA_HOSTTYPE_SOC,
 };
 struct bcma_chipinfo {
@@ -130,6 +131,7 @@ struct bcma_device {
        struct device dev;
        struct device *dma_dev;
        unsigned int irq;
        bool dev_registered;
@@ -138,6 +140,9 @@ struct bcma_device {
        u32 addr;
        u32 wrap;
+        void __iomem *io_addr;
+        void __iomem *io_wrap;
        void *drvdata;
        struct list_head list;
 };
@@ -190,9 +195,11 @@ struct bcma_bus {
        struct bcma_device *mapped_core;
        struct list_head cores;
        u8 nr_cores;
+        u8 init_done:1;
        struct bcma_drv_cc drv_cc;
        struct bcma_drv_pci drv_pci;
+        struct bcma_drv_mips drv_mips;
        /* We decided to share SPROM struct with SSB as long as we do not need
         * any hacks for BCMA. This simplifies drivers code. */
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index a0f684615ae5..1526d965ed06 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -24,6 +24,7 @@
 #define   BCMA_CC_FLASHT_NONE           0x00000000      /* No flash */
 #define   BCMA_CC_FLASHT_STSER          0x00000100      /* ST serial flash */
 #define   BCMA_CC_FLASHT_ATSER          0x00000200      /* Atmel serial flash */
+#define   BCMA_CC_FLASHT_NFLASH         0x00000200
 #define   BCMA_CC_FLASHT_PARA           0x00000700      /* Parallel flash */
 #define  BCMA_CC_CAP_PLLT               0x00038000      /* PLL Type */
 #define   BCMA_PLLTYPE_NONE             0x00000000
@@ -178,6 +179,7 @@
 #define BCMA_CC_PROG_CFG                0x0120
 #define BCMA_CC_PROG_WAITCNT            0x0124
 #define BCMA_CC_FLASH_CFG               0x0128
+#define  BCMA_CC_FLASH_CFG_DS           0x0010  /* Data size, 0=8bit, 1=16bit */
 #define BCMA_CC_FLASH_WAITCNT           0x012C
 /* 0x1E0 is defined as shared BCMA_CLKCTLST */
 #define BCMA_CC_HW_WORKAROUND           0x01E4 /* Hardware workaround (rev >= 20) */
@@ -239,6 +241,64 @@
 #define BCMA_CC_SPROM                   0x0800 /* SPROM beginning */
 #define BCMA_CC_SPROM_PCIE6             0x0830 /* SPROM beginning on PCIe rev >= 6 */
+/* Divider allocation in 4716/47162/5356 */
+#define BCMA_CC_PMU5_MAINPLL_CPU        1
+#define BCMA_CC_PMU5_MAINPLL_MEM        2
+#define BCMA_CC_PMU5_MAINPLL_SSB        3
+/* PLL usage in 4716/47162 */
+#define BCMA_CC_PMU4716_MAINPLL_PLL0    12
+/* PLL usage in 5356/5357 */
+#define BCMA_CC_PMU5356_MAINPLL_PLL0    0
+#define BCMA_CC_PMU5357_MAINPLL_PLL0    0
+/* 4706 PMU */
+#define BCMA_CC_PMU4706_MAINPLL_PLL0    0
+/* ALP clock on pre-PMU chips */
+#define BCMA_CC_PMU_ALP_CLOCK           20000000
+/* HT clock for systems with PMU-enabled chipcommon */
+#define BCMA_CC_PMU_HT_CLOCK            80000000
+/* PMU rev 5 (& 6) */
+#define BCMA_CC_PPL_P1P2_OFF            0
+#define BCMA_CC_PPL_P1_MASK             0x0f000000
+#define BCMA_CC_PPL_P1_SHIFT            24
+#define BCMA_CC_PPL_P2_MASK             0x00f00000
+#define BCMA_CC_PPL_P2_SHIFT            20
+#define BCMA_CC_PPL_M14_OFF             1
+#define BCMA_CC_PPL_MDIV_MASK           0x000000ff
+#define BCMA_CC_PPL_MDIV_WIDTH          8
+#define BCMA_CC_PPL_NM5_OFF             2
+#define BCMA_CC_PPL_NDIV_MASK           0xfff00000
+#define BCMA_CC_PPL_NDIV_SHIFT          20
+#define BCMA_CC_PPL_FMAB_OFF            3
+#define BCMA_CC_PPL_MRAT_MASK           0xf0000000
+#define BCMA_CC_PPL_MRAT_SHIFT          28
+#define BCMA_CC_PPL_ABRAT_MASK          0x08000000
+#define BCMA_CC_PPL_ABRAT_SHIFT         27
+#define BCMA_CC_PPL_FDIV_MASK           0x07ffffff
+#define BCMA_CC_PPL_PLLCTL_OFF          4
+#define BCMA_CC_PPL_PCHI_OFF            5
+#define BCMA_CC_PPL_PCHI_MASK           0x0000003f
+/* BCM4331 ChipControl numbers. */
+#define BCMA_CHIPCTL_4331_BT_COEXIST            BIT(0)  /* 0 disable */
+#define BCMA_CHIPCTL_4331_SECI                  BIT(1)  /* 0 SECI is disabled (JATG functional) */
+#define BCMA_CHIPCTL_4331_EXT_LNA               BIT(2)  /* 0 disable */
+#define BCMA_CHIPCTL_4331_SPROM_GPIO13_15       BIT(3)  /* sprom/gpio13-15 mux */
+#define BCMA_CHIPCTL_4331_EXTPA_EN              BIT(4)  /* 0 ext pa disable, 1 ext pa enabled */
+#define BCMA_CHIPCTL_4331_GPIOCLK_ON_SPROMCS    BIT(5)  /* set drive out GPIO_CLK on sprom_cs pin */
+#define BCMA_CHIPCTL_4331_PCIE_MDIO_ON_SPROMCS  BIT(6)  /* use sprom_cs pin as PCIE mdio interface */
+#define BCMA_CHIPCTL_4331_EXTPA_ON_GPIO2_5      BIT(7)  /* aband extpa will be at gpio2/5 and sprom_dout */
+#define BCMA_CHIPCTL_4331_OVR_PIPEAUXCLKEN      BIT(8)  /* override core control on pipe_AuxClkEnable */
+#define BCMA_CHIPCTL_4331_OVR_PIPEAUXPWRDOWN    BIT(9)  /* override core control on pipe_AuxPowerDown */
+#define BCMA_CHIPCTL_4331_PCIE_AUXCLKEN         BIT(10) /* pcie_auxclkenable */
+#define BCMA_CHIPCTL_4331_PCIE_PIPE_PLLDOWN     BIT(11) /* pcie_pipe_pllpowerdown */
+#define BCMA_CHIPCTL_4331_BT_SHD0_ON_GPIO4      BIT(16) /* enable bt_shd0 at gpio4 */
+#define BCMA_CHIPCTL_4331_BT_SHD1_ON_GPIO5      BIT(17) /* enable bt_shd1 at gpio5 */
 /* Data for the PMU, if available.
 * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
 */
@@ -247,14 +307,37 @@ struct bcma_chipcommon_pmu {
        u32 crystalfreq;        /* The active crystal frequency (in kHz) */
 };
+#ifdef CONFIG_BCMA_DRIVER_MIPS
+struct bcma_pflash {
+        u8 buswidth;
+        u32 window;
+        u32 window_size;
+};
+struct bcma_serial_port {
+        void *regs;
+        unsigned long clockspeed;
+        unsigned int irq;
+        unsigned int baud_base;
+        unsigned int reg_shift;
+};
+#endif /* CONFIG_BCMA_DRIVER_MIPS */
 struct bcma_drv_cc {
        struct bcma_device *core;
        u32 status;
        u32 capabilities;
        u32 capabilities_ext;
+        u8 setup_done:1;
        /* Fast Powerup Delay constant */
        u16 fast_pwrup_delay;
        struct bcma_chipcommon_pmu pmu;
+#ifdef CONFIG_BCMA_DRIVER_MIPS
+        struct bcma_pflash pflash;
+        int nr_serial_ports;
+        struct bcma_serial_port serial_ports[4];
+#endif /* CONFIG_BCMA_DRIVER_MIPS */
 };
 /* Register access */
@@ -275,6 +358,8 @@ extern void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
 extern void bcma_chipco_suspend(struct bcma_drv_cc *cc);
 extern void bcma_chipco_resume(struct bcma_drv_cc *cc);
+void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
 extern void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc,
                                          u32 ticks);
@@ -293,4 +378,13 @@ u32 bcma_chipco_gpio_polarity(struct bcma_drv_cc *cc, u32 mask, u32 value);
 /* PMU support */
 extern void bcma_pmu_init(struct bcma_drv_cc *cc);
+extern void bcma_chipco_pll_write(struct bcma_drv_cc *cc, u32 offset,
+                                  u32 value);
+extern void bcma_chipco_pll_maskset(struct bcma_drv_cc *cc, u32 offset,
+                                    u32 mask, u32 set);
+extern void bcma_chipco_chipctl_maskset(struct bcma_drv_cc *cc,
+                                        u32 offset, u32 mask, u32 set);
+extern void bcma_chipco_regctl_maskset(struct bcma_drv_cc *cc,
+                                       u32 offset, u32 mask, u32 set);
 #endif /* LINUX_BCMA_DRIVER_CC_H_ */
diff --git a/include/linux/bcma/bcma_driver_mips.h b/include/linux/bcma/bcma_driver_mips.h
new file mode 100644
index 000000000000..c0043645cdcb
--- /dev/null
+++ b/include/linux/bcma/bcma_driver_mips.h
@@ -0,0 +1,51 @@
+#ifndef LINUX_BCMA_DRIVER_MIPS_H_
+#define LINUX_BCMA_DRIVER_MIPS_H_
+#define BCMA_MIPS_IPSFLAG               0x0F08
+/* which sbflags get routed to mips interrupt 1 */
+#define  BCMA_MIPS_IPSFLAG_IRQ1         0x0000003F
+#define  BCMA_MIPS_IPSFLAG_IRQ1_SHIFT   0
+/* which sbflags get routed to mips interrupt 2 */
+#define  BCMA_MIPS_IPSFLAG_IRQ2         0x00003F00
+#define  BCMA_MIPS_IPSFLAG_IRQ2_SHIFT   8
+/* which sbflags get routed to mips interrupt 3 */
+#define  BCMA_MIPS_IPSFLAG_IRQ3         0x003F0000
+#define  BCMA_MIPS_IPSFLAG_IRQ3_SHIFT   16
+/* which sbflags get routed to mips interrupt 4 */
+#define  BCMA_MIPS_IPSFLAG_IRQ4         0x3F000000
+#define  BCMA_MIPS_IPSFLAG_IRQ4_SHIFT   24
+/* MIPS 74K core registers */
+#define BCMA_MIPS_MIPS74K_CORECTL       0x0000
+#define BCMA_MIPS_MIPS74K_EXCEPTBASE    0x0004
+#define BCMA_MIPS_MIPS74K_BIST          0x000C
+#define BCMA_MIPS_MIPS74K_INTMASK_INT0  0x0014
+#define BCMA_MIPS_MIPS74K_INTMASK(int) \
+        ((int) * 4 + BCMA_MIPS_MIPS74K_INTMASK_INT0)
+#define BCMA_MIPS_MIPS74K_NMIMASK       0x002C
+#define BCMA_MIPS_MIPS74K_GPIOSEL       0x0040
+#define BCMA_MIPS_MIPS74K_GPIOOUT       0x0044
+#define BCMA_MIPS_MIPS74K_GPIOEN        0x0048
+#define BCMA_MIPS_MIPS74K_CLKCTLST      0x01E0
+#define BCMA_MIPS_OOBSELOUTA30          0x100
+struct bcma_device;
+struct bcma_drv_mips {
+        struct bcma_device *core;
+        u8 setup_done:1;
+        unsigned int assigned_irqs;
+};
+#ifdef CONFIG_BCMA_DRIVER_MIPS
+extern void bcma_core_mips_init(struct bcma_drv_mips *mcore);
+#else
+static inline void bcma_core_mips_init(struct bcma_drv_mips *mcore) { }
+#endif
+extern u32 bcma_cpu_clock(struct bcma_drv_mips *mcore);
+extern unsigned int bcma_core_mips_irq(struct bcma_device *dev);
+#endif /* LINUX_BCMA_DRIVER_MIPS_H_ */
diff --git a/include/linux/bcma/bcma_soc.h b/include/linux/bcma/bcma_soc.h
new file mode 100644
index 000000000000..4203c5593b9f
--- /dev/null
+++ b/include/linux/bcma/bcma_soc.h
@@ -0,0 +1,16 @@
+#ifndef LINUX_BCMA_SOC_H_
+#define LINUX_BCMA_SOC_H_
+#include <linux/bcma/bcma.h>
+struct bcma_soc {
+        struct bcma_bus bus;
+        struct bcma_device core_cc;
+        struct bcma_device core_mips;
+};
+int __init bcma_host_soc_register(struct bcma_soc *soc);
+int bcma_bus_register(struct bcma_bus *bus);
+#endif /* LINUX_BCMA_SOC_H_ */
diff --git a/include/linux/caif/caif_socket.h b/include/linux/caif/caif_socket.h
index d9cb19b7cff7..3f3bac6af7bc 100644
--- a/include/linux/caif/caif_socket.h
+++ b/include/linux/caif/caif_socket.h
@@ -9,12 +9,7 @@
 #define _LINUX_CAIF_SOCKET_H
 #include <linux/types.h>
-#ifdef __KERNEL__
 #include <linux/socket.h>
-#else
-#include <sys/socket.h>
-#endif
 /**
 * enum caif_link_selector -    Physical Link Selection.
@@ -144,7 +139,7 @@ enum caif_debug_service {
 * CAIF Channel. It defines the service to connect to on the modem.
 */
 struct sockaddr_caif {
-        sa_family_t  family;
+        __kernel_sa_family_t  family;
        union {
                struct {
                        __u8  type;             /* type: enum caif_at_type */
diff --git a/include/linux/can.h b/include/linux/can.h
index d18333302cbd..9a19bcb3eeaf 100644
--- a/include/linux/can.h
+++ b/include/linux/can.h
@@ -8,8 +8,6 @@
 * Copyright (c) 2002-2007 Volkswagen Group Electronic Research
 * All rights reserved.
 *
- * Send feedback to <socketcan-users@lists.berlios.de>
- *
 */
 #ifndef CAN_H
@@ -78,7 +76,7 @@ struct can_frame {
 * @can_addr:    protocol specific address information
 */
 struct sockaddr_can {
-        sa_family_t can_family;
+        __kernel_sa_family_t can_family;
        int         can_ifindex;
        union {
                /* transport protocol class address information (e.g. ISOTP) */
diff --git a/include/linux/can/Kbuild b/include/linux/can/Kbuild
index 8cb05aae661c..c62b7f1728f9 100644
--- a/include/linux/can/Kbuild
+++ b/include/linux/can/Kbuild
@@ -1,4 +1,5 @@
 header-y += raw.h
 header-y += bcm.h
+header-y += gw.h
 header-y += error.h
 header-y += netlink.h
diff --git a/include/linux/can/bcm.h b/include/linux/can/bcm.h
index 1432b278c52d..3ebe387fea4d 100644
--- a/include/linux/can/bcm.h
+++ b/include/linux/can/bcm.h
@@ -7,14 +7,13 @@
 * Copyright (c) 2002-2007 Volkswagen Group Electronic Research
 * All rights reserved.
 *
- * Send feedback to <socketcan-users@lists.berlios.de>
- *
 */
 #ifndef CAN_BCM_H
 #define CAN_BCM_H
 #include <linux/types.h>
+#include <linux/can.h>
 /**
 * struct bcm_msg_head - head of messages to/from the broadcast manager
diff --git a/include/linux/can/core.h b/include/linux/can/core.h
index 5ce6b5d62ecc..0ccc1cd28b95 100644
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -8,8 +8,6 @@
 * Copyright (c) 2002-2007 Volkswagen Group Electronic Research
 * All rights reserved.
 *
- * Send feedback to <socketcan-users@lists.berlios.de>
- *
 */
 #ifndef CAN_CORE_H
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index cc0bb4961669..a0969fcb72b9 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -8,7 +8,6 @@
 *
 * Copyright (C) 2008 Wolfgang Grandegger <wg@grandegger.com>
 *
- * Send feedback to <socketcan-users@lists.berlios.de>
 */
 #ifndef CAN_DEV_H
diff --git a/include/linux/can/error.h b/include/linux/can/error.h
index 5958074302a4..63e855ea6b84 100644
--- a/include/linux/can/error.h
+++ b/include/linux/can/error.h
@@ -7,8 +7,6 @@
 * Copyright (c) 2002-2007 Volkswagen Group Electronic Research
 * All rights reserved.
 *
- * Send feedback to <socketcan-users@lists.berlios.de>
- *
 */
 #ifndef CAN_ERROR_H
diff --git a/include/linux/can/gw.h b/include/linux/can/gw.h
new file mode 100644
index 000000000000..8e1db18c3cb6
--- /dev/null
+++ b/include/linux/can/gw.h
@@ -0,0 +1,162 @@
+/*
+ * linux/can/gw.h
+ *
+ * Definitions for CAN frame Gateway/Router/Bridge
+ *
+ * Author: Oliver Hartkopp <oliver.hartkopp@volkswagen.de>
+ * Copyright (c) 2011 Volkswagen Group Electronic Research
+ * All rights reserved.
+ *
+ */
+#ifndef CAN_GW_H
+#define CAN_GW_H
+#include <linux/types.h>
+#include <linux/can.h>
+struct rtcanmsg {
+        __u8  can_family;
+        __u8  gwtype;
+        __u16 flags;
+};
+/* CAN gateway types */
+enum {
+        CGW_TYPE_UNSPEC,
+        CGW_TYPE_CAN_CAN,       /* CAN->CAN routing */
+        __CGW_TYPE_MAX
+};
+#define CGW_TYPE_MAX (__CGW_TYPE_MAX - 1)
+/* CAN rtnetlink attribute definitions */
+enum {
+        CGW_UNSPEC,
+        CGW_MOD_AND,    /* CAN frame modification binary AND */
+        CGW_MOD_OR,     /* CAN frame modification binary OR */
+        CGW_MOD_XOR,    /* CAN frame modification binary XOR */
+        CGW_MOD_SET,    /* CAN frame modification set alternate values */
+        CGW_CS_XOR,     /* set data[] XOR checksum into data[index] */
+        CGW_CS_CRC8,    /* set data[] CRC8 checksum into data[index] */
+        CGW_HANDLED,    /* number of handled CAN frames */
+        CGW_DROPPED,    /* number of dropped CAN frames */
+        CGW_SRC_IF,     /* ifindex of source network interface */
+        CGW_DST_IF,     /* ifindex of destination network interface */
+        CGW_FILTER,     /* specify struct can_filter on source CAN device */
+        __CGW_MAX
+};
+#define CGW_MAX (__CGW_MAX - 1)
+#define CGW_FLAGS_CAN_ECHO 0x01
+#define CGW_FLAGS_CAN_SRC_TSTAMP 0x02
+#define CGW_MOD_FUNCS 4 /* AND OR XOR SET */
+/* CAN frame elements that are affected by curr. 3 CAN frame modifications */
+#define CGW_MOD_ID      0x01
+#define CGW_MOD_DLC     0x02
+#define CGW_MOD_DATA    0x04
+#define CGW_FRAME_MODS 3 /* ID DLC DATA */
+#define MAX_MODFUNCTIONS (CGW_MOD_FUNCS * CGW_FRAME_MODS)
+struct cgw_frame_mod {
+        struct can_frame cf;
+        __u8 modtype;
+} __attribute__((packed));
+#define CGW_MODATTR_LEN sizeof(struct cgw_frame_mod)
+struct cgw_csum_xor {
+        __s8 from_idx;
+        __s8 to_idx;
+        __s8 result_idx;
+        __u8 init_xor_val;
+} __attribute__((packed));
+struct cgw_csum_crc8 {
+        __s8 from_idx;
+        __s8 to_idx;
+        __s8 result_idx;
+        __u8 init_crc_val;
+        __u8 final_xor_val;
+        __u8 crctab[256];
+        __u8 profile;
+        __u8 profile_data[20];
+} __attribute__((packed));
+/* length of checksum operation parameters. idx = index in CAN frame data[] */
+#define CGW_CS_XOR_LEN  sizeof(struct cgw_csum_xor)
+#define CGW_CS_CRC8_LEN  sizeof(struct cgw_csum_crc8)
+/* CRC8 profiles (compute CRC for additional data elements - see below) */
+enum {
+        CGW_CRC8PRF_UNSPEC,
+        CGW_CRC8PRF_1U8,        /* compute one additional u8 value */
+        CGW_CRC8PRF_16U8,       /* u8 value table indexed by data[1] & 0xF */
+        CGW_CRC8PRF_SFFID_XOR,  /* (can_id & 0xFF) ^ (can_id >> 8 & 0xFF) */
+        __CGW_CRC8PRF_MAX
+};
+#define CGW_CRC8PRF_MAX (__CGW_CRC8PRF_MAX - 1)
+/*
+ * CAN rtnetlink attribute contents in detail
+ *
+ * CGW_XXX_IF (length 4 bytes):
+ * Sets an interface index for source/destination network interfaces.
+ * For the CAN->CAN gwtype the indices of _two_ CAN interfaces are mandatory.
+ *
+ * CGW_FILTER (length 8 bytes):
+ * Sets a CAN receive filter for the gateway job specified by the
+ * struct can_filter described in include/linux/can.h
+ *
+ * CGW_MOD_XXX (length 17 bytes):
+ * Specifies a modification that's done to a received CAN frame before it is
+ * send out to the destination interface.
+ *
+ * <struct can_frame> data used as operator
+ * <u8> affected CAN frame elements
+ *
+ * CGW_CS_XOR (length 4 bytes):
+ * Set a simple XOR checksum starting with an initial value into
+ * data[result-idx] using data[start-idx] .. data[end-idx]
+ *
+ * The XOR checksum is calculated like this:
+ *
+ * xor = init_xor_val
+ *
+ * for (i = from_idx .. to_idx)
+ *      xor ^= can_frame.data[i]
+ *
+ * can_frame.data[ result_idx ] = xor
+ *
+ * CGW_CS_CRC8 (length 282 bytes):
+ * Set a CRC8 value into data[result-idx] using a given 256 byte CRC8 table,
+ * a given initial value and a defined input data[start-idx] .. data[end-idx].
+ * Finally the result value is XOR'ed with the final_xor_val.
+ *
+ * The CRC8 checksum is calculated like this:
+ *
+ * crc = init_crc_val
+ *
+ * for (i = from_idx .. to_idx)
+ *      crc = crctab[ crc ^ can_frame.data[i] ]
+ *
+ * can_frame.data[ result_idx ] = crc ^ final_xor_val
+ *
+ * The calculated CRC may contain additional source data elements that can be
+ * defined in the handling of 'checksum profiles' e.g. shown in AUTOSAR specs
+ * like http://www.autosar.org/download/R4.0/AUTOSAR_SWS_E2ELibrary.pdf
+ * E.g. the profile_data[] may contain additional u8 values (called DATA_IDs)
+ * that are used depending on counter values inside the CAN frame data[].
+ * So far only three profiles have been implemented for illustration.
+ *
+ * Remark: In general the attribute data is a linear buffer.
+ *         Beware of sending unpacked or aligned structs!
+ */
+#endif
diff --git a/include/linux/can/netlink.h b/include/linux/can/netlink.h
index 34542d374dd8..14966ddb7df1 100644
--- a/include/linux/can/netlink.h
+++ b/include/linux/can/netlink.h
@@ -5,8 +5,6 @@
 *
 * Copyright (c) 2009 Wolfgang Grandegger <wg@grandegger.com>
 *
- * Send feedback to <socketcan-users@lists.berlios.de>
- *
 */
 #ifndef CAN_NETLINK_H
diff --git a/include/linux/can/raw.h b/include/linux/can/raw.h
index b2a0f87492c5..781f3a3701be 100644
--- a/include/linux/can/raw.h
+++ b/include/linux/can/raw.h
@@ -8,8 +8,6 @@
 * Copyright (c) 2002-2007 Volkswagen Group Electronic Research
 * All rights reserved.
 *
- * Send feedback to <socketcan-users@lists.berlios.de>
- *
 */
 #ifndef CAN_RAW_H
diff --git a/include/linux/capability.h b/include/linux/capability.h
index c42112350003..a63d13d84ad8 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -198,7 +198,7 @@ struct cpu_vfs_cap_data {
 /* Allow modification of routing tables */
 /* Allow setting arbitrary process / process group ownership on
   sockets */
-/* Allow binding to any address for transparent proxying */
+/* Allow binding to any address for transparent proxying (also via NET_RAW) */
 /* Allow setting TOS (type of service) */
 /* Allow setting promiscuous mode */
 /* Allow clearing driver statistics */
@@ -210,6 +210,7 @@ struct cpu_vfs_cap_data {
 /* Allow use of RAW sockets */
 /* Allow use of PACKET sockets */
+/* Allow binding to any address for transparent proxying (also via NET_ADMIN) */
 #define CAP_NET_RAW          13
diff --git a/include/linux/cn_proc.h b/include/linux/cn_proc.h
index 12c517b51ca2..d03612b196e1 100644
--- a/include/linux/cn_proc.h
+++ b/include/linux/cn_proc.h
@@ -54,6 +54,7 @@ struct proc_event {
                PROC_EVENT_GID  = 0x00000040,
                PROC_EVENT_SID  = 0x00000080,
                PROC_EVENT_PTRACE = 0x00000100,
+                PROC_EVENT_COMM = 0x00000200,
                /* "next" should be 0x00000400 */
                /* "last" is the last process event: exit */
                PROC_EVENT_EXIT = 0x80000000
@@ -103,6 +104,12 @@ struct proc_event {
                        __kernel_pid_t tracer_tgid;
                } ptrace;
+                struct comm_proc_event {
+                        __kernel_pid_t process_pid;
+                        __kernel_pid_t process_tgid;
+                        char           comm[16];
+                } comm;
                struct exit_proc_event {
                        __kernel_pid_t process_pid;
                        __kernel_pid_t process_tgid;
@@ -118,6 +125,7 @@ void proc_exec_connector(struct task_struct *task);
 void proc_id_connector(struct task_struct *task, int which_id);
 void proc_sid_connector(struct task_struct *task);
 void proc_ptrace_connector(struct task_struct *task, int which_id);
+void proc_comm_connector(struct task_struct *task);
 void proc_exit_connector(struct task_struct *task);
 #else
 static inline void proc_fork_connector(struct task_struct *task)
@@ -133,6 +141,9 @@ static inline void proc_id_connector(struct task_struct *task,
 static inline void proc_sid_connector(struct task_struct *task)
 {}
+static inline void proc_comm_connector(struct task_struct *task)
+{}
 static inline void proc_ptrace_connector(struct task_struct *task,
                                         int ptrace_id)
 {}
diff --git a/include/linux/device.h b/include/linux/device.h
index 4639419522da..46751bdb71da 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -350,6 +350,8 @@ struct class_attribute {
                        char *buf);
        ssize_t (*store)(struct class *class, struct class_attribute *attr,
                        const char *buf, size_t count);
+        const void *(*namespace)(struct class *class,
+                                 const struct class_attribute *attr);
 };
 #define CLASS_ATTR(_name, _mode, _show, _store)                 \
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index c6e427ab65fe..45f00b61c096 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -117,99 +117,101 @@ struct ethtool_eeprom {
        __u8    data[0];
 };
-/* for configuring coalescing parameters of chip */
+/**
+ * struct ethtool_coalesce - coalescing parameters for IRQs and stats updates
+ * @cmd: ETHTOOL_{G,S}COALESCE
+ * @rx_coalesce_usecs: How many usecs to delay an RX interrupt after
+ *      a packet arrives.
+ * @rx_max_coalesced_frames: Maximum number of packets to receive
+ *      before an RX interrupt.
+ * @rx_coalesce_usecs_irq: Same as @rx_coalesce_usecs, except that
+ *      this value applies while an IRQ is being serviced by the host.
+ * @rx_max_coalesced_frames_irq: Same as @rx_max_coalesced_frames,
+ *      except that this value applies while an IRQ is being serviced
+ *      by the host.
+ * @tx_coalesce_usecs: How many usecs to delay a TX interrupt after
+ *      a packet is sent.
+ * @tx_max_coalesced_frames: Maximum number of packets to be sent
+ *      before a TX interrupt.
+ * @tx_coalesce_usecs_irq: Same as @tx_coalesce_usecs, except that
+ *      this value applies while an IRQ is being serviced by the host.
+ * @tx_max_coalesced_frames_irq: Same as @tx_max_coalesced_frames,
+ *      except that this value applies while an IRQ is being serviced
+ *      by the host.
+ * @stats_block_coalesce_usecs: How many usecs to delay in-memory
+ *      statistics block updates.  Some drivers do not have an
+ *      in-memory statistic block, and in such cases this value is
+ *      ignored.  This value must not be zero.
+ * @use_adaptive_rx_coalesce: Enable adaptive RX coalescing.
+ * @use_adaptive_tx_coalesce: Enable adaptive TX coalescing.
+ * @pkt_rate_low: Threshold for low packet rate (packets per second).
+ * @rx_coalesce_usecs_low: How many usecs to delay an RX interrupt after
+ *      a packet arrives, when the packet rate is below @pkt_rate_low.
+ * @rx_max_coalesced_frames_low: Maximum number of packets to be received
+ *      before an RX interrupt, when the packet rate is below @pkt_rate_low.
+ * @tx_coalesce_usecs_low: How many usecs to delay a TX interrupt after
+ *      a packet is sent, when the packet rate is below @pkt_rate_low.
+ * @tx_max_coalesced_frames_low: Maximum nuumber of packets to be sent before
+ *      a TX interrupt, when the packet rate is below @pkt_rate_low.
+ * @pkt_rate_high: Threshold for high packet rate (packets per second).
+ * @rx_coalesce_usecs_high: How many usecs to delay an RX interrupt after
+ *      a packet arrives, when the packet rate is above @pkt_rate_high.
+ * @rx_max_coalesced_frames_high: Maximum number of packets to be received
+ *      before an RX interrupt, when the packet rate is above @pkt_rate_high.
+ * @tx_coalesce_usecs_high: How many usecs to delay a TX interrupt after
+ *      a packet is sent, when the packet rate is above @pkt_rate_high.
+ * @tx_max_coalesced_frames_high: Maximum number of packets to be sent before
+ *      a TX interrupt, when the packet rate is above @pkt_rate_high.
+ * @rate_sample_interval: How often to do adaptive coalescing packet rate
+ *      sampling, measured in seconds.  Must not be zero.
+ *
+ * Each pair of (usecs, max_frames) fields specifies this exit
+ * condition for interrupt coalescing:
+ *      (usecs > 0 && time_since_first_completion >= usecs) ||
+ *      (max_frames > 0 && completed_frames >= max_frames)
+ * It is illegal to set both usecs and max_frames to zero as this
+ * would cause interrupts to never be generated.  To disable
+ * coalescing, set usecs = 0 and max_frames = 1.
+ *
+ * Some implementations ignore the value of max_frames and use the
+ * condition:
+ *      time_since_first_completion >= usecs
+ * This is deprecated.  Drivers for hardware that does not support
+ * counting completions should validate that max_frames == !rx_usecs.
+ *
+ * Adaptive RX/TX coalescing is an algorithm implemented by some
+ * drivers to improve latency under low packet rates and improve
+ * throughput under high packet rates.  Some drivers only implement
+ * one of RX or TX adaptive coalescing.  Anything not implemented by
+ * the driver causes these values to be silently ignored.
+ *
+ * When the packet rate is below @pkt_rate_high but above
+ * @pkt_rate_low (both measured in packets per second) the
+ * normal {rx,tx}_* coalescing parameters are used.
+ */
 struct ethtool_coalesce {
-        __u32   cmd;    /* ETHTOOL_{G,S}COALESCE */
+        __u32   cmd;
-        /* How many usecs to delay an RX interrupt after
-         * a packet arrives.  If 0, only rx_max_coalesced_frames
-         * is used.
-         */
        __u32   rx_coalesce_usecs;
-        /* How many packets to delay an RX interrupt after
-         * a packet arrives.  If 0, only rx_coalesce_usecs is
-         * used.  It is illegal to set both usecs and max frames
-         * to zero as this would cause RX interrupts to never be
-         * generated.
-         */
        __u32   rx_max_coalesced_frames;
-        /* Same as above two parameters, except that these values
-         * apply while an IRQ is being serviced by the host.  Not
-         * all cards support this feature and the values are ignored
-         * in that case.
-         */
        __u32   rx_coalesce_usecs_irq;
        __u32   rx_max_coalesced_frames_irq;
-        /* How many usecs to delay a TX interrupt after
-         * a packet is sent.  If 0, only tx_max_coalesced_frames
-         * is used.
-         */
        __u32   tx_coalesce_usecs;
-        /* How many packets to delay a TX interrupt after
-         * a packet is sent.  If 0, only tx_coalesce_usecs is
-         * used.  It is illegal to set both usecs and max frames
-         * to zero as this would cause TX interrupts to never be
-         * generated.
-         */
        __u32   tx_max_coalesced_frames;
-        /* Same as above two parameters, except that these values
-         * apply while an IRQ is being serviced by the host.  Not
-         * all cards support this feature and the values are ignored
-         * in that case.
-         */
        __u32   tx_coalesce_usecs_irq;
        __u32   tx_max_coalesced_frames_irq;
-        /* How many usecs to delay in-memory statistics
-         * block updates.  Some drivers do not have an in-memory
-         * statistic block, and in such cases this value is ignored.
-         * This value must not be zero.
-         */
        __u32   stats_block_coalesce_usecs;
-        /* Adaptive RX/TX coalescing is an algorithm implemented by
-         * some drivers to improve latency under low packet rates and
-         * improve throughput under high packet rates.  Some drivers
-         * only implement one of RX or TX adaptive coalescing.  Anything
-         * not implemented by the driver causes these values to be
-         * silently ignored.
-         */
        __u32   use_adaptive_rx_coalesce;
        __u32   use_adaptive_tx_coalesce;
-        /* When the packet rate (measured in packets per second)
-         * is below pkt_rate_low, the {rx,tx}_*_low parameters are
-         * used.
-         */
        __u32   pkt_rate_low;
        __u32   rx_coalesce_usecs_low;
        __u32   rx_max_coalesced_frames_low;
        __u32   tx_coalesce_usecs_low;
        __u32   tx_max_coalesced_frames_low;
-        /* When the packet rate is below pkt_rate_high but above
-         * pkt_rate_low (both measured in packets per second) the
-         * normal {rx,tx}_* coalescing parameters are used.
-         */
-        /* When the packet rate is (measured in packets per second)
-         * is above pkt_rate_high, the {rx,tx}_*_high parameters are
-         * used.
-         */
        __u32   pkt_rate_high;
        __u32   rx_coalesce_usecs_high;
        __u32   rx_max_coalesced_frames_high;
        __u32   tx_coalesce_usecs_high;
        __u32   tx_max_coalesced_frames_high;
-        /* How often to do adaptive coalescing packet rate sampling,
-         * measured in seconds.  Must not be zero.
-         */
        __u32   rate_sample_interval;
 };
@@ -444,7 +446,7 @@ struct ethtool_flow_ext {
 };
 /**
- * struct ethtool_rx_flow_spec - specification for RX flow filter
+ * struct ethtool_rx_flow_spec - classification rule for RX flows
 * @flow_type: Type of match to perform, e.g. %TCP_V4_FLOW
 * @h_u: Flow fields to match (dependent on @flow_type)
 * @h_ext: Additional fields to match
@@ -454,7 +456,9 @@ struct ethtool_flow_ext {
 *      includes the %FLOW_EXT flag.
 * @ring_cookie: RX ring/queue index to deliver to, or %RX_CLS_FLOW_DISC
 *      if packets should be discarded
- * @location: Index of filter in hardware table
+ * @location: Location of rule in the table.  Locations must be
+ *      numbered such that a flow matching multiple rules will be
+ *      classified according to the first (lowest numbered) rule.
 */
 struct ethtool_rx_flow_spec {
        __u32           flow_type;
@@ -473,9 +477,9 @@ struct ethtool_rx_flow_spec {
 *      %ETHTOOL_GRXCLSRLALL, %ETHTOOL_SRXCLSRLDEL or %ETHTOOL_SRXCLSRLINS
 * @flow_type: Type of flow to be affected, e.g. %TCP_V4_FLOW
 * @data: Command-dependent value
- * @fs: Flow filter specification
+ * @fs: Flow classification rule
 * @rule_cnt: Number of rules to be affected
- * @rule_locs: Array of valid rule indices
+ * @rule_locs: Array of used rule locations
 *
 * For %ETHTOOL_GRXFH and %ETHTOOL_SRXFH, @data is a bitmask indicating
 * the fields included in the flow hash, e.g. %RXH_IP_SRC.  The following
@@ -487,23 +491,20 @@ struct ethtool_rx_flow_spec {
 * For %ETHTOOL_GRXCLSRLCNT, @rule_cnt is set to the number of defined
 * rules on return.
 *
- * For %ETHTOOL_GRXCLSRULE, @fs.@location specifies the index of an
+ * For %ETHTOOL_GRXCLSRULE, @fs.@location specifies the location of an
- * existing filter rule on entry and @fs contains the rule on return.
+ * existing rule on entry and @fs contains the rule on return.
 *
 * For %ETHTOOL_GRXCLSRLALL, @rule_cnt specifies the array size of the
 * user buffer for @rule_locs on entry.  On return, @data is the size
- * of the filter table and @rule_locs contains the indices of the
+ * of the rule table, @rule_cnt is the number of defined rules, and
- * defined rules.
+ * @rule_locs contains the locations of the defined rules.  Drivers
+ * must use the second parameter to get_rxnfc() instead of @rule_locs.
 *
- * For %ETHTOOL_SRXCLSRLINS, @fs specifies the filter rule to add or
+ * For %ETHTOOL_SRXCLSRLINS, @fs specifies the rule to add or update.
- * update.  @fs.@location specifies the index to use and must not be
+ * @fs.@location specifies the location to use and must not be ignored.
- * ignored.
 *
- * For %ETHTOOL_SRXCLSRLDEL, @fs.@location specifies the index of an
+ * For %ETHTOOL_SRXCLSRLDEL, @fs.@location specifies the location of an
- * existing filter rule on entry.
+ * existing rule on entry.
- *
- * Implementation of indexed classification rules generally requires a
- * TCAM.
 */
 struct ethtool_rxnfc {
        __u32                           cmd;
@@ -726,6 +727,9 @@ enum ethtool_sfeatures_retval_bits {
 /* needed by dev_disable_lro() */
 extern int __ethtool_set_flags(struct net_device *dev, u32 flags);
+extern int __ethtool_get_settings(struct net_device *dev,
+                                  struct ethtool_cmd *cmd);
 /**
 * enum ethtool_phys_id_state - indicator state for physical identification
 * @ETHTOOL_ID_INACTIVE: Physical ID indicator should be deactivated
@@ -936,7 +940,7 @@ struct ethtool_ops {
        int     (*set_priv_flags)(struct net_device *, u32);
        int     (*get_sset_count)(struct net_device *, int);
        int     (*get_rxnfc)(struct net_device *,
-                             struct ethtool_rxnfc *, void *);
+                             struct ethtool_rxnfc *, u32 *rule_locs);
        int     (*set_rxnfc)(struct net_device *, struct ethtool_rxnfc *);
        int     (*flash_device)(struct net_device *, struct ethtool_flash *);
        int     (*reset)(struct net_device *, u32 *);
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 741956fa5bfd..8eeb205f298b 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -155,7 +155,7 @@ extern unsigned int sk_run_filter(const struct sk_buff *skb,
                                  const struct sock_filter *filter);
 extern int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk);
 extern int sk_detach_filter(struct sock *sk);
-extern int sk_chk_filter(struct sock_filter *filter, int flen);
+extern int sk_chk_filter(struct sock_filter *filter, unsigned int flen);
 #ifdef CONFIG_BPF_JIT
 extern void bpf_jit_compile(struct sk_filter *fp);
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 54c878960872..48363c3c40f8 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -130,6 +130,8 @@
 #define IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK   0x0060
 /* A-MSDU 802.11n */
 #define IEEE80211_QOS_CTL_A_MSDU_PRESENT        0x0080
+/* Mesh Control 802.11s */
+#define IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT  0x0100
 /* U-APSD queue for WMM IEs sent by AP */
 #define IEEE80211_WMM_IE_AP_QOSINFO_UAPSD       (1<<7)
@@ -629,9 +631,14 @@ struct ieee80211_rann_ie {
        u8 rann_ttl;
        u8 rann_addr[6];
        u32 rann_seq;
+        u32 rann_interval;
        u32 rann_metric;
 } __attribute__ ((packed));
+enum ieee80211_rann_flags {
+        RANN_FLAG_IS_GATE = 1 << 0,
+};
 #define WLAN_SA_QUERY_TR_ID_LEN 2
 struct ieee80211_mgmt {
@@ -736,19 +743,10 @@ struct ieee80211_mgmt {
                                        __le16 params;
                                        __le16 reason_code;
                                } __attribute__((packed)) delba;
-                                struct{
+                                struct {
                                        u8 action_code;
-                                        /* capab_info for open and confirm,
-                                         * reason for close
-                                         */
-                                        __le16 aux;
-                                        /* Followed in plink_confirm by status
-                                         * code, AID and supported rates,
-                                         * and directly by supported rates in
-                                         * plink_open and plink_close
-                                         */
                                        u8 variable[0];
-                                } __attribute__((packed)) plink_action;
+                                } __attribute__((packed)) self_prot;
                                struct{
                                        u8 action_code;
                                        u8 variable[0];
@@ -761,6 +759,12 @@ struct ieee80211_mgmt {
                                        u8 action;
                                        u8 smps_control;
                                } __attribute__ ((packed)) ht_smps;
+                                struct {
+                                        u8 action_code;
+                                        u8 dialog_token;
+                                        __le16 capability;
+                                        u8 variable[0];
+                                } __packed tdls_discover_resp;
                        } u;
                } __attribute__ ((packed)) action;
        } u;
@@ -779,6 +783,13 @@ struct ieee80211_mmie {
        u8 mic[8];
 } __attribute__ ((packed));
+struct ieee80211_vendor_ie {
+        u8 element_id;
+        u8 len;
+        u8 oui[3];
+        u8 oui_type;
+} __packed;
 /* Control frames */
 struct ieee80211_rts {
        __le16 frame_control;
@@ -800,6 +811,52 @@ struct ieee80211_pspoll {
        u8 ta[6];
 } __attribute__ ((packed));
+/* TDLS */
+/* Link-id information element */
+struct ieee80211_tdls_lnkie {
+        u8 ie_type; /* Link Identifier IE */
+        u8 ie_len;
+        u8 bssid[6];
+        u8 init_sta[6];
+        u8 resp_sta[6];
+} __packed;
+struct ieee80211_tdls_data {
+        u8 da[6];
+        u8 sa[6];
+        __be16 ether_type;
+        u8 payload_type;
+        u8 category;
+        u8 action_code;
+        union {
+                struct {
+                        u8 dialog_token;
+                        __le16 capability;
+                        u8 variable[0];
+                } __packed setup_req;
+                struct {
+                        __le16 status_code;
+                        u8 dialog_token;
+                        __le16 capability;
+                        u8 variable[0];
+                } __packed setup_resp;
+                struct {
+                        __le16 status_code;
+                        u8 dialog_token;
+                        u8 variable[0];
+                } __packed setup_cfm;
+                struct {
+                        __le16 reason_code;
+                        u8 variable[0];
+                } __packed teardown;
+                struct {
+                        u8 dialog_token;
+                        u8 variable[0];
+                } __packed discover_req;
+        } u;
+} __packed;
 /**
 * struct ieee80211_bar - HT Block Ack Request
 *
@@ -816,9 +873,11 @@ struct ieee80211_bar {
 } __attribute__((packed));
 /* 802.11 BAR control masks */
-#define IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL     0x0000
+#define IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL    0x0000
-#define IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA  0x0004
+#define IEEE80211_BAR_CTRL_MULTI_TID            0x0002
+#define IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA 0x0004
+#define IEEE80211_BAR_CTRL_TID_INFO_MASK        0xf000
+#define IEEE80211_BAR_CTRL_TID_INFO_SHIFT       12
 #define IEEE80211_HT_MCS_MASK_LEN               10
@@ -1189,16 +1248,13 @@ enum ieee80211_eid {
        WLAN_EID_TS_DELAY = 43,
        WLAN_EID_TCLAS_PROCESSING = 44,
        WLAN_EID_QOS_CAPA = 46,
+        /* 802.11z */
+        WLAN_EID_LINK_ID = 101,
        /* 802.11s */
        WLAN_EID_MESH_CONFIG = 113,
        WLAN_EID_MESH_ID = 114,
        WLAN_EID_LINK_METRIC_REPORT = 115,
        WLAN_EID_CONGESTION_NOTIFICATION = 116,
-        /* Note that the Peer Link IE has been replaced with the similar
-         * Peer Management IE.  We will keep the former definition until mesh
-         * code is changed to comply with latest 802.11s drafts.
-         */
-        WLAN_EID_PEER_LINK = 55,  /* no longer in 802.11s drafts */
        WLAN_EID_PEER_MGMT = 117,
        WLAN_EID_CHAN_SWITCH_PARAM = 118,
        WLAN_EID_MESH_AWAKE_WINDOW = 119,
@@ -1277,13 +1333,11 @@ enum ieee80211_category {
        WLAN_CATEGORY_HT = 7,
        WLAN_CATEGORY_SA_QUERY = 8,
        WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION = 9,
+        WLAN_CATEGORY_TDLS = 12,
        WLAN_CATEGORY_MESH_ACTION = 13,
        WLAN_CATEGORY_MULTIHOP_ACTION = 14,
        WLAN_CATEGORY_SELF_PROTECTED = 15,
        WLAN_CATEGORY_WMM = 17,
-        /* TODO: remove MESH_PATH_SEL after mesh is updated
-         * to current 802.11s draft  */
-        WLAN_CATEGORY_MESH_PATH_SEL = 32,
        WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
        WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
 };
@@ -1309,6 +1363,31 @@ enum ieee80211_ht_actioncode {
        WLAN_HT_ACTION_ASEL_IDX_FEEDBACK = 7,
 };
+/* Self Protected Action codes */
+enum ieee80211_self_protected_actioncode {
+        WLAN_SP_RESERVED = 0,
+        WLAN_SP_MESH_PEERING_OPEN = 1,
+        WLAN_SP_MESH_PEERING_CONFIRM = 2,
+        WLAN_SP_MESH_PEERING_CLOSE = 3,
+        WLAN_SP_MGK_INFORM = 4,
+        WLAN_SP_MGK_ACK = 5,
+};
+/* Mesh action codes */
+enum ieee80211_mesh_actioncode {
+        WLAN_MESH_ACTION_LINK_METRIC_REPORT,
+        WLAN_MESH_ACTION_HWMP_PATH_SELECTION,
+        WLAN_MESH_ACTION_GATE_ANNOUNCEMENT,
+        WLAN_MESH_ACTION_CONGESTION_CONTROL_NOTIFICATION,
+        WLAN_MESH_ACTION_MCCA_SETUP_REQUEST,
+        WLAN_MESH_ACTION_MCCA_SETUP_REPLY,
+        WLAN_MESH_ACTION_MCCA_ADVERTISEMENT_REQUEST,
+        WLAN_MESH_ACTION_MCCA_ADVERTISEMENT,
+        WLAN_MESH_ACTION_MCCA_TEARDOWN,
+        WLAN_MESH_ACTION_TBTT_ADJUSTMENT_REQUEST,
+        WLAN_MESH_ACTION_TBTT_ADJUSTMENT_RESPONSE,
+};
 /* Security key length */
 enum ieee80211_key_len {
        WLAN_KEY_LEN_WEP40 = 5,
@@ -1318,6 +1397,36 @@ enum ieee80211_key_len {
        WLAN_KEY_LEN_AES_CMAC = 16,
 };
+/* Public action codes */
+enum ieee80211_pub_actioncode {
+        WLAN_PUB_ACTION_TDLS_DISCOVER_RES = 14,
+};
+/* TDLS action codes */
+enum ieee80211_tdls_actioncode {
+        WLAN_TDLS_SETUP_REQUEST = 0,
+        WLAN_TDLS_SETUP_RESPONSE = 1,
+        WLAN_TDLS_SETUP_CONFIRM = 2,
+        WLAN_TDLS_TEARDOWN = 3,
+        WLAN_TDLS_PEER_TRAFFIC_INDICATION = 4,
+        WLAN_TDLS_CHANNEL_SWITCH_REQUEST = 5,
+        WLAN_TDLS_CHANNEL_SWITCH_RESPONSE = 6,
+        WLAN_TDLS_PEER_PSM_REQUEST = 7,
+        WLAN_TDLS_PEER_PSM_RESPONSE = 8,
+        WLAN_TDLS_PEER_TRAFFIC_RESPONSE = 9,
+        WLAN_TDLS_DISCOVERY_REQUEST = 10,
+};
+/*
+ * TDLS capabililites to be enabled in the 5th byte of the
+ * @WLAN_EID_EXT_CAPABILITY information element
+ */
+#define WLAN_EXT_CAPA5_TDLS_ENABLED     BIT(5)
+#define WLAN_EXT_CAPA5_TDLS_PROHIBITED  BIT(6)
+/* TDLS specific payload type in the LLC/SNAP header */
+#define WLAN_TDLS_SNAP_RFTYPE   0x2
 /**
 * enum - mesh path selection protocol identifier
 *
@@ -1453,6 +1562,9 @@ enum ieee80211_sa_query_action {
 #define WLAN_PMKID_LEN                  16
+#define WLAN_OUI_WFA                    0x506f9a
+#define WLAN_OUI_TYPE_WFA_P2P           9
 /*
 * WMM/802.11e Tspec Element
 */
diff --git a/include/linux/if.h b/include/linux/if.h
index 03489ca92ded..db20bd4fd16b 100644
--- a/include/linux/if.h
+++ b/include/linux/if.h
@@ -78,6 +78,7 @@
                                         * datapath port */
 #define IFF_TX_SKB_SHARING      0x10000 /* The interface supports sharing
                                         * skbs on transmit */
+#define IFF_UNICAST_FLT 0x20000         /* Supports unicast filtering   */
 #define IF_GET_IFACE    0x0001          /* for querying only */
 #define IF_GET_PROTO    0x0002
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index a3d99ff6e3b5..e473003e4bda 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -83,11 +83,13 @@
 #define ETH_P_8021AH    0x88E7          /* 802.1ah Backbone Service Tag */
 #define ETH_P_1588      0x88F7          /* IEEE 1588 Timesync */
 #define ETH_P_FCOE      0x8906          /* Fibre Channel over Ethernet  */
+#define ETH_P_TDLS      0x890D          /* TDLS */
 #define ETH_P_FIP       0x8914          /* FCoE Initialization Protocol */
 #define ETH_P_QINQ1     0x9100          /* deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] */
 #define ETH_P_QINQ2     0x9200          /* deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] */
 #define ETH_P_QINQ3     0x9300          /* deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] */
 #define ETH_P_EDSA      0xDADA          /* Ethertype DSA [ NOT AN OFFICIALLY REGISTERED ID ] */
+#define ETH_P_AF_IUCV   0xFBFB          /* IBM af_iucv [ NOT AN OFFICIALLY REGISTERED ID ] */
 /*
 *      Non DIX types. Won't clash for 1500 types.
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index 0ee969a5593d..c52d4b5f872a 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -279,6 +279,7 @@ enum {
        IFLA_VF_MAC,            /* Hardware queue specific attributes */
        IFLA_VF_VLAN,
        IFLA_VF_TX_RATE,        /* TX Bandwidth Allocation */
+        IFLA_VF_SPOOFCHK,       /* Spoof Checking on/off switch */
        __IFLA_VF_MAX,
 };
@@ -300,13 +301,22 @@ struct ifla_vf_tx_rate {
        __u32 rate; /* Max TX bandwidth in Mbps, 0 disables throttling */
 };
+struct ifla_vf_spoofchk {
+        __u32 vf;
+        __u32 setting;
+};
+#ifdef __KERNEL__
+/* We don't want this structure exposed to user space */
 struct ifla_vf_info {
        __u32 vf;
        __u8 mac[32];
        __u32 vlan;
        __u32 qos;
        __u32 tx_rate;
+        __u32 spoofchk;
 };
+#endif
 /* VF ports management section
 *
diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
index e28b2e4959d4..d103dca5c563 100644
--- a/include/linux/if_macvlan.h
+++ b/include/linux/if_macvlan.h
@@ -64,6 +64,7 @@ struct macvlan_dev {
        int (*forward)(struct net_device *dev, struct sk_buff *skb);
        struct macvtap_queue    *taps[MAX_MACVTAP_QUEUES];
        int                     numvtaps;
+        int                     minor;
 };
 static inline void macvlan_count_rx(const struct macvlan_dev *vlan,
diff --git a/include/linux/if_packet.h b/include/linux/if_packet.h
index c1486060f5ed..f3799295d231 100644
--- a/include/linux/if_packet.h
+++ b/include/linux/if_packet.h
@@ -61,6 +61,17 @@ struct tpacket_stats {
        unsigned int    tp_drops;
 };
+struct tpacket_stats_v3 {
+        unsigned int    tp_packets;
+        unsigned int    tp_drops;
+        unsigned int    tp_freeze_q_cnt;
+};
+union tpacket_stats_u {
+        struct tpacket_stats stats1;
+        struct tpacket_stats_v3 stats3;
+};
 struct tpacket_auxdata {
        __u32           tp_status;
        __u32           tp_len;
@@ -78,6 +89,7 @@ struct tpacket_auxdata {
 #define TP_STATUS_LOSING        0x4
 #define TP_STATUS_CSUMNOTREADY  0x8
 #define TP_STATUS_VLAN_VALID   0x10 /* auxdata has valid tp_vlan_tci */
+#define TP_STATUS_BLK_TMO       0x20
 /* Tx ring - header status */
 #define TP_STATUS_AVAILABLE     0x0
@@ -85,6 +97,9 @@ struct tpacket_auxdata {
 #define TP_STATUS_SENDING       0x2
 #define TP_STATUS_WRONG_FORMAT  0x4
+/* Rx ring - feature request bits */
+#define TP_FT_REQ_FILL_RXHASH   0x1
 struct tpacket_hdr {
        unsigned long   tp_status;
        unsigned int    tp_len;
@@ -111,11 +126,100 @@ struct tpacket2_hdr {
        __u16           tp_padding;
 };
+struct tpacket_hdr_variant1 {
+        __u32   tp_rxhash;
+        __u32   tp_vlan_tci;
+};
+struct tpacket3_hdr {
+        __u32           tp_next_offset;
+        __u32           tp_sec;
+        __u32           tp_nsec;
+        __u32           tp_snaplen;
+        __u32           tp_len;
+        __u32           tp_status;
+        __u16           tp_mac;
+        __u16           tp_net;
+        /* pkt_hdr variants */
+        union {
+                struct tpacket_hdr_variant1 hv1;
+        };
+};
+struct tpacket_bd_ts {
+        unsigned int ts_sec;
+        union {
+                unsigned int ts_usec;
+                unsigned int ts_nsec;
+        };
+};
+struct tpacket_hdr_v1 {
+        __u32   block_status;
+        __u32   num_pkts;
+        __u32   offset_to_first_pkt;
+        /* Number of valid bytes (including padding)
+         * blk_len <= tp_block_size
+         */
+        __u32   blk_len;
+        /*
+         * Quite a few uses of sequence number:
+         * 1. Make sure cache flush etc worked.
+         *    Well, one can argue - why not use the increasing ts below?
+         *    But look at 2. below first.
+         * 2. When you pass around blocks to other user space decoders,
+         *    you can see which blk[s] is[are] outstanding etc.
+         * 3. Validate kernel code.
+         */
+        __aligned_u64   seq_num;
+        /*
+         * ts_last_pkt:
+         *
+         * Case 1.      Block has 'N'(N >=1) packets and TMO'd(timed out)
+         *              ts_last_pkt == 'time-stamp of last packet' and NOT the
+         *              time when the timer fired and the block was closed.
+         *              By providing the ts of the last packet we can absolutely
+         *              guarantee that time-stamp wise, the first packet in the
+         *              next block will never precede the last packet of the
+         *              previous block.
+         * Case 2.      Block has zero packets and TMO'd
+         *              ts_last_pkt = time when the timer fired and the block
+         *              was closed.
+         * Case 3.      Block has 'N' packets and NO TMO.
+         *              ts_last_pkt = time-stamp of the last pkt in the block.
+         *
+         * ts_first_pkt:
+         *              Is always the time-stamp when the block was opened.
+         *              Case a) ZERO packets
+         *                      No packets to deal with but atleast you know the
+         *                      time-interval of this block.
+         *              Case b) Non-zero packets
+         *                      Use the ts of the first packet in the block.
+         *
+         */
+        struct tpacket_bd_ts    ts_first_pkt, ts_last_pkt;
+};
+union tpacket_bd_header_u {
+        struct tpacket_hdr_v1 bh1;
+};
+struct tpacket_block_desc {
+        __u32 version;
+        __u32 offset_to_priv;
+        union tpacket_bd_header_u hdr;
+};
 #define TPACKET2_HDRLEN         (TPACKET_ALIGN(sizeof(struct tpacket2_hdr)) + sizeof(struct sockaddr_ll))
+#define TPACKET3_HDRLEN         (TPACKET_ALIGN(sizeof(struct tpacket3_hdr)) + sizeof(struct sockaddr_ll))
 enum tpacket_versions {
        TPACKET_V1,
        TPACKET_V2,
+        TPACKET_V3
 };
 /*
@@ -138,6 +242,21 @@ struct tpacket_req {
        unsigned int    tp_frame_nr;    /* Total number of frames */
 };
+struct tpacket_req3 {
+        unsigned int    tp_block_size;  /* Minimal size of contiguous block */
+        unsigned int    tp_block_nr;    /* Number of blocks */
+        unsigned int    tp_frame_size;  /* Size of frame */
+        unsigned int    tp_frame_nr;    /* Total number of frames */
+        unsigned int    tp_retire_blk_tov; /* timeout in msecs */
+        unsigned int    tp_sizeof_priv; /* offset to private data area */
+        unsigned int    tp_feature_req_word;
+};
+union tpacket_req_u {
+        struct tpacket_req      req;
+        struct tpacket_req3     req3;
+};
 struct packet_mreq {
        int             mr_ifindex;
        unsigned short  mr_type;
diff --git a/include/linux/if_pppol2tp.h b/include/linux/if_pppol2tp.h
index 184bc5566207..23cefa1111bf 100644
--- a/include/linux/if_pppol2tp.h
+++ b/include/linux/if_pppol2tp.h
@@ -39,7 +39,7 @@ struct pppol2tp_addr {
 * bits. So we need a different sockaddr structure.
 */
 struct pppol2tpv3_addr {
-        pid_t   pid;                    /* pid that owns the fd.
+        __kernel_pid_t  pid;            /* pid that owns the fd.
                                         * 0 => current */
        int     fd;                     /* FD of UDP or IP socket to use */
diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
index 397921b09ef9..b5f927f59f26 100644
--- a/include/linux/if_pppox.h
+++ b/include/linux/if_pppox.h
@@ -20,8 +20,9 @@
 #include <linux/types.h>
 #include <asm/byteorder.h>
-#ifdef  __KERNEL__
+#include <linux/socket.h>
 #include <linux/if_ether.h>
+#ifdef  __KERNEL__
 #include <linux/if.h>
 #include <linux/netdevice.h>
 #include <linux/ppp_channel.h>
@@ -63,7 +64,7 @@ struct pptp_addr {
 #define PX_MAX_PROTO   3
 struct sockaddr_pppox {
-        sa_family_t     sa_family;            /* address family, AF_PPPOX */
+        __kernel_sa_family_t sa_family;       /* address family, AF_PPPOX */
        unsigned int    sa_protocol;          /* protocol identifier */
        union {
                struct pppoe_addr  pppoe;
@@ -77,7 +78,7 @@ struct sockaddr_pppox {
 * type instead.
 */
 struct sockaddr_pppol2tp {
-        sa_family_t     sa_family;      /* address family, AF_PPPOX */
+        __kernel_sa_family_t sa_family; /* address family, AF_PPPOX */
        unsigned int    sa_protocol;    /* protocol identifier */
        struct pppol2tp_addr pppol2tp;
 } __attribute__((packed));
@@ -86,7 +87,7 @@ struct sockaddr_pppol2tp {
 * bits. So we need a different sockaddr structure.
 */
 struct sockaddr_pppol2tpv3 {
-        sa_family_t     sa_family;      /* address family, AF_PPPOX */
+        __kernel_sa_family_t sa_family; /* address family, AF_PPPOX */
        unsigned int    sa_protocol;    /* protocol identifier */
        struct pppol2tpv3_addr pppol2tp;
 } __attribute__((packed));
diff --git a/include/linux/in.h b/include/linux/in.h
index beeb6dee2b49..01129c0ea87c 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -182,7 +182,7 @@ struct in_pktinfo {
 /* Structure describing an Internet (IP) socket address. */
 #define __SOCK_SIZE__   16              /* sizeof(struct sockaddr)      */
 struct sockaddr_in {
-  sa_family_t           sin_family;     /* Address family               */
+  __kernel_sa_family_t  sin_family;     /* Address family               */
  __be16                sin_port;       /* Port number                  */
  struct in_addr        sin_addr;       /* Internet address             */
diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h
index bc8c49022084..80b480c97532 100644
--- a/include/linux/inet_diag.h
+++ b/include/linux/inet_diag.h
@@ -97,9 +97,10 @@ enum {
        INET_DIAG_INFO,
        INET_DIAG_VEGASINFO,
        INET_DIAG_CONG,
+        INET_DIAG_TOS,
 };
-#define INET_DIAG_MAX INET_DIAG_CONG
+#define INET_DIAG_MAX INET_DIAG_TOS
 /* INET_DIAG_MEM */
diff --git a/include/linux/ip6_tunnel.h b/include/linux/ip6_tunnel.h
index acb9ad684d63..bf22b0317902 100644
--- a/include/linux/ip6_tunnel.h
+++ b/include/linux/ip6_tunnel.h
@@ -16,6 +16,8 @@
 #define IP6_TNL_F_MIP6_DEV 0x8
 /* copy DSCP from the outer packet */
 #define IP6_TNL_F_RCV_DSCP_COPY 0x10
+/* copy fwmark from inner packet */
+#define IP6_TNL_F_USE_ORIG_FWMARK 0x20
 struct ip6_tnl_parm {
        char name[IFNAMSIZ];    /* name of tunnel device */
diff --git a/include/linux/ipx.h b/include/linux/ipx.h
index aabb1d294025..3d48014cdd71 100644
--- a/include/linux/ipx.h
+++ b/include/linux/ipx.h
@@ -7,7 +7,7 @@
 #define IPX_MTU         576
 struct sockaddr_ipx {
-        sa_family_t     sipx_family;
+        __kernel_sa_family_t sipx_family;
        __be16          sipx_port;
        __be32          sipx_network;
        unsigned char   sipx_node[IPX_NODE_LEN];
diff --git a/include/linux/irda.h b/include/linux/irda.h
index 00bdad0e8515..a014c3252311 100644
--- a/include/linux/irda.h
+++ b/include/linux/irda.h
@@ -26,12 +26,9 @@
 #define KERNEL_IRDA_H
 #include <linux/types.h>
+#include <linux/socket.h>
-/* Please do *not* add any #include in this file, this file is
+/* Note that this file is shared with user space. */
- * included as-is in user space.
- * Please fix the calling file to properly included needed files before
- * this one, or preferably to include <net/irda/irda.h> instead.
- * Jean II */
 /* Hint bit positions for first hint byte */
 #define HINT_PNP         0x01
@@ -125,7 +122,7 @@ enum {
 #define LSAP_ANY              0xff
 struct sockaddr_irda {
-        sa_family_t sir_family;   /* AF_IRDA */
+        __kernel_sa_family_t sir_family; /* AF_IRDA */
        __u8        sir_lsap_sel; /* LSAP selector */
        __u32       sir_addr;     /* Device address */
        char        sir_name[25]; /* Usually <service>:IrDA:TinyTP */
diff --git a/include/linux/l2tp.h b/include/linux/l2tp.h
index 4bdb31df8e72..e77d7f9bb246 100644
--- a/include/linux/l2tp.h
+++ b/include/linux/l2tp.h
@@ -8,8 +8,8 @@
 #define _LINUX_L2TP_H_
 #include <linux/types.h>
-#ifdef __KERNEL__
 #include <linux/socket.h>
+#ifdef __KERNEL__
 #include <linux/in.h>
 #else
 #include <netinet/in.h>
@@ -26,14 +26,15 @@
 #define __SOCK_SIZE__   16              /* sizeof(struct sockaddr)      */
 struct sockaddr_l2tpip {
        /* The first fields must match struct sockaddr_in */
-        sa_family_t     l2tp_family;    /* AF_INET */
+        __kernel_sa_family_t l2tp_family; /* AF_INET */
        __be16          l2tp_unused;    /* INET port number (unused) */
        struct in_addr  l2tp_addr;      /* Internet address */
        __u32           l2tp_conn_id;   /* Connection ID of tunnel */
        /* Pad to size of `struct sockaddr'. */
-        unsigned char   __pad[sizeof(struct sockaddr) - sizeof(sa_family_t) -
+        unsigned char   __pad[sizeof(struct sockaddr) -
+                              sizeof(__kernel_sa_family_t) -
                              sizeof(__be16) - sizeof(struct in_addr) -
                              sizeof(__u32)];
 };
diff --git a/include/linux/lapb.h b/include/linux/lapb.h
index ce709e1885cc..873c1eb635e4 100644
--- a/include/linux/lapb.h
+++ b/include/linux/lapb.h
@@ -44,7 +44,8 @@ struct lapb_parms_struct {
        unsigned int mode;
 };
-extern int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks);
+extern int lapb_register(struct net_device *dev,
+                         const struct lapb_register_struct *callbacks);
 extern int lapb_unregister(struct net_device *dev);
 extern int lapb_getparms(struct net_device *dev, struct lapb_parms_struct *parms);
 extern int lapb_setparms(struct net_device *dev, struct lapb_parms_struct *parms);
diff --git a/include/linux/llc.h b/include/linux/llc.h
index ad7074ba81af..a2418ae13ee9 100644
--- a/include/linux/llc.h
+++ b/include/linux/llc.h
@@ -12,16 +12,20 @@
 *
 * See the GNU General Public License for more details.
 */
+#include <linux/socket.h>
 #define __LLC_SOCK_SIZE__ 16    /* sizeof(sockaddr_llc), word align. */
 struct sockaddr_llc {
-        sa_family_t     sllc_family;    /* AF_LLC */
+        __kernel_sa_family_t sllc_family; /* AF_LLC */
-        sa_family_t     sllc_arphrd;    /* ARPHRD_ETHER */
+        __kernel_sa_family_t sllc_arphrd; /* ARPHRD_ETHER */
        unsigned char   sllc_test;
        unsigned char   sllc_xid;
        unsigned char   sllc_ua;        /* UA data, only for SOCK_STREAM. */
        unsigned char   sllc_sap;
        unsigned char   sllc_mac[IFHWADDRLEN];
-        unsigned char   __pad[__LLC_SOCK_SIZE__ - sizeof(sa_family_t) * 2 -
+        unsigned char   __pad[__LLC_SOCK_SIZE__ -
+                              sizeof(__kernel_sa_family_t) * 2 -
                              sizeof(unsigned char) * 4 - IFHWADDRLEN];
 };
diff --git a/include/linux/mii.h b/include/linux/mii.h
index 103113a2fd18..27748230aa69 100644
--- a/include/linux/mii.h
+++ b/include/linux/mii.h
@@ -11,131 +11,130 @@
 #include <linux/types.h>
 /* Generic MII registers. */
+#define MII_BMCR                0x00    /* Basic mode control register */
-#define MII_BMCR            0x00        /* Basic mode control register */
+#define MII_BMSR                0x01    /* Basic mode status register  */
-#define MII_BMSR            0x01        /* Basic mode status register  */
+#define MII_PHYSID1             0x02    /* PHYS ID 1                   */
-#define MII_PHYSID1         0x02        /* PHYS ID 1                   */
+#define MII_PHYSID2             0x03    /* PHYS ID 2                   */
-#define MII_PHYSID2         0x03        /* PHYS ID 2                   */
+#define MII_ADVERTISE           0x04    /* Advertisement control reg   */
-#define MII_ADVERTISE       0x04        /* Advertisement control reg   */
+#define MII_LPA                 0x05    /* Link partner ability reg    */
-#define MII_LPA             0x05        /* Link partner ability reg    */
+#define MII_EXPANSION           0x06    /* Expansion register          */
-#define MII_EXPANSION       0x06        /* Expansion register          */
+#define MII_CTRL1000            0x09    /* 1000BASE-T control          */
-#define MII_CTRL1000        0x09        /* 1000BASE-T control          */
+#define MII_STAT1000            0x0a    /* 1000BASE-T status           */
-#define MII_STAT1000        0x0a        /* 1000BASE-T status           */
+#define MII_ESTATUS             0x0f    /* Extended Status             */
-#define MII_ESTATUS         0x0f        /* Extended Status */
+#define MII_DCOUNTER            0x12    /* Disconnect counter          */
-#define MII_DCOUNTER        0x12        /* Disconnect counter          */
+#define MII_FCSCOUNTER          0x13    /* False carrier counter       */
-#define MII_FCSCOUNTER      0x13        /* False carrier counter       */
+#define MII_NWAYTEST            0x14    /* N-way auto-neg test reg     */
-#define MII_NWAYTEST        0x14        /* N-way auto-neg test reg     */
+#define MII_RERRCOUNTER         0x15    /* Receive error counter       */
-#define MII_RERRCOUNTER     0x15        /* Receive error counter       */
+#define MII_SREVISION           0x16    /* Silicon revision            */
-#define MII_SREVISION       0x16        /* Silicon revision            */
+#define MII_RESV1               0x17    /* Reserved...                 */
-#define MII_RESV1           0x17        /* Reserved...                 */
+#define MII_LBRERROR            0x18    /* Lpback, rx, bypass error    */
-#define MII_LBRERROR        0x18        /* Lpback, rx, bypass error    */
+#define MII_PHYADDR             0x19    /* PHY address                 */
-#define MII_PHYADDR         0x19        /* PHY address                 */
+#define MII_RESV2               0x1a    /* Reserved...                 */
-#define MII_RESV2           0x1a        /* Reserved...                 */
+#define MII_TPISTATUS           0x1b    /* TPI status for 10mbps       */
-#define MII_TPISTATUS       0x1b        /* TPI status for 10mbps       */
+#define MII_NCONFIG             0x1c    /* Network interface config    */
-#define MII_NCONFIG         0x1c        /* Network interface config    */
 /* Basic mode control register. */
-#define BMCR_RESV               0x003f  /* Unused...                   */
+#define BMCR_RESV               0x003f  /* Unused...                   */
-#define BMCR_SPEED1000          0x0040  /* MSB of Speed (1000)         */
+#define BMCR_SPEED1000          0x0040  /* MSB of Speed (1000)         */
-#define BMCR_CTST               0x0080  /* Collision test              */
+#define BMCR_CTST               0x0080  /* Collision test              */
-#define BMCR_FULLDPLX           0x0100  /* Full duplex                 */
+#define BMCR_FULLDPLX           0x0100  /* Full duplex                 */
-#define BMCR_ANRESTART          0x0200  /* Auto negotiation restart    */
+#define BMCR_ANRESTART          0x0200  /* Auto negotiation restart    */
-#define BMCR_ISOLATE            0x0400  /* Disconnect DP83840 from MII */
+#define BMCR_ISOLATE            0x0400  /* Isolate data paths from MII */
-#define BMCR_PDOWN              0x0800  /* Powerdown the DP83840       */
+#define BMCR_PDOWN              0x0800  /* Enable low power state      */
-#define BMCR_ANENABLE           0x1000  /* Enable auto negotiation     */
+#define BMCR_ANENABLE           0x1000  /* Enable auto negotiation     */
-#define BMCR_SPEED100           0x2000  /* Select 100Mbps              */
+#define BMCR_SPEED100           0x2000  /* Select 100Mbps              */
-#define BMCR_LOOPBACK           0x4000  /* TXD loopback bits           */
+#define BMCR_LOOPBACK           0x4000  /* TXD loopback bits           */
-#define BMCR_RESET              0x8000  /* Reset the DP83840           */
+#define BMCR_RESET              0x8000  /* Reset to default state      */
 /* Basic mode status register. */
-#define BMSR_ERCAP              0x0001  /* Ext-reg capability          */
+#define BMSR_ERCAP              0x0001  /* Ext-reg capability          */
-#define BMSR_JCD                0x0002  /* Jabber detected             */
+#define BMSR_JCD                0x0002  /* Jabber detected             */
-#define BMSR_LSTATUS            0x0004  /* Link status                 */
+#define BMSR_LSTATUS            0x0004  /* Link status                 */
-#define BMSR_ANEGCAPABLE        0x0008  /* Able to do auto-negotiation */
+#define BMSR_ANEGCAPABLE        0x0008  /* Able to do auto-negotiation */
-#define BMSR_RFAULT             0x0010  /* Remote fault detected       */
+#define BMSR_RFAULT             0x0010  /* Remote fault detected       */
-#define BMSR_ANEGCOMPLETE       0x0020  /* Auto-negotiation complete   */
+#define BMSR_ANEGCOMPLETE       0x0020  /* Auto-negotiation complete   */
-#define BMSR_RESV               0x00c0  /* Unused...                   */
+#define BMSR_RESV               0x00c0  /* Unused...                   */
-#define BMSR_ESTATEN            0x0100  /* Extended Status in R15 */
+#define BMSR_ESTATEN            0x0100  /* Extended Status in R15      */
-#define BMSR_100HALF2           0x0200  /* Can do 100BASE-T2 HDX */
+#define BMSR_100HALF2           0x0200  /* Can do 100BASE-T2 HDX       */
-#define BMSR_100FULL2           0x0400  /* Can do 100BASE-T2 FDX */
+#define BMSR_100FULL2           0x0400  /* Can do 100BASE-T2 FDX       */
-#define BMSR_10HALF             0x0800  /* Can do 10mbps, half-duplex  */
+#define BMSR_10HALF             0x0800  /* Can do 10mbps, half-duplex  */
-#define BMSR_10FULL             0x1000  /* Can do 10mbps, full-duplex  */
+#define BMSR_10FULL             0x1000  /* Can do 10mbps, full-duplex  */
-#define BMSR_100HALF            0x2000  /* Can do 100mbps, half-duplex */
+#define BMSR_100HALF            0x2000  /* Can do 100mbps, half-duplex */
-#define BMSR_100FULL            0x4000  /* Can do 100mbps, full-duplex */
+#define BMSR_100FULL            0x4000  /* Can do 100mbps, full-duplex */
-#define BMSR_100BASE4           0x8000  /* Can do 100mbps, 4k packets  */
+#define BMSR_100BASE4           0x8000  /* Can do 100mbps, 4k packets  */
 /* Advertisement control register. */
-#define ADVERTISE_SLCT          0x001f  /* Selector bits               */
+#define ADVERTISE_SLCT          0x001f  /* Selector bits               */
-#define ADVERTISE_CSMA          0x0001  /* Only selector supported     */
+#define ADVERTISE_CSMA          0x0001  /* Only selector supported     */
-#define ADVERTISE_10HALF        0x0020  /* Try for 10mbps half-duplex  */
+#define ADVERTISE_10HALF        0x0020  /* Try for 10mbps half-duplex  */
-#define ADVERTISE_1000XFULL     0x0020  /* Try for 1000BASE-X full-duplex */
+#define ADVERTISE_1000XFULL     0x0020  /* Try for 1000BASE-X full-duplex */
-#define ADVERTISE_10FULL        0x0040  /* Try for 10mbps full-duplex  */
+#define ADVERTISE_10FULL        0x0040  /* Try for 10mbps full-duplex  */
-#define ADVERTISE_1000XHALF     0x0040  /* Try for 1000BASE-X half-duplex */
+#define ADVERTISE_1000XHALF     0x0040  /* Try for 1000BASE-X half-duplex */
-#define ADVERTISE_100HALF       0x0080  /* Try for 100mbps half-duplex */
+#define ADVERTISE_100HALF       0x0080  /* Try for 100mbps half-duplex */
-#define ADVERTISE_1000XPAUSE    0x0080  /* Try for 1000BASE-X pause    */
+#define ADVERTISE_1000XPAUSE    0x0080  /* Try for 1000BASE-X pause    */
-#define ADVERTISE_100FULL       0x0100  /* Try for 100mbps full-duplex */
+#define ADVERTISE_100FULL       0x0100  /* Try for 100mbps full-duplex */
-#define ADVERTISE_1000XPSE_ASYM 0x0100  /* Try for 1000BASE-X asym pause */
+#define ADVERTISE_1000XPSE_ASYM 0x0100  /* Try for 1000BASE-X asym pause */
-#define ADVERTISE_100BASE4      0x0200  /* Try for 100mbps 4k packets  */
+#define ADVERTISE_100BASE4      0x0200  /* Try for 100mbps 4k packets  */
-#define ADVERTISE_PAUSE_CAP     0x0400  /* Try for pause               */
+#define ADVERTISE_PAUSE_CAP     0x0400  /* Try for pause               */
-#define ADVERTISE_PAUSE_ASYM    0x0800  /* Try for asymetric pause     */
+#define ADVERTISE_PAUSE_ASYM    0x0800  /* Try for asymetric pause     */
-#define ADVERTISE_RESV          0x1000  /* Unused...                   */
+#define ADVERTISE_RESV          0x1000  /* Unused...                   */
-#define ADVERTISE_RFAULT        0x2000  /* Say we can detect faults    */
+#define ADVERTISE_RFAULT        0x2000  /* Say we can detect faults    */
-#define ADVERTISE_LPACK         0x4000  /* Ack link partners response  */
+#define ADVERTISE_LPACK         0x4000  /* Ack link partners response  */
-#define ADVERTISE_NPAGE         0x8000  /* Next page bit               */
+#define ADVERTISE_NPAGE         0x8000  /* Next page bit               */
-#define ADVERTISE_FULL (ADVERTISE_100FULL | ADVERTISE_10FULL | \
+#define ADVERTISE_FULL          (ADVERTISE_100FULL | ADVERTISE_10FULL | \
-                        ADVERTISE_CSMA)
+                                  ADVERTISE_CSMA)
-#define ADVERTISE_ALL (ADVERTISE_10HALF | ADVERTISE_10FULL | \
+#define ADVERTISE_ALL           (ADVERTISE_10HALF | ADVERTISE_10FULL | \
-                       ADVERTISE_100HALF | ADVERTISE_100FULL)
+                                  ADVERTISE_100HALF | ADVERTISE_100FULL)
 /* Link partner ability register. */
-#define LPA_SLCT                0x001f  /* Same as advertise selector  */
+#define LPA_SLCT                0x001f  /* Same as advertise selector  */
-#define LPA_10HALF              0x0020  /* Can do 10mbps half-duplex   */
+#define LPA_10HALF              0x0020  /* Can do 10mbps half-duplex   */
-#define LPA_1000XFULL           0x0020  /* Can do 1000BASE-X full-duplex */
+#define LPA_1000XFULL           0x0020  /* Can do 1000BASE-X full-duplex */
-#define LPA_10FULL              0x0040  /* Can do 10mbps full-duplex   */
+#define LPA_10FULL              0x0040  /* Can do 10mbps full-duplex   */
-#define LPA_1000XHALF           0x0040  /* Can do 1000BASE-X half-duplex */
+#define LPA_1000XHALF           0x0040  /* Can do 1000BASE-X half-duplex */
-#define LPA_100HALF             0x0080  /* Can do 100mbps half-duplex  */
+#define LPA_100HALF             0x0080  /* Can do 100mbps half-duplex  */
-#define LPA_1000XPAUSE          0x0080  /* Can do 1000BASE-X pause     */
+#define LPA_1000XPAUSE          0x0080  /* Can do 1000BASE-X pause     */
-#define LPA_100FULL             0x0100  /* Can do 100mbps full-duplex  */
+#define LPA_100FULL             0x0100  /* Can do 100mbps full-duplex  */
-#define LPA_1000XPAUSE_ASYM     0x0100  /* Can do 1000BASE-X pause asym*/
+#define LPA_1000XPAUSE_ASYM     0x0100  /* Can do 1000BASE-X pause asym*/
-#define LPA_100BASE4            0x0200  /* Can do 100mbps 4k packets   */
+#define LPA_100BASE4            0x0200  /* Can do 100mbps 4k packets   */
-#define LPA_PAUSE_CAP           0x0400  /* Can pause                   */
+#define LPA_PAUSE_CAP           0x0400  /* Can pause                   */
-#define LPA_PAUSE_ASYM          0x0800  /* Can pause asymetrically     */
+#define LPA_PAUSE_ASYM          0x0800  /* Can pause asymetrically     */
-#define LPA_RESV                0x1000  /* Unused...                   */
+#define LPA_RESV                0x1000  /* Unused...                   */
-#define LPA_RFAULT              0x2000  /* Link partner faulted        */
+#define LPA_RFAULT              0x2000  /* Link partner faulted        */
-#define LPA_LPACK               0x4000  /* Link partner acked us       */
+#define LPA_LPACK               0x4000  /* Link partner acked us       */
-#define LPA_NPAGE               0x8000  /* Next page bit               */
+#define LPA_NPAGE               0x8000  /* Next page bit               */
 #define LPA_DUPLEX              (LPA_10FULL | LPA_100FULL)
 #define LPA_100                 (LPA_100FULL | LPA_100HALF | LPA_100BASE4)
 /* Expansion register for auto-negotiation. */
-#define EXPANSION_NWAY          0x0001  /* Can do N-way auto-nego      */
+#define EXPANSION_NWAY          0x0001  /* Can do N-way auto-nego      */
-#define EXPANSION_LCWP          0x0002  /* Got new RX page code word   */
+#define EXPANSION_LCWP          0x0002  /* Got new RX page code word   */
-#define EXPANSION_ENABLENPAGE   0x0004  /* This enables npage words    */
+#define EXPANSION_ENABLENPAGE   0x0004  /* This enables npage words    */
-#define EXPANSION_NPCAPABLE     0x0008  /* Link partner supports npage */
+#define EXPANSION_NPCAPABLE     0x0008  /* Link partner supports npage */
-#define EXPANSION_MFAULTS       0x0010  /* Multiple faults detected    */
+#define EXPANSION_MFAULTS       0x0010  /* Multiple faults detected    */
-#define EXPANSION_RESV          0xffe0  /* Unused...                   */
+#define EXPANSION_RESV          0xffe0  /* Unused...                   */
-#define ESTATUS_1000_TFULL      0x2000  /* Can do 1000BT Full */
+#define ESTATUS_1000_TFULL      0x2000  /* Can do 1000BT Full          */
-#define ESTATUS_1000_THALF      0x1000  /* Can do 1000BT Half */
+#define ESTATUS_1000_THALF      0x1000  /* Can do 1000BT Half          */
 /* N-way test register. */
-#define NWAYTEST_RESV1          0x00ff  /* Unused...                   */
+#define NWAYTEST_RESV1          0x00ff  /* Unused...                   */
-#define NWAYTEST_LOOPBACK       0x0100  /* Enable loopback for N-way   */
+#define NWAYTEST_LOOPBACK       0x0100  /* Enable loopback for N-way   */
-#define NWAYTEST_RESV2          0xfe00  /* Unused...                   */
+#define NWAYTEST_RESV2          0xfe00  /* Unused...                   */
 /* 1000BASE-T Control register */
-#define ADVERTISE_1000FULL      0x0200  /* Advertise 1000BASE-T full duplex */
+#define ADVERTISE_1000FULL      0x0200  /* Advertise 1000BASE-T full duplex */
-#define ADVERTISE_1000HALF      0x0100  /* Advertise 1000BASE-T half duplex */
+#define ADVERTISE_1000HALF      0x0100  /* Advertise 1000BASE-T half duplex */
 #define CTL1000_AS_MASTER       0x0800
 #define CTL1000_ENABLE_MASTER   0x1000
 /* 1000BASE-T Status register */
-#define LPA_1000LOCALRXOK       0x2000  /* Link partner local receiver status */
+#define LPA_1000LOCALRXOK       0x2000  /* Link partner local receiver status */
-#define LPA_1000REMRXOK         0x1000  /* Link partner remote receiver status */
+#define LPA_1000REMRXOK         0x1000  /* Link partner remote receiver status */
-#define LPA_1000FULL            0x0800  /* Link partner 1000BASE-T full duplex */
+#define LPA_1000FULL            0x0800  /* Link partner 1000BASE-T full duplex */
-#define LPA_1000HALF            0x0400  /* Link partner 1000BASE-T half duplex */
+#define LPA_1000HALF            0x0400  /* Link partner 1000BASE-T half duplex */
 /* Flow control flags */
 #define FLOW_CTRL_TX            0x01
@@ -149,7 +148,7 @@ struct mii_ioctl_data {
        __u16           val_out;
 };
-#ifdef __KERNEL__ 
+#ifdef __KERNEL__
 #include <linux/if.h>
@@ -180,7 +179,7 @@ extern unsigned int mii_check_media (struct mii_if_info *mii,
                                     unsigned int ok_to_print,
                                     unsigned int init_media);
 extern int generic_mii_ioctl(struct mii_if_info *mii_if,
-                             struct mii_ioctl_data *mii_data, int cmd,
+                             struct mii_ioctl_data *mii_data, int cmd,
                             unsigned int *duplex_changed);
@@ -189,7 +188,6 @@ static inline struct mii_ioctl_data *if_mii(struct ifreq *rq)
        return (struct mii_ioctl_data *) &rq->ifr_ifru;
 }
 /**
 * mii_nway_result
 * @negotiated: value of MII ANAR and'd with ANLPAR
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 53ef894bfa05..2366f94a095a 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -75,6 +75,7 @@ enum {
        MLX4_DEV_CAP_FLAG_UD_MCAST      = 1LL << 21,
        MLX4_DEV_CAP_FLAG_IBOE          = 1LL << 30,
        MLX4_DEV_CAP_FLAG_UC_LOOPBACK   = 1LL << 32,
+        MLX4_DEV_CAP_FLAG_FCS_KEEP      = 1LL << 34,
        MLX4_DEV_CAP_FLAG_WOL           = 1LL << 38,
        MLX4_DEV_CAP_FLAG_UDP_RSS       = 1LL << 40,
        MLX4_DEV_CAP_FLAG_VEP_UC_STEER  = 1LL << 41,
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 774b8952deb4..29971a589ff2 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -135,6 +135,17 @@ struct page {
 #endif
 ;
+struct page_frag {
+        struct page *page;
+#if (BITS_PER_LONG > 32) || (PAGE_SIZE >= 65536)
+        __u32 offset;
+        __u32 size;
+#else
+        __u16 offset;
+        __u16 size;
+#endif
+};
 typedef unsigned long __nocast vm_flags_t;
 /*
diff --git a/include/linux/net_tstamp.h b/include/linux/net_tstamp.h
index a3b8546354ac..ae5df122e42f 100644
--- a/include/linux/net_tstamp.h
+++ b/include/linux/net_tstamp.h
@@ -45,7 +45,7 @@ struct hwtstamp_config {
 };
 /* possible values for hwtstamp_config->tx_type */
-enum {
+enum hwtstamp_tx_types {
        /*
         * No outgoing packet will need hardware time stamping;
         * should a packet arrive which asks for it, no hardware
@@ -60,10 +60,19 @@ enum {
         * before sending the packet.
         */
        HWTSTAMP_TX_ON,
+        /*
+         * Enables time stamping for outgoing packets just as
+         * HWTSTAMP_TX_ON does, but also enables time stamp insertion
+         * directly into Sync packets. In this case, transmitted Sync
+         * packets will not received a time stamp via the socket error
+         * queue.
+         */
+        HWTSTAMP_TX_ONESTEP_SYNC,
 };
 /* possible values for hwtstamp_config->rx_filter */
-enum {
+enum hwtstamp_rx_filters {
        /* time stamp no incoming packet at all */
        HWTSTAMP_FILTER_NONE,
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 279726039f00..c8615cd0b2f6 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -723,9 +723,8 @@ struct netdev_tc_txq {
 *
 * void (*ndo_set_rx_mode)(struct net_device *dev);
 *      This function is called device changes address list filtering.
- *
+ *      If driver handles unicast address filtering, it should set
- * void (*ndo_set_multicast_list)(struct net_device *dev);
+ *      IFF_UNICAST_FLT to its priv_flags.
- *      This function is called when the multicast address list changes.
 *
 * int (*ndo_set_mac_address)(struct net_device *dev, void *addr);
 *      This function  is called when the Media Access Control address
@@ -782,6 +781,7 @@ struct netdev_tc_txq {
 * int (*ndo_set_vf_mac)(struct net_device *dev, int vf, u8* mac);
 * int (*ndo_set_vf_vlan)(struct net_device *dev, int vf, u16 vlan, u8 qos);
 * int (*ndo_set_vf_tx_rate)(struct net_device *dev, int vf, int rate);
+ * int (*ndo_set_vf_spoofchk)(struct net_device *dev, int vf, bool setting);
 * int (*ndo_get_vf_config)(struct net_device *dev,
 *                          int vf, struct ifla_vf_info *ivf);
 * int (*ndo_set_vf_port)(struct net_device *dev, int vf,
@@ -868,7 +868,6 @@ struct net_device_ops {
        void                    (*ndo_change_rx_flags)(struct net_device *dev,
                                                       int flags);
        void                    (*ndo_set_rx_mode)(struct net_device *dev);
-        void                    (*ndo_set_multicast_list)(struct net_device *dev);
        int                     (*ndo_set_mac_address)(struct net_device *dev,
                                                       void *addr);
        int                     (*ndo_validate_addr)(struct net_device *dev);
@@ -902,6 +901,8 @@ struct net_device_ops {
                                                   int queue, u16 vlan, u8 qos);
        int                     (*ndo_set_vf_tx_rate)(struct net_device *dev,
                                                      int vf, int rate);
+        int                     (*ndo_set_vf_spoofchk)(struct net_device *dev,
+                                                       int vf, bool setting);
        int                     (*ndo_get_vf_config)(struct net_device *dev,
                                                     int vf,
                                                     struct ifla_vf_info *ivf);
@@ -924,11 +925,15 @@ struct net_device_ops {
                                                       u16 xid,
                                                       struct scatterlist *sgl,
                                                       unsigned int sgc);
+#endif
+#if defined(CONFIG_LIBFCOE) || defined(CONFIG_LIBFCOE_MODULE)
 #define NETDEV_FCOE_WWNN 0
 #define NETDEV_FCOE_WWPN 1
        int                     (*ndo_fcoe_get_wwn)(struct net_device *dev,
                                                    u64 *wwn, int type);
 #endif
 #ifdef CONFIG_RFS_ACCEL
        int                     (*ndo_rx_flow_steer)(struct net_device *dev,
                                                     const struct sk_buff *skb,
@@ -2587,9 +2592,6 @@ static inline int netif_is_bond_slave(struct net_device *dev)
 extern struct pernet_operations __net_initdata loopback_net_ops;
-int dev_ethtool_get_settings(struct net_device *dev,
-                             struct ethtool_cmd *cmd);
 static inline u32 dev_ethtool_get_rx_csum(struct net_device *dev)
 {
        if (dev->features & NETIF_F_RXCSUM)
diff --git a/include/linux/netfilter/xt_connlimit.h b/include/linux/netfilter/xt_connlimit.h
index 0ca66e97acbc..d1366f05d1b2 100644
--- a/include/linux/netfilter/xt_connlimit.h
+++ b/include/linux/netfilter/xt_connlimit.h
@@ -2,6 +2,7 @@
 #define _XT_CONNLIMIT_H
 #include <linux/types.h>
+#include <linux/netfilter.h>
 struct xt_connlimit_data;
diff --git a/include/linux/netfilter/xt_conntrack.h b/include/linux/netfilter/xt_conntrack.h
index 74b904d8f99c..e3c041d54020 100644
--- a/include/linux/netfilter/xt_conntrack.h
+++ b/include/linux/netfilter/xt_conntrack.h
@@ -6,6 +6,7 @@
 #define _XT_CONNTRACK_H
 #include <linux/types.h>
+#include <linux/netfilter.h>
 #include <linux/netfilter/nf_conntrack_tuple_common.h>
 #define XT_CONNTRACK_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
diff --git a/include/linux/netfilter/xt_iprange.h b/include/linux/netfilter/xt_iprange.h
index c1f21a779a45..25fd7cf851f0 100644
--- a/include/linux/netfilter/xt_iprange.h
+++ b/include/linux/netfilter/xt_iprange.h
@@ -2,6 +2,7 @@
 #define _LINUX_NETFILTER_XT_IPRANGE_H 1
 #include <linux/types.h>
+#include <linux/netfilter.h>
 enum {
        IPRANGE_SRC     = 1 << 0,       /* match source IP address */
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index adbf4bff87ed..e08565d45178 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -52,7 +52,7 @@ struct arpt_arp {
        struct in_addr smsk, tmsk;
        /* Device hw address length, src+target device addresses */
-        u_int8_t arhln, arhln_mask;
+        __u8 arhln, arhln_mask;
        struct arpt_devaddr_info src_devaddr;
        struct arpt_devaddr_info tgt_devaddr;
@@ -71,9 +71,9 @@ struct arpt_arp {
        unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
        /* Flags word */
-        u_int8_t flags;
+        __u8 flags;
        /* Inverse flags */
-        u_int16_t invflags;
+        __u16 invflags;
 };
 /* Values for "flag" field in struct arpt_ip (general arp structure).
@@ -102,9 +102,9 @@ struct arpt_entry
        struct arpt_arp arp;
        /* Size of arpt_entry + matches */
-        u_int16_t target_offset;
+        __u16 target_offset;
        /* Size of arpt_entry + matches + target */
-        u_int16_t next_offset;
+        __u16 next_offset;
        /* Back pointer */
        unsigned int comefrom;
@@ -260,8 +260,8 @@ extern unsigned int arpt_do_table(struct sk_buff *skb,
 struct compat_arpt_entry {
        struct arpt_arp arp;
-        u_int16_t target_offset;
+        __u16 target_offset;
-        u_int16_t next_offset;
+        __u16 next_offset;
        compat_uint_t comefrom;
        struct compat_xt_counters counters;
        unsigned char elems[0];
diff --git a/include/linux/netfilter_decnet.h b/include/linux/netfilter_decnet.h
index 6f425369ee29..0b09732aacd5 100644
--- a/include/linux/netfilter_decnet.h
+++ b/include/linux/netfilter_decnet.h
@@ -11,6 +11,9 @@
 /* only for userspace compatibility */
 #ifndef __KERNEL__
+#include <limits.h> /* for INT_MIN, INT_MAX */
 /* IP Cache bits. */
 /* Src IP address. */
 #define NFC_DN_SRC              0x0001
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index 29c7727ff0e8..fa0946c549d3 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -9,6 +9,9 @@
 /* only for userspace compatibility */
 #ifndef __KERNEL__
+#include <limits.h> /* for INT_MIN, INT_MAX */
 /* IP Cache bits. */
 /* Src IP address. */
 #define NFC_IP_SRC              0x0001
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index 64a5d95c58e8..db79231914ce 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -81,12 +81,12 @@ struct ipt_ip {
        unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
        /* Protocol, 0 = ANY */
-        u_int16_t proto;
+        __u16 proto;
        /* Flags word */
-        u_int8_t flags;
+        __u8 flags;
        /* Inverse flags */
-        u_int8_t invflags;
+        __u8 invflags;
 };
 /* Values for "flag" field in struct ipt_ip (general ip structure). */
@@ -114,9 +114,9 @@ struct ipt_entry {
        unsigned int nfcache;
        /* Size of ipt_entry + matches */
-        u_int16_t target_offset;
+        __u16 target_offset;
        /* Size of ipt_entry + matches + target */
-        u_int16_t next_offset;
+        __u16 next_offset;
        /* Back pointer */
        unsigned int comefrom;
@@ -149,9 +149,9 @@ struct ipt_entry {
 /* ICMP matching stuff */
 struct ipt_icmp {
-        u_int8_t type;                          /* type to match */
+        __u8 type;                              /* type to match */
-        u_int8_t code[2];                       /* range of code */
+        __u8 code[2];                           /* range of code */
-        u_int8_t invflags;                      /* Inverse flags */
+        __u8 invflags;                          /* Inverse flags */
 };
 /* Values for "inv" field for struct ipt_icmp. */
@@ -288,8 +288,8 @@ extern unsigned int ipt_do_table(struct sk_buff *skb,
 struct compat_ipt_entry {
        struct ipt_ip ip;
        compat_uint_t nfcache;
-        u_int16_t target_offset;
+        __u16 target_offset;
-        u_int16_t next_offset;
+        __u16 next_offset;
        compat_uint_t comefrom;
        struct compat_xt_counters counters;
        unsigned char elems[0];
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index 1f7e300094cd..57c025127f1d 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -12,6 +12,9 @@
 /* only for userspace compatibility */
 #ifndef __KERNEL__
+#include <limits.h> /* for INT_MIN, INT_MAX */
 /* IP Cache bits. */
 /* Src IP address. */
 #define NFC_IP6_SRC              0x0001
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index c9784f7a9c1f..f549adccc94c 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -81,14 +81,14 @@ struct ip6t_ip6 {
         *   MH do not match any packets.
         * - You also need to set IP6T_FLAGS_PROTO to "flags" to check protocol.
         */
-        u_int16_t proto;
+        __u16 proto;
        /* TOS to match iff flags & IP6T_F_TOS */
-        u_int8_t tos;
+        __u8 tos;
        /* Flags word */
-        u_int8_t flags;
+        __u8 flags;
        /* Inverse flags */
-        u_int8_t invflags;
+        __u8 invflags;
 };
 /* Values for "flag" field in struct ip6t_ip6 (general ip6 structure). */
@@ -118,9 +118,9 @@ struct ip6t_entry {
        unsigned int nfcache;
        /* Size of ipt_entry + matches */
-        u_int16_t target_offset;
+        __u16 target_offset;
        /* Size of ipt_entry + matches + target */
-        u_int16_t next_offset;
+        __u16 next_offset;
        /* Back pointer */
        unsigned int comefrom;
@@ -186,9 +186,9 @@ struct ip6t_error {
 /* ICMP matching stuff */
 struct ip6t_icmp {
-        u_int8_t type;                          /* type to match */
+        __u8 type;                              /* type to match */
-        u_int8_t code[2];                       /* range of code */
+        __u8 code[2];                           /* range of code */
-        u_int8_t invflags;                      /* Inverse flags */
+        __u8 invflags;                          /* Inverse flags */
 };
 /* Values for "inv" field for struct ipt_icmp. */
@@ -298,8 +298,8 @@ extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 struct compat_ip6t_entry {
        struct ip6t_ip6 ipv6;
        compat_uint_t nfcache;
-        u_int16_t target_offset;
+        __u16 target_offset;
-        u_int16_t next_offset;
+        __u16 next_offset;
        compat_uint_t comefrom;
        struct compat_xt_counters counters;
        unsigned char elems[0];
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 180540a84d37..8180cd9d73d5 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -1,7 +1,7 @@
 #ifndef __LINUX_NETLINK_H
 #define __LINUX_NETLINK_H
-#include <linux/socket.h> /* for sa_family_t */
+#include <linux/socket.h> /* for __kernel_sa_family_t */
 #include <linux/types.h>
 #define NETLINK_ROUTE           0       /* Routing/device hook                          */
diff --git a/include/linux/netrom.h b/include/linux/netrom.h
index 6939b32f66a0..af7313cc9cb6 100644
--- a/include/linux/netrom.h
+++ b/include/linux/netrom.h
@@ -7,6 +7,8 @@
 #ifndef NETROM_KERNEL_H
 #define NETROM_KERNEL_H
+#include <linux/ax25.h>
 #define NETROM_MTU      236
 #define NETROM_T1       1
diff --git a/include/linux/nfc.h b/include/linux/nfc.h
index 330a4c5db588..36cb955b05cc 100644
--- a/include/linux/nfc.h
+++ b/include/linux/nfc.h
@@ -39,6 +39,10 @@
 *
 * @NFC_CMD_GET_DEVICE: request information about a device (requires
 *      %NFC_ATTR_DEVICE_INDEX) or dump request to get a list of all nfc devices
+ * @NFC_CMD_DEV_UP: turn on the nfc device
+ *      (requires %NFC_ATTR_DEVICE_INDEX)
+ * @NFC_CMD_DEV_DOWN: turn off the nfc device
+ *      (requires %NFC_ATTR_DEVICE_INDEX)
 * @NFC_CMD_START_POLL: start polling for targets using the given protocols
 *      (requires %NFC_ATTR_DEVICE_INDEX and %NFC_ATTR_PROTOCOLS)
 * @NFC_CMD_STOP_POLL: stop polling for targets (requires
@@ -56,6 +60,8 @@
 enum nfc_commands {
        NFC_CMD_UNSPEC,
        NFC_CMD_GET_DEVICE,
+        NFC_CMD_DEV_UP,
+        NFC_CMD_DEV_DOWN,
        NFC_CMD_START_POLL,
        NFC_CMD_STOP_POLL,
        NFC_CMD_GET_TARGET,
@@ -123,4 +129,6 @@ struct sockaddr_nfc {
 #define NFC_SOCKPROTO_RAW       0
 #define NFC_SOCKPROTO_MAX       1
+#define NFC_HEADER_SIZE 1
 #endif /*__LINUX_NFC_H */
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 8ad70dcac3f9..8049bf77d799 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -161,6 +161,13 @@
 * @NL80211_CMD_SET_BEACON: set the beacon on an access point interface
 *      using the %NL80211_ATTR_BEACON_INTERVAL, %NL80211_ATTR_DTIM_PERIOD,
 *      %NL80211_ATTR_BEACON_HEAD and %NL80211_ATTR_BEACON_TAIL attributes.
+ *      Following attributes are provided for drivers that generate full Beacon
+ *      and Probe Response frames internally: %NL80211_ATTR_SSID,
+ *      %NL80211_ATTR_HIDDEN_SSID, %NL80211_ATTR_CIPHERS_PAIRWISE,
+ *      %NL80211_ATTR_CIPHER_GROUP, %NL80211_ATTR_WPA_VERSIONS,
+ *      %NL80211_ATTR_AKM_SUITES, %NL80211_ATTR_PRIVACY,
+ *      %NL80211_ATTR_AUTH_TYPE, %NL80211_ATTR_IE, %NL80211_ATTR_IE_PROBE_RESP,
+ *      %NL80211_ATTR_IE_ASSOC_RESP.
 * @NL80211_CMD_NEW_BEACON: add a new beacon to an access point interface,
 *      parameters are like for %NL80211_CMD_SET_BEACON.
 * @NL80211_CMD_DEL_BEACON: remove the beacon, stop sending it
@@ -231,6 +238,8 @@
 *
 * @NL80211_CMD_GET_SCAN: get scan results
 * @NL80211_CMD_TRIGGER_SCAN: trigger a new scan with the given parameters
+ *      %NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the
+ *      probe requests at CCK rate or not.
 * @NL80211_CMD_NEW_SCAN_RESULTS: scan notification (as a reply to
 *      NL80211_CMD_GET_SCAN and on the "scan" multicast group)
 * @NL80211_CMD_SCAN_ABORTED: scan was aborted, for unspecified reasons,
@@ -425,6 +434,8 @@
 *      specified using %NL80211_ATTR_DURATION. When called, this operation
 *      returns a cookie (%NL80211_ATTR_COOKIE) that will be included with the
 *      TX status event pertaining to the TX request.
+ *      %NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the
+ *      management frames at CCK rate or not in 2GHz band.
 * @NL80211_CMD_FRAME_WAIT_CANCEL: When an off-channel TX was requested, this
 *      command may be used with the corresponding cookie to cancel the wait
 *      time if it is known that it is no longer necessary.
@@ -492,6 +503,12 @@
 *      this command may also be sent by the driver as an MLME event to
 *      inform userspace of the new replay counter.
 *
+ * @NL80211_CMD_PMKSA_CANDIDATE: This is used as an event to inform userspace
+ *      of PMKSA caching dandidates.
+ *
+ * @NL80211_CMD_TDLS_OPER: Perform a high-level TDLS command (e.g. link setup).
+ * @NL80211_CMD_TDLS_MGMT: Send a TDLS management frame.
+ *
 * @NL80211_CMD_MAX: highest used command number
 * @__NL80211_CMD_AFTER_LAST: internal use
 */
@@ -616,6 +633,11 @@ enum nl80211_commands {
        NL80211_CMD_SET_REKEY_OFFLOAD,
+        NL80211_CMD_PMKSA_CANDIDATE,
+        NL80211_CMD_TDLS_OPER,
+        NL80211_CMD_TDLS_MGMT,
        /* add new commands above here */
        /* used to define NL80211_CMD_MAX below */
@@ -762,6 +784,8 @@ enum nl80211_commands {
 *      that can be added to a scan request
 * @NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN: maximum length of information
 *      elements that can be added to a scheduled scan request
+ * @NL80211_ATTR_MAX_MATCH_SETS: maximum number of sets that can be
+ *      used with @NL80211_ATTR_SCHED_SCAN_MATCH, a wiphy attribute.
 *
 * @NL80211_ATTR_SCAN_FREQUENCIES: nested attribute with frequencies (in MHz)
 * @NL80211_ATTR_SCAN_SSIDS: nested attribute with SSIDs, leave out for passive
@@ -842,18 +866,20 @@ enum nl80211_commands {
 * @NL80211_ATTR_STATUS_CODE: StatusCode for the %NL80211_CMD_CONNECT
 *      event (u16)
 * @NL80211_ATTR_PRIVACY: Flag attribute, used with connect(), indicating
- *      that protected APs should be used.
+ *      that protected APs should be used. This is also used with NEW_BEACON to
+ *      indicate that the BSS is to use protection.
 *
- * @NL80211_ATTR_CIPHERS_PAIRWISE: Used with CONNECT and ASSOCIATE to
+ * @NL80211_ATTR_CIPHERS_PAIRWISE: Used with CONNECT, ASSOCIATE, and NEW_BEACON
- *      indicate which unicast key ciphers will be used with the connection
+ *      to indicate which unicast key ciphers will be used with the connection
 *      (an array of u32).
- * @NL80211_ATTR_CIPHER_GROUP: Used with CONNECT and ASSOCIATE to indicate
+ * @NL80211_ATTR_CIPHER_GROUP: Used with CONNECT, ASSOCIATE, and NEW_BEACON to
- *      which group key cipher will be used with the connection (a u32).
+ *      indicate which group key cipher will be used with the connection (a
- * @NL80211_ATTR_WPA_VERSIONS: Used with CONNECT and ASSOCIATE to indicate
+ *      u32).
- *      which WPA version(s) the AP we want to associate with is using
+ * @NL80211_ATTR_WPA_VERSIONS: Used with CONNECT, ASSOCIATE, and NEW_BEACON to
+ *      indicate which WPA version(s) the AP we want to associate with is using
 *      (a u32 with flags from &enum nl80211_wpa_versions).
- * @NL80211_ATTR_AKM_SUITES: Used with CONNECT and ASSOCIATE to indicate
+ * @NL80211_ATTR_AKM_SUITES: Used with CONNECT, ASSOCIATE, and NEW_BEACON to
- *      which key management algorithm(s) to use (an array of u32).
+ *      indicate which key management algorithm(s) to use (an array of u32).
 *
 * @NL80211_ATTR_REQ_IE: (Re)association request information elements as
 *      sent out by the card, for ROAM and successful CONNECT events.
@@ -1002,6 +1028,24 @@ enum nl80211_commands {
 * @NL80211_ATTR_SCHED_SCAN_INTERVAL: Interval between scheduled scan
 *      cycles, in msecs.
+ * @NL80211_ATTR_SCHED_SCAN_MATCH: Nested attribute with one or more
+ *      sets of attributes to match during scheduled scans.  Only BSSs
+ *      that match any of the sets will be reported.  These are
+ *      pass-thru filter rules.
+ *      For a match to succeed, the BSS must match all attributes of a
+ *      set.  Since not every hardware supports matching all types of
+ *      attributes, there is no guarantee that the reported BSSs are
+ *      fully complying with the match sets and userspace needs to be
+ *      able to ignore them by itself.
+ *      Thus, the implementation is somewhat hardware-dependent, but
+ *      this is only an optimization and the userspace application
+ *      needs to handle all the non-filtered results anyway.
+ *      If the match attributes don't make sense when combined with
+ *      the values passed in @NL80211_ATTR_SCAN_SSIDS (eg. if an SSID
+ *      is included in the probe request, but the match attributes
+ *      will never let it go through), -EINVAL may be returned.
+ *      If ommited, no filtering is done.
 *
 * @NL80211_ATTR_INTERFACE_COMBINATIONS: Nested attribute listing the supported
 *      interface combinations. In each nested item, it contains attributes
@@ -1019,6 +1063,52 @@ enum nl80211_commands {
 *      being a list of supported rates as defined by IEEE 802.11 7.3.2.2 but
 *      without the length restriction (at most %NL80211_MAX_SUPP_RATES).
 *
+ * @NL80211_ATTR_HIDDEN_SSID: indicates whether SSID is to be hidden from Beacon
+ *      and Probe Response (when response to wildcard Probe Request); see
+ *      &enum nl80211_hidden_ssid, represented as a u32
+ *
+ * @NL80211_ATTR_IE_PROBE_RESP: Information element(s) for Probe Response frame.
+ *      This is used with %NL80211_CMD_NEW_BEACON and %NL80211_CMD_SET_BEACON to
+ *      provide extra IEs (e.g., WPS/P2P IE) into Probe Response frames when the
+ *      driver (or firmware) replies to Probe Request frames.
+ * @NL80211_ATTR_IE_ASSOC_RESP: Information element(s) for (Re)Association
+ *      Response frames. This is used with %NL80211_CMD_NEW_BEACON and
+ *      %NL80211_CMD_SET_BEACON to provide extra IEs (e.g., WPS/P2P IE) into
+ *      (Re)Association Response frames when the driver (or firmware) replies to
+ *      (Re)Association Request frames.
+ *
+ * @NL80211_ATTR_STA_WME: Nested attribute containing the wme configuration
+ *      of the station, see &enum nl80211_sta_wme_attr.
+ * @NL80211_ATTR_SUPPORT_AP_UAPSD: the device supports uapsd when working
+ *      as AP.
+ *
+ * @NL80211_ATTR_ROAM_SUPPORT: Indicates whether the firmware is capable of
+ *      roaming to another AP in the same ESS if the signal lever is low.
+ *
+ * @NL80211_ATTR_PMKSA_CANDIDATE: Nested attribute containing the PMKSA caching
+ *      candidate information, see &enum nl80211_pmksa_candidate_attr.
+ *
+ * @NL80211_ATTR_TX_NO_CCK_RATE: Indicates whether to use CCK rate or not
+ *      for management frames transmission. In order to avoid p2p probe/action
+ *      frames are being transmitted at CCK rate in 2GHz band, the user space
+ *      applications use this attribute.
+ *      This attribute is used with %NL80211_CMD_TRIGGER_SCAN and
+ *      %NL80211_CMD_FRAME commands.
+ *
+ * @NL80211_ATTR_TDLS_ACTION: Low level TDLS action code (e.g. link setup
+ *      request, link setup confirm, link teardown, etc.). Values are
+ *      described in the TDLS (802.11z) specification.
+ * @NL80211_ATTR_TDLS_DIALOG_TOKEN: Non-zero token for uniquely identifying a
+ *      TDLS conversation between two devices.
+ * @NL80211_ATTR_TDLS_OPERATION: High level TDLS operation; see
+ *      &enum nl80211_tdls_operation, represented as a u8.
+ * @NL80211_ATTR_TDLS_SUPPORT: A flag indicating the device can operate
+ *      as a TDLS peer sta.
+ * @NL80211_ATTR_TDLS_EXTERNAL_SETUP: The TDLS discovery/setup and teardown
+ *      procedures should be performed by sending TDLS packets via
+ *      %NL80211_CMD_TDLS_MGMT. Otherwise %NL80211_CMD_TDLS_OPER should be
+ *      used for asking the driver to perform a TDLS operation.
+ *
 * @NL80211_ATTR_MAX: highest attribute number currently defined
 * @__NL80211_ATTR_AFTER_LAST: internal use
 */
@@ -1224,6 +1314,29 @@ enum nl80211_attrs {
        NL80211_ATTR_SCAN_SUPP_RATES,
+        NL80211_ATTR_HIDDEN_SSID,
+        NL80211_ATTR_IE_PROBE_RESP,
+        NL80211_ATTR_IE_ASSOC_RESP,
+        NL80211_ATTR_STA_WME,
+        NL80211_ATTR_SUPPORT_AP_UAPSD,
+        NL80211_ATTR_ROAM_SUPPORT,
+        NL80211_ATTR_SCHED_SCAN_MATCH,
+        NL80211_ATTR_MAX_MATCH_SETS,
+        NL80211_ATTR_PMKSA_CANDIDATE,
+        NL80211_ATTR_TX_NO_CCK_RATE,
+        NL80211_ATTR_TDLS_ACTION,
+        NL80211_ATTR_TDLS_DIALOG_TOKEN,
+        NL80211_ATTR_TDLS_OPERATION,
+        NL80211_ATTR_TDLS_SUPPORT,
+        NL80211_ATTR_TDLS_EXTERNAL_SETUP,
        /* add attributes here, update the policy in nl80211.c */
        __NL80211_ATTR_AFTER_LAST,
@@ -1321,6 +1434,7 @@ enum nl80211_iftype {
 * @NL80211_STA_FLAG_WME: station is WME/QoS capable
 * @NL80211_STA_FLAG_MFP: station uses management frame protection
 * @NL80211_STA_FLAG_AUTHENTICATED: station is authenticated
+ * @NL80211_STA_FLAG_TDLS_PEER: station is a TDLS peer
 * @NL80211_STA_FLAG_MAX: highest station flag number currently defined
 * @__NL80211_STA_FLAG_AFTER_LAST: internal use
 */
@@ -1331,6 +1445,7 @@ enum nl80211_sta_flags {
        NL80211_STA_FLAG_WME,
        NL80211_STA_FLAG_MFP,
        NL80211_STA_FLAG_AUTHENTICATED,
+        NL80211_STA_FLAG_TDLS_PEER,
        /* keep last */
        __NL80211_STA_FLAG_AFTER_LAST,
@@ -1433,6 +1548,7 @@ enum nl80211_sta_bss_param {
 * @NL80211_STA_INFO_BSS_PARAM: current station's view of BSS, nested attribute
 *     containing info as possible, see &enum nl80211_sta_bss_param
 * @NL80211_STA_INFO_CONNECTED_TIME: time since the station is last connected
+ * @NL80211_STA_INFO_STA_FLAGS: Contains a struct nl80211_sta_flag_update.
 * @__NL80211_STA_INFO_AFTER_LAST: internal
 * @NL80211_STA_INFO_MAX: highest possible station info attribute
 */
@@ -1454,6 +1570,7 @@ enum nl80211_sta_info {
        NL80211_STA_INFO_RX_BITRATE,
        NL80211_STA_INFO_BSS_PARAM,
        NL80211_STA_INFO_CONNECTED_TIME,
+        NL80211_STA_INFO_STA_FLAGS,
        /* keep last */
        __NL80211_STA_INFO_AFTER_LAST,
@@ -1683,6 +1800,26 @@ enum nl80211_reg_rule_attr {
 };
 /**
+ * enum nl80211_sched_scan_match_attr - scheduled scan match attributes
+ * @__NL80211_SCHED_SCAN_MATCH_ATTR_INVALID: attribute number 0 is reserved
+ * @NL80211_SCHED_SCAN_MATCH_ATTR_SSID: SSID to be used for matching,
+ * only report BSS with matching SSID.
+ * @NL80211_SCHED_SCAN_MATCH_ATTR_MAX: highest scheduled scan filter
+ *      attribute number currently defined
+ * @__NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST: internal use
+ */
+enum nl80211_sched_scan_match_attr {
+        __NL80211_SCHED_SCAN_MATCH_ATTR_INVALID,
+        NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
+        /* keep last */
+        __NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST,
+        NL80211_SCHED_SCAN_MATCH_ATTR_MAX =
+                __NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST - 1
+};
+/**
 * enum nl80211_reg_rule_flags - regulatory rule flags
 *
 * @NL80211_RRF_NO_OFDM: OFDM modulation not allowed
@@ -1833,6 +1970,13 @@ enum nl80211_mntr_flags {
 * @NL80211_MESHCONF_ELEMENT_TTL: specifies the value of TTL field set at a
 * source mesh point for path selection elements.
 *
+ * @NL80211_MESHCONF_HWMP_RANN_INTERVAL:  The interval of time (in TUs) between
+ * root announcements are transmitted.
+ *
+ * @NL80211_MESHCONF_GATE_ANNOUNCEMENTS: Advertise that this mesh station has
+ * access to a broader network beyond the MBSS.  This is done via Root
+ * Announcement frames.
+ *
 * @NL80211_MESHCONF_ATTR_MAX: highest possible mesh configuration attribute
 *
 * @__NL80211_MESHCONF_ATTR_AFTER_LAST: internal use
@@ -1854,6 +1998,8 @@ enum nl80211_meshconf_params {
        NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
        NL80211_MESHCONF_HWMP_ROOTMODE,
        NL80211_MESHCONF_ELEMENT_TTL,
+        NL80211_MESHCONF_HWMP_RANN_INTERVAL,
+        NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
        /* keep last */
        __NL80211_MESHCONF_ATTR_AFTER_LAST,
@@ -2430,4 +2576,78 @@ enum nl80211_rekey_data {
        MAX_NL80211_REKEY_DATA = NUM_NL80211_REKEY_DATA - 1
 };
+/**
+ * enum nl80211_hidden_ssid - values for %NL80211_ATTR_HIDDEN_SSID
+ * @NL80211_HIDDEN_SSID_NOT_IN_USE: do not hide SSID (i.e., broadcast it in
+ *      Beacon frames)
+ * @NL80211_HIDDEN_SSID_ZERO_LEN: hide SSID by using zero-length SSID element
+ *      in Beacon frames
+ * @NL80211_HIDDEN_SSID_ZERO_CONTENTS: hide SSID by using correct length of SSID
+ *      element in Beacon frames but zero out each byte in the SSID
+ */
+enum nl80211_hidden_ssid {
+        NL80211_HIDDEN_SSID_NOT_IN_USE,
+        NL80211_HIDDEN_SSID_ZERO_LEN,
+        NL80211_HIDDEN_SSID_ZERO_CONTENTS
+};
+/**
+ * enum nl80211_sta_wme_attr - station WME attributes
+ * @__NL80211_STA_WME_INVALID: invalid number for nested attribute
+ * @NL80211_STA_WME_UAPSD_QUEUES: bitmap of uapsd queues. the format
+ *      is the same as the AC bitmap in the QoS info field.
+ * @NL80211_STA_WME_MAX_SP: max service period. the format is the same
+ *      as the MAX_SP field in the QoS info field (but already shifted down).
+ * @__NL80211_STA_WME_AFTER_LAST: internal
+ * @NL80211_STA_WME_MAX: highest station WME attribute
+ */
+enum nl80211_sta_wme_attr {
+        __NL80211_STA_WME_INVALID,
+        NL80211_STA_WME_UAPSD_QUEUES,
+        NL80211_STA_WME_MAX_SP,
+        /* keep last */
+        __NL80211_STA_WME_AFTER_LAST,
+        NL80211_STA_WME_MAX = __NL80211_STA_WME_AFTER_LAST - 1
+};
+/**
+ * enum nl80211_pmksa_candidate_attr - attributes for PMKSA caching candidates
+ * @__NL80211_PMKSA_CANDIDATE_INVALID: invalid number for nested attributes
+ * @NL80211_PMKSA_CANDIDATE_INDEX: candidate index (u32; the smaller, the higher
+ *      priority)
+ * @NL80211_PMKSA_CANDIDATE_BSSID: candidate BSSID (6 octets)
+ * @NL80211_PMKSA_CANDIDATE_PREAUTH: RSN pre-authentication supported (flag)
+ * @NUM_NL80211_PMKSA_CANDIDATE: number of PMKSA caching candidate attributes
+ *      (internal)
+ * @MAX_NL80211_PMKSA_CANDIDATE: highest PMKSA caching candidate attribute
+ *      (internal)
+ */
+enum nl80211_pmksa_candidate_attr {
+        __NL80211_PMKSA_CANDIDATE_INVALID,
+        NL80211_PMKSA_CANDIDATE_INDEX,
+        NL80211_PMKSA_CANDIDATE_BSSID,
+        NL80211_PMKSA_CANDIDATE_PREAUTH,
+        /* keep last */
+        NUM_NL80211_PMKSA_CANDIDATE,
+        MAX_NL80211_PMKSA_CANDIDATE = NUM_NL80211_PMKSA_CANDIDATE - 1
+};
+/**
+ * enum nl80211_tdls_operation - values for %NL80211_ATTR_TDLS_OPERATION
+ * @NL80211_TDLS_DISCOVERY_REQ: Send a TDLS discovery request
+ * @NL80211_TDLS_SETUP: Setup TDLS link
+ * @NL80211_TDLS_TEARDOWN: Teardown a TDLS link which is already established
+ * @NL80211_TDLS_ENABLE_LINK: Enable TDLS link
+ * @NL80211_TDLS_DISABLE_LINK: Disable TDLS link
+ */
+enum nl80211_tdls_operation {
+        NL80211_TDLS_DISCOVERY_REQ,
+        NL80211_TDLS_SETUP,
+        NL80211_TDLS_TEARDOWN,
+        NL80211_TDLS_ENABLE_LINK,
+        NL80211_TDLS_DISABLE_LINK,
+};
 #endif /* __LINUX_NL80211_H */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 9fc01226055b..f1b1ca1a09e1 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -174,6 +174,8 @@ enum pci_dev_flags {
        PCI_DEV_FLAGS_MSI_INTX_DISABLE_BUG = (__force pci_dev_flags_t) 1,
        /* Device configuration is irrevocably lost if disabled into D3 */
        PCI_DEV_FLAGS_NO_D3 = (__force pci_dev_flags_t) 2,
+        /* Provide indication device is assigned by a Virtual Machine Manager */
+        PCI_DEV_FLAGS_ASSIGNED = (__force pci_dev_flags_t) 4,
 };
 enum pci_irq_reroute_variant {
diff --git a/include/linux/phonet.h b/include/linux/phonet.h
index 6fb13841db45..f53a4167c5f4 100644
--- a/include/linux/phonet.h
+++ b/include/linux/phonet.h
@@ -24,6 +24,7 @@
 #define LINUX_PHONET_H
 #include <linux/types.h>
+#include <linux/socket.h>
 /* Automatic protocol selection */
 #define PN_PROTO_TRANSPORT      0
@@ -96,11 +97,11 @@ struct phonetmsg {
 /* Phonet socket address structure */
 struct sockaddr_pn {
-        sa_family_t spn_family;
+        __kernel_sa_family_t spn_family;
        __u8 spn_obj;
        __u8 spn_dev;
        __u8 spn_resource;
-        __u8 spn_zero[sizeof(struct sockaddr) - sizeof(sa_family_t) - 3];
+        __u8 spn_zero[sizeof(struct sockaddr) - sizeof(__kernel_sa_family_t) - 3];
 } __attribute__((packed));
 /* Well known address */
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 54fc4138955f..79f337c47388 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -420,7 +420,7 @@ struct phy_driver {
        /*
         * Requests a Tx timestamp for 'skb'. The phy driver promises
-         * to deliver it to the socket's error queue as soon as a
+         * to deliver it using skb_complete_tx_timestamp() as soon as a
         * timestamp becomes available. One of the PTP_CLASS_ values
         * is passed in 'type'.
         */
diff --git a/include/linux/rfkill-gpio.h b/include/linux/rfkill-gpio.h
index a175d0598033..4d09f6eab359 100644
--- a/include/linux/rfkill-gpio.h
+++ b/include/linux/rfkill-gpio.h
@@ -30,6 +30,8 @@
 * @reset_gpio:         GPIO which is used for reseting rfkill switch
 * @shutdown_gpio:      GPIO which is used for shutdown of rfkill switch
 * @power_clk_name:     [optional] name of clk to turn off while blocked
+ * @gpio_runtime_close: clean up platform specific gpio configuration
+ * @gpio_runtime_setup: set up platform specific gpio configuration
 */
 struct rfkill_gpio_platform_data {
@@ -38,6 +40,8 @@ struct rfkill_gpio_platform_data {
        int                     shutdown_gpio;
        const char              *power_clk_name;
        enum rfkill_type        type;
+        void    (*gpio_runtime_close)(struct platform_device *);
+        int     (*gpio_runtime_setup)(struct platform_device *);
 };
 #endif /* __RFKILL_GPIO_H */
diff --git a/include/linux/rose.h b/include/linux/rose.h
index c7b4b184c82e..1fcfe95893b8 100644
--- a/include/linux/rose.h
+++ b/include/linux/rose.h
@@ -7,6 +7,9 @@
 #ifndef ROSE_KERNEL_H
 #define ROSE_KERNEL_H
+#include <linux/socket.h>
+#include <linux/ax25.h>
 #define ROSE_MTU        251
 #define ROSE_MAX_DIGIS 6
@@ -44,7 +47,7 @@ typedef struct {
 } rose_address;
 struct sockaddr_rose {
-        sa_family_t     srose_family;
+        __kernel_sa_family_t srose_family;
        rose_address    srose_addr;
        ax25_address    srose_call;
        int             srose_ndigis;
@@ -52,7 +55,7 @@ struct sockaddr_rose {
 };
 struct full_sockaddr_rose {
-        sa_family_t     srose_family;
+        __kernel_sa_family_t srose_family;
        rose_address    srose_addr;
        ax25_address    srose_call;
        unsigned int    srose_ndigis;
diff --git a/include/linux/sh_eth.h b/include/linux/sh_eth.h
new file mode 100644
index 000000000000..2076acf8294d
--- /dev/null
+++ b/include/linux/sh_eth.h
@@ -0,0 +1,25 @@
+#ifndef __ASM_SH_ETH_H__
+#define __ASM_SH_ETH_H__
+#include <linux/phy.h>
+enum {EDMAC_LITTLE_ENDIAN, EDMAC_BIG_ENDIAN};
+enum {
+        SH_ETH_REG_GIGABIT,
+        SH_ETH_REG_FAST_SH4,
+        SH_ETH_REG_FAST_SH3_SH2
+};
+struct sh_eth_plat_data {
+        int phy;
+        int edmac_endian;
+        int register_type;
+        phy_interface_t phy_interface;
+        void (*set_mdio_gate)(void *addr);
+        unsigned char mac_addr[6];
+        unsigned no_ether_link:1;
+        unsigned ether_link_active_low:1;
+};
+#endif
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 8bd383caa363..6a6b352326d7 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -29,6 +29,7 @@
 #include <linux/rcupdate.h>
 #include <linux/dmaengine.h>
 #include <linux/hrtimer.h>
+#include <linux/dma-mapping.h>
 /* Don't change this without changing skb_csum_unnecessary! */
 #define CHECKSUM_NONE 0
@@ -45,6 +46,11 @@
 #define SKB_MAX_HEAD(X)         (SKB_MAX_ORDER((X), 0))
 #define SKB_MAX_ALLOC           (SKB_MAX_ORDER(0, 2))
+/* return minimum truesize of one skb containing X bytes of data */
+#define SKB_TRUESIZE(X) ((X) +                                          \
+                         SKB_DATA_ALIGN(sizeof(struct sk_buff)) +       \
+                         SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 /* A. Checksumming of received packets by device.
 *
 *      NONE: device failed to checksum this packet.
@@ -134,7 +140,9 @@ struct sk_buff;
 typedef struct skb_frag_struct skb_frag_t;
 struct skb_frag_struct {
-        struct page *page;
+        struct {
+                struct page *p;
+        } page;
 #if (BITS_PER_LONG > 32) || (PAGE_SIZE >= 65536)
        __u32 page_offset;
        __u32 size;
@@ -144,6 +152,26 @@ struct skb_frag_struct {
 #endif
 };
+static inline unsigned int skb_frag_size(const skb_frag_t *frag)
+{
+        return frag->size;
+}
+static inline void skb_frag_size_set(skb_frag_t *frag, unsigned int size)
+{
+        frag->size = size;
+}
+static inline void skb_frag_size_add(skb_frag_t *frag, int delta)
+{
+        frag->size += delta;
+}
+static inline void skb_frag_size_sub(skb_frag_t *frag, int delta)
+{
+        frag->size -= delta;
+}
 #define HAVE_HW_TIME_STAMP
 /**
@@ -322,6 +350,8 @@ typedef unsigned char *sk_buff_data_t;
 *      @queue_mapping: Queue mapping for multiqueue devices
 *      @ndisc_nodetype: router type (from link layer)
 *      @ooo_okay: allow the mapping of a socket to a queue to be changed
+ *      @l4_rxhash: indicate rxhash is a canonical 4-tuple hash over transport
+ *              ports.
 *      @dma_cookie: a cookie to one of several possible DMA operations
 *              done by skb DMA functions
 *      @secmark: security marking
@@ -414,6 +444,7 @@ struct sk_buff {
        __u8                    ndisc_nodetype:2;
 #endif
        __u8                    ooo_okay:1;
+        __u8                    l4_rxhash:1;
        kmemcheck_bitfield_end(flags2);
        /* 0/13 bit hole */
@@ -521,6 +552,7 @@ static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
        return __alloc_skb(size, priority, 1, NUMA_NO_NODE);
 }
+extern void skb_recycle(struct sk_buff *skb);
 extern bool skb_recycle_check(struct sk_buff *skb, int skb_size);
 extern struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src);
@@ -573,11 +605,11 @@ extern unsigned int   skb_find_text(struct sk_buff *skb, unsigned int from,
                                    unsigned int to, struct ts_config *config,
                                    struct ts_state *state);
-extern __u32 __skb_get_rxhash(struct sk_buff *skb);
+extern void __skb_get_rxhash(struct sk_buff *skb);
 static inline __u32 skb_get_rxhash(struct sk_buff *skb)
 {
        if (!skb->rxhash)
-                skb->rxhash = __skb_get_rxhash(skb);
+                __skb_get_rxhash(skb);
        return skb->rxhash;
 }
@@ -823,9 +855,9 @@ static inline struct sk_buff *skb_unshare(struct sk_buff *skb,
 *      The reference count is not incremented and the reference is therefore
 *      volatile. Use with caution.
 */
-static inline struct sk_buff *skb_peek(struct sk_buff_head *list_)
+static inline struct sk_buff *skb_peek(const struct sk_buff_head *list_)
 {
-        struct sk_buff *list = ((struct sk_buff *)list_)->next;
+        struct sk_buff *list = ((const struct sk_buff *)list_)->next;
        if (list == (struct sk_buff *)list_)
                list = NULL;
        return list;
@@ -844,9 +876,9 @@ static inline struct sk_buff *skb_peek(struct sk_buff_head *list_)
 *      The reference count is not incremented and the reference is therefore
 *      volatile. Use with caution.
 */
-static inline struct sk_buff *skb_peek_tail(struct sk_buff_head *list_)
+static inline struct sk_buff *skb_peek_tail(const struct sk_buff_head *list_)
 {
-        struct sk_buff *list = ((struct sk_buff *)list_)->prev;
+        struct sk_buff *list = ((const struct sk_buff *)list_)->prev;
        if (list == (struct sk_buff *)list_)
                list = NULL;
        return list;
@@ -1123,18 +1155,51 @@ static inline int skb_pagelen(const struct sk_buff *skb)
        int i, len = 0;
        for (i = (int)skb_shinfo(skb)->nr_frags - 1; i >= 0; i--)
-                len += skb_shinfo(skb)->frags[i].size;
+                len += skb_frag_size(&skb_shinfo(skb)->frags[i]);
        return len + skb_headlen(skb);
 }
-static inline void skb_fill_page_desc(struct sk_buff *skb, int i,
+/**
-                                      struct page *page, int off, int size)
+ * __skb_fill_page_desc - initialise a paged fragment in an skb
+ * @skb: buffer containing fragment to be initialised
+ * @i: paged fragment index to initialise
+ * @page: the page to use for this fragment
+ * @off: the offset to the data with @page
+ * @size: the length of the data
+ *
+ * Initialises the @i'th fragment of @skb to point to &size bytes at
+ * offset @off within @page.
+ *
+ * Does not take any additional reference on the fragment.
+ */
+static inline void __skb_fill_page_desc(struct sk_buff *skb, int i,
+                                        struct page *page, int off, int size)
 {
        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-        frag->page                = page;
+        frag->page.p              = page;
        frag->page_offset         = off;
-        frag->size                = size;
+        skb_frag_size_set(frag, size);
+}
+/**
+ * skb_fill_page_desc - initialise a paged fragment in an skb
+ * @skb: buffer containing fragment to be initialised
+ * @i: paged fragment index to initialise
+ * @page: the page to use for this fragment
+ * @off: the offset to the data with @page
+ * @size: the length of the data
+ *
+ * As per __skb_fill_page_desc() -- initialises the @i'th fragment of
+ * @skb to point to &size bytes at offset @off within @page. In
+ * addition updates @skb such that @i is the last fragment.
+ *
+ * Does not take any additional reference on the fragment.
+ */
+static inline void skb_fill_page_desc(struct sk_buff *skb, int i,
+                                      struct page *page, int off, int size)
+{
+        __skb_fill_page_desc(skb, i, page, off, size);
        skb_shinfo(skb)->nr_frags = i + 1;
 }
@@ -1629,6 +1694,137 @@ static inline void netdev_free_page(struct net_device *dev, struct page *page)
 }
 /**
+ * skb_frag_page - retrieve the page refered to by a paged fragment
+ * @frag: the paged fragment
+ *
+ * Returns the &struct page associated with @frag.
+ */
+static inline struct page *skb_frag_page(const skb_frag_t *frag)
+{
+        return frag->page.p;
+}
+/**
+ * __skb_frag_ref - take an addition reference on a paged fragment.
+ * @frag: the paged fragment
+ *
+ * Takes an additional reference on the paged fragment @frag.
+ */
+static inline void __skb_frag_ref(skb_frag_t *frag)
+{
+        get_page(skb_frag_page(frag));
+}
+/**
+ * skb_frag_ref - take an addition reference on a paged fragment of an skb.
+ * @skb: the buffer
+ * @f: the fragment offset.
+ *
+ * Takes an additional reference on the @f'th paged fragment of @skb.
+ */
+static inline void skb_frag_ref(struct sk_buff *skb, int f)
+{
+        __skb_frag_ref(&skb_shinfo(skb)->frags[f]);
+}
+/**
+ * __skb_frag_unref - release a reference on a paged fragment.
+ * @frag: the paged fragment
+ *
+ * Releases a reference on the paged fragment @frag.
+ */
+static inline void __skb_frag_unref(skb_frag_t *frag)
+{
+        put_page(skb_frag_page(frag));
+}
+/**
+ * skb_frag_unref - release a reference on a paged fragment of an skb.
+ * @skb: the buffer
+ * @f: the fragment offset
+ *
+ * Releases a reference on the @f'th paged fragment of @skb.
+ */
+static inline void skb_frag_unref(struct sk_buff *skb, int f)
+{
+        __skb_frag_unref(&skb_shinfo(skb)->frags[f]);
+}
+/**
+ * skb_frag_address - gets the address of the data contained in a paged fragment
+ * @frag: the paged fragment buffer
+ *
+ * Returns the address of the data within @frag. The page must already
+ * be mapped.
+ */
+static inline void *skb_frag_address(const skb_frag_t *frag)
+{
+        return page_address(skb_frag_page(frag)) + frag->page_offset;
+}
+/**
+ * skb_frag_address_safe - gets the address of the data contained in a paged fragment
+ * @frag: the paged fragment buffer
+ *
+ * Returns the address of the data within @frag. Checks that the page
+ * is mapped and returns %NULL otherwise.
+ */
+static inline void *skb_frag_address_safe(const skb_frag_t *frag)
+{
+        void *ptr = page_address(skb_frag_page(frag));
+        if (unlikely(!ptr))
+                return NULL;
+        return ptr + frag->page_offset;
+}
+/**
+ * __skb_frag_set_page - sets the page contained in a paged fragment
+ * @frag: the paged fragment
+ * @page: the page to set
+ *
+ * Sets the fragment @frag to contain @page.
+ */
+static inline void __skb_frag_set_page(skb_frag_t *frag, struct page *page)
+{
+        frag->page.p = page;
+}
+/**
+ * skb_frag_set_page - sets the page contained in a paged fragment of an skb
+ * @skb: the buffer
+ * @f: the fragment offset
+ * @page: the page to set
+ *
+ * Sets the @f'th fragment of @skb to contain @page.
+ */
+static inline void skb_frag_set_page(struct sk_buff *skb, int f,
+                                     struct page *page)
+{
+        __skb_frag_set_page(&skb_shinfo(skb)->frags[f], page);
+}
+/**
+ * skb_frag_dma_map - maps a paged fragment via the DMA API
+ * @device: the device to map the fragment to
+ * @frag: the paged fragment to map
+ * @offset: the offset within the fragment (starting at the
+ *          fragment's own offset)
+ * @size: the number of bytes to map
+ * @direction: the direction of the mapping (%PCI_DMA_*)
+ *
+ * Maps the page associated with @frag to @device.
+ */
+static inline dma_addr_t skb_frag_dma_map(struct device *dev,
+                                          const skb_frag_t *frag,
+                                          size_t offset, size_t size,
+                                          enum dma_data_direction dir)
+{
+        return dma_map_page(dev, skb_frag_page(frag),
+                            frag->page_offset + offset, size, dir);
+}
+/**
 *      skb_clone_writable - is the header of a clone writable
 *      @skb: buffer to check
 *      @len: length up to which to write
@@ -1636,7 +1832,7 @@ static inline void netdev_free_page(struct net_device *dev, struct page *page)
 *      Returns true if modifying the header part of the cloned buffer
 *      does not requires the data to be copied.
 */
-static inline int skb_clone_writable(struct sk_buff *skb, unsigned int len)
+static inline int skb_clone_writable(const struct sk_buff *skb, unsigned int len)
 {
        return !skb_header_cloned(skb) &&
               skb_headroom(skb) + len <= skb->hdr_len;
@@ -1730,13 +1926,13 @@ static inline int skb_add_data(struct sk_buff *skb,
 }
 static inline int skb_can_coalesce(struct sk_buff *skb, int i,
-                                   struct page *page, int off)
+                                   const struct page *page, int off)
 {
        if (i) {
-                struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[i - 1];
+                const struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[i - 1];
-                return page == frag->page &&
+                return page == skb_frag_page(frag) &&
-                       off == frag->page_offset + frag->size;
+                       off == frag->page_offset + skb_frag_size(frag);
        }
        return 0;
 }
@@ -2020,8 +2216,13 @@ static inline bool skb_defer_rx_timestamp(struct sk_buff *skb)
 /**
 * skb_complete_tx_timestamp() - deliver cloned skb with tx timestamps
 *
+ * PHY drivers may accept clones of transmitted packets for
+ * timestamping via their phy_driver.txtstamp method. These drivers
+ * must call this function to return the skb back to the stack, with
+ * or without a timestamp.
+ *
 * @skb: clone of the the original outgoing packet
- * @hwtstamps: hardware time stamps
+ * @hwtstamps: hardware time stamps, may be NULL if not available
 *
 */
 void skb_complete_tx_timestamp(struct sk_buff *skb,
@@ -2257,7 +2458,8 @@ static inline bool skb_warn_if_lro(const struct sk_buff *skb)
 {
        /* LRO sets gso_size but not gso_type, whereas if GSO is really
         * wanted then gso_type will be set. */
-        struct skb_shared_info *shinfo = skb_shinfo(skb);
+        const struct skb_shared_info *shinfo = skb_shinfo(skb);
        if (skb_is_nonlinear(skb) && shinfo->gso_size != 0 &&
            unlikely(shinfo->gso_type == 0)) {
                __skb_warn_lro_forwarding(skb);
@@ -2281,7 +2483,7 @@ static inline void skb_forward_csum(struct sk_buff *skb)
 * Instead of forcing ip_summed to CHECKSUM_NONE, we can
 * use this helper, to document places where we make this assertion.
 */
-static inline void skb_checksum_none_assert(struct sk_buff *skb)
+static inline void skb_checksum_none_assert(const struct sk_buff *skb)
 {
 #ifdef DEBUG
        BUG_ON(skb->ip_summed != CHECKSUM_NONE);
@@ -2290,5 +2492,25 @@ static inline void skb_checksum_none_assert(struct sk_buff *skb)
 bool skb_partial_csum_set(struct sk_buff *skb, u16 start, u16 off);
+static inline bool skb_is_recycleable(const struct sk_buff *skb, int skb_size)
+{
+        if (irqs_disabled())
+                return false;
+        if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY)
+                return false;
+        if (skb_is_nonlinear(skb) || skb->fclone != SKB_FCLONE_UNAVAILABLE)
+                return false;
+        skb_size = SKB_DATA_ALIGN(skb_size + NET_SKB_PAD);
+        if (skb_end_pointer(skb) - skb->head < skb_size)
+                return false;
+        if (skb_shared(skb) || skb_cloned(skb))
+                return false;
+        return true;
+}
 #endif  /* __KERNEL__ */
 #endif  /* _LINUX_SKBUFF_H */
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 8623217f84d0..f10ed7b4a714 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -25,7 +25,7 @@ struct ssb_sprom {
        u8 et1phyaddr;          /* MII address for enet1 */
        u8 et0mdcport;          /* MDIO for enet0 */
        u8 et1mdcport;          /* MDIO for enet1 */
-        u8 board_rev;           /* Board revision number from SPROM. */
+        u16 board_rev;          /* Board revision number from SPROM. */
        u8 country_code;        /* Country Code */
        u16 leddc_on_time;      /* LED Powersave Duty Cycle On Count */
        u16 leddc_off_time;     /* LED Powersave Duty Cycle Off Count */
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index efbf459d571c..98941203a27f 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -462,6 +462,46 @@
 #define SSB_SPROM8_OFDM5GLPO            0x014A  /* 5.2GHz OFDM power offset */
 #define SSB_SPROM8_OFDM5GHPO            0x014E  /* 5.8GHz OFDM power offset */
+/* Values for boardflags_lo read from SPROM */
+#define SSB_BFL_BTCOEXIST               0x0001  /* implements Bluetooth coexistance */
+#define SSB_BFL_PACTRL                  0x0002  /* GPIO 9 controlling the PA */
+#define SSB_BFL_AIRLINEMODE             0x0004  /* implements GPIO 13 radio disable indication */
+#define SSB_BFL_RSSI                    0x0008  /* software calculates nrssi slope. */
+#define SSB_BFL_ENETSPI                 0x0010  /* has ephy roboswitch spi */
+#define SSB_BFL_XTAL_NOSLOW             0x0020  /* no slow clock available */
+#define SSB_BFL_CCKHIPWR                0x0040  /* can do high power CCK transmission */
+#define SSB_BFL_ENETADM                 0x0080  /* has ADMtek switch */
+#define SSB_BFL_ENETVLAN                0x0100  /* can do vlan */
+#define SSB_BFL_AFTERBURNER             0x0200  /* supports Afterburner mode */
+#define SSB_BFL_NOPCI                   0x0400  /* board leaves PCI floating */
+#define SSB_BFL_FEM                     0x0800  /* supports the Front End Module */
+#define SSB_BFL_EXTLNA                  0x1000  /* has an external LNA */
+#define SSB_BFL_HGPA                    0x2000  /* had high gain PA */
+#define SSB_BFL_BTCMOD                  0x4000  /* BFL_BTCOEXIST is given in alternate GPIOs */
+#define SSB_BFL_ALTIQ                   0x8000  /* alternate I/Q settings */
+/* Values for boardflags_hi read from SPROM */
+#define SSB_BFH_NOPA                    0x0001  /* has no PA */
+#define SSB_BFH_RSSIINV                 0x0002  /* RSSI uses positive slope (not TSSI) */
+#define SSB_BFH_PAREF                   0x0004  /* uses the PARef LDO */
+#define SSB_BFH_3TSWITCH                0x0008  /* uses a triple throw switch shared with bluetooth */
+#define SSB_BFH_PHASESHIFT              0x0010  /* can support phase shifter */
+#define SSB_BFH_BUCKBOOST               0x0020  /* has buck/booster */
+#define SSB_BFH_FEM_BT                  0x0040  /* has FEM and switch to share antenna with bluetooth */
+/* Values for boardflags2_lo read from SPROM */
+#define SSB_BFL2_RXBB_INT_REG_DIS       0x0001  /* external RX BB regulator present */
+#define SSB_BFL2_APLL_WAR               0x0002  /* alternative A-band PLL settings implemented */
+#define SSB_BFL2_TXPWRCTRL_EN           0x0004  /* permits enabling TX Power Control */
+#define SSB_BFL2_2X4_DIV                0x0008  /* 2x4 diversity switch */
+#define SSB_BFL2_5G_PWRGAIN             0x0010  /* supports 5G band power gain */
+#define SSB_BFL2_PCIEWAR_OVR            0x0020  /* overrides ASPM and Clkreq settings */
+#define SSB_BFL2_CAESERS_BRD            0x0040  /* is Caesers board (unused) */
+#define SSB_BFL2_BTC3WIRE               0x0080  /* used 3-wire bluetooth coexist */
+#define SSB_BFL2_SKWRKFEM_BRD           0x0100  /* 4321mcm93 uses Skyworks FEM */
+#define SSB_BFL2_SPUR_WAR               0x0200  /* has a workaround for clock-harmonic spurs */
+#define SSB_BFL2_GPLL_WAR               0x0400  /* altenative G-band PLL settings implemented */
 /* Values for SSB_SPROM1_BINF_CCODE */
 enum {
        SSB_SPROM1CCODE_WORLD = 0,
diff --git a/include/linux/sungem_phy.h b/include/linux/sungem_phy.h
new file mode 100644
index 000000000000..bd9be9f59d3a
--- /dev/null
+++ b/include/linux/sungem_phy.h
@@ -0,0 +1,132 @@
+#ifndef __SUNGEM_PHY_H__
+#define __SUNGEM_PHY_H__
+struct mii_phy;
+/* Operations supported by any kind of PHY */
+struct mii_phy_ops
+{
+        int             (*init)(struct mii_phy *phy);
+        int             (*suspend)(struct mii_phy *phy);
+        int             (*setup_aneg)(struct mii_phy *phy, u32 advertise);
+        int             (*setup_forced)(struct mii_phy *phy, int speed, int fd);
+        int             (*poll_link)(struct mii_phy *phy);
+        int             (*read_link)(struct mii_phy *phy);
+        int             (*enable_fiber)(struct mii_phy *phy, int autoneg);
+};
+/* Structure used to statically define an mii/gii based PHY */
+struct mii_phy_def
+{
+        u32                             phy_id;         /* Concatenated ID1 << 16 | ID2 */
+        u32                             phy_id_mask;    /* Significant bits */
+        u32                             features;       /* Ethtool SUPPORTED_* defines */
+        int                             magic_aneg;     /* Autoneg does all speed test for us */
+        const char*                     name;
+        const struct mii_phy_ops*       ops;
+};
+enum {
+        BCM54XX_COPPER,
+        BCM54XX_FIBER,
+        BCM54XX_GBIC,
+        BCM54XX_SGMII,
+        BCM54XX_UNKNOWN,
+};
+/* An instance of a PHY, partially borrowed from mii_if_info */
+struct mii_phy
+{
+        struct mii_phy_def*     def;
+        u32                     advertising;
+        int                     mii_id;
+        /* 1: autoneg enabled, 0: disabled */
+        int                     autoneg;
+        /* forced speed & duplex (no autoneg)
+         * partner speed & duplex & pause (autoneg)
+         */
+        int                     speed;
+        int                     duplex;
+        int                     pause;
+        /* Provided by host chip */
+        struct net_device       *dev;
+        int (*mdio_read) (struct net_device *dev, int mii_id, int reg);
+        void (*mdio_write) (struct net_device *dev, int mii_id, int reg, int val);
+        void                    *platform_data;
+};
+/* Pass in a struct mii_phy with dev, mdio_read and mdio_write
+ * filled, the remaining fields will be filled on return
+ */
+extern int sungem_phy_probe(struct mii_phy *phy, int mii_id);
+/* MII definitions missing from mii.h */
+#define BMCR_SPD2       0x0040          /* Gigabit enable (bcm54xx)     */
+#define LPA_PAUSE       0x0400
+/* More PHY registers (model specific) */
+/* MII BCM5201 MULTIPHY interrupt register */
+#define MII_BCM5201_INTERRUPT                   0x1A
+#define MII_BCM5201_INTERRUPT_INTENABLE         0x4000
+#define MII_BCM5201_AUXMODE2                    0x1B
+#define MII_BCM5201_AUXMODE2_LOWPOWER           0x0008
+#define MII_BCM5201_MULTIPHY                    0x1E
+/* MII BCM5201 MULTIPHY register bits */
+#define MII_BCM5201_MULTIPHY_SERIALMODE         0x0002
+#define MII_BCM5201_MULTIPHY_SUPERISOLATE       0x0008
+/* MII BCM5221 Additional registers */
+#define MII_BCM5221_TEST                        0x1f
+#define MII_BCM5221_TEST_ENABLE_SHADOWS         0x0080
+#define MII_BCM5221_SHDOW_AUX_STAT2             0x1b
+#define MII_BCM5221_SHDOW_AUX_STAT2_APD         0x0020
+#define MII_BCM5221_SHDOW_AUX_MODE4             0x1a
+#define MII_BCM5221_SHDOW_AUX_MODE4_IDDQMODE    0x0001
+#define MII_BCM5221_SHDOW_AUX_MODE4_CLKLOPWR    0x0004
+/* MII BCM5241 Additional registers */
+#define MII_BCM5241_SHDOW_AUX_MODE4_STANDBYPWR  0x0008
+/* MII BCM5400 1000-BASET Control register */
+#define MII_BCM5400_GB_CONTROL                  0x09
+#define MII_BCM5400_GB_CONTROL_FULLDUPLEXCAP    0x0200
+/* MII BCM5400 AUXCONTROL register */
+#define MII_BCM5400_AUXCONTROL                  0x18
+#define MII_BCM5400_AUXCONTROL_PWR10BASET       0x0004
+/* MII BCM5400 AUXSTATUS register */
+#define MII_BCM5400_AUXSTATUS                   0x19
+#define MII_BCM5400_AUXSTATUS_LINKMODE_MASK     0x0700
+#define MII_BCM5400_AUXSTATUS_LINKMODE_SHIFT    8
+/* 1000BT control (Marvell & BCM54xx at least) */
+#define MII_1000BASETCONTROL                    0x09
+#define MII_1000BASETCONTROL_FULLDUPLEXCAP      0x0200
+#define MII_1000BASETCONTROL_HALFDUPLEXCAP      0x0100
+/* Marvell 88E1011 PHY control */
+#define MII_M1011_PHY_SPEC_CONTROL              0x10
+#define MII_M1011_PHY_SPEC_CONTROL_MANUAL_MDIX  0x20
+#define MII_M1011_PHY_SPEC_CONTROL_AUTO_MDIX    0x40
+/* Marvell 88E1011 PHY status */
+#define MII_M1011_PHY_SPEC_STATUS               0x11
+#define MII_M1011_PHY_SPEC_STATUS_1000          0x8000
+#define MII_M1011_PHY_SPEC_STATUS_100           0x4000
+#define MII_M1011_PHY_SPEC_STATUS_SPD_MASK      0xc000
+#define MII_M1011_PHY_SPEC_STATUS_FULLDUPLEX    0x2000
+#define MII_M1011_PHY_SPEC_STATUS_RESOLVED      0x0800
+#define MII_M1011_PHY_SPEC_STATUS_TX_PAUSE      0x0008
+#define MII_M1011_PHY_SPEC_STATUS_RX_PAUSE      0x0004
+#endif /* __SUNGEM_PHY_H__ */
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 11684d9e6bd2..9a1ec10fd504 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -435,7 +435,7 @@ enum {
        NET_IPV4_ROUTE_MAX_SIZE=5,
        NET_IPV4_ROUTE_GC_MIN_INTERVAL=6,
        NET_IPV4_ROUTE_GC_TIMEOUT=7,
-        NET_IPV4_ROUTE_GC_INTERVAL=8,
+        NET_IPV4_ROUTE_GC_INTERVAL=8, /* obsolete since 2.6.38 */
        NET_IPV4_ROUTE_REDIRECT_LOAD=9,
        NET_IPV4_ROUTE_REDIRECT_NUMBER=10,
        NET_IPV4_ROUTE_REDIRECT_SILENCE=11,
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index d7d2f2158142..dac0859e6440 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -112,6 +112,7 @@ struct bin_attribute {
 struct sysfs_ops {
        ssize_t (*show)(struct kobject *, struct attribute *,char *);
        ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
+        const void *(*namespace)(struct kobject *, const struct attribute *);
 };
 struct sysfs_dirent;
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 531ede8006d9..7f59ee946983 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -111,7 +111,8 @@ enum {
 #define TCPI_OPT_TIMESTAMPS     1
 #define TCPI_OPT_SACK           2
 #define TCPI_OPT_WSCALE         4
-#define TCPI_OPT_ECN            8
+#define TCPI_OPT_ECN            8 /* ECN was negociated at TCP session init */
+#define TCPI_OPT_ECN_SEEN       16 /* we received at least one packet with ECT */
 enum tcp_ca_state {
        TCP_CA_Open = 0,
@@ -379,6 +380,10 @@ struct tcp_sock {
        u32     snd_cwnd_clamp; /* Do not allow snd_cwnd to grow above this */
        u32     snd_cwnd_used;
        u32     snd_cwnd_stamp;
+        u32     prior_cwnd;     /* Congestion window at start of Recovery. */
+        u32     prr_delivered;  /* Number of newly delivered packets to
+                                 * receiver in Recovery. */
+        u32     prr_out;        /* Total number of pkts sent during Recovery. */
        u32     rcv_wnd;        /* Current receiver window              */
        u32     write_seq;      /* Tail(+1) of data held in tcp send buffer */
diff --git a/include/linux/tipc_config.h b/include/linux/tipc_config.h
index 0db239590b4d..9730b0e51e46 100644
--- a/include/linux/tipc_config.h
+++ b/include/linux/tipc_config.h
@@ -41,6 +41,10 @@
 #include <linux/string.h>
 #include <asm/byteorder.h>
+#ifndef __KERNEL__
+#include <arpa/inet.h> /* for ntohs etc. */
+#endif
 /*
 * Configuration
 *
diff --git a/include/linux/un.h b/include/linux/un.h
index 45561c564b8e..3ed3e46c1b1f 100644
--- a/include/linux/un.h
+++ b/include/linux/un.h
@@ -1,10 +1,12 @@
 #ifndef _LINUX_UN_H
 #define _LINUX_UN_H
+#include <linux/socket.h>
 #define UNIX_PATH_MAX   108
 struct sockaddr_un {
-        sa_family_t sun_family; /* AF_UNIX */
+        __kernel_sa_family_t sun_family; /* AF_UNIX */
        char sun_path[UNIX_PATH_MAX];   /* pathname */
 };
diff --git a/include/linux/virtio.h b/include/linux/virtio.h
index 710885749605..851ebf1a4476 100644
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -61,6 +61,9 @@ struct virtqueue {
 * virtqueue_detach_unused_buf: detach first unused buffer
 *      vq: the struct virtqueue we're talking about.
 *      Returns NULL or the "data" token handed to add_buf
+ * virtqueue_get_vring_size: return the size of the virtqueue's vring
+ *      vq: the struct virtqueue containing the vring of interest.
+ *      Returns the size of the vring.
 *
 * Locking rules are straightforward: the driver is responsible for
 * locking.  No two operations may be invoked simultaneously, with the exception
@@ -97,6 +100,8 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *vq);
 void *virtqueue_detach_unused_buf(struct virtqueue *vq);
+unsigned int virtqueue_get_vring_size(struct virtqueue *vq);
 /**
 * virtio_device - representation of a device using virtio
 * @index: unique position on the virtio bus
diff --git a/include/linux/x25.h b/include/linux/x25.h
index 6450a7f12074..810cce6737ea 100644
--- a/include/linux/x25.h
+++ b/include/linux/x25.h
@@ -12,6 +12,7 @@
 #define X25_KERNEL_H
 #include <linux/types.h>
+#include <linux/socket.h>
 #define SIOCX25GSUBSCRIP        (SIOCPROTOPRIVATE + 0)
 #define SIOCX25SSUBSCRIP        (SIOCPROTOPRIVATE + 1)
@@ -57,7 +58,7 @@ struct x25_address {
 *      Linux X.25 Address structure, used for bind, and connect mostly.
 */
 struct sockaddr_x25 {
-        sa_family_t        sx25_family;         /* Must be AF_X25 */
+        __kernel_sa_family_t sx25_family;       /* Must be AF_X25 */
        struct x25_address sx25_addr;           /* X.121 Address */
 };
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 582e4ae70753..cbc6bb0a6838 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -8,7 +8,7 @@
 #define TEMP_VALID_LIFETIME             (7*86400)
 #define TEMP_PREFERRED_LIFETIME         (86400)
-#define REGEN_MAX_RETRY                 (5)
+#define REGEN_MAX_RETRY                 (3)
 #define MAX_DESYNC_FACTOR               (600)
 #define ADDR_CHECK_FREQUENCY            (120*HZ)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index be30aabe7b88..aaf79af72432 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -716,6 +716,16 @@ struct hci_rp_read_bd_addr {
        bdaddr_t bdaddr;
 } __packed;
+#define HCI_OP_WRITE_PAGE_SCAN_ACTIVITY 0x0c1c
+struct hci_cp_write_page_scan_activity {
+        __le16   interval;
+        __le16   window;
+} __packed;
+#define HCI_OP_WRITE_PAGE_SCAN_TYPE     0x0c47
+        #define PAGE_SCAN_TYPE_STANDARD         0x00
+        #define PAGE_SCAN_TYPE_INTERLACED       0x01
 #define HCI_OP_LE_SET_EVENT_MASK        0x2001
 struct hci_cp_le_set_event_mask {
        __u8     mask[8];
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 8f441b8b2963..5b924423cf20 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -195,8 +195,6 @@ struct hci_dev {
        __u16                   init_last_cmd;
-        struct crypto_blkcipher *tfm;
        struct inquiry_cache    inq_cache;
        struct hci_conn_hash    conn_hash;
        struct list_head        blacklist;
@@ -348,6 +346,7 @@ enum {
        HCI_CONN_RSWITCH_PEND,
        HCI_CONN_MODE_CHANGE_PEND,
        HCI_CONN_SCO_SETUP_PEND,
+        HCI_CONN_LE_SMP_PEND,
 };
 static inline void hci_conn_hash_init(struct hci_dev *hdev)
@@ -395,6 +394,22 @@ static inline void hci_conn_hash_del(struct hci_dev *hdev, struct hci_conn *c)
        }
 }
+static inline unsigned int hci_conn_num(struct hci_dev *hdev, __u8 type)
+{
+        struct hci_conn_hash *h = &hdev->conn_hash;
+        switch (type) {
+        case ACL_LINK:
+                return h->acl_num;
+        case LE_LINK:
+                return h->le_num;
+        case SCO_LINK:
+        case ESCO_LINK:
+                return h->sco_num;
+        default:
+                return 0;
+        }
+}
 static inline struct hci_conn *hci_conn_hash_lookup_handle(struct hci_dev *hdev,
                                                                __u16 handle)
 {
@@ -475,7 +490,7 @@ static inline void hci_conn_put(struct hci_conn *conn)
 {
        if (atomic_dec_and_test(&conn->refcnt)) {
                unsigned long timeo;
-                if (conn->type == ACL_LINK) {
+                if (conn->type == ACL_LINK || conn->type == LE_LINK) {
                        del_timer(&conn->idle_timer);
                        if (conn->state == BT_CONNECTED) {
                                timeo = msecs_to_jiffies(conn->disc_timeout);
@@ -838,7 +853,7 @@ int mgmt_powered(u16 index, u8 powered);
 int mgmt_discoverable(u16 index, u8 discoverable);
 int mgmt_connectable(u16 index, u8 connectable);
 int mgmt_new_key(u16 index, struct link_key *key, u8 persistent);
-int mgmt_connected(u16 index, bdaddr_t *bdaddr);
+int mgmt_connected(u16 index, bdaddr_t *bdaddr, u8 link_type);
 int mgmt_disconnected(u16 index, bdaddr_t *bdaddr);
 int mgmt_disconnect_failed(u16 index);
 int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 status);
@@ -858,6 +873,8 @@ int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 *dev_class, s8 rssi,
                                                                u8 *eir);
 int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name);
 int mgmt_discovering(u16 index, u8 discovering);
+int mgmt_device_blocked(u16 index, bdaddr_t *bdaddr);
+int mgmt_device_unblocked(u16 index, bdaddr_t *bdaddr);
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 4f34ad25e75c..ab90ae0970a6 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -354,8 +354,8 @@ struct l2cap_chan {
        __u8            retry_count;
        __u8            num_acked;
        __u16           sdu_len;
-        __u16           partial_sdu_len;
        struct sk_buff  *sdu;
+        struct sk_buff  *sdu_last_frag;
        __u8            remote_tx_win;
        __u8            remote_max_tx;
@@ -409,14 +409,8 @@ struct l2cap_conn {
        __u8            disc_reason;
-        __u8            preq[7]; /* SMP Pairing Request */
-        __u8            prsp[7]; /* SMP Pairing Response */
-        __u8            prnd[16]; /* SMP Pairing Random */
-        __u8            pcnf[16]; /* SMP Pairing Confirm */
-        __u8            tk[16]; /* SMP Temporary Key */
-        __u8            smp_key_size;
        struct timer_list security_timer;
+        struct smp_chan *smp_chan;
        struct list_head chan_l;
        rwlock_t        chan_lock;
@@ -454,7 +448,6 @@ enum {
 #define L2CAP_CONF_MAX_CONF_RSP 2
 enum {
-        CONN_SAR_SDU,
        CONN_SREJ_SENT,
        CONN_WAIT_F,
        CONN_SREJ_ACT,
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 5428fd32ccec..d66da0f94f95 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -211,6 +211,11 @@ struct mgmt_cp_unblock_device {
        bdaddr_t bdaddr;
 } __packed;
+#define MGMT_OP_SET_FAST_CONNECTABLE    0x001F
+struct mgmt_cp_set_fast_connectable {
+        __u8 enable;
+} __packed;
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
        __le16 opcode;
@@ -249,6 +254,7 @@ struct mgmt_ev_new_key {
 #define MGMT_EV_CONNECTED               0x000B
 struct mgmt_ev_connected {
        bdaddr_t bdaddr;
+        __u8 link_type;
 } __packed;
 #define MGMT_EV_DISCONNECTED            0x000C
@@ -301,3 +307,13 @@ struct mgmt_ev_remote_name {
 } __packed;
 #define MGMT_EV_DISCOVERING             0x0014
+#define MGMT_EV_DEVICE_BLOCKED          0x0015
+struct mgmt_ev_device_blocked {
+        bdaddr_t bdaddr;
+} __packed;
+#define MGMT_EV_DEVICE_UNBLOCKED        0x0016
+struct mgmt_ev_device_unblocked {
+        bdaddr_t bdaddr;
+} __packed;
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
index 46c457612300..15b97d549441 100644
--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -115,9 +115,26 @@ struct smp_cmd_security_req {
 #define SMP_MIN_ENC_KEY_SIZE            7
 #define SMP_MAX_ENC_KEY_SIZE            16
+struct smp_chan {
+        struct l2cap_conn *conn;
+        u8              preq[7]; /* SMP Pairing Request */
+        u8              prsp[7]; /* SMP Pairing Response */
+        u8              prnd[16]; /* SMP Pairing Random (local) */
+        u8              rrnd[16]; /* SMP Pairing Random (remote) */
+        u8              pcnf[16]; /* SMP Pairing Confirm */
+        u8              tk[16]; /* SMP Temporary Key */
+        u8              smp_key_size;
+        struct crypto_blkcipher *tfm;
+        struct work_struct confirm;
+        struct work_struct random;
+};
 /* SMP Commands */
 int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level);
 int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
 int smp_distribute_keys(struct l2cap_conn *conn, __u8 force);
+void smp_chan_destroy(struct l2cap_conn *conn);
 #endif /* __SMP_H */
diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
index c5dedd87b4cb..8d552519ff67 100644
--- a/include/net/caif/caif_hsi.h
+++ b/include/net/caif/caif_hsi.h
@@ -52,8 +52,9 @@ struct cfhsi_desc {
 /*
 * Maximum bytes transferred in one transfer.
 */
-/* TODO: 4096 is temporary... */
+#define CFHSI_MAX_CAIF_FRAME_SZ 4096
-#define CFHSI_MAX_PAYLOAD_SZ (CFHSI_MAX_PKTS * 4096)
+#define CFHSI_MAX_PAYLOAD_SZ (CFHSI_MAX_PKTS * CFHSI_MAX_CAIF_FRAME_SZ)
 /* Size of the complete HSI TX buffer. */
 #define CFHSI_BUF_SZ_TX (CFHSI_DESC_SZ + CFHSI_MAX_PAYLOAD_SZ)
@@ -75,18 +76,21 @@ struct cfhsi_desc {
 #define CFHSI_WAKE_UP_ACK                       1
 #define CFHSI_WAKE_DOWN_ACK                     2
 #define CFHSI_AWAKE                             3
-#define CFHSI_PENDING_RX                        4
+#define CFHSI_WAKELOCK_HELD                     4
-#define CFHSI_SHUTDOWN                          6
+#define CFHSI_SHUTDOWN                          5
-#define CFHSI_FLUSH_FIFO                        7
+#define CFHSI_FLUSH_FIFO                        6
 #ifndef CFHSI_INACTIVITY_TOUT
 #define CFHSI_INACTIVITY_TOUT                   (1 * HZ)
 #endif /* CFHSI_INACTIVITY_TOUT */
-#ifndef CFHSI_WAKEUP_TOUT
+#ifndef CFHSI_WAKE_TOUT
-#define CFHSI_WAKEUP_TOUT                       (3 * HZ)
+#define CFHSI_WAKE_TOUT                 (3 * HZ)
-#endif /* CFHSI_WAKEUP_TOUT */
+#endif /* CFHSI_WAKE_TOUT */
+#ifndef CFHSI_MAX_RX_RETRIES
+#define CFHSI_MAX_RX_RETRIES            (10 * HZ)
+#endif
 /* Structure implemented by the CAIF HSI driver. */
 struct cfhsi_drv {
@@ -104,11 +108,21 @@ struct cfhsi_dev {
        int (*cfhsi_rx) (u8 *ptr, int len, struct cfhsi_dev *dev);
        int (*cfhsi_wake_up) (struct cfhsi_dev *dev);
        int (*cfhsi_wake_down) (struct cfhsi_dev *dev);
+        int (*cfhsi_get_peer_wake) (struct cfhsi_dev *dev, bool *status);
        int (*cfhsi_fifo_occupancy)(struct cfhsi_dev *dev, size_t *occupancy);
        int (*cfhsi_rx_cancel)(struct cfhsi_dev *dev);
        struct cfhsi_drv *drv;
 };
+/* Structure holds status of received CAIF frames processing */
+struct cfhsi_rx_state {
+        int state;
+        int nfrms;
+        int pld_len;
+        int retries;
+        bool piggy_desc;
+};
 /* Structure implemented by CAIF HSI drivers. */
 struct cfhsi {
        struct caif_dev_common cfdev;
@@ -118,7 +132,8 @@ struct cfhsi {
        struct cfhsi_drv drv;
        struct cfhsi_dev *dev;
        int tx_state;
-        int rx_state;
+        struct cfhsi_rx_state rx_state;
+        unsigned long inactivity_timeout;
        int rx_len;
        u8 *rx_ptr;
        u8 *tx_buf;
@@ -130,13 +145,13 @@ struct cfhsi {
        struct list_head list;
        struct work_struct wake_up_work;
        struct work_struct wake_down_work;
-        struct work_struct rx_done_work;
+        struct work_struct out_of_sync_work;
-        struct work_struct tx_done_work;
        struct workqueue_struct *wq;
        wait_queue_head_t wake_up_wait;
        wait_queue_head_t wake_down_wait;
        wait_queue_head_t flush_fifo_wait;
        struct timer_list timer;
+        struct timer_list rx_slowpath_timer;
        unsigned long bits;
 };
diff --git a/include/net/cfg80211-wext.h b/include/net/cfg80211-wext.h
new file mode 100644
index 000000000000..25baddc4fbed
--- /dev/null
+++ b/include/net/cfg80211-wext.h
@@ -0,0 +1,55 @@
+#ifndef __NET_CFG80211_WEXT_H
+#define __NET_CFG80211_WEXT_H
+/*
+ * 802.11 device and configuration interface -- wext handlers
+ *
+ * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/netdevice.h>
+#include <linux/wireless.h>
+#include <net/iw_handler.h>
+/*
+ * Temporary wext handlers & helper functions
+ *
+ * These are used only by drivers that aren't yet fully
+ * converted to cfg80211.
+ */
+int cfg80211_wext_giwname(struct net_device *dev,
+                          struct iw_request_info *info,
+                          char *name, char *extra);
+int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
+                          u32 *mode, char *extra);
+int cfg80211_wext_giwmode(struct net_device *dev, struct iw_request_info *info,
+                          u32 *mode, char *extra);
+int cfg80211_wext_siwscan(struct net_device *dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *wrqu, char *extra);
+int cfg80211_wext_giwscan(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_point *data, char *extra);
+int cfg80211_wext_giwrange(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *extra);
+int cfg80211_wext_siwrts(struct net_device *dev,
+                         struct iw_request_info *info,
+                         struct iw_param *rts, char *extra);
+int cfg80211_wext_giwrts(struct net_device *dev,
+                         struct iw_request_info *info,
+                         struct iw_param *rts, char *extra);
+int cfg80211_wext_siwfrag(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *frag, char *extra);
+int cfg80211_wext_giwfrag(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *frag, char *extra);
+int cfg80211_wext_giwretry(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *retry, char *extra);
+#endif /* __NET_CFG80211_WEXT_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 401d73bd151f..92cf1c2c30c9 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -20,11 +20,6 @@
 #include <linux/ieee80211.h>
 #include <net/regulatory.h>
-/* remove once we remove the wext stuff */
-#include <net/iw_handler.h>
-#include <linux/wireless.h>
 /**
 * DOC: Introduction
 *
@@ -339,6 +334,36 @@ struct survey_info {
 };
 /**
+ * struct cfg80211_crypto_settings - Crypto settings
+ * @wpa_versions: indicates which, if any, WPA versions are enabled
+ *      (from enum nl80211_wpa_versions)
+ * @cipher_group: group key cipher suite (or 0 if unset)
+ * @n_ciphers_pairwise: number of AP supported unicast ciphers
+ * @ciphers_pairwise: unicast key cipher suites
+ * @n_akm_suites: number of AKM suites
+ * @akm_suites: AKM suites
+ * @control_port: Whether user space controls IEEE 802.1X port, i.e.,
+ *      sets/clears %NL80211_STA_FLAG_AUTHORIZED. If true, the driver is
+ *      required to assume that the port is unauthorized until authorized by
+ *      user space. Otherwise, port is marked authorized by default.
+ * @control_port_ethertype: the control port protocol that should be
+ *      allowed through even on unauthorized ports
+ * @control_port_no_encrypt: TRUE to prevent encryption of control port
+ *      protocol frames.
+ */
+struct cfg80211_crypto_settings {
+        u32 wpa_versions;
+        u32 cipher_group;
+        int n_ciphers_pairwise;
+        u32 ciphers_pairwise[NL80211_MAX_NR_CIPHER_SUITES];
+        int n_akm_suites;
+        u32 akm_suites[NL80211_MAX_NR_AKM_SUITES];
+        bool control_port;
+        __be16 control_port_ethertype;
+        bool control_port_no_encrypt;
+};
+/**
 * struct beacon_parameters - beacon parameters
 *
 * Used to configure the beacon for an interface.
@@ -351,11 +376,38 @@ struct survey_info {
 * @dtim_period: DTIM period or zero if not changed
 * @head_len: length of @head
 * @tail_len: length of @tail
+ * @ssid: SSID to be used in the BSS (note: may be %NULL if not provided from
+ *      user space)
+ * @ssid_len: length of @ssid
+ * @hidden_ssid: whether to hide the SSID in Beacon/Probe Response frames
+ * @crypto: crypto settings
+ * @privacy: the BSS uses privacy
+ * @auth_type: Authentication type (algorithm)
+ * @beacon_ies: extra information element(s) to add into Beacon frames or %NULL
+ * @beacon_ies_len: length of beacon_ies in octets
+ * @proberesp_ies: extra information element(s) to add into Probe Response
+ *      frames or %NULL
+ * @proberesp_ies_len: length of proberesp_ies in octets
+ * @assocresp_ies: extra information element(s) to add into (Re)Association
+ *      Response frames or %NULL
+ * @assocresp_ies_len: length of assocresp_ies in octets
 */
 struct beacon_parameters {
        u8 *head, *tail;
        int interval, dtim_period;
        int head_len, tail_len;
+        const u8 *ssid;
+        size_t ssid_len;
+        enum nl80211_hidden_ssid hidden_ssid;
+        struct cfg80211_crypto_settings crypto;
+        bool privacy;
+        enum nl80211_auth_type auth_type;
+        const u8 *beacon_ies;
+        size_t beacon_ies_len;
+        const u8 *proberesp_ies;
+        size_t proberesp_ies_len;
+        const u8 *assocresp_ies;
+        size_t assocresp_ies_len;
 };
 /**
@@ -372,6 +424,17 @@ enum plink_actions {
 };
 /**
+ * enum station_parameters_apply_mask - station parameter values to apply
+ * @STATION_PARAM_APPLY_UAPSD: apply new uAPSD parameters (uapsd_queues, max_sp)
+ *
+ * Not all station parameters have in-band "no change" signalling,
+ * for those that don't these flags will are used.
+ */
+enum station_parameters_apply_mask {
+        STATION_PARAM_APPLY_UAPSD = BIT(0),
+};
+/**
 * struct station_parameters - station parameters
 *
 * Used to change and create a new station.
@@ -389,17 +452,24 @@ enum plink_actions {
 * @plink_action: plink action to take
 * @plink_state: set the peer link state for a station
 * @ht_capa: HT capabilities of station
+ * @uapsd_queues: bitmap of queues configured for uapsd. same format
+ *      as the AC bitmap in the QoS info field
+ * @max_sp: max Service Period. same format as the MAX_SP in the
+ *      QoS info field (but already shifted down)
 */
 struct station_parameters {
        u8 *supported_rates;
        struct net_device *vlan;
        u32 sta_flags_mask, sta_flags_set;
+        u32 sta_modify_mask;
        int listen_interval;
        u16 aid;
        u8 supported_rates_len;
        u8 plink_action;
        u8 plink_state;
        struct ieee80211_ht_cap *ht_capa;
+        u8 uapsd_queues;
+        u8 max_sp;
 };
 /**
@@ -426,6 +496,8 @@ struct station_parameters {
 * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
 * @STATION_INFO_BSS_PARAM: @bss_param filled
 * @STATION_INFO_CONNECTED_TIME: @connected_time filled
+ * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
+ * @STATION_INFO_STA_FLAGS: @sta_flags filled
 */
 enum station_info_flags {
        STATION_INFO_INACTIVE_TIME      = 1<<0,
@@ -444,7 +516,9 @@ enum station_info_flags {
        STATION_INFO_SIGNAL_AVG         = 1<<13,
        STATION_INFO_RX_BITRATE         = 1<<14,
        STATION_INFO_BSS_PARAM          = 1<<15,
-        STATION_INFO_CONNECTED_TIME     = 1<<16
+        STATION_INFO_CONNECTED_TIME     = 1<<16,
+        STATION_INFO_ASSOC_REQ_IES      = 1<<17,
+        STATION_INFO_STA_FLAGS          = 1<<18
 };
 /**
@@ -536,6 +610,11 @@ struct sta_bss_parameters {
 *      This number should increase every time the list of stations
 *      changes, i.e. when a station is added or removed, so that
 *      userspace can tell whether it got a consistent snapshot.
+ * @assoc_req_ies: IEs from (Re)Association Request.
+ *      This is used only when in AP mode with drivers that do not use
+ *      user space MLME/SME implementation. The information is provided for
+ *      the cfg80211_new_sta() calls to notify user space of the IEs.
+ * @assoc_req_ies_len: Length of assoc_req_ies buffer in octets.
 */
 struct station_info {
        u32 filled;
@@ -556,8 +635,17 @@ struct station_info {
        u32 tx_failed;
        u32 rx_dropped_misc;
        struct sta_bss_parameters bss_param;
+        struct nl80211_sta_flag_update sta_flags;
        int generation;
+        const u8 *assoc_req_ies;
+        size_t assoc_req_ies_len;
+        /*
+         * Note: Add a new enum station_info_flags value for each new field and
+         * use it to check which fields are initialized.
+         */
 };
 /**
@@ -688,6 +776,12 @@ struct mesh_config {
        u16 dot11MeshHWMPpreqMinInterval;
        u16 dot11MeshHWMPnetDiameterTraversalTime;
        u8  dot11MeshHWMPRootMode;
+        u16 dot11MeshHWMPRannInterval;
+        /* This is missnamed in draft 12.0: dot11MeshGateAnnouncementProtocol
+         * set to true only means that the station will announce others it's a
+         * mesh gate, but not necessarily using the gate announcement protocol.
+         * Still keeping the same nomenclature to be in sync with the spec. */
+        bool  dot11MeshGateAnnouncementProtocol;
 };
 /**
@@ -781,6 +875,7 @@ struct cfg80211_ssid {
 * @wiphy: the wiphy this was for
 * @dev: the interface
 * @aborted: (internal) scan request was notified as aborted
+ * @no_cck: used to send probe requests at non CCK rate in 2GHz band
 */
 struct cfg80211_scan_request {
        struct cfg80211_ssid *ssids;
@@ -795,12 +890,22 @@ struct cfg80211_scan_request {
        struct wiphy *wiphy;
        struct net_device *dev;
        bool aborted;
+        bool no_cck;
        /* keep last */
        struct ieee80211_channel *channels[0];
 };
 /**
+ * struct cfg80211_match_set - sets of attributes to match
+ *
+ * @ssid: SSID to be matched
+ */
+struct cfg80211_match_set {
+        struct cfg80211_ssid ssid;
+};
+/**
 * struct cfg80211_sched_scan_request - scheduled scan request description
 *
 * @ssids: SSIDs to scan for (passed in the probe_reqs in active scans)
@@ -809,6 +914,11 @@ struct cfg80211_scan_request {
 * @interval: interval between each scheduled scan cycle
 * @ie: optional information element(s) to add into Probe Request or %NULL
 * @ie_len: length of ie in octets
+ * @match_sets: sets of parameters to be matched for a scan result
+ *      entry to be considered valid and to be passed to the host
+ *      (others are filtered out).
+ *      If ommited, all results are passed.
+ * @n_match_sets: number of match sets
 * @wiphy: the wiphy this was for
 * @dev: the interface
 * @channels: channels to scan
@@ -820,6 +930,8 @@ struct cfg80211_sched_scan_request {
        u32 interval;
        const u8 *ie;
        size_t ie_len;
+        struct cfg80211_match_set *match_sets;
+        int n_match_sets;
        /* internal */
        struct wiphy *wiphy;
@@ -896,36 +1008,6 @@ const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
 /**
- * struct cfg80211_crypto_settings - Crypto settings
- * @wpa_versions: indicates which, if any, WPA versions are enabled
- *      (from enum nl80211_wpa_versions)
- * @cipher_group: group key cipher suite (or 0 if unset)
- * @n_ciphers_pairwise: number of AP supported unicast ciphers
- * @ciphers_pairwise: unicast key cipher suites
- * @n_akm_suites: number of AKM suites
- * @akm_suites: AKM suites
- * @control_port: Whether user space controls IEEE 802.1X port, i.e.,
- *      sets/clears %NL80211_STA_FLAG_AUTHORIZED. If true, the driver is
- *      required to assume that the port is unauthorized until authorized by
- *      user space. Otherwise, port is marked authorized by default.
- * @control_port_ethertype: the control port protocol that should be
- *      allowed through even on unauthorized ports
- * @control_port_no_encrypt: TRUE to prevent encryption of control port
- *      protocol frames.
- */
-struct cfg80211_crypto_settings {
-        u32 wpa_versions;
-        u32 cipher_group;
-        int n_ciphers_pairwise;
-        u32 ciphers_pairwise[NL80211_MAX_NR_CIPHER_SUITES];
-        int n_akm_suites;
-        u32 akm_suites[NL80211_MAX_NR_AKM_SUITES];
-        bool control_port;
-        __be16 control_port_ethertype;
-        bool control_port_no_encrypt;
-};
-/**
 * struct cfg80211_auth_request - Authentication request data
 *
 * This structure provides information needed to complete IEEE 802.11
@@ -1343,6 +1425,9 @@ struct cfg80211_gtk_rekey_data {
 * @set_ringparam: Set tx and rx ring sizes.
 *
 * @get_ringparam: Get tx and rx ring current and maximum sizes.
+ *
+ * @tdls_mgmt: Transmit a TDLS management frame.
+ * @tdls_oper: Perform a high-level TDLS operation (e.g. TDLS link setup).
 */
 struct cfg80211_ops {
        int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -1419,7 +1504,7 @@ struct cfg80211_ops {
        int     (*change_bss)(struct wiphy *wiphy, struct net_device *dev,
                              struct bss_parameters *params);
-        int     (*set_txq_params)(struct wiphy *wiphy,
+        int     (*set_txq_params)(struct wiphy *wiphy, struct net_device *dev,
                                  struct ieee80211_txq_params *params);
        int     (*set_channel)(struct wiphy *wiphy, struct net_device *dev,
@@ -1495,7 +1580,8 @@ struct cfg80211_ops {
                          struct ieee80211_channel *chan, bool offchan,
                          enum nl80211_channel_type channel_type,
                          bool channel_type_valid, unsigned int wait,
-                          const u8 *buf, size_t len, u64 *cookie);
+                          const u8 *buf, size_t len, bool no_cck,
+                          u64 *cookie);
        int     (*mgmt_tx_cancel_wait)(struct wiphy *wiphy,
                                       struct net_device *dev,
                                       u64 cookie);
@@ -1525,6 +1611,12 @@ struct cfg80211_ops {
        int     (*set_rekey_data)(struct wiphy *wiphy, struct net_device *dev,
                                  struct cfg80211_gtk_rekey_data *data);
+        int     (*tdls_mgmt)(struct wiphy *wiphy, struct net_device *dev,
+                             u8 *peer, u8 action_code,  u8 dialog_token,
+                             u16 status_code, const u8 *buf, size_t len);
+        int     (*tdls_oper)(struct wiphy *wiphy, struct net_device *dev,
+                             u8 *peer, enum nl80211_tdls_operation oper);
 };
 /*
@@ -1574,6 +1666,15 @@ struct cfg80211_ops {
 * @WIPHY_FLAG_MESH_AUTH: The device supports mesh authentication by routing
 *      auth frames to userspace. See @NL80211_MESH_SETUP_USERSPACE_AUTH.
 * @WIPHY_FLAG_SUPPORTS_SCHED_SCAN: The device supports scheduled scans.
+ * @WIPHY_FLAG_SUPPORTS_FW_ROAM: The device supports roaming feature in the
+ *      firmware.
+ * @WIPHY_FLAG_AP_UAPSD: The device supports uapsd on AP.
+ * @WIPHY_FLAG_SUPPORTS_TDLS: The device supports TDLS (802.11z) operation.
+ * @WIPHY_FLAG_TDLS_EXTERNAL_SETUP: The device does not handle TDLS (802.11z)
+ *      link setup/discovery operations internally. Setup, discovery and
+ *      teardown packets should be sent through the @NL80211_CMD_TDLS_MGMT
+ *      command. When this flag is not set, @NL80211_CMD_TDLS_OPER should be
+ *      used for asking the driver/firmware to perform a TDLS operation.
 */
 enum wiphy_flags {
        WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
@@ -1588,6 +1689,10 @@ enum wiphy_flags {
        WIPHY_FLAG_MESH_AUTH                    = BIT(10),
        WIPHY_FLAG_SUPPORTS_SCHED_SCAN          = BIT(11),
        WIPHY_FLAG_ENFORCE_COMBINATIONS         = BIT(12),
+        WIPHY_FLAG_SUPPORTS_FW_ROAM             = BIT(13),
+        WIPHY_FLAG_AP_UAPSD                     = BIT(14),
+        WIPHY_FLAG_SUPPORTS_TDLS                = BIT(15),
+        WIPHY_FLAG_TDLS_EXTERNAL_SETUP          = BIT(16),
 };
 /**
@@ -1749,6 +1854,7 @@ struct wiphy_wowlan_support {
 * @debugfsdir: debugfs directory used for this wiphy, will be renamed
 *      automatically on wiphy renames
 * @dev: (virtual) struct device for this wiphy
+ * @registered: helps synchronize suspend/resume with wiphy unregister
 * @wext: wireless extension handlers
 * @priv: driver private data (sized according to wiphy_new() parameter)
 * @interface_modes: bitmask of interfaces types valid for this wiphy,
@@ -1765,6 +1871,9 @@ struct wiphy_wowlan_support {
 *      any given scan
 * @max_sched_scan_ssids: maximum number of SSIDs the device can scan
 *      for in any given scheduled scan
+ * @max_match_sets: maximum number of match sets the device can handle
+ *      when performing a scheduled scan, 0 if filtering is not
+ *      supported.
 * @max_scan_ie_len: maximum length of user-controlled IEs device can
 *      add to probe request frames transmitted during a scan, must not
 *      include fixed IEs like supported rates
@@ -1822,6 +1931,7 @@ struct wiphy {
        int bss_priv_size;
        u8 max_scan_ssids;
        u8 max_sched_scan_ssids;
+        u8 max_match_sets;
        u16 max_scan_ie_len;
        u16 max_sched_scan_ie_len;
@@ -2235,6 +2345,69 @@ extern int ieee80211_radiotap_iterator_next(
 extern const unsigned char rfc1042_header[6];
 extern const unsigned char bridge_tunnel_header[6];
+/* Parsed Information Elements */
+struct ieee802_11_elems {
+        u8 *ie_start;
+        size_t total_len;
+        /* pointers to IEs */
+        u8 *ssid;
+        u8 *supp_rates;
+        u8 *fh_params;
+        u8 *ds_params;
+        u8 *cf_params;
+        struct ieee80211_tim_ie *tim;
+        u8 *ibss_params;
+        u8 *challenge;
+        u8 *wpa;
+        u8 *rsn;
+        u8 *erp_info;
+        u8 *ext_supp_rates;
+        u8 *wmm_info;
+        u8 *wmm_param;
+        struct ieee80211_ht_cap *ht_cap_elem;
+        struct ieee80211_ht_info *ht_info_elem;
+        struct ieee80211_meshconf_ie *mesh_config;
+        u8 *mesh_id;
+        u8 *peering;
+        u8 *preq;
+        u8 *prep;
+        u8 *perr;
+        struct ieee80211_rann_ie *rann;
+        u8 *ch_switch_elem;
+        u8 *country_elem;
+        u8 *pwr_constr_elem;
+        u8 *quiet_elem; /* first quite element */
+        u8 *timeout_int;
+        /* length of them, respectively */
+        u8 ssid_len;
+        u8 supp_rates_len;
+        u8 fh_params_len;
+        u8 ds_params_len;
+        u8 cf_params_len;
+        u8 tim_len;
+        u8 ibss_params_len;
+        u8 challenge_len;
+        u8 wpa_len;
+        u8 rsn_len;
+        u8 erp_info_len;
+        u8 ext_supp_rates_len;
+        u8 wmm_info_len;
+        u8 wmm_param_len;
+        u8 mesh_id_len;
+        u8 peering_len;
+        u8 preq_len;
+        u8 prep_len;
+        u8 perr_len;
+        u8 ch_switch_elem_len;
+        u8 country_elem_len;
+        u8 pwr_constr_elem_len;
+        u8 quiet_elem_len;
+        u8 num_of_quiet_elem;   /* can be more the one */
+        u8 timeout_int_len;
+};
 /**
 * ieee80211_get_hdrlen_from_skb - get header length from data
 *
@@ -2324,6 +2497,24 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb);
 const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len);
 /**
+ * cfg80211_find_vendor_ie - find vendor specific information element in data
+ *
+ * @oui: vendor OUI
+ * @oui_type: vendor-specific OUI type
+ * @ies: data consisting of IEs
+ * @len: length of data
+ *
+ * This function will return %NULL if the vendor specific element ID
+ * could not be found or if the element is invalid (claims to be
+ * longer than the given data), or a pointer to the first byte
+ * of the requested element, that is the byte containing the
+ * element ID. There are no checks on the element length
+ * other than having to fit into the given data.
+ */
+const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
+                                  const u8 *ies, int len);
+/**
 * DOC: Regulatory enforcement infrastructure
 *
 * TODO
@@ -2398,113 +2589,6 @@ extern int freq_reg_info(struct wiphy *wiphy,
                         const struct ieee80211_reg_rule **reg_rule);
 /*
- * Temporary wext handlers & helper functions
- *
- * In the future cfg80211 will simply assign the entire wext handler
- * structure to netdevs it manages, but we're not there yet.
- */
-int cfg80211_wext_giwname(struct net_device *dev,
-                          struct iw_request_info *info,
-                          char *name, char *extra);
-int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
-                          u32 *mode, char *extra);
-int cfg80211_wext_giwmode(struct net_device *dev, struct iw_request_info *info,
-                          u32 *mode, char *extra);
-int cfg80211_wext_siwscan(struct net_device *dev,
-                          struct iw_request_info *info,
-                          union iwreq_data *wrqu, char *extra);
-int cfg80211_wext_giwscan(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_point *data, char *extra);
-int cfg80211_wext_siwmlme(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_point *data, char *extra);
-int cfg80211_wext_giwrange(struct net_device *dev,
-                           struct iw_request_info *info,
-                           struct iw_point *data, char *extra);
-int cfg80211_wext_siwgenie(struct net_device *dev,
-                           struct iw_request_info *info,
-                           struct iw_point *data, char *extra);
-int cfg80211_wext_siwauth(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_param *data, char *extra);
-int cfg80211_wext_giwauth(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_param *data, char *extra);
-int cfg80211_wext_siwfreq(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_freq *freq, char *extra);
-int cfg80211_wext_giwfreq(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_freq *freq, char *extra);
-int cfg80211_wext_siwessid(struct net_device *dev,
-                           struct iw_request_info *info,
-                           struct iw_point *data, char *ssid);
-int cfg80211_wext_giwessid(struct net_device *dev,
-                           struct iw_request_info *info,
-                           struct iw_point *data, char *ssid);
-int cfg80211_wext_siwrate(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_param *rate, char *extra);
-int cfg80211_wext_giwrate(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_param *rate, char *extra);
-int cfg80211_wext_siwrts(struct net_device *dev,
-                         struct iw_request_info *info,
-                         struct iw_param *rts, char *extra);
-int cfg80211_wext_giwrts(struct net_device *dev,
-                         struct iw_request_info *info,
-                         struct iw_param *rts, char *extra);
-int cfg80211_wext_siwfrag(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_param *frag, char *extra);
-int cfg80211_wext_giwfrag(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_param *frag, char *extra);
-int cfg80211_wext_siwretry(struct net_device *dev,
-                           struct iw_request_info *info,
-                           struct iw_param *retry, char *extra);
-int cfg80211_wext_giwretry(struct net_device *dev,
-                           struct iw_request_info *info,
-                           struct iw_param *retry, char *extra);
-int cfg80211_wext_siwencodeext(struct net_device *dev,
-                               struct iw_request_info *info,
-                               struct iw_point *erq, char *extra);
-int cfg80211_wext_siwencode(struct net_device *dev,
-                            struct iw_request_info *info,
-                            struct iw_point *erq, char *keybuf);
-int cfg80211_wext_giwencode(struct net_device *dev,
-                            struct iw_request_info *info,
-                            struct iw_point *erq, char *keybuf);
-int cfg80211_wext_siwtxpower(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *data, char *keybuf);
-int cfg80211_wext_giwtxpower(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *data, char *keybuf);
-struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev);
-int cfg80211_wext_siwpower(struct net_device *dev,
-                           struct iw_request_info *info,
-                           struct iw_param *wrq, char *extra);
-int cfg80211_wext_giwpower(struct net_device *dev,
-                           struct iw_request_info *info,
-                           struct iw_param *wrq, char *extra);
-int cfg80211_wext_siwap(struct net_device *dev,
-                        struct iw_request_info *info,
-                        struct sockaddr *ap_addr, char *extra);
-int cfg80211_wext_giwap(struct net_device *dev,
-                        struct iw_request_info *info,
-                        struct sockaddr *ap_addr, char *extra);
-int cfg80211_wext_siwpmksa(struct net_device *dev,
-                           struct iw_request_info *info,
-                           struct iw_point *data, char *extra);
-/*
 * callbacks for asynchronous cfg80211 methods, notification
 * functions and BSS handling helpers
 */
@@ -3090,6 +3174,17 @@ void cfg80211_cqm_pktloss_notify(struct net_device *dev,
 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
                               const u8 *replay_ctr, gfp_t gfp);
+/**
+ * cfg80211_pmksa_candidate_notify - notify about PMKSA caching candidate
+ * @dev: network device
+ * @index: candidate index (the smaller the index, the higher the priority)
+ * @bssid: BSSID of AP
+ * @preauth: Whether AP advertises support for RSN pre-authentication
+ * @gfp: allocation flags
+ */
+void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
+                                     const u8 *bssid, bool preauth, gfp_t gfp);
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/dcbevent.h b/include/net/dcbevent.h
index bc1e7ef40171..443626ed4cbc 100644
--- a/include/net/dcbevent.h
+++ b/include/net/dcbevent.h
@@ -24,8 +24,26 @@ enum dcbevent_notif_type {
        DCB_APP_EVENT = 1,
 };
+#ifdef CONFIG_DCB
 extern int register_dcbevent_notifier(struct notifier_block *nb);
 extern int unregister_dcbevent_notifier(struct notifier_block *nb);
 extern int call_dcbevent_notifiers(unsigned long val, void *v);
+#else
+static inline int
+register_dcbevent_notifier(struct notifier_block *nb)
+{
+        return 0;
+}
+static inline int unregister_dcbevent_notifier(struct notifier_block *nb)
+{
+        return 0;
+}
+static inline int call_dcbevent_notifiers(unsigned long val, void *v)
+{
+        return 0;
+}
+#endif /* CONFIG_DCB */
 #endif
diff --git a/include/net/dcbnl.h b/include/net/dcbnl.h
index f5aa39997f0b..2cd66d0be348 100644
--- a/include/net/dcbnl.h
+++ b/include/net/dcbnl.h
@@ -23,9 +23,10 @@
 #include <linux/dcbnl.h>
 struct dcb_app_type {
-        char              name[IFNAMSIZ];
+        int     ifindex;
        struct dcb_app    app;
        struct list_head  list;
+        u8      dcbx;
 };
 int dcb_setapp(struct net_device *, struct dcb_app *);
diff --git a/include/net/dst.h b/include/net/dst.h
index 13d507d69ddb..4fb6c4381791 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -325,7 +325,14 @@ static inline void skb_dst_force(struct sk_buff *skb)
 static inline void __skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
 {
        skb->dev = dev;
-        skb->rxhash = 0;
+        /*
+         * Clear rxhash so that we can recalulate the hash for the
+         * encapsulated packet, unless we have already determine the hash
+         * over the L4 4-tuple.
+         */
+        if (!skb->l4_rxhash)
+                skb->rxhash = 0;
        skb_set_queue_mapping(skb, 0);
        skb_dst_drop(skb);
        nf_reset(skb);
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index b0be5fb9de19..7e2c4d483ad0 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -251,6 +251,7 @@ enum ieee80211_radiotap_type {
                                                 * retries */
 #define IEEE80211_RADIOTAP_F_TX_CTS     0x0002  /* used cts 'protection' */
 #define IEEE80211_RADIOTAP_F_TX_RTS     0x0004  /* used rts/cts handshake */
+#define IEEE80211_RADIOTAP_F_TX_NOACK   0x0008  /* don't expect an ack */
 /* For IEEE80211_RADIOTAP_MCS */
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 11cf373970a9..51a7031b4aa3 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -41,6 +41,7 @@ struct inet6_ifaddr {
        struct in6_addr         addr;
        __u32                   prefix_len;
        
+        /* In seconds, relative to tstamp. Expiry is at tstamp + HZ * lft. */
        __u32                   valid_lft;
        __u32                   prefered_lft;
        atomic_t                refcnt;
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index 2fa8d1341a0a..2fa14691869c 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -30,6 +30,14 @@ static inline int INET_ECN_is_capable(__u8 dsfield)
        return dsfield & INET_ECN_ECT_0;
 }
+/*
+ * RFC 3168 9.1.1
+ *  The full-functionality option for ECN encapsulation is to copy the
+ *  ECN codepoint of the inside header to the outside header on
+ *  encapsulation if the inside header is not-ECT or ECT, and to set the
+ *  ECN codepoint of the outside header to ECT(0) if the ECN codepoint of
+ *  the inside header is CE.
+ */
 static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
 {
        outer &= ~INET_ECN_MASK;
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index f1a770977c4f..180231c5bbbe 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -126,7 +126,8 @@ struct inet_timewait_sock {
        /* And these are ours. */
        unsigned int            tw_ipv6only     : 1,
                                tw_transparent  : 1,
-                                tw_pad          : 14,   /* 14 bits hole */
+                                tw_pad          : 6,    /* 6 bits hole */
+                                tw_tos          : 8,
                                tw_ipv6_offset  : 16;
        kmemcheck_bitfield_end(flags);
        unsigned long           tw_ttd;
diff --git a/include/net/ip.h b/include/net/ip.h
index aa76c7a4d9c3..eca0ef7a495e 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -165,6 +165,7 @@ struct ip_reply_arg {
        int         csumoffset; /* u16 offset of csum in iov[0].iov_base */
                                /* -1 if not needed */ 
        int         bound_dev_if;
+        u8          tos;
 }; 
 #define IP_REPLY_ARG_NOSRCCHECK 1
@@ -175,7 +176,7 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
 }
 void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
-                   struct ip_reply_arg *arg, unsigned int len);
+                   const struct ip_reply_arg *arg, unsigned int len);
 struct ipv4_config {
        int     log_martians;
@@ -406,9 +407,18 @@ enum ip_defrag_users {
        IP_DEFRAG_VS_OUT,
        IP_DEFRAG_VS_FWD,
        IP_DEFRAG_AF_PACKET,
+        IP_DEFRAG_MACVLAN,
 };
 int ip_defrag(struct sk_buff *skb, u32 user);
+#ifdef CONFIG_INET
+struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user);
+#else
+static inline struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
+{
+        return skb;
+}
+#endif
 int ip_frag_mem(struct net *net);
 int ip_frag_nqueues(struct net *net);
diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
index f82a1e877372..f2419cf44cef 100644
--- a/include/net/iucv/af_iucv.h
+++ b/include/net/iucv/af_iucv.h
@@ -14,6 +14,7 @@
 #include <linux/list.h>
 #include <linux/poll.h>
 #include <linux/socket.h>
+#include <net/iucv/iucv.h>
 #ifndef AF_IUCV
 #define AF_IUCV         32
@@ -33,6 +34,7 @@ enum {
 };
 #define IUCV_QUEUELEN_DEFAULT   65535
+#define IUCV_HIPER_MSGLIM_DEFAULT       128
 #define IUCV_CONN_TIMEOUT       (HZ * 40)
 #define IUCV_DISCONN_TIMEOUT    (HZ * 2)
 #define IUCV_CONN_IDLE_TIMEOUT  (HZ * 60)
@@ -57,8 +59,51 @@ struct sock_msg_q {
        spinlock_t              lock;
 };
+#define AF_IUCV_FLAG_ACK 0x1
+#define AF_IUCV_FLAG_SYN 0x2
+#define AF_IUCV_FLAG_FIN 0x4
+#define AF_IUCV_FLAG_WIN 0x8
+struct af_iucv_trans_hdr {
+        u16 magic;
+        u8 version;
+        u8 flags;
+        u16 window;
+        char destNodeID[8];
+        char destUserID[8];
+        char destAppName[16];
+        char srcNodeID[8];
+        char srcUserID[8];
+        char srcAppName[16];             /* => 70 bytes */
+        struct iucv_message iucv_hdr;    /* => 33 bytes */
+        u8 pad;                          /* total 104 bytes */
+} __packed;
+enum iucv_tx_notify {
+        /* transmission of skb is completed and was successful */
+        TX_NOTIFY_OK = 0,
+        /* target is unreachable */
+        TX_NOTIFY_UNREACHABLE = 1,
+        /* transfer pending queue full */
+        TX_NOTIFY_TPQFULL = 2,
+        /* general error */
+        TX_NOTIFY_GENERALERROR = 3,
+        /* transmission of skb is pending - may interleave
+         * with TX_NOTIFY_DELAYED_* */
+        TX_NOTIFY_PENDING = 4,
+        /* transmission of skb was done successfully (delayed) */
+        TX_NOTIFY_DELAYED_OK = 5,
+        /* target unreachable (detected delayed) */
+        TX_NOTIFY_DELAYED_UNREACHABLE = 6,
+        /* general error (detected delayed) */
+        TX_NOTIFY_DELAYED_GENERALERROR = 7,
+};
 #define iucv_sk(__sk) ((struct iucv_sock *) __sk)
+#define AF_IUCV_TRANS_IUCV 0
+#define AF_IUCV_TRANS_HIPER 1
 struct iucv_sock {
        struct sock             sk;
        char                    src_user_id[8];
@@ -75,6 +120,13 @@ struct iucv_sock {
        unsigned int            send_tag;
        u8                      flags;
        u16                     msglimit;
+        u16                     msglimit_peer;
+        atomic_t                msg_sent;
+        atomic_t                msg_recv;
+        atomic_t                pendings;
+        int                     transport;
+        void                    (*sk_txnotify)(struct sk_buff *skb,
+                                               enum iucv_tx_notify n);
 };
 /* iucv socket options (SOL_IUCV) */
diff --git a/include/net/iucv/iucv.h b/include/net/iucv/iucv.h
index 1121baa9f695..0894ced31957 100644
--- a/include/net/iucv/iucv.h
+++ b/include/net/iucv/iucv.h
@@ -120,7 +120,7 @@ struct iucv_message {
        u32 reply_size;
        u8  rmmsg[8];
        u8  flags;
-};
+} __packed;
 /*
 * struct iucv_handler
@@ -459,3 +459,37 @@ int __iucv_message_send(struct iucv_path *path, struct iucv_message *msg,
 int iucv_message_send2way(struct iucv_path *path, struct iucv_message *msg,
                          u8 flags, u32 srccls, void *buffer, size_t size,
                          void *answer, size_t asize, size_t *residual);
+struct iucv_interface {
+        int (*message_receive)(struct iucv_path *path, struct iucv_message *msg,
+                u8 flags, void *buffer, size_t size, size_t *residual);
+        int (*__message_receive)(struct iucv_path *path,
+                struct iucv_message *msg, u8 flags, void *buffer, size_t size,
+                size_t *residual);
+        int (*message_reply)(struct iucv_path *path, struct iucv_message *msg,
+                u8 flags, void *reply, size_t size);
+        int (*message_reject)(struct iucv_path *path, struct iucv_message *msg);
+        int (*message_send)(struct iucv_path *path, struct iucv_message *msg,
+                u8 flags, u32 srccls, void *buffer, size_t size);
+        int (*__message_send)(struct iucv_path *path, struct iucv_message *msg,
+                u8 flags, u32 srccls, void *buffer, size_t size);
+        int (*message_send2way)(struct iucv_path *path,
+                struct iucv_message *msg, u8 flags, u32 srccls, void *buffer,
+                size_t size, void *answer, size_t asize, size_t *residual);
+        int (*message_purge)(struct iucv_path *path, struct iucv_message *msg,
+                u32 srccls);
+        int (*path_accept)(struct iucv_path *path, struct iucv_handler *handler,
+                u8 userdata[16], void *private);
+        int (*path_connect)(struct iucv_path *path,
+                struct iucv_handler *handler,
+                u8 userid[8], u8 system[8], u8 userdata[16], void *private);
+        int (*path_quiesce)(struct iucv_path *path, u8 userdata[16]);
+        int (*path_resume)(struct iucv_path *path, u8 userdata[16]);
+        int (*path_sever)(struct iucv_path *path, u8 userdata[16]);
+        int (*iucv_register)(struct iucv_handler *handler, int smp);
+        void (*iucv_unregister)(struct iucv_handler *handler, int smp);
+        struct bus_type *bus;
+        struct device *root;
+};
+extern struct iucv_interface iucv_if;
diff --git a/include/net/lapb.h b/include/net/lapb.h
index 96cb5ddaa9f1..fd2bf572ee1d 100644
--- a/include/net/lapb.h
+++ b/include/net/lapb.h
@@ -95,7 +95,7 @@ struct lapb_cb {
        struct sk_buff_head     write_queue;
        struct sk_buff_head     ack_queue;
        unsigned char           window;
-        struct lapb_register_struct callbacks;
+        const struct lapb_register_struct *callbacks;
        /* FRMR control information */
        struct lapb_frame       frmr_data;
diff --git a/include/net/lib80211.h b/include/net/lib80211.h
index b95bbb083ee8..2ec896bb72b2 100644
--- a/include/net/lib80211.h
+++ b/include/net/lib80211.h
@@ -117,10 +117,7 @@ void lib80211_crypt_info_free(struct lib80211_crypt_info *info);
 int lib80211_register_crypto_ops(struct lib80211_crypto_ops *ops);
 int lib80211_unregister_crypto_ops(struct lib80211_crypto_ops *ops);
 struct lib80211_crypto_ops *lib80211_get_crypto_ops(const char *name);
-void lib80211_crypt_deinit_entries(struct lib80211_crypt_info *, int);
-void lib80211_crypt_deinit_handler(unsigned long);
 void lib80211_crypt_delayed_deinit(struct lib80211_crypt_info *info,
                                    struct lib80211_crypt_data **crypt);
-void lib80211_crypt_quiescing(struct lib80211_crypt_info *info);
 #endif /* LIB80211_H */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 9259e97864d7..dc1123aa8181 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -16,7 +16,6 @@
 #include <linux/kernel.h>
 #include <linux/if_ether.h>
 #include <linux/skbuff.h>
-#include <linux/wireless.h>
 #include <linux/device.h>
 #include <linux/ieee80211.h>
 #include <net/cfg80211.h>
@@ -110,6 +109,7 @@ enum ieee80211_ac_numbers {
        IEEE80211_AC_BE         = 2,
        IEEE80211_AC_BK         = 3,
 };
+#define IEEE80211_NUM_ACS       4
 /**
 * struct ieee80211_tx_queue_params - transmit queue configuration
@@ -165,13 +165,14 @@ struct ieee80211_low_level_stats {
 * @BSS_CHANGED_QOS: QoS for this association was enabled/disabled. Note
 *      that it is only ever disabled for station mode.
 * @BSS_CHANGED_IDLE: Idle changed for this BSS/interface.
+ * @BSS_CHANGED_SSID: SSID changed for this BSS (AP mode)
 */
 enum ieee80211_bss_change {
        BSS_CHANGED_ASSOC               = 1<<0,
        BSS_CHANGED_ERP_CTS_PROT        = 1<<1,
        BSS_CHANGED_ERP_PREAMBLE        = 1<<2,
        BSS_CHANGED_ERP_SLOT            = 1<<3,
-        BSS_CHANGED_HT                  = 1<<4,
+        BSS_CHANGED_HT                  = 1<<4,
        BSS_CHANGED_BASIC_RATES         = 1<<5,
        BSS_CHANGED_BEACON_INT          = 1<<6,
        BSS_CHANGED_BSSID               = 1<<7,
@@ -182,6 +183,7 @@ enum ieee80211_bss_change {
        BSS_CHANGED_ARP_FILTER          = 1<<12,
        BSS_CHANGED_QOS                 = 1<<13,
        BSS_CHANGED_IDLE                = 1<<14,
+        BSS_CHANGED_SSID                = 1<<15,
        /* when adding here, make sure to change ieee80211_reconfig */
 };
@@ -255,6 +257,9 @@ enum ieee80211_rssi_event {
 * @idle: This interface is idle. There's also a global idle flag in the
 *      hardware config which may be more appropriate depending on what
 *      your driver/device needs to do.
+ * @ssid: The SSID of the current vif. Only valid in AP-mode.
+ * @ssid_len: Length of SSID given in @ssid.
+ * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
 */
 struct ieee80211_bss_conf {
        const u8 *bssid;
@@ -281,6 +286,9 @@ struct ieee80211_bss_conf {
        bool arp_filter_enabled;
        bool qos;
        bool idle;
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        size_t ssid_len;
+        bool hidden_ssid;
 };
 /**
@@ -331,9 +339,9 @@ struct ieee80211_bss_conf {
 *      used to indicate that a frame was already retried due to PS
 * @IEEE80211_TX_INTFL_DONT_ENCRYPT: completely internal to mac80211,
 *      used to indicate frame should not be encrypted
- * @IEEE80211_TX_CTL_PSPOLL_RESPONSE: (internal?)
+ * @IEEE80211_TX_CTL_POLL_RESPONSE: This frame is a response to a poll
- *      This frame is a response to a PS-poll frame and should be sent
+ *      frame (PS-Poll or uAPSD) and should be sent although the station
- *      although the station is in powersave mode.
+ *      is in powersave mode.
 * @IEEE80211_TX_CTL_MORE_FRAMES: More frames will be passed to the
 *      transmit function after the current frame, this can be used
 *      by drivers to kick the DMA queue only if unset or when the
@@ -341,8 +349,6 @@ struct ieee80211_bss_conf {
 * @IEEE80211_TX_INTFL_RETRANSMISSION: This frame is being retransmitted
 *      after TX status because the destination was asleep, it must not
 *      be modified again (no seqno assignment, crypto, etc.)
- * @IEEE80211_TX_INTFL_HAS_RADIOTAP: This frame was injected and still
- *      has a radiotap header at skb->data.
 * @IEEE80211_TX_INTFL_NL80211_FRAME_TX: Frame was requested through nl80211
 *      MLME command (internal to mac80211 to figure out whether to send TX
 *      status to user space)
@@ -356,6 +362,20 @@ struct ieee80211_bss_conf {
 * @IEEE80211_TX_INTFL_TKIP_MIC_FAILURE: Marks this packet to be used for TKIP
 *      testing. It will be sent out with incorrect Michael MIC key to allow
 *      TKIP countermeasures to be tested.
+ * @IEEE80211_TX_CTL_NO_CCK_RATE: This frame will be sent at non CCK rate.
+ *      This flag is actually used for management frame especially for P2P
+ *      frames not being sent at CCK rate in 2GHz band.
+ * @IEEE80211_TX_STATUS_EOSP: This packet marks the end of service period,
+ *      when its status is reported the service period ends. For frames in
+ *      an SP that mac80211 transmits, it is already set; for driver frames
+ *      the driver may set this flag. It is also used to do the same for
+ *      PS-Poll responses.
+ * @IEEE80211_TX_CTL_USE_MINRATE: This frame will be sent at lowest rate.
+ *      This flag is used to send nullfunc frame at minimum rate when
+ *      the nullfunc is used for connection monitoring purpose.
+ * @IEEE80211_TX_CTL_DONTFRAG: Don't fragment this packet even if it
+ *      would be fragmented by size (this is optional, only used for
+ *      monitor injection).
 *
 * Note: If you have to add new flags to the enumeration, then don't
 *       forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
@@ -377,15 +397,19 @@ enum mac80211_tx_control_flags {
        IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
        IEEE80211_TX_INTFL_RETRIED              = BIT(15),
        IEEE80211_TX_INTFL_DONT_ENCRYPT         = BIT(16),
-        IEEE80211_TX_CTL_PSPOLL_RESPONSE        = BIT(17),
+        IEEE80211_TX_CTL_POLL_RESPONSE          = BIT(17),
        IEEE80211_TX_CTL_MORE_FRAMES            = BIT(18),
        IEEE80211_TX_INTFL_RETRANSMISSION       = BIT(19),
-        IEEE80211_TX_INTFL_HAS_RADIOTAP         = BIT(20),
+        /* hole at 20, use later */
        IEEE80211_TX_INTFL_NL80211_FRAME_TX     = BIT(21),
        IEEE80211_TX_CTL_LDPC                   = BIT(22),
        IEEE80211_TX_CTL_STBC                   = BIT(23) | BIT(24),
        IEEE80211_TX_CTL_TX_OFFCHAN             = BIT(25),
        IEEE80211_TX_INTFL_TKIP_MIC_FAILURE     = BIT(26),
+        IEEE80211_TX_CTL_NO_CCK_RATE            = BIT(27),
+        IEEE80211_TX_STATUS_EOSP                = BIT(28),
+        IEEE80211_TX_CTL_USE_MINRATE            = BIT(29),
+        IEEE80211_TX_CTL_DONTFRAG               = BIT(30),
 };
 #define IEEE80211_TX_CTL_STBC_SHIFT             23
@@ -399,9 +423,9 @@ enum mac80211_tx_control_flags {
        IEEE80211_TX_CTL_SEND_AFTER_DTIM | IEEE80211_TX_CTL_AMPDU |           \
        IEEE80211_TX_STAT_TX_FILTERED | IEEE80211_TX_STAT_ACK |               \
        IEEE80211_TX_STAT_AMPDU | IEEE80211_TX_STAT_AMPDU_NO_BACK |           \
-        IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_PSPOLL_RESPONSE | \
+        IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_POLL_RESPONSE |   \
        IEEE80211_TX_CTL_MORE_FRAMES | IEEE80211_TX_CTL_LDPC |                \
-        IEEE80211_TX_CTL_STBC)
+        IEEE80211_TX_CTL_STBC | IEEE80211_TX_STATUS_EOSP)
 /**
 * enum mac80211_rate_control_flags - per-rate flags set by the
@@ -948,6 +972,9 @@ enum set_key_cmd {
 * @wme: indicates whether the STA supports WME. Only valid during AP-mode.
 * @drv_priv: data area for driver use, will always be aligned to
 *      sizeof(void *), size is determined in hw information.
+ * @uapsd_queues: bitmap of queues configured for uapsd. Only valid
+ *      if wme is supported.
+ * @max_sp: max Service Period. Only valid if wme is supported.
 */
 struct ieee80211_sta {
        u32 supp_rates[IEEE80211_NUM_BANDS];
@@ -955,6 +982,8 @@ struct ieee80211_sta {
        u16 aid;
        struct ieee80211_sta_ht_cap ht_cap;
        bool wme;
+        u8 uapsd_queues;
+        u8 max_sp;
        /* must be last */
        u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
@@ -1095,6 +1124,10 @@ enum sta_notify_cmd {
 *      stations based on the PM bit of incoming frames.
 *      Use ieee80211_start_ps()/ieee8021_end_ps() to manually configure
 *      the PS mode of connected stations.
+ *
+ * @IEEE80211_HW_TX_AMPDU_SETUP_IN_HW: The device handles TX A-MPDU session
+ *      setup strictly in HW. mac80211 should not attempt to do this in
+ *      software.
 */
 enum ieee80211_hw_flags {
        IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1120,6 +1153,7 @@ enum ieee80211_hw_flags {
        IEEE80211_HW_SUPPORTS_CQM_RSSI                  = 1<<20,
        IEEE80211_HW_SUPPORTS_PER_STA_GTK               = 1<<21,
        IEEE80211_HW_AP_LINK_PS                         = 1<<22,
+        IEEE80211_HW_TX_AMPDU_SETUP_IN_HW               = 1<<23,
 };
 /**
@@ -1511,6 +1545,95 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
 */
 /**
+ * DOC: AP support for powersaving clients
+ *
+ * In order to implement AP and P2P GO modes, mac80211 has support for
+ * client powersaving, both "legacy" PS (PS-Poll/null data) and uAPSD.
+ * There currently is no support for sAPSD.
+ *
+ * There is one assumption that mac80211 makes, namely that a client
+ * will not poll with PS-Poll and trigger with uAPSD at the same time.
+ * Both are supported, and both can be used by the same client, but
+ * they can't be used concurrently by the same client. This simplifies
+ * the driver code.
+ *
+ * The first thing to keep in mind is that there is a flag for complete
+ * driver implementation: %IEEE80211_HW_AP_LINK_PS. If this flag is set,
+ * mac80211 expects the driver to handle most of the state machine for
+ * powersaving clients and will ignore the PM bit in incoming frames.
+ * Drivers then use ieee80211_sta_ps_transition() to inform mac80211 of
+ * stations' powersave transitions. In this mode, mac80211 also doesn't
+ * handle PS-Poll/uAPSD.
+ *
+ * In the mode without %IEEE80211_HW_AP_LINK_PS, mac80211 will check the
+ * PM bit in incoming frames for client powersave transitions. When a
+ * station goes to sleep, we will stop transmitting to it. There is,
+ * however, a race condition: a station might go to sleep while there is
+ * data buffered on hardware queues. If the device has support for this
+ * it will reject frames, and the driver should give the frames back to
+ * mac80211 with the %IEEE80211_TX_STAT_TX_FILTERED flag set which will
+ * cause mac80211 to retry the frame when the station wakes up. The
+ * driver is also notified of powersave transitions by calling its
+ * @sta_notify callback.
+ *
+ * When the station is asleep, it has three choices: it can wake up,
+ * it can PS-Poll, or it can possibly start a uAPSD service period.
+ * Waking up is implemented by simply transmitting all buffered (and
+ * filtered) frames to the station. This is the easiest case. When
+ * the station sends a PS-Poll or a uAPSD trigger frame, mac80211
+ * will inform the driver of this with the @allow_buffered_frames
+ * callback; this callback is optional. mac80211 will then transmit
+ * the frames as usual and set the %IEEE80211_TX_CTL_POLL_RESPONSE
+ * on each frame. The last frame in the service period (or the only
+ * response to a PS-Poll) also has %IEEE80211_TX_STATUS_EOSP set to
+ * indicate that it ends the service period; as this frame must have
+ * TX status report it also sets %IEEE80211_TX_CTL_REQ_TX_STATUS.
+ * When TX status is reported for this frame, the service period is
+ * marked has having ended and a new one can be started by the peer.
+ *
+ * Another race condition can happen on some devices like iwlwifi
+ * when there are frames queued for the station and it wakes up
+ * or polls; the frames that are already queued could end up being
+ * transmitted first instead, causing reordering and/or wrong
+ * processing of the EOSP. The cause is that allowing frames to be
+ * transmitted to a certain station is out-of-band communication to
+ * the device. To allow this problem to be solved, the driver can
+ * call ieee80211_sta_block_awake() if frames are buffered when it
+ * is notified that the station went to sleep. When all these frames
+ * have been filtered (see above), it must call the function again
+ * to indicate that the station is no longer blocked.
+ *
+ * If the driver buffers frames in the driver for aggregation in any
+ * way, it must use the ieee80211_sta_set_buffered() call when it is
+ * notified of the station going to sleep to inform mac80211 of any
+ * TIDs that have frames buffered. Note that when a station wakes up
+ * this information is reset (hence the requirement to call it when
+ * informed of the station going to sleep). Then, when a service
+ * period starts for any reason, @release_buffered_frames is called
+ * with the number of frames to be released and which TIDs they are
+ * to come from. In this case, the driver is responsible for setting
+ * the EOSP (for uAPSD) and MORE_DATA bits in the released frames,
+ * to help the @more_data paramter is passed to tell the driver if
+ * there is more data on other TIDs -- the TIDs to release frames
+ * from are ignored since mac80211 doesn't know how many frames the
+ * buffers for those TIDs contain.
+ *
+ * If the driver also implement GO mode, where absence periods may
+ * shorten service periods (or abort PS-Poll responses), it must
+ * filter those response frames except in the case of frames that
+ * are buffered in the driver -- those must remain buffered to avoid
+ * reordering. Because it is possible that no frames are released
+ * in this case, the driver must call ieee80211_sta_eosp_irqsafe()
+ * to indicate to mac80211 that the service period ended anyway.
+ *
+ * Finally, if frames from multiple TIDs are released from mac80211
+ * but the driver might reorder them, it must clear & set the flags
+ * appropriately (only the last frame may have %IEEE80211_TX_STATUS_EOSP)
+ * and also take care of the EOSP and MORE_DATA bits in the frame.
+ * The driver may also use ieee80211_sta_eosp_irqsafe() in this case.
+ */
+/**
 * enum ieee80211_filter_flags - hardware filter flags
 *
 * These flags determine what the filter in hardware should be
@@ -1600,6 +1723,17 @@ enum ieee80211_tx_sync_type {
 };
 /**
+ * enum ieee80211_frame_release_type - frame release reason
+ * @IEEE80211_FRAME_RELEASE_PSPOLL: frame released for PS-Poll
+ * @IEEE80211_FRAME_RELEASE_UAPSD: frame(s) released due to
+ *      frame received on trigger-enabled AC
+ */
+enum ieee80211_frame_release_type {
+        IEEE80211_FRAME_RELEASE_PSPOLL,
+        IEEE80211_FRAME_RELEASE_UAPSD,
+};
+/**
 * struct ieee80211_ops - callbacks from mac80211 to the driver
 *
 * This structure contains various callbacks that the driver may
@@ -1896,11 +2030,6 @@ enum ieee80211_tx_sync_type {
 *      ieee80211_remain_on_channel_expired(). This callback may sleep.
 * @cancel_remain_on_channel: Requests that an ongoing off-channel period is
 *      aborted before it expires. This callback may sleep.
- * @offchannel_tx: Transmit frame on another channel, wait for a response
- *      and return. Reliable TX status must be reported for the frame. If the
- *      return value is 1, then the @remain_on_channel will be used with a
- *      regular transmission (if supported.)
- * @offchannel_tx_cancel_wait: cancel wait associated with offchannel TX
 *
 * @set_ringparam: Set tx and rx ring sizes.
 *
@@ -1914,6 +2043,45 @@ enum ieee80211_tx_sync_type {
 *      The callback can sleep.
 * @rssi_callback: Notify driver when the average RSSI goes above/below
 *      thresholds that were registered previously. The callback can sleep.
+ *
+ * @release_buffered_frames: Release buffered frames according to the given
+ *      parameters. In the case where the driver buffers some frames for
+ *      sleeping stations mac80211 will use this callback to tell the driver
+ *      to release some frames, either for PS-poll or uAPSD.
+ *      Note that if the @more_data paramter is %false the driver must check
+ *      if there are more frames on the given TIDs, and if there are more than
+ *      the frames being released then it must still set the more-data bit in
+ *      the frame. If the @more_data parameter is %true, then of course the
+ *      more-data bit must always be set.
+ *      The @tids parameter tells the driver which TIDs to release frames
+ *      from, for PS-poll it will always have only a single bit set.
+ *      In the case this is used for a PS-poll initiated release, the
+ *      @num_frames parameter will always be 1 so code can be shared. In
+ *      this case the driver must also set %IEEE80211_TX_STATUS_EOSP flag
+ *      on the TX status (and must report TX status) so that the PS-poll
+ *      period is properly ended. This is used to avoid sending multiple
+ *      responses for a retried PS-poll frame.
+ *      In the case this is used for uAPSD, the @num_frames parameter may be
+ *      bigger than one, but the driver may send fewer frames (it must send
+ *      at least one, however). In this case it is also responsible for
+ *      setting the EOSP flag in the QoS header of the frames. Also, when the
+ *      service period ends, the driver must set %IEEE80211_TX_STATUS_EOSP
+ *      on the last frame in the SP. Alternatively, it may call the function
+ *      ieee80211_sta_eosp_irqsafe() to inform mac80211 of the end of the SP.
+ *      This callback must be atomic.
+ * @allow_buffered_frames: Prepare device to allow the given number of frames
+ *      to go out to the given station. The frames will be sent by mac80211
+ *      via the usual TX path after this call. The TX information for frames
+ *      released will also have the %IEEE80211_TX_CTL_POLL_RESPONSE flag set
+ *      and the last one will also have %IEEE80211_TX_STATUS_EOSP set. In case
+ *      frames from multiple TIDs are released and the driver might reorder
+ *      them between the TIDs, it must set the %IEEE80211_TX_STATUS_EOSP flag
+ *      on the last frame and clear it on all others and also handle the EOSP
+ *      bit in the QoS header correctly. Alternatively, it can also call the
+ *      ieee80211_sta_eosp_irqsafe() function.
+ *      The @tids parameter is a bitmap and tells the driver which TIDs the
+ *      frames will be on; it will at most have two bits set.
+ *      This callback must be atomic.
 */
 struct ieee80211_ops {
        void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1986,11 +2154,13 @@ struct ieee80211_ops {
                          struct ieee80211_sta *sta);
        void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        enum sta_notify_cmd, struct ieee80211_sta *sta);
-        int (*conf_tx)(struct ieee80211_hw *hw, u16 queue,
+        int (*conf_tx)(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif, u16 queue,
                       const struct ieee80211_tx_queue_params *params);
-        u64 (*get_tsf)(struct ieee80211_hw *hw);
+        u64 (*get_tsf)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
-        void (*set_tsf)(struct ieee80211_hw *hw, u64 tsf);
+        void (*set_tsf)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-        void (*reset_tsf)(struct ieee80211_hw *hw);
+                        u64 tsf);
+        void (*reset_tsf)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
        int (*tx_last_beacon)(struct ieee80211_hw *hw);
        int (*ampdu_action)(struct ieee80211_hw *hw,
                            struct ieee80211_vif *vif,
@@ -2019,11 +2189,6 @@ struct ieee80211_ops {
                                 enum nl80211_channel_type channel_type,
                                 int duration);
        int (*cancel_remain_on_channel)(struct ieee80211_hw *hw);
-        int (*offchannel_tx)(struct ieee80211_hw *hw, struct sk_buff *skb,
-                             struct ieee80211_channel *chan,
-                             enum nl80211_channel_type channel_type,
-                             unsigned int wait);
-        int (*offchannel_tx_cancel_wait)(struct ieee80211_hw *hw);
        int (*set_ringparam)(struct ieee80211_hw *hw, u32 tx, u32 rx);
        void (*get_ringparam)(struct ieee80211_hw *hw,
                              u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max);
@@ -2032,6 +2197,17 @@ struct ieee80211_ops {
                                const struct cfg80211_bitrate_mask *mask);
        void (*rssi_callback)(struct ieee80211_hw *hw,
                              enum ieee80211_rssi_event rssi_event);
+        void (*allow_buffered_frames)(struct ieee80211_hw *hw,
+                                      struct ieee80211_sta *sta,
+                                      u16 tids, int num_frames,
+                                      enum ieee80211_frame_release_type reason,
+                                      bool more_data);
+        void (*release_buffered_frames)(struct ieee80211_hw *hw,
+                                        struct ieee80211_sta *sta,
+                                        u16 tids, int num_frames,
+                                        enum ieee80211_frame_release_type reason,
+                                        bool more_data);
 };
 /**
@@ -2346,20 +2522,38 @@ static inline int ieee80211_sta_ps_transition_ni(struct ieee80211_sta *sta,
 * The TX headroom reserved by mac80211 for its own tx_status functions.
 * This is enough for the radiotap header.
 */
-#define IEEE80211_TX_STATUS_HEADROOM    13
+#define IEEE80211_TX_STATUS_HEADROOM    14
 /**
- * ieee80211_sta_set_tim - set the TIM bit for a sleeping station
+ * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames
 * @sta: &struct ieee80211_sta pointer for the sleeping station
+ * @tid: the TID that has buffered frames
+ * @buffered: indicates whether or not frames are buffered for this TID
 *
 * If a driver buffers frames for a powersave station instead of passing
- * them back to mac80211 for retransmission, the station needs to be told
+ * them back to mac80211 for retransmission, the station may still need
- * to wake up using the TIM bitmap in the beacon.
+ * to be told that there are buffered frames via the TIM bit.
 *
- * This function sets the station's TIM bit - it will be cleared when the
+ * This function informs mac80211 whether or not there are frames that are
- * station wakes up.
+ * buffered in the driver for a given TID; mac80211 can then use this data
+ * to set the TIM bit (NOTE: This may call back into the driver's set_tim
+ * call! Beware of the locking!)
+ *
+ * If all frames are released to the station (due to PS-poll or uAPSD)
+ * then the driver needs to inform mac80211 that there no longer are
+ * frames buffered. However, when the station wakes up mac80211 assumes
+ * that all buffered frames will be transmitted and clears this data,
+ * drivers need to make sure they inform mac80211 about all buffered
+ * frames on the sleep transition (sta_notify() with %STA_NOTIFY_SLEEP).
+ *
+ * Note that technically mac80211 only needs to know this per AC, not per
+ * TID, but since driver buffering will inevitably happen per TID (since
+ * it is related to aggregation) it is easier to make mac80211 map the
+ * TID to the AC as required instead of keeping track in all drivers that
+ * use this API.
 */
-void ieee80211_sta_set_tim(struct ieee80211_sta *sta);
+void ieee80211_sta_set_buffered(struct ieee80211_sta *sta,
+                                u8 tid, bool buffered);
 /**
 * ieee80211_tx_status - transmit status callback
@@ -3017,6 +3211,24 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
                               struct ieee80211_sta *pubsta, bool block);
 /**
+ * ieee80211_sta_eosp - notify mac80211 about end of SP
+ * @pubsta: the station
+ *
+ * When a device transmits frames in a way that it can't tell
+ * mac80211 in the TX status about the EOSP, it must clear the
+ * %IEEE80211_TX_STATUS_EOSP bit and call this function instead.
+ * This applies for PS-Poll as well as uAPSD.
+ *
+ * Note that there is no non-_irqsafe version right now as
+ * it wasn't needed, but just like _tx_status() and _rx()
+ * must not be mixed in irqsafe/non-irqsafe versions, this
+ * function must not be mixed with those either. Use the
+ * all irqsafe, or all non-irqsafe, don't mix! If you need
+ * the non-irqsafe version of this, you need to add it.
+ */
+void ieee80211_sta_eosp_irqsafe(struct ieee80211_sta *pubsta);
+/**
 * ieee80211_iter_keys - iterate keys programmed into the device
 * @hw: pointer obtained from ieee80211_alloc_hw()
 * @vif: virtual interface to iterate, may be %NULL for all
@@ -3229,6 +3441,19 @@ void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw);
 void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
                                  const u8 *addr);
+/**
+ * ieee80211_send_bar - send a BlockAckReq frame
+ *
+ * can be used to flush pending frames from the peer's aggregation reorder
+ * buffer.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @ra: the peer's destination address
+ * @tid: the TID of the aggregation session
+ * @ssn: the new starting sequence number for the receiver
+ */
+void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn);
 /* Rate control API */
 /**
@@ -3419,4 +3644,9 @@ void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
                                   int rssi_max_thold);
 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif);
+int ieee80211_add_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb);
+int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif,
+                                struct sk_buff *skb);
 #endif /* MAC80211_H */
diff --git a/include/net/nfc/nci.h b/include/net/nfc/nci.h
new file mode 100644
index 000000000000..39b85bc0804f
--- /dev/null
+++ b/include/net/nfc/nci.h
@@ -0,0 +1,313 @@
+/*
+ *  The NFC Controller Interface is the communication protocol between an
+ *  NFC Controller (NFCC) and a Device Host (DH).
+ *
+ *  Copyright (C) 2011 Texas Instruments, Inc.
+ *
+ *  Written by Ilan Elias <ilane@ti.com>
+ *
+ *  Acknowledgements:
+ *  This file is based on hci.h, which was written
+ *  by Maxim Krasnyansky.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2
+ *  as published by the Free Software Foundation
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+#ifndef __NCI_H
+#define __NCI_H
+/* NCI constants */
+#define NCI_MAX_NUM_MAPPING_CONFIGS                             10
+#define NCI_MAX_NUM_RF_CONFIGS                                  10
+#define NCI_MAX_NUM_CONN                                        10
+/* NCI Status Codes */
+#define NCI_STATUS_OK                                           0x00
+#define NCI_STATUS_REJECTED                                     0x01
+#define NCI_STATUS_MESSAGE_CORRUPTED                            0x02
+#define NCI_STATUS_BUFFER_FULL                                  0x03
+#define NCI_STATUS_FAILED                                       0x04
+#define NCI_STATUS_NOT_INITIALIZED                              0x05
+#define NCI_STATUS_SYNTAX_ERROR                                 0x06
+#define NCI_STATUS_SEMANTIC_ERROR                               0x07
+#define NCI_STATUS_UNKNOWN_GID                                  0x08
+#define NCI_STATUS_UNKNOWN_OID                                  0x09
+#define NCI_STATUS_INVALID_PARAM                                0x0a
+#define NCI_STATUS_MESSAGE_SIZE_EXCEEDED                        0x0b
+/* Discovery Specific Status Codes */
+#define NCI_STATUS_DISCOVERY_ALREADY_STARTED                    0xa0
+#define NCI_STATUS_DISCOVERY_TARGET_ACTIVATION_FAILED           0xa1
+/* RF Interface Specific Status Codes */
+#define NCI_STATUS_RF_TRANSMISSION_ERROR                        0xb0
+#define NCI_STATUS_RF_PROTOCOL_ERROR                            0xb1
+#define NCI_STATUS_RF_TIMEOUT_ERROR                             0xb2
+#define NCI_STATUS_RF_LINK_LOSS_ERROR                           0xb3
+/* NFCEE Interface Specific Status Codes */
+#define NCI_STATUS_MAX_ACTIVE_NFCEE_INTERFACES_REACHED          0xc0
+#define NCI_STATUS_NFCEE_INTERFACE_ACTIVATION_FAILED            0xc1
+#define NCI_STATUS_NFCEE_TRANSMISSION_ERROR                     0xc2
+#define NCI_STATUS_NFCEE_PROTOCOL_ERROR                         0xc3
+#define NCI_STATUS_NFCEE_TIMEOUT_ERROR                          0xc4
+/* NCI RF Technology and Mode */
+#define NCI_NFC_A_PASSIVE_POLL_MODE                             0x00
+#define NCI_NFC_B_PASSIVE_POLL_MODE                             0x01
+#define NCI_NFC_F_PASSIVE_POLL_MODE                             0x02
+#define NCI_NFC_A_ACTIVE_POLL_MODE                              0x03
+#define NCI_NFC_F_ACTIVE_POLL_MODE                              0x05
+#define NCI_NFC_A_PASSIVE_LISTEN_MODE                           0x80
+#define NCI_NFC_B_PASSIVE_LISTEN_MODE                           0x81
+#define NCI_NFC_F_PASSIVE_LISTEN_MODE                           0x82
+#define NCI_NFC_A_ACTIVE_LISTEN_MODE                            0x83
+#define NCI_NFC_F_ACTIVE_LISTEN_MODE                            0x85
+/* NCI RF Protocols */
+#define NCI_RF_PROTOCOL_UNKNOWN                                 0x00
+#define NCI_RF_PROTOCOL_T1T                                     0x01
+#define NCI_RF_PROTOCOL_T2T                                     0x02
+#define NCI_RF_PROTOCOL_T3T                                     0x03
+#define NCI_RF_PROTOCOL_ISO_DEP                                 0x04
+#define NCI_RF_PROTOCOL_NFC_DEP                                 0x05
+/* NCI RF Interfaces */
+#define NCI_RF_INTERFACE_RFU                                    0x00
+#define NCI_RF_INTERFACE_FRAME                                  0x01
+#define NCI_RF_INTERFACE_ISO_DEP                                0x02
+#define NCI_RF_INTERFACE_NFC_DEP                                0x03
+/* NCI RF_DISCOVER_MAP_CMD modes */
+#define NCI_DISC_MAP_MODE_POLL                                  0x01
+#define NCI_DISC_MAP_MODE_LISTEN                                0x02
+#define NCI_DISC_MAP_MODE_BOTH                                  0x03
+/* NCI Discovery Types */
+#define NCI_DISCOVERY_TYPE_POLL_A_PASSIVE                       0x00
+#define NCI_DISCOVERY_TYPE_POLL_B_PASSIVE                       0x01
+#define NCI_DISCOVERY_TYPE_POLL_F_PASSIVE                       0x02
+#define NCI_DISCOVERY_TYPE_POLL_A_ACTIVE                        0x03
+#define NCI_DISCOVERY_TYPE_POLL_F_ACTIVE                        0x05
+#define NCI_DISCOVERY_TYPE_WAKEUP_A_PASSIVE                     0x06
+#define NCI_DISCOVERY_TYPE_WAKEUP_B_PASSIVE                     0x07
+#define NCI_DISCOVERY_TYPE_WAKEUP_A_ACTIVE                      0x09
+#define NCI_DISCOVERY_TYPE_LISTEN_A_PASSIVE                     0x80
+#define NCI_DISCOVERY_TYPE_LISTEN_B_PASSIVE                     0x81
+#define NCI_DISCOVERY_TYPE_LISTEN_F_PASSIVE                     0x82
+#define NCI_DISCOVERY_TYPE_LISTEN_A_ACTIVE                      0x83
+#define NCI_DISCOVERY_TYPE_LISTEN_F_ACTIVE                      0x85
+/* NCI Deactivation Type */
+#define NCI_DEACTIVATE_TYPE_IDLE_MODE                           0x00
+#define NCI_DEACTIVATE_TYPE_SLEEP_MODE                          0x01
+#define NCI_DEACTIVATE_TYPE_SLEEP_AF_MODE                       0x02
+#define NCI_DEACTIVATE_TYPE_RF_LINK_LOSS                        0x03
+#define NCI_DEACTIVATE_TYPE_DISCOVERY_ERROR                     0x04
+/* Message Type (MT) */
+#define NCI_MT_DATA_PKT                                         0x00
+#define NCI_MT_CMD_PKT                                          0x01
+#define NCI_MT_RSP_PKT                                          0x02
+#define NCI_MT_NTF_PKT                                          0x03
+#define nci_mt(hdr)                     (((hdr)[0]>>5)&0x07)
+#define nci_mt_set(hdr, mt)             ((hdr)[0] |= (__u8)(((mt)&0x07)<<5))
+/* Packet Boundary Flag (PBF) */
+#define NCI_PBF_LAST                                            0x00
+#define NCI_PBF_CONT                                            0x01
+#define nci_pbf(hdr)                    (__u8)(((hdr)[0]>>4)&0x01)
+#define nci_pbf_set(hdr, pbf)           ((hdr)[0] |= (__u8)(((pbf)&0x01)<<4))
+/* Control Opcode manipulation */
+#define nci_opcode_pack(gid, oid)       (__u16)((((__u16)((gid)&0x0f))<<8)|\
+                                        ((__u16)((oid)&0x3f)))
+#define nci_opcode(hdr)                 nci_opcode_pack(hdr[0], hdr[1])
+#define nci_opcode_gid(op)              (__u8)(((op)&0x0f00)>>8)
+#define nci_opcode_oid(op)              (__u8)((op)&0x003f)
+/* Payload Length */
+#define nci_plen(hdr)                   (__u8)((hdr)[2])
+/* Connection ID */
+#define nci_conn_id(hdr)                (__u8)(((hdr)[0])&0x0f)
+/* GID values */
+#define NCI_GID_CORE                                            0x0
+#define NCI_GID_RF_MGMT                                         0x1
+#define NCI_GID_NFCEE_MGMT                                      0x2
+#define NCI_GID_PROPRIETARY                                     0xf
+/* ---- NCI Packet structures ---- */
+#define NCI_CTRL_HDR_SIZE                                       3
+#define NCI_DATA_HDR_SIZE                                       3
+struct nci_ctrl_hdr {
+        __u8    gid;            /* MT & PBF & GID */
+        __u8    oid;
+        __u8    plen;
+} __packed;
+struct nci_data_hdr {
+        __u8    conn_id;        /* MT & PBF & ConnID */
+        __u8    rfu;
+        __u8    plen;
+} __packed;
+/* ------------------------ */
+/* -----  NCI Commands ---- */
+/* ------------------------ */
+#define NCI_OP_CORE_RESET_CMD           nci_opcode_pack(NCI_GID_CORE, 0x00)
+#define NCI_OP_CORE_INIT_CMD            nci_opcode_pack(NCI_GID_CORE, 0x01)
+#define NCI_OP_CORE_SET_CONFIG_CMD      nci_opcode_pack(NCI_GID_CORE, 0x02)
+#define NCI_OP_CORE_CONN_CREATE_CMD     nci_opcode_pack(NCI_GID_CORE, 0x04)
+struct nci_core_conn_create_cmd {
+        __u8    target_handle;
+        __u8    num_target_specific_params;
+} __packed;
+#define NCI_OP_CORE_CONN_CLOSE_CMD      nci_opcode_pack(NCI_GID_CORE, 0x06)
+#define NCI_OP_RF_DISCOVER_MAP_CMD      nci_opcode_pack(NCI_GID_RF_MGMT, 0x00)
+struct disc_map_config {
+        __u8    rf_protocol;
+        __u8    mode;
+        __u8    rf_interface_type;
+} __packed;
+struct nci_rf_disc_map_cmd {
+        __u8                            num_mapping_configs;
+        struct disc_map_config          mapping_configs
+                                        [NCI_MAX_NUM_MAPPING_CONFIGS];
+} __packed;
+#define NCI_OP_RF_DISCOVER_CMD          nci_opcode_pack(NCI_GID_RF_MGMT, 0x03)
+struct disc_config {
+        __u8    type;
+        __u8    frequency;
+} __packed;
+struct nci_rf_disc_cmd {
+        __u8                            num_disc_configs;
+        struct disc_config              disc_configs[NCI_MAX_NUM_RF_CONFIGS];
+} __packed;
+#define NCI_OP_RF_DEACTIVATE_CMD        nci_opcode_pack(NCI_GID_RF_MGMT, 0x06)
+struct nci_rf_deactivate_cmd {
+        __u8    type;
+} __packed;
+/* ----------------------- */
+/* ---- NCI Responses ---- */
+/* ----------------------- */
+#define NCI_OP_CORE_RESET_RSP           nci_opcode_pack(NCI_GID_CORE, 0x00)
+struct nci_core_reset_rsp {
+        __u8    status;
+        __u8    nci_ver;
+} __packed;
+#define NCI_OP_CORE_INIT_RSP            nci_opcode_pack(NCI_GID_CORE, 0x01)
+struct nci_core_init_rsp_1 {
+        __u8    status;
+        __le32  nfcc_features;
+        __u8    num_supported_rf_interfaces;
+        __u8    supported_rf_interfaces[0];     /* variable size array */
+        /* continuted in nci_core_init_rsp_2 */
+} __packed;
+struct nci_core_init_rsp_2 {
+        __u8    max_logical_connections;
+        __le16  max_routing_table_size;
+        __u8    max_control_packet_payload_length;
+        __le16  rf_sending_buffer_size;
+        __le16  rf_receiving_buffer_size;
+        __le16  manufacturer_id;
+} __packed;
+#define NCI_OP_CORE_SET_CONFIG_RSP      nci_opcode_pack(NCI_GID_CORE, 0x02)
+#define NCI_OP_CORE_CONN_CREATE_RSP     nci_opcode_pack(NCI_GID_CORE, 0x04)
+struct nci_core_conn_create_rsp {
+        __u8    status;
+        __u8    max_pkt_payload_size;
+        __u8    initial_num_credits;
+        __u8    conn_id;
+} __packed;
+#define NCI_OP_CORE_CONN_CLOSE_RSP      nci_opcode_pack(NCI_GID_CORE, 0x06)
+#define NCI_OP_RF_DISCOVER_MAP_RSP      nci_opcode_pack(NCI_GID_RF_MGMT, 0x00)
+#define NCI_OP_RF_DISCOVER_RSP          nci_opcode_pack(NCI_GID_RF_MGMT, 0x03)
+#define NCI_OP_RF_DEACTIVATE_RSP        nci_opcode_pack(NCI_GID_RF_MGMT, 0x06)
+/* --------------------------- */
+/* ---- NCI Notifications ---- */
+/* --------------------------- */
+#define NCI_OP_CORE_CONN_CREDITS_NTF    nci_opcode_pack(NCI_GID_CORE, 0x07)
+struct conn_credit_entry {
+        __u8    conn_id;
+        __u8    credits;
+} __packed;
+struct nci_core_conn_credit_ntf {
+        __u8                            num_entries;
+        struct conn_credit_entry        conn_entries[NCI_MAX_NUM_CONN];
+} __packed;
+#define NCI_OP_RF_FIELD_INFO_NTF        nci_opcode_pack(NCI_GID_CORE, 0x08)
+struct nci_rf_field_info_ntf {
+        __u8    rf_field_status;
+} __packed;
+#define NCI_OP_RF_ACTIVATE_NTF          nci_opcode_pack(NCI_GID_RF_MGMT, 0x05)
+struct rf_tech_specific_params_nfca_poll {
+        __u16   sens_res;
+        __u8    nfcid1_len;     /* 0, 4, 7, or 10 Bytes */
+        __u8    nfcid1[10];
+        __u8    sel_res_len;    /* 0 or 1 Bytes */
+        __u8    sel_res;
+} __packed;
+struct activation_params_nfca_poll_iso_dep {
+        __u8    rats_res_len;
+        __u8    rats_res[20];
+};
+struct nci_rf_activate_ntf {
+        __u8    target_handle;
+        __u8    rf_protocol;
+        __u8    rf_tech_and_mode;
+        __u8    rf_tech_specific_params_len;
+        union {
+                struct rf_tech_specific_params_nfca_poll nfca_poll;
+        } rf_tech_specific_params;
+        __u8    rf_interface_type;
+        __u8    activation_params_len;
+        union {
+                struct activation_params_nfca_poll_iso_dep nfca_poll_iso_dep;
+        } activation_params;
+} __packed;
+#define NCI_OP_RF_DEACTIVATE_NTF        nci_opcode_pack(NCI_GID_RF_MGMT, 0x06)
+#endif /* __NCI_H */
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
new file mode 100644
index 000000000000..b8b4bbd7e0fc
--- /dev/null
+++ b/include/net/nfc/nci_core.h
@@ -0,0 +1,184 @@
+/*
+ *  The NFC Controller Interface is the communication protocol between an
+ *  NFC Controller (NFCC) and a Device Host (DH).
+ *
+ *  Copyright (C) 2011 Texas Instruments, Inc.
+ *
+ *  Written by Ilan Elias <ilane@ti.com>
+ *
+ *  Acknowledgements:
+ *  This file is based on hci_core.h, which was written
+ *  by Maxim Krasnyansky.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2
+ *  as published by the Free Software Foundation
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+#ifndef __NCI_CORE_H
+#define __NCI_CORE_H
+#include <linux/interrupt.h>
+#include <linux/skbuff.h>
+#include <net/nfc/nfc.h>
+#include <net/nfc/nci.h>
+/* NCI device state */
+enum {
+        NCI_INIT,
+        NCI_UP,
+        NCI_DISCOVERY,
+        NCI_POLL_ACTIVE,
+        NCI_DATA_EXCHANGE,
+};
+/* NCI timeouts */
+#define NCI_RESET_TIMEOUT                       5000
+#define NCI_INIT_TIMEOUT                        5000
+#define NCI_RF_DISC_TIMEOUT                     5000
+#define NCI_RF_DEACTIVATE_TIMEOUT               5000
+#define NCI_CMD_TIMEOUT                         5000
+struct nci_dev;
+struct nci_ops {
+        int (*open)(struct nci_dev *ndev);
+        int (*close)(struct nci_dev *ndev);
+        int (*send)(struct sk_buff *skb);
+};
+#define NCI_MAX_SUPPORTED_RF_INTERFACES         4
+/* NCI Core structures */
+struct nci_dev {
+        struct nfc_dev          *nfc_dev;
+        struct nci_ops          *ops;
+        int                     tx_headroom;
+        int                     tx_tailroom;
+        unsigned long           flags;
+        atomic_t                cmd_cnt;
+        atomic_t                credits_cnt;
+        struct timer_list       cmd_timer;
+        struct workqueue_struct *cmd_wq;
+        struct work_struct      cmd_work;
+        struct workqueue_struct *rx_wq;
+        struct work_struct      rx_work;
+        struct workqueue_struct *tx_wq;
+        struct work_struct      tx_work;
+        struct sk_buff_head     cmd_q;
+        struct sk_buff_head     rx_q;
+        struct sk_buff_head     tx_q;
+        struct mutex            req_lock;
+        struct completion       req_completion;
+        __u32                   req_status;
+        __u32                   req_result;
+        void                    *driver_data;
+        __u32                   poll_prots;
+        __u32                   target_available_prots;
+        __u32                   target_active_prot;
+        /* received during NCI_OP_CORE_RESET_RSP */
+        __u8                    nci_ver;
+        /* received during NCI_OP_CORE_INIT_RSP */
+        __u32                   nfcc_features;
+        __u8                    num_supported_rf_interfaces;
+        __u8                    supported_rf_interfaces
+                                [NCI_MAX_SUPPORTED_RF_INTERFACES];
+        __u8                    max_logical_connections;
+        __u16                   max_routing_table_size;
+        __u8                    max_control_packet_payload_length;
+        __u16                   rf_sending_buffer_size;
+        __u16                   rf_receiving_buffer_size;
+        __u16                   manufacturer_id;
+        /* received during NCI_OP_CORE_CONN_CREATE_RSP for static conn 0 */
+        __u8                    max_pkt_payload_size;
+        __u8                    initial_num_credits;
+        __u8                    conn_id;
+        /* stored during nci_data_exchange */
+        data_exchange_cb_t      data_exchange_cb;
+        void                    *data_exchange_cb_context;
+        struct sk_buff          *rx_data_reassembly;
+};
+/* ----- NCI Devices ----- */
+struct nci_dev *nci_allocate_device(struct nci_ops *ops,
+                                __u32 supported_protocols,
+                                int tx_headroom,
+                                int tx_tailroom);
+void nci_free_device(struct nci_dev *ndev);
+int nci_register_device(struct nci_dev *ndev);
+void nci_unregister_device(struct nci_dev *ndev);
+int nci_recv_frame(struct sk_buff *skb);
+static inline struct sk_buff *nci_skb_alloc(struct nci_dev *ndev,
+                                                unsigned int len,
+                                                gfp_t how)
+{
+        struct sk_buff *skb;
+        skb = alloc_skb(len + ndev->tx_headroom + ndev->tx_tailroom, how);
+        if (skb)
+                skb_reserve(skb, ndev->tx_headroom);
+        return skb;
+}
+static inline void nci_set_parent_dev(struct nci_dev *ndev, struct device *dev)
+{
+        nfc_set_parent_dev(ndev->nfc_dev, dev);
+}
+static inline void nci_set_drvdata(struct nci_dev *ndev, void *data)
+{
+        ndev->driver_data = data;
+}
+static inline void *nci_get_drvdata(struct nci_dev *ndev)
+{
+        return ndev->driver_data;
+}
+void nci_rsp_packet(struct nci_dev *ndev, struct sk_buff *skb);
+void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb);
+void nci_rx_data_packet(struct nci_dev *ndev, struct sk_buff *skb);
+int nci_send_cmd(struct nci_dev *ndev, __u16 opcode, __u8 plen, void *payload);
+int nci_send_data(struct nci_dev *ndev, __u8 conn_id, struct sk_buff *skb);
+void nci_data_exchange_complete(struct nci_dev *ndev, struct sk_buff *skb,
+                                int err);
+/* ----- NCI requests ----- */
+#define NCI_REQ_DONE            0
+#define NCI_REQ_PEND            1
+#define NCI_REQ_CANCELED        2
+void nci_req_complete(struct nci_dev *ndev, int result);
+/* ----- NCI status code ----- */
+int nci_to_errno(__u8 code);
+#endif /* __NCI_CORE_H */
diff --git a/include/net/nfc.h b/include/net/nfc/nfc.h
index cc0130312f70..6a7f602aa841 100644
--- a/include/net/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -48,6 +48,8 @@ typedef void (*data_exchange_cb_t)(void *context, struct sk_buff *skb,
                                                                int err);
 struct nfc_ops {
+        int (*dev_up)(struct nfc_dev *dev);
+        int (*dev_down)(struct nfc_dev *dev);
        int (*start_poll)(struct nfc_dev *dev, u32 protocols);
        void (*stop_poll)(struct nfc_dev *dev);
        int (*activate_target)(struct nfc_dev *dev, u32 target_idx,
@@ -78,10 +80,15 @@ struct nfc_dev {
        int targets_generation;
        spinlock_t targets_lock;
        struct device dev;
+        bool dev_up;
        bool polling;
+        bool remote_activated;
        struct nfc_genl_data genl_data;
        u32 supported_protocols;
+        int tx_headroom;
+        int tx_tailroom;
        struct nfc_ops *ops;
 };
 #define to_nfc_dev(_dev) container_of(_dev, struct nfc_dev, dev)
@@ -89,7 +96,9 @@ struct nfc_dev {
 extern struct class nfc_class;
 struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
-                                        u32 supported_protocols);
+                                        u32 supported_protocols,
+                                        int tx_headroom,
+                                        int tx_tailroom);
 /**
 * nfc_free_device - free nfc device
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 356d6e3dc20a..eb7d3c2d4274 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -3,11 +3,19 @@
 /*
 * regulatory support structures
 *
- * Copyright 2008-2009  Luis R. Rodriguez <lrodriguez@atheros.com>
+ * Copyright 2008-2009  Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
 *
- * This program is free software; you can redistribute it and/or modify
+ * Permission to use, copy, modify, and/or distribute this software for any
- * it under the terms of the GNU General Public License version 2 as
+ * purpose with or without fee is hereby granted, provided that the above
- * published by the Free Software Foundation.
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 4fc88f3ccd5f..2eb207ea4eaf 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -46,14 +46,14 @@ struct qdisc_size_table {
 struct Qdisc {
        int                     (*enqueue)(struct sk_buff *skb, struct Qdisc *dev);
        struct sk_buff *        (*dequeue)(struct Qdisc *dev);
-        unsigned                flags;
+        unsigned int            flags;
 #define TCQ_F_BUILTIN           1
 #define TCQ_F_INGRESS           2
 #define TCQ_F_CAN_BYPASS        4
 #define TCQ_F_MQROOT            8
 #define TCQ_F_WARN_NONWC        (1 << 16)
        int                     padded;
-        struct Qdisc_ops        *ops;
+        const struct Qdisc_ops  *ops;
        struct qdisc_size_table __rcu *stab;
        struct list_head        list;
        u32                     handle;
@@ -224,7 +224,7 @@ struct qdisc_skb_cb {
        long                    data[];
 };
-static inline int qdisc_qlen(struct Qdisc *q)
+static inline int qdisc_qlen(const struct Qdisc *q)
 {
        return q->q.qlen;
 }
@@ -239,12 +239,12 @@ static inline spinlock_t *qdisc_lock(struct Qdisc *qdisc)
        return &qdisc->q.lock;
 }
-static inline struct Qdisc *qdisc_root(struct Qdisc *qdisc)
+static inline struct Qdisc *qdisc_root(const struct Qdisc *qdisc)
 {
        return qdisc->dev_queue->qdisc;
 }
-static inline struct Qdisc *qdisc_root_sleeping(struct Qdisc *qdisc)
+static inline struct Qdisc *qdisc_root_sleeping(const struct Qdisc *qdisc)
 {
        return qdisc->dev_queue->qdisc_sleeping;
 }
@@ -260,7 +260,7 @@ static inline struct Qdisc *qdisc_root_sleeping(struct Qdisc *qdisc)
 * root.  This is enforced by holding the RTNL semaphore, which
 * all users of this lock accessor must do.
 */
-static inline spinlock_t *qdisc_root_lock(struct Qdisc *qdisc)
+static inline spinlock_t *qdisc_root_lock(const struct Qdisc *qdisc)
 {
        struct Qdisc *root = qdisc_root(qdisc);
@@ -268,7 +268,7 @@ static inline spinlock_t *qdisc_root_lock(struct Qdisc *qdisc)
        return qdisc_lock(root);
 }
-static inline spinlock_t *qdisc_root_sleeping_lock(struct Qdisc *qdisc)
+static inline spinlock_t *qdisc_root_sleeping_lock(const struct Qdisc *qdisc)
 {
        struct Qdisc *root = qdisc_root_sleeping(qdisc);
@@ -276,17 +276,17 @@ static inline spinlock_t *qdisc_root_sleeping_lock(struct Qdisc *qdisc)
        return qdisc_lock(root);
 }
-static inline struct net_device *qdisc_dev(struct Qdisc *qdisc)
+static inline struct net_device *qdisc_dev(const struct Qdisc *qdisc)
 {
        return qdisc->dev_queue->dev;
 }
-static inline void sch_tree_lock(struct Qdisc *q)
+static inline void sch_tree_lock(const struct Qdisc *q)
 {
        spin_lock_bh(qdisc_root_sleeping_lock(q));
 }
-static inline void sch_tree_unlock(struct Qdisc *q)
+static inline void sch_tree_unlock(const struct Qdisc *q)
 {
        spin_unlock_bh(qdisc_root_sleeping_lock(q));
 }
@@ -319,7 +319,7 @@ static inline unsigned int qdisc_class_hash(u32 id, u32 mask)
 }
 static inline struct Qdisc_class_common *
-qdisc_class_find(struct Qdisc_class_hash *hash, u32 id)
+qdisc_class_find(const struct Qdisc_class_hash *hash, u32 id)
 {
        struct Qdisc_class_common *cl;
        struct hlist_node *n;
@@ -393,7 +393,7 @@ static inline bool qdisc_all_tx_empty(const struct net_device *dev)
 }
 /* Are any of the TX qdiscs changing?  */
-static inline bool qdisc_tx_changing(struct net_device *dev)
+static inline bool qdisc_tx_changing(const struct net_device *dev)
 {
        unsigned int i;
        for (i = 0; i < dev->num_tx_queues; i++) {
diff --git a/include/net/scm.h b/include/net/scm.h
index 745460fa2f02..d456f4c71a32 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -49,7 +49,7 @@ static __inline__ void scm_set_cred(struct scm_cookie *scm,
                                    struct pid *pid, const struct cred *cred)
 {
        scm->pid  = get_pid(pid);
-        scm->cred = get_cred(cred);
+        scm->cred = cred ? get_cred(cred) : NULL;
        cred_to_ucred(pid, cred, &scm->creds);
 }
@@ -73,8 +73,7 @@ static __inline__ void scm_destroy(struct scm_cookie *scm)
 static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
                               struct scm_cookie *scm)
 {
-        scm_set_cred(scm, task_tgid(current), current_cred());
+        memset(scm, 0, sizeof(*scm));
-        scm->fp = NULL;
        unix_get_peersec_dgram(sock, scm);
        if (msg->msg_controllen <= 0)
                return 0;
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index f7d9c3fc06fd..e90e7a9935dd 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1915,6 +1915,7 @@ struct sctp_association {
        __u32 addip_serial;
        union sctp_addr *asconf_addr_del_pending;
        int src_out_of_asoc_ok;
+        struct sctp_transport *new_transport;
        /* SCTP AUTH: list of the endpoint shared keys.  These
         * keys are provided out of band by the user applicaton
diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
index d97f6892c019..c2e542b27a5a 100644
--- a/include/net/secure_seq.h
+++ b/include/net/secure_seq.h
@@ -10,7 +10,7 @@ extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
                                      __be16 dport);
 extern __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
                                        __be16 sport, __be16 dport);
-extern __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
+extern __u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
                                          __be16 sport, __be16 dport);
 extern u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
                                       __be16 sport, __be16 dport);
diff --git a/include/net/sock.h b/include/net/sock.h
index 8e4062f165b8..5ac682f73d63 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -686,16 +686,25 @@ static inline void sock_rps_reset_flow(const struct sock *sk)
 #endif
 }
-static inline void sock_rps_save_rxhash(struct sock *sk, u32 rxhash)
+static inline void sock_rps_save_rxhash(struct sock *sk,
+                                        const struct sk_buff *skb)
 {
 #ifdef CONFIG_RPS
-        if (unlikely(sk->sk_rxhash != rxhash)) {
+        if (unlikely(sk->sk_rxhash != skb->rxhash)) {
                sock_rps_reset_flow(sk);
-                sk->sk_rxhash = rxhash;
+                sk->sk_rxhash = skb->rxhash;
        }
 #endif
 }
+static inline void sock_rps_reset_rxhash(struct sock *sk)
+{
+#ifdef CONFIG_RPS
+        sock_rps_reset_flow(sk);
+        sk->sk_rxhash = 0;
+#endif
+}
 #define sk_wait_event(__sk, __timeo, __condition)                       \
        ({      int __rc;                                               \
                release_sock(__sk);                                     \
diff --git a/include/net/tcp.h b/include/net/tcp.h
index acc620a4a45f..e147f42d643d 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -18,7 +18,6 @@
 #ifndef _TCP_H
 #define _TCP_H
-#define TCP_DEBUG 1
 #define FASTRETRANS_DEBUG 1
 #include <linux/list.h>
@@ -327,9 +326,9 @@ extern int tcp_sendpage(struct sock *sk, struct page *page, int offset,
                        size_t size, int flags);
 extern int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 extern int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
-                                 struct tcphdr *th, unsigned len);
+                                 const struct tcphdr *th, unsigned int len);
 extern int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                               struct tcphdr *th, unsigned len);
+                               const struct tcphdr *th, unsigned int len);
 extern void tcp_rcv_space_adjust(struct sock *sk);
 extern void tcp_cleanup_rbuf(struct sock *sk, int copied);
 extern int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp);
@@ -356,6 +355,7 @@ static inline void tcp_dec_quickack_mode(struct sock *sk,
 #define TCP_ECN_OK              1
 #define TCP_ECN_QUEUE_CWR       2
 #define TCP_ECN_DEMAND_CWR      4
+#define TCP_ECN_SEEN            8
 static __inline__ void
 TCP_ECN_create_request(struct request_sock *req, struct tcphdr *th)
@@ -400,10 +400,10 @@ extern void tcp_set_keepalive(struct sock *sk, int val);
 extern void tcp_syn_ack_timeout(struct sock *sk, struct request_sock *req);
 extern int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                       size_t len, int nonblock, int flags, int *addr_len);
-extern void tcp_parse_options(struct sk_buff *skb,
+extern void tcp_parse_options(const struct sk_buff *skb,
-                              struct tcp_options_received *opt_rx, u8 **hvpp,
+                              struct tcp_options_received *opt_rx, const u8 **hvpp,
                              int estab);
-extern u8 *tcp_parse_md5sig_option(struct tcphdr *th);
+extern const u8 *tcp_parse_md5sig_option(const struct tcphdr *th);
 /*
 *      TCP v4 functions exported for the inet6 API
@@ -449,7 +449,7 @@ extern bool cookie_check_timestamp(struct tcp_options_received *opt, bool *);
 /* From net/ipv6/syncookies.c */
 extern struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb);
 #ifdef CONFIG_SYN_COOKIES
-extern __u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb,
+extern __u32 cookie_v6_init_sequence(struct sock *sk, const struct sk_buff *skb,
                                     __u16 *mss);
 #else
 static inline __u32 cookie_v6_init_sequence(struct sock *sk,
@@ -521,7 +521,7 @@ static inline int tcp_bound_to_half_wnd(struct tcp_sock *tp, int pktsize)
 }
 /* tcp.c */
-extern void tcp_get_info(struct sock *, struct tcp_info *);
+extern void tcp_get_info(const struct sock *, struct tcp_info *);
 /* Read 'sendfile()'-style from a TCP socket */
 typedef int (*sk_read_actor_t)(read_descriptor_t *, struct sk_buff *,
@@ -531,8 +531,8 @@ extern int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
 extern void tcp_initialize_rcv_mss(struct sock *sk);
-extern int tcp_mtu_to_mss(struct sock *sk, int pmtu);
+extern int tcp_mtu_to_mss(const struct sock *sk, int pmtu);
-extern int tcp_mss_to_mtu(struct sock *sk, int mss);
+extern int tcp_mss_to_mtu(const struct sock *sk, int mss);
 extern void tcp_mtup_init(struct sock *sk);
 extern void tcp_valid_rtt_meas(struct sock *sk, u32 seq_rtt);
@@ -573,7 +573,7 @@ static inline void tcp_fast_path_check(struct sock *sk)
 /* Compute the actual rto_min value */
 static inline u32 tcp_rto_min(struct sock *sk)
 {
-        struct dst_entry *dst = __sk_dst_get(sk);
+        const struct dst_entry *dst = __sk_dst_get(sk);
        u32 rto_min = TCP_RTO_MIN;
        if (dst && dst_metric_locked(dst, RTAX_RTO_MIN))
@@ -635,13 +635,14 @@ struct tcp_skb_cb {
        __u32           seq;            /* Starting sequence number     */
        __u32           end_seq;        /* SEQ + FIN + SYN + datalen    */
        __u32           when;           /* used to compute rtt's        */
-        __u8            flags;          /* TCP header flags.            */
+        __u8            tcp_flags;      /* TCP header flags. (tcp[13])  */
        __u8            sacked;         /* State flags for SACK/FACK.   */
 #define TCPCB_SACKED_ACKED      0x01    /* SKB ACK'd by a SACK block    */
 #define TCPCB_SACKED_RETRANS    0x02    /* SKB retransmitted            */
 #define TCPCB_LOST              0x04    /* SKB is lost                  */
 #define TCPCB_TAGBITS           0x07    /* All tag bits                 */
+        __u8            ip_dsfield;     /* IPv4 tos or IPv6 dsfield     */
+        /* 1 byte hole */
 #define TCPCB_EVER_RETRANS      0x80    /* Ever retransmitted frame     */
 #define TCPCB_RETRANS           (TCPCB_SACKED_RETRANS|TCPCB_EVER_RETRANS)
@@ -818,6 +819,7 @@ static inline bool tcp_in_initial_slowstart(const struct tcp_sock *tp)
 static inline __u32 tcp_current_ssthresh(const struct sock *sk)
 {
        const struct tcp_sock *tp = tcp_sk(sk);
        if ((1 << inet_csk(sk)->icsk_ca_state) & (TCPF_CA_CWR | TCPF_CA_Recovery))
                return tp->snd_ssthresh;
        else
@@ -830,7 +832,7 @@ static inline __u32 tcp_current_ssthresh(const struct sock *sk)
 #define tcp_verify_left_out(tp) WARN_ON(tcp_left_out(tp) > tp->packets_out)
 extern void tcp_enter_cwr(struct sock *sk, const int set_ssthresh);
-extern __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst);
+extern __u32 tcp_init_cwnd(const struct tcp_sock *tp, const struct dst_entry *dst);
 /* Slow start with delack produces 3 packets of burst, so that
 * it is safe "de facto".  This will be the default - same as
@@ -859,7 +861,7 @@ static inline void tcp_minshall_update(struct tcp_sock *tp, unsigned int mss,
 static inline void tcp_check_probe_timer(struct sock *sk)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
        const struct inet_connection_sock *icsk = inet_csk(sk);
        if (!tp->packets_out && !icsk->icsk_pending)
@@ -1182,8 +1184,9 @@ struct tcp_md5sig_pool {
 /* - functions */
 extern int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
-                               struct sock *sk, struct request_sock *req,
+                               const struct sock *sk,
-                               struct sk_buff *skb);
+                               const struct request_sock *req,
+                               const struct sk_buff *skb);
 extern struct tcp_md5sig_key * tcp_v4_md5_lookup(struct sock *sk,
                                                 struct sock *addr_sk);
 extern int tcp_v4_md5_do_add(struct sock *sk, __be32 addr, u8 *newkey,
@@ -1200,17 +1203,17 @@ extern int tcp_v4_md5_do_del(struct sock *sk, __be32 addr);
 #define tcp_twsk_md5_key(twsk)  NULL
 #endif
-extern struct tcp_md5sig_pool * __percpu *tcp_alloc_md5sig_pool(struct sock *);
+extern struct tcp_md5sig_pool __percpu *tcp_alloc_md5sig_pool(struct sock *);
 extern void tcp_free_md5sig_pool(void);
 extern struct tcp_md5sig_pool   *tcp_get_md5sig_pool(void);
 extern void tcp_put_md5sig_pool(void);
-extern int tcp_md5_hash_header(struct tcp_md5sig_pool *, struct tcphdr *);
+extern int tcp_md5_hash_header(struct tcp_md5sig_pool *, const struct tcphdr *);
-extern int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *, struct sk_buff *,
+extern int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *, const struct sk_buff *,
                                 unsigned header_len);
 extern int tcp_md5_hash_key(struct tcp_md5sig_pool *hp,
-                            struct tcp_md5sig_key *key);
+                            const struct tcp_md5sig_key *key);
 /* write queue abstraction */
 static inline void tcp_write_queue_purge(struct sock *sk)
@@ -1223,22 +1226,24 @@ static inline void tcp_write_queue_purge(struct sock *sk)
        tcp_clear_all_retrans_hints(tcp_sk(sk));
 }
-static inline struct sk_buff *tcp_write_queue_head(struct sock *sk)
+static inline struct sk_buff *tcp_write_queue_head(const struct sock *sk)
 {
        return skb_peek(&sk->sk_write_queue);
 }
-static inline struct sk_buff *tcp_write_queue_tail(struct sock *sk)
+static inline struct sk_buff *tcp_write_queue_tail(const struct sock *sk)
 {
        return skb_peek_tail(&sk->sk_write_queue);
 }
-static inline struct sk_buff *tcp_write_queue_next(struct sock *sk, struct sk_buff *skb)
+static inline struct sk_buff *tcp_write_queue_next(const struct sock *sk,
+                                                   const struct sk_buff *skb)
 {
        return skb_queue_next(&sk->sk_write_queue, skb);
 }
-static inline struct sk_buff *tcp_write_queue_prev(struct sock *sk, struct sk_buff *skb)
+static inline struct sk_buff *tcp_write_queue_prev(const struct sock *sk,
+                                                   const struct sk_buff *skb)
 {
        return skb_queue_prev(&sk->sk_write_queue, skb);
 }
@@ -1252,7 +1257,7 @@ static inline struct sk_buff *tcp_write_queue_prev(struct sock *sk, struct sk_bu
 #define tcp_for_write_queue_from_safe(skb, tmp, sk)                     \
        skb_queue_walk_from_safe(&(sk)->sk_write_queue, skb, tmp)
-static inline struct sk_buff *tcp_send_head(struct sock *sk)
+static inline struct sk_buff *tcp_send_head(const struct sock *sk)
 {
        return sk->sk_send_head;
 }
@@ -1263,7 +1268,7 @@ static inline bool tcp_skb_is_last(const struct sock *sk,
        return skb_queue_is_last(&sk->sk_write_queue, skb);
 }
-static inline void tcp_advance_send_head(struct sock *sk, struct sk_buff *skb)
+static inline void tcp_advance_send_head(struct sock *sk, const struct sk_buff *skb)
 {
        if (tcp_skb_is_last(sk, skb))
                sk->sk_send_head = NULL;
@@ -1443,9 +1448,9 @@ struct tcp_sock_af_ops {
                                                struct sock *addr_sk);
        int                     (*calc_md5_hash) (char *location,
                                                  struct tcp_md5sig_key *md5,
-                                                  struct sock *sk,
+                                                  const struct sock *sk,
-                                                  struct request_sock *req,
+                                                  const struct request_sock *req,
-                                                  struct sk_buff *skb);
+                                                  const struct sk_buff *skb);
        int                     (*md5_add) (struct sock *sk,
                                            struct sock *addr_sk,
                                            u8 *newkey,
@@ -1462,9 +1467,9 @@ struct tcp_request_sock_ops {
                                                struct request_sock *req);
        int                     (*calc_md5_hash) (char *location,
                                                  struct tcp_md5sig_key *md5,
-                                                  struct sock *sk,
+                                                  const struct sock *sk,
-                                                  struct request_sock *req,
+                                                  const struct request_sock *req,
-                                                  struct sk_buff *skb);
+                                                  const struct sk_buff *skb);
 #endif
 };
diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
index ae8c68f30f1b..639a4491fc0d 100644
--- a/include/rdma/ib_addr.h
+++ b/include/rdma/ib_addr.h
@@ -218,8 +218,12 @@ static inline int iboe_get_rate(struct net_device *dev)
 {
        struct ethtool_cmd cmd;
        u32 speed;
+        int err;
-        if (dev_ethtool_get_settings(dev, &cmd))
+        rtnl_lock();
+        err = __ethtool_get_settings(dev, &cmd);
+        rtnl_unlock();
+        if (err)
                return IB_RATE_PORT_CURRENT;
        speed = ethtool_cmd_speed(&cmd);