Merge branch 'master' of /repos/git/net-next-2.6

Conflicts:
	net/bridge/br_device.c
	net/bridge/br_forward.c

Signed-off-by: Patrick McHardy <kaber@trash.net>

24 files changed, 340 insertions, 143 deletions

diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 1614d78c60ed..20725e213aee 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -30,7 +30,7 @@ struct unix_skb_parms {
 #endif
 };
 
-#define UNIXCB(skb)     (*(struct unix_skb_parms*)&((skb)->cb))
+#define UNIXCB(skb)     (*(struct unix_skb_parms *)&((skb)->cb))
 #define UNIXCREDS(skb)  (&UNIXCB((skb)).creds)
 #define UNIXSID(skb)    (&UNIXCB((skb)).secid)
 
@@ -45,21 +45,23 @@ struct unix_skb_parms {
 struct unix_sock {
         /* WARNING: sk has to be the first member */
         struct sock             sk;
-        struct unix_address     *addr;
-        struct dentry           *dentry;
-        struct vfsmount         *mnt;
+        struct unix_address     *addr;
+        struct dentry           *dentry;
+        struct vfsmount         *mnt;
         struct mutex            readlock;
-        struct sock             *peer;
-        struct sock             *other;
+        struct sock             *peer;
+        struct sock             *other;
         struct list_head        link;
-        atomic_long_t           inflight;
-        spinlock_t              lock;
+        atomic_long_t           inflight;
+        spinlock_t              lock;
         unsigned int            gc_candidate : 1;
         unsigned int            gc_maybe_cycle : 1;
-        wait_queue_head_t       peer_wait;
+        struct socket_wq        peer_wq;
 };
 #define unix_sk(__sk) ((struct unix_sock *)__sk)
 
+#define peer_wait peer_wq.wait
+
 #ifdef CONFIG_SYSCTL
 extern int unix_sysctl_register(struct net *net);
 extern void unix_sysctl_unregister(struct net *net);
diff --git a/include/net/caif/caif_dev.h b/include/net/caif/caif_dev.h
index 42a7c7867849..318ab9478a44 100644
--- a/include/net/caif/caif_dev.h
+++ b/include/net/caif/caif_dev.h
@@ -23,17 +23,19 @@ struct caif_param {
 };
 
 /**
- * caif_connect_request - Request data for CAIF channel setup.
+ * struct caif_connect_request - Request data for CAIF channel setup.
+ * @protocol:           Type of CAIF protocol to use (at, datagram etc)
  * @sockaddr:           Socket address to connect.
  * @priority:           Priority of the connection.
  * @link_selector:      Link selector (high bandwidth or low latency)
  * @link_name:          Name of the CAIF Link Layer to use.
+ * @param:              Connect Request parameters (CAIF_SO_REQ_PARAM).
  *
  * This struct is used when connecting a CAIF channel.
  * It contains all CAIF channel configuration options.
  */
 struct caif_connect_request {
-        int protocol;
+        enum caif_protocol_type protocol;
         struct sockaddr_caif sockaddr;
         enum caif_channel_priority priority;
         enum caif_link_selector link_selector;
@@ -68,6 +70,17 @@ int caif_connect_client(struct caif_connect_request *config,
 int caif_disconnect_client(struct cflayer *client_layer);
 
 /**
+ * caif_release_client - Release adaptation layer reference to client.
+ *
+ * @client_layer: Client layer.
+ *
+ * Releases a client/adaptation layer use of the caif stack.
+ * This function must be used after caif_disconnect_client to
+ * decrease the reference count of the service layer.
+ */
+void caif_release_client(struct cflayer *client_layer);
+
+/**
  * connect_req_to_link_param - Translate configuration parameters
  *                              from socket format to internal format.
  * @cnfg:       Pointer to configuration handler
diff --git a/include/net/caif/cfcnfg.h b/include/net/caif/cfcnfg.h
index 366082c5d435..9fc2fc20b884 100644
--- a/include/net/caif/cfcnfg.h
+++ b/include/net/caif/cfcnfg.h
@@ -87,13 +87,21 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg, enum cfcnfg_phy_type phy_type,
 int cfcnfg_del_phy_layer(struct cfcnfg *cnfg, struct cflayer *phy_layer);
 
 /**
- * cfcnfg_del_adapt_layer - Deletes an adaptation layer from the CAIF stack.
+ * cfcnfg_disconn_adapt_layer - Disconnects an adaptation layer.
  *
  * @cnfg:       Pointer to a CAIF configuration object, created by
  *              cfcnfg_create().
  * @adap_layer: Adaptation layer to be removed.
  */
-int cfcnfg_del_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer);
+int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg,
+                        struct cflayer *adap_layer);
+
+/**
+ * cfcnfg_release_adap_layer - Used by client to release the adaptation layer.
+ *
+ * @adap_layer: Adaptation layer.
+ */
+void cfcnfg_release_adap_layer(struct cflayer *adap_layer);
 
 /**
  * cfcnfg_add_adaptation_layer - Add an adaptation layer to the CAIF stack.
@@ -102,14 +110,13 @@ int cfcnfg_del_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer);
  * driver functionality is implemented.
  *
  * @cnfg:               Pointer to a CAIF configuration object, created by
- *                              cfcnfg_create().
+ *                      cfcnfg_create().
  * @param:              Link setup parameters.
  * @adap_layer:         Specify the adaptation layer; the receive and
  *                      flow-control functions MUST be set in the structure.
  *
  */
-int
-cfcnfg_add_adaptation_layer(struct cfcnfg *cnfg,
+int cfcnfg_add_adaptation_layer(struct cfcnfg *cnfg,
                             struct cfctrl_link_param *param,
                             struct cflayer *adap_layer);
 
diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
index dee25b86caa0..997603f2bf4c 100644
--- a/include/net/caif/cfctrl.h
+++ b/include/net/caif/cfctrl.h
@@ -43,8 +43,7 @@ struct cfctrl_rsp {
         void (*linksetup_rsp)(struct cflayer *layer, u8 linkid,
                               enum cfctrl_srv serv, u8 phyid,
                               struct cflayer *adapt_layer);
-        void (*linkdestroy_rsp)(struct cflayer *layer, u8 linkid,
-                                struct cflayer *client_layer);
+        void (*linkdestroy_rsp)(struct cflayer *layer, u8 linkid);
         void (*linkerror_ind)(void);
         void (*enum_rsp)(void);
         void (*sleep_rsp)(void);
@@ -117,7 +116,7 @@ struct cfctrl {
 };
 
 void cfctrl_enum_req(struct cflayer *cfctrl, u8 physlinkid);
-void cfctrl_linkup_request(struct cflayer *cfctrl,
+int cfctrl_linkup_request(struct cflayer *cfctrl,
                            struct cfctrl_link_param *param,
                            struct cflayer *user_layer);
 int  cfctrl_linkdown_req(struct cflayer *cfctrl, u8 linkid,
@@ -135,4 +134,6 @@ void cfctrl_insert_req(struct cfctrl *ctrl,
                               struct cfctrl_request_info *req);
 struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
                                               struct cfctrl_request_info *req);
+void cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer);
+
 #endif                          /* CFCTRL_H_ */
diff --git a/include/net/caif/cfsrvl.h b/include/net/caif/cfsrvl.h
index b2a12db20cd2..2dc9eb193ecf 100644
--- a/include/net/caif/cfsrvl.h
+++ b/include/net/caif/cfsrvl.h
@@ -9,14 +9,18 @@
 #include <linux/list.h>
 #include <linux/stddef.h>
 #include <linux/types.h>
+#include <linux/kref.h>
+
 struct cfsrvl {
         struct cflayer layer;
         bool open;
         bool phy_flow_on;
         bool modem_flow_on;
         struct dev_info dev_info;
+        struct kref ref;
 };
 
+void cfsrvl_release(struct kref *kref);
 struct cflayer *cfvei_create(u8 linkid, struct dev_info *dev_info);
 struct cflayer *cfdgml_create(u8 linkid, struct dev_info *dev_info);
 struct cflayer *cfutill_create(u8 linkid, struct dev_info *dev_info);
@@ -31,4 +35,22 @@ void cfsrvl_init(struct cfsrvl *service,
 bool cfsrvl_ready(struct cfsrvl *service, int *err);
 u8 cfsrvl_getphyid(struct cflayer *layer);
 
+static inline void cfsrvl_get(struct cflayer *layr)
+{
+        struct cfsrvl *s;
+        if (layr == NULL)
+                return;
+        s = container_of(layr, struct cfsrvl, layer);
+        kref_get(&s->ref);
+}
+
+static inline void cfsrvl_put(struct cflayer *layr)
+{
+        struct cfsrvl *s;
+        if (layr == NULL)
+                return;
+        s = container_of(layr, struct cfsrvl, layer);
+        kref_put(&s->ref, cfsrvl_release);
+}
+
 #endif                          /* CFSRVL_H_ */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 37cebd3aa0f7..7d10c0182f53 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -511,6 +511,7 @@ struct mpath_info {
  * @basic_rates: basic rates in IEEE 802.11 format
  *      (or NULL for no change)
  * @basic_rates_len: number of basic rates
+ * @ap_isolate: do not forward packets between connected stations
  */
 struct bss_parameters {
         int use_cts_prot;
@@ -518,6 +519,7 @@ struct bss_parameters {
         int use_short_slot_time;
         u8 *basic_rates;
         u8 basic_rates_len;
+        int ap_isolate;
 };
 
 struct mesh_config {
@@ -1018,6 +1020,8 @@ struct cfg80211_pmksa {
  *      RSN IE. It allows for faster roaming between WPA2 BSSIDs.
  * @del_pmksa: Delete a cached PMKID.
  * @flush_pmksa: Flush all cached PMKIDs.
+ * @set_power_mgmt: Configure WLAN power management. A timeout value of -1
+ *      allows the driver to adjust the dynamic ps timeout value.
  * @set_cqm_rssi_config: Configure connection quality monitor RSSI threshold.
  *
  */
@@ -1643,7 +1647,7 @@ struct ieee80211_radiotap_iterator {
         const struct ieee80211_radiotap_namespace *current_namespace;
 
         unsigned char *_arg, *_next_ns_data;
-        uint32_t *_next_bitmap;
+        __le32 *_next_bitmap;
 
         unsigned char *this_arg;
         int this_arg_index;
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index 52bd9e6c9141..e8923bc20f9f 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -104,7 +104,7 @@ static inline u32 frh_get_table(struct fib_rule_hdr *frh, struct nlattr **nla)
         return frh->table;
 }
 
-extern struct fib_rules_ops *fib_rules_register(struct fib_rules_ops *, struct net *);
+extern struct fib_rules_ops *fib_rules_register(const struct fib_rules_ops *, struct net *);
 extern void fib_rules_unregister(struct fib_rules_ops *);
 extern void                     fib_rules_cleanup_ops(struct fib_rules_ops *);
 
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index b487bc1b99ab..1653de515cee 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -102,7 +102,6 @@ struct rtable;
  * @uc_ttl - Unicast TTL
  * @inet_sport - Source port
  * @inet_id - ID counter for DF pkts
- * @rxhash - flow hash received from netif layer
  * @tos - TOS
  * @mc_ttl - Multicasting TTL
  * @is_icsk - is this an inet_connection_sock?
@@ -126,9 +125,6 @@ struct inet_sock {
         __u16                   cmsg_flags;
         __be16                  inet_sport;
         __u16                   inet_id;
-#ifdef CONFIG_RPS
-        __u32                   rxhash;
-#endif
 
         struct ip_options       *opt;
         __u8                    tos;
@@ -224,37 +220,4 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
         return inet_sk(sk)->transparent ? FLOWI_FLAG_ANYSRC : 0;
 }
 
-static inline void inet_rps_record_flow(const struct sock *sk)
-{
-#ifdef CONFIG_RPS
-        struct rps_sock_flow_table *sock_flow_table;
-
-        rcu_read_lock();
-        sock_flow_table = rcu_dereference(rps_sock_flow_table);
-        rps_record_sock_flow(sock_flow_table, inet_sk(sk)->rxhash);
-        rcu_read_unlock();
-#endif
-}
-
-static inline void inet_rps_reset_flow(const struct sock *sk)
-{
-#ifdef CONFIG_RPS
-        struct rps_sock_flow_table *sock_flow_table;
-
-        rcu_read_lock();
-        sock_flow_table = rcu_dereference(rps_sock_flow_table);
-        rps_reset_sock_flow(sock_flow_table, inet_sk(sk)->rxhash);
-        rcu_read_unlock();
-#endif
-}
-
-static inline void inet_rps_save_rxhash(const struct sock *sk, u32 rxhash)
-{
-#ifdef CONFIG_RPS
-        if (unlikely(inet_sk(sk)->rxhash != rxhash)) {
-                inet_rps_reset_flow(sk);
-                inet_sk(sk)->rxhash = rxhash;
-        }
-#endif
-}
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 79f67eae8a7e..a066fdd50da6 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -224,7 +224,9 @@ static inline
 struct net *twsk_net(const struct inet_timewait_sock *twsk)
 {
 #ifdef CONFIG_NET_NS
-        return rcu_dereference(twsk->tw_net);
+        return rcu_dereference_raw(twsk->tw_net); /* protected by locking, */
+                                                  /* reference counting, */
+                                                  /* initialization, or RCU. */
 #else
         return &init_net;
 #endif
diff --git a/include/net/ip.h b/include/net/ip.h
index a84ceb692687..8149b77cea9b 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -393,6 +393,7 @@ extern int ip_options_rcv_srr(struct sk_buff *skb);
  *      Functions provided by ip_sockglue.c
  */
 
+extern int      ip_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 extern void     ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb);
 extern int      ip_cmsg_send(struct net *net,
                              struct msghdr *msg, struct ipcm_cookie *ipc);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index b1d8db90b214..eba5cc00325a 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -503,7 +503,8 @@ extern int			ip6_append_data(struct sock *sk,
                                                 struct ipv6_txoptions *opt,
                                                 struct flowi *fl,
                                                 struct rt6_info *rt,
-                                                unsigned int flags);
+                                                unsigned int flags,
+                                                int dontfrag);
 
 extern int                      ip6_push_pending_frames(struct sock *sk);
 
@@ -577,9 +578,11 @@ extern int			ip6_datagram_connect(struct sock *sk,
                                                      struct sockaddr *addr, int addr_len);
 
 extern int                      ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len);
+extern int                      ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len);
 extern void                     ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
                                                 u32 info, u8 *payload);
 extern void                     ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info);
+extern void                     ipv6_local_rxpmtu(struct sock *sk, struct flowi *fl, u32 mtu);
 
 extern int inet6_release(struct socket *sock);
 extern int inet6_bind(struct socket *sock, struct sockaddr *uaddr, 
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 344e5bf72062..54aa16b98b76 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -145,6 +145,7 @@ struct ieee80211_low_level_stats {
  * @BSS_CHANGED_BEACON_ENABLED: Beaconing should be
  *      enabled/disabled (beaconing modes)
  * @BSS_CHANGED_CQM: Connection quality monitor config changed
+ * @BSS_CHANGED_IBSS: IBSS join status changed
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
@@ -158,6 +159,7 @@ enum ieee80211_bss_change {
         BSS_CHANGED_BEACON              = 1<<8,
         BSS_CHANGED_BEACON_ENABLED      = 1<<9,
         BSS_CHANGED_CQM                 = 1<<10,
+        BSS_CHANGED_IBSS                = 1<<11,
 };
 
 /**
@@ -167,6 +169,8 @@ enum ieee80211_bss_change {
  * to that BSS) that can change during the lifetime of the BSS.
  *
  * @assoc: association status
+ * @ibss_joined: indicates whether this station is part of an IBSS
+ *      or not
  * @aid: association ID number, valid only when @assoc is true
  * @use_cts_prot: use CTS protection
  * @use_short_preamble: use 802.11b short preamble;
@@ -194,7 +198,7 @@ enum ieee80211_bss_change {
 struct ieee80211_bss_conf {
         const u8 *bssid;
         /* association related data */
-        bool assoc;
+        bool assoc, ibss_joined;
         u16 aid;
         /* erp related data */
         bool use_cts_prot;
@@ -274,6 +278,9 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_INTFL_NL80211_FRAME_TX: Frame was requested through nl80211
  *      MLME command (internal to mac80211 to figure out whether to send TX
  *      status to user space)
+ * @IEEE80211_TX_CTL_LDPC: tells the driver to use LDPC for this frame
+ * @IEEE80211_TX_CTL_STBC: Enables Space-Time Block Coding (STBC) for this
+ *      frame and selects the maximum number of streams that it can use.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -297,6 +304,9 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_INTFL_RETRANSMISSION       = BIT(19),
         IEEE80211_TX_INTFL_HAS_RADIOTAP         = BIT(20),
         IEEE80211_TX_INTFL_NL80211_FRAME_TX     = BIT(21),
+        IEEE80211_TX_CTL_LDPC                   = BIT(22),
+        IEEE80211_TX_CTL_STBC                   = BIT(23) | BIT(24),
+#define IEEE80211_TX_CTL_STBC_SHIFT             23
 };
 
 /**
@@ -395,11 +405,11 @@ struct ieee80211_tx_rate {
  * @status: union for status data
  * @driver_data: array of driver_data pointers
  * @ampdu_ack_len: number of acked aggregated frames.
- *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
+ *      relevant only if IEEE80211_TX_STAT_AMPDU was set.
  * @ampdu_ack_map: block ack bit map for the aggregation.
- *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
+ *      relevant only if IEEE80211_TX_STAT_AMPDU was set.
  * @ampdu_len: number of aggregated frames.
- *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
+ *      relevant only if IEEE80211_TX_STAT_AMPDU was set.
  * @ack_signal: signal strength of the ACK frame
  */
 struct ieee80211_tx_info {
@@ -550,7 +560,6 @@ enum mac80211_rx_flags {
  * @signal: signal strength when receiving this frame, either in dBm, in dB or
  *      unspecified depending on the hardware capabilities flags
  *      @IEEE80211_HW_SIGNAL_*
- * @noise: noise when receiving this frame, in dBm (DEPRECATED).
  * @antenna: antenna used
  * @rate_idx: index of data rate into band's supported rates or MCS index if
  *      HT rates are use (RX_FLAG_HT)
@@ -561,7 +570,6 @@ struct ieee80211_rx_status {
         enum ieee80211_band band;
         int freq;
         int signal;
-        int noise __deprecated;
         int antenna;
         int rate_idx;
         int flag;
@@ -610,6 +618,7 @@ enum ieee80211_conf_flags {
  * @IEEE80211_CONF_CHANGE_RETRY_LIMITS: retry limits changed
  * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
  * @IEEE80211_CONF_CHANGE_SMPS: Spatial multiplexing powersave mode changed
+ * @IEEE80211_CONF_CHANGE_QOS: Quality of service was enabled or disabled
  */
 enum ieee80211_conf_changed {
         IEEE80211_CONF_CHANGE_SMPS              = BIT(1),
@@ -661,6 +670,9 @@ enum ieee80211_smps_mode {
  * @dynamic_ps_timeout: The dynamic powersave timeout (in ms), see the
  *      powersave documentation below. This variable is valid only when
  *      the CONF_PS flag is set.
+ * @dynamic_ps_forced_timeout: The dynamic powersave timeout (in ms) configured
+ *      by cfg80211 (essentially, wext) If set, this value overrules the value
+ *      chosen by mac80211 based on ps qos network latency.
  *
  * @power_level: requested transmit power (in dBm)
  *
@@ -680,7 +692,7 @@ enum ieee80211_smps_mode {
  */
 struct ieee80211_conf {
         u32 flags;
-        int power_level, dynamic_ps_timeout;
+        int power_level, dynamic_ps_timeout, dynamic_ps_forced_timeout;
         int max_sleep_period;
 
         u16 listen_interval;
@@ -791,6 +803,7 @@ struct ieee80211_key_conf {
         u8 iv_len;
         u8 hw_key_idx;
         u8 flags;
+        u8 *ap_addr;
         s8 keyidx;
         u8 keylen;
         u8 key[0];
@@ -919,10 +932,6 @@ enum ieee80211_tkip_key_type {
  *      one milliwatt. This is the preferred method since it is standardized
  *      between different devices. @max_signal does not need to be set.
  *
- * @IEEE80211_HW_NOISE_DBM:
- *      Hardware can provide noise (radio interference) values in units dBm,
- *      decibel difference from one milliwatt.
- *
  * @IEEE80211_HW_SPECTRUM_MGMT:
  *      Hardware supports spectrum management defined in 802.11h
  *      Measurement, Channel Switch, Quieting, TPC
@@ -986,7 +995,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE      = 1<<4,
         IEEE80211_HW_SIGNAL_UNSPEC                      = 1<<5,
         IEEE80211_HW_SIGNAL_DBM                         = 1<<6,
-        IEEE80211_HW_NOISE_DBM                          = 1<<7,
+        /* use this hole */
         IEEE80211_HW_SPECTRUM_MGMT                      = 1<<8,
         IEEE80211_HW_AMPDU_AGGREGATION                  = 1<<9,
         IEEE80211_HW_SUPPORTS_PS                        = 1<<10,
@@ -1646,7 +1655,7 @@ struct ieee80211_ops {
                                 struct ieee80211_key_conf *conf,
                                 struct ieee80211_sta *sta,
                                 u32 iv32, u16 *phase1key);
-        int (*hw_scan)(struct ieee80211_hw *hw,
+        int (*hw_scan)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct cfg80211_scan_request *req);
         void (*sw_scan_start)(struct ieee80211_hw *hw);
         void (*sw_scan_complete)(struct ieee80211_hw *hw);
@@ -1671,7 +1680,8 @@ struct ieee80211_ops {
                             struct ieee80211_vif *vif,
                             enum ieee80211_ampdu_mlme_action action,
                             struct ieee80211_sta *sta, u16 tid, u16 *ssn);
-
+        int (*get_survey)(struct ieee80211_hw *hw, int idx,
+                struct survey_info *survey);
         void (*rfkill_poll)(struct ieee80211_hw *hw);
         void (*set_coverage_class)(struct ieee80211_hw *hw, u8 coverage_class);
 #ifdef CONFIG_NL80211_TESTMODE
diff --git a/include/net/mld.h b/include/net/mld.h
new file mode 100644
index 000000000000..467143cd4e2f
--- /dev/null
+++ b/include/net/mld.h
@@ -0,0 +1,75 @@
+#ifndef LINUX_MLD_H
+#define LINUX_MLD_H
+
+#include <linux/in6.h>
+#include <linux/icmpv6.h>
+
+/* MLDv1 Query/Report/Done */
+struct mld_msg {
+        struct icmp6hdr         mld_hdr;
+        struct in6_addr         mld_mca;
+};
+
+#define mld_type                mld_hdr.icmp6_type
+#define mld_code                mld_hdr.icmp6_code
+#define mld_cksum               mld_hdr.icmp6_cksum
+#define mld_maxdelay            mld_hdr.icmp6_maxdelay
+#define mld_reserved            mld_hdr.icmp6_dataun.un_data16[1]
+
+/* Multicast Listener Discovery version 2 headers */
+/* MLDv2 Report */
+struct mld2_grec {
+        __u8            grec_type;
+        __u8            grec_auxwords;
+        __be16          grec_nsrcs;
+        struct in6_addr grec_mca;
+        struct in6_addr grec_src[0];
+};
+
+struct mld2_report {
+        struct icmp6hdr         mld2r_hdr;
+        struct mld2_grec        mld2r_grec[0];
+};
+
+#define mld2r_type              mld2r_hdr.icmp6_type
+#define mld2r_resv1             mld2r_hdr.icmp6_code
+#define mld2r_cksum             mld2r_hdr.icmp6_cksum
+#define mld2r_resv2             mld2r_hdr.icmp6_dataun.un_data16[0]
+#define mld2r_ngrec             mld2r_hdr.icmp6_dataun.un_data16[1]
+
+/* MLDv2 Query */
+struct mld2_query {
+        struct icmp6hdr         mld2q_hdr;
+        struct in6_addr         mld2q_mca;
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        __u8                    mld2q_qrv:3,
+                                mld2q_suppress:1,
+                                mld2q_resv2:4;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+        __u8                    mld2q_resv2:4,
+                                mld2q_suppress:1,
+                                mld2q_qrv:3;
+#else
+#error "Please fix <asm/byteorder.h>"
+#endif
+        __u8                    mld2q_qqic;
+        __be16                  mld2q_nsrcs;
+        struct in6_addr         mld2q_srcs[0];
+};
+
+#define mld2q_type              mld2q_hdr.icmp6_type
+#define mld2q_code              mld2q_hdr.icmp6_code
+#define mld2q_cksum             mld2q_hdr.icmp6_cksum
+#define mld2q_mrc               mld2q_hdr.icmp6_maxdelay
+#define mld2q_resv1             mld2q_hdr.icmp6_dataun.un_data16[1]
+
+/* Max Response Code */
+#define MLDV2_MASK(value, nb) ((nb)>=32 ? (value) : ((1<<(nb))-1) & (value))
+#define MLDV2_EXP(thresh, nbmant, nbexp, value) \
+        ((value) < (thresh) ? (value) : \
+        ((MLDV2_MASK(value, nbmant) | (1<<(nbmant))) << \
+        (MLDV2_MASK((value) >> (nbmant), nbexp) + (nbexp))))
+
+#define MLDV2_MRC(value) MLDV2_EXP(0x8000, 12, 3, value)
+
+#endif
diff --git a/include/net/netns/generic.h b/include/net/netns/generic.h
index ff4982ab84b6..81a31c0db3e7 100644
--- a/include/net/netns/generic.h
+++ b/include/net/netns/generic.h
@@ -14,11 +14,8 @@
  * The rules are simple:
  * 1. set pernet_operations->id.  After register_pernet_device you
  *    will have the id of your private pointer.
- * 2. Either set pernet_operations->size (to have the code allocate and
- *    free a private structure pointed to from struct net ) or 
- *    call net_assign_generic() to put the private data on the struct
- *    net (most preferably this should be done in the ->init callback
- *    of the ops registered);
+ * 2. set pernet_operations->size to have the code allocate and free
+ *    a private structure pointed to from struct net.
  * 3. do not change this pointer while the net is alive;
  * 4. do not try to have any private reference on the net_generic object.
  *
@@ -46,6 +43,4 @@ static inline void *net_generic(struct net *net, int id)
 
         return ptr;
 }
-
-extern int net_assign_generic(struct net *net, int id, void *data);
 #endif
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index ae07feec6446..d68c3f121774 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -55,7 +55,6 @@ struct netns_ipv4 {
         int sysctl_rt_cache_rebuild_count;
         int current_rt_cache_rebuild_count;
 
-        struct timer_list rt_secret_timer;
         atomic_t rt_genid;
 
 #ifdef CONFIG_IP_MROUTE
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 8be5135ff7aa..2c55a7ea20af 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -107,6 +107,7 @@ typedef enum {
         SCTP_CMD_T1_RETRAN,      /* Mark for retransmission after T1 timeout  */
         SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
         SCTP_CMD_SEND_MSG,       /* Send the whole use message */
+        SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */
         SCTP_CMD_LAST
 } sctp_verb_t;
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 59151557406c..65946bc43d00 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -128,6 +128,7 @@ extern int sctp_register_pf(struct sctp_pf *, sa_family_t);
 int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb);
 int sctp_inet_listen(struct socket *sock, int backlog);
 void sctp_write_space(struct sock *sk);
+void sctp_data_ready(struct sock *sk, int len);
 unsigned int sctp_poll(struct file *file, struct socket *sock,
                 poll_table *wait);
 void sctp_sock_rfree(struct sk_buff *skb);
@@ -546,7 +547,7 @@ for (pos = chunk->subh.fwdtsn_hdr->skip;\
 #define WORD_ROUND(s) (((s)+3)&~3)
 
 /* Make a new instance of type.  */
-#define t_new(type, flags)      (type *)kmalloc(sizeof(type), flags)
+#define t_new(type, flags)      (type *)kzalloc(sizeof(type), flags)
 
 /* Compare two timevals.  */
 #define tv_lt(s, t) \
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 851c813adb3a..273a8bb683e3 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -437,7 +437,7 @@ sctp_vtag_verify_either(const struct sctp_chunk *chunk,
          */
         if ((!sctp_test_T_bit(chunk) &&
              (ntohl(chunk->sctp_hdr->vtag) == asoc->c.my_vtag)) ||
-            (sctp_test_T_bit(chunk) &&
+            (sctp_test_T_bit(chunk) && asoc->c.peer_vtag &&
              (ntohl(chunk->sctp_hdr->vtag) == asoc->c.peer_vtag))) {
                 return 1;
         }
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index ff3017744711..43257b903c82 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -643,17 +643,15 @@ struct sctp_pf {
 struct sctp_datamsg {
         /* Chunks waiting to be submitted to lower layer. */
         struct list_head chunks;
-        /* Chunks that have been transmitted. */
-        size_t msg_size;
         /* Reference counting. */
         atomic_t refcnt;
         /* When is this message no longer interesting to the peer? */
         unsigned long expires_at;
         /* Did the messenge fail to send? */
         int send_error;
-        char send_failed;
-        /* Control whether chunks from this message can be abandoned. */
-        char can_abandon;
+        u8 send_failed:1,
+           can_abandon:1,   /* can chunks from this message can be abandoned. */
+           can_delay;       /* should this message be Nagle delayed */
 };
 
 struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *,
@@ -757,7 +755,6 @@ struct sctp_chunk {
 #define SCTP_NEED_FRTX 0x1
 #define SCTP_DONT_FRTX 0x2
         __u16   rtt_in_progress:1,      /* This chunk used for RTT calc? */
-                resent:1,               /* Has this chunk ever been resent. */
                 has_tsn:1,              /* Does this chunk have a TSN yet? */
                 has_ssn:1,              /* Does this chunk have a SSN yet? */
                 singleton:1,            /* Only chunk in the packet? */
@@ -778,6 +775,7 @@ int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
                           struct iovec *data);
 void sctp_chunk_free(struct sctp_chunk *);
 void  *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data);
+void  *sctp_addto_chunk_fixed(struct sctp_chunk *, int len, const void *data);
 struct sctp_chunk *sctp_chunkify(struct sk_buff *,
                                  const struct sctp_association *,
                                  struct sock *);
@@ -878,7 +876,30 @@ struct sctp_transport {
 
         /* Reference counting. */
         atomic_t refcnt;
-        int      dead;
+        int      dead:1,
+                /* RTO-Pending : A flag used to track if one of the DATA
+                 *              chunks sent to this address is currently being
+                 *              used to compute a RTT. If this flag is 0,
+                 *              the next DATA chunk sent to this destination
+                 *              should be used to compute a RTT and this flag
+                 *              should be set. Every time the RTT
+                 *              calculation completes (i.e. the DATA chunk
+                 *              is SACK'd) clear this flag.
+                 */
+                 rto_pending:1,
+
+                /*
+                 * hb_sent : a flag that signals that we have a pending
+                 * heartbeat.
+                 */
+                hb_sent:1,
+
+                /* Is the Path MTU update pending on this tranport */
+                pmtu_pending:1,
+
+                /* Is this structure kfree()able? */
+                malloced:1;
+
 
         /* This is the peer's IP address and port. */
         union sctp_addr ipaddr;
@@ -908,22 +929,6 @@ struct sctp_transport {
         /* SRTT        : The current smoothed round trip time.  */
         __u32 srtt;
 
-        /* RTO-Pending : A flag used to track if one of the DATA
-         *              chunks sent to this address is currently being
-         *              used to compute a RTT. If this flag is 0,
-         *              the next DATA chunk sent to this destination
-         *              should be used to compute a RTT and this flag
-         *              should be set. Every time the RTT
-         *              calculation completes (i.e. the DATA chunk
-         *              is SACK'd) clear this flag.
-         * hb_sent : a flag that signals that we have a pending heartbeat.
-         */
-        __u8 rto_pending;
-        __u8 hb_sent;
-
-        /* Flag to track the current fast recovery state */
-        __u8 fast_recovery;
-
         /*
          * These are the congestion stats.
          */
@@ -943,9 +948,6 @@ struct sctp_transport {
 
         __u32 burst_limited;    /* Holds old cwnd when max.burst is applied */
 
-        /* TSN marking the fast recovery exit point */
-        __u32 fast_recovery_exit;
-
         /* Destination */
         struct dst_entry *dst;
         /* Source address. */
@@ -976,9 +978,6 @@ struct sctp_transport {
          */
         __u16 pathmaxrxt;
 
-        /* is the Path MTU update pending on this tranport */
-        __u8 pmtu_pending;
-
         /* PMTU       : The current known path MTU.  */
         __u32 pathmtu;
 
@@ -1022,8 +1021,6 @@ struct sctp_transport {
         /* This is the list of transports that have chunks to send.  */
         struct list_head send_ready;
 
-        int malloced; /* Is this structure kfree()able? */
-
         /* State information saved for SFR_CACC algorithm. The key
          * idea in SFR_CACC is to maintain state at the sender on a
          * per-destination basis when a changeover happens.
@@ -1065,7 +1062,7 @@ void sctp_transport_route(struct sctp_transport *, union sctp_addr *,
                           struct sctp_sock *);
 void sctp_transport_pmtu(struct sctp_transport *);
 void sctp_transport_free(struct sctp_transport *);
-void sctp_transport_reset_timers(struct sctp_transport *, int);
+void sctp_transport_reset_timers(struct sctp_transport *);
 void sctp_transport_hold(struct sctp_transport *);
 void sctp_transport_put(struct sctp_transport *);
 void sctp_transport_update_rto(struct sctp_transport *, __u32);
@@ -1719,6 +1716,12 @@ struct sctp_association {
         /* Highest TSN that is acknowledged by incoming SACKs. */
         __u32 highest_sacked;
 
+        /* TSN marking the fast recovery exit point */
+        __u32 fast_recovery_exit;
+
+        /* Flag to track the current fast recovery state */
+        __u8 fast_recovery;
+
         /* The number of unacknowledged data chunks.  Reported through
          * the SCTP_STATUS sockopt.
          */
diff --git a/include/net/snmp.h b/include/net/snmp.h
index 884fdbb74b23..92456f1035f5 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -133,6 +133,8 @@ struct linux_xfrm_mib {
                         __this_cpu_add(mib[0]->mibs[field], addend)
 #define SNMP_ADD_STATS_USER(mib, field, addend) \
                         this_cpu_add(mib[1]->mibs[field], addend)
+#define SNMP_ADD_STATS(mib, field, addend)      \
+                        this_cpu_add(mib[0]->mibs[field], addend)
 /*
  * Use "__typeof__(*mib[0]) *ptr" instead of "__typeof__(mib[0]) ptr"
  * to make @ptr a non-percpu pointer.
diff --git a/include/net/sock.h b/include/net/sock.h
index 56df440a950b..328e03f47dd1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -74,7 +74,7 @@
                                         printk(KERN_DEBUG msg); } while (0)
 #else
 /* Validate arguments and do nothing */
-static void inline int __attribute__ ((format (printf, 2, 3)))
+static inline void __attribute__ ((format (printf, 2, 3)))
 SOCK_DEBUG(struct sock *sk, const char *msg, ...)
 {
 }
@@ -159,7 +159,7 @@ struct sock_common {
   *     @sk_userlocks: %SO_SNDBUF and %SO_RCVBUF settings
   *     @sk_lock:       synchronizer
   *     @sk_rcvbuf: size of receive buffer in bytes
-  *     @sk_sleep: sock wait queue
+  *     @sk_wq: sock wait queue and async head
   *     @sk_dst_cache: destination cache
   *     @sk_dst_lock: destination cache lock
   *     @sk_policy: flow policy
@@ -198,6 +198,7 @@ struct sock_common {
   *     @sk_rcvlowat: %SO_RCVLOWAT setting
   *     @sk_rcvtimeo: %SO_RCVTIMEO setting
   *     @sk_sndtimeo: %SO_SNDTIMEO setting
+  *     @sk_rxhash: flow hash received from netif layer
   *     @sk_filter: socket filtering instructions
   *     @sk_protinfo: private area, net family specific, when not using slab
   *     @sk_timer: sock cleanup timer
@@ -255,9 +256,8 @@ struct sock {
                 struct sk_buff *head;
                 struct sk_buff *tail;
                 int len;
-                int limit;
         } sk_backlog;
-        wait_queue_head_t       *sk_sleep;
+        struct socket_wq        *sk_wq;
         struct dst_entry        *sk_dst_cache;
 #ifdef CONFIG_XFRM
         struct xfrm_policy      *sk_policy[2];
@@ -279,6 +279,9 @@ struct sock {
         int                     sk_gso_type;
         unsigned int            sk_gso_max_size;
         int                     sk_rcvlowat;
+#ifdef CONFIG_RPS
+        __u32                   sk_rxhash;
+#endif
         unsigned long           sk_flags;
         unsigned long           sk_lingertime;
         struct sk_buff_head     sk_error_queue;
@@ -604,10 +607,20 @@ static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
         skb->next = NULL;
 }
 
+/*
+ * Take into account size of receive queue and backlog queue
+ */
+static inline bool sk_rcvqueues_full(const struct sock *sk, const struct sk_buff *skb)
+{
+        unsigned int qsize = sk->sk_backlog.len + atomic_read(&sk->sk_rmem_alloc);
+
+        return qsize + skb->truesize > sk->sk_rcvbuf;
+}
+
 /* The per-socket spinlock must be held here. */
 static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *skb)
 {
-        if (sk->sk_backlog.len >= max(sk->sk_backlog.limit, sk->sk_rcvbuf << 1))
+        if (sk_rcvqueues_full(sk, skb))
                 return -ENOBUFS;
 
         __sk_add_backlog(sk, skb);
@@ -620,6 +633,40 @@ static inline int sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
         return sk->sk_backlog_rcv(sk, skb);
 }
 
+static inline void sock_rps_record_flow(const struct sock *sk)
+{
+#ifdef CONFIG_RPS
+        struct rps_sock_flow_table *sock_flow_table;
+
+        rcu_read_lock();
+        sock_flow_table = rcu_dereference(rps_sock_flow_table);
+        rps_record_sock_flow(sock_flow_table, sk->sk_rxhash);
+        rcu_read_unlock();
+#endif
+}
+
+static inline void sock_rps_reset_flow(const struct sock *sk)
+{
+#ifdef CONFIG_RPS
+        struct rps_sock_flow_table *sock_flow_table;
+
+        rcu_read_lock();
+        sock_flow_table = rcu_dereference(rps_sock_flow_table);
+        rps_reset_sock_flow(sock_flow_table, sk->sk_rxhash);
+        rcu_read_unlock();
+#endif
+}
+
+static inline void sock_rps_save_rxhash(struct sock *sk, u32 rxhash)
+{
+#ifdef CONFIG_RPS
+        if (unlikely(sk->sk_rxhash != rxhash)) {
+                sock_rps_reset_flow(sk);
+                sk->sk_rxhash = rxhash;
+        }
+#endif
+}
+
 #define sk_wait_event(__sk, __timeo, __condition)                       \
         ({      int __rc;                                               \
                 release_sock(__sk);                                     \
@@ -974,6 +1021,16 @@ extern void release_sock(struct sock *sk);
                                 SINGLE_DEPTH_NESTING)
 #define bh_unlock_sock(__sk)    spin_unlock(&((__sk)->sk_lock.slock))
 
+static inline void lock_sock_bh(struct sock *sk)
+{
+        spin_lock_bh(&sk->sk_lock.slock);
+}
+
+static inline void unlock_sock_bh(struct sock *sk)
+{
+        spin_unlock_bh(&sk->sk_lock.slock);
+}
+
 extern struct sock              *sk_alloc(struct net *net, int family,
                                           gfp_t priority,
                                           struct proto *prot);
@@ -1160,6 +1217,10 @@ static inline void sk_set_socket(struct sock *sk, struct socket *sock)
         sk->sk_socket = sock;
 }
 
+static inline wait_queue_head_t *sk_sleep(struct sock *sk)
+{
+        return &sk->sk_wq->wait;
+}
 /* Detach socket from process context.
  * Announce socket dead, detach it from wait queue and inode.
  * Note that parent inode held reference count on this struct sock,
@@ -1172,14 +1233,14 @@ static inline void sock_orphan(struct sock *sk)
         write_lock_bh(&sk->sk_callback_lock);
         sock_set_flag(sk, SOCK_DEAD);
         sk_set_socket(sk, NULL);
-        sk->sk_sleep  = NULL;
+        sk->sk_wq  = NULL;
         write_unlock_bh(&sk->sk_callback_lock);
 }
 
 static inline void sock_graft(struct sock *sk, struct socket *parent)
 {
         write_lock_bh(&sk->sk_callback_lock);
-        sk->sk_sleep = &parent->wait;
+        rcu_assign_pointer(sk->sk_wq, parent->wq);
         parent->sk = sk;
         sk_set_socket(sk, parent);
         security_sock_graft(sk, parent);
@@ -1193,7 +1254,8 @@ static inline struct dst_entry *
 __sk_dst_get(struct sock *sk)
 {
         return rcu_dereference_check(sk->sk_dst_cache, rcu_read_lock_held() ||
-                                                       sock_owned_by_user(sk));
+                                                       sock_owned_by_user(sk) ||
+                                                       lockdep_is_held(&sk->sk_lock.slock));
 }
 
 static inline struct dst_entry *
@@ -1231,8 +1293,11 @@ __sk_dst_set(struct sock *sk, struct dst_entry *dst)
         struct dst_entry *old_dst;
 
         sk_tx_queue_clear(sk);
-        old_dst = rcu_dereference_check(sk->sk_dst_cache,
-                                        lockdep_is_held(&sk->sk_dst_lock));
+        /*
+         * This can be called while sk is owned by the caller only,
+         * with no state that can be checked in a rcu_dereference_check() cond
+         */
+        old_dst = rcu_dereference_raw(sk->sk_dst_cache);
         rcu_assign_pointer(sk->sk_dst_cache, dst);
         dst_release(old_dst);
 }
@@ -1327,12 +1392,12 @@ static inline int sk_has_allocations(const struct sock *sk)
 }
 
 /**
- * sk_has_sleeper - check if there are any waiting processes
- * @sk: socket
+ * wq_has_sleeper - check if there are any waiting processes
+ * @sk: struct socket_wq
  *
- * Returns true if socket has waiting processes
+ * Returns true if socket_wq has waiting processes
  *
- * The purpose of the sk_has_sleeper and sock_poll_wait is to wrap the memory
+ * The purpose of the wq_has_sleeper and sock_poll_wait is to wrap the memory
  * barrier call. They were added due to the race found within the tcp code.
  *
  * Consider following tcp code paths:
@@ -1345,9 +1410,10 @@ static inline int sk_has_allocations(const struct sock *sk)
  *   ...                 ...
  *   tp->rcv_nxt check   sock_def_readable
  *   ...                 {
- *   schedule               ...
- *                          if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
- *                              wake_up_interruptible(sk->sk_sleep)
+ *   schedule               rcu_read_lock();
+ *                          wq = rcu_dereference(sk->sk_wq);
+ *                          if (wq && waitqueue_active(&wq->wait))
+ *                              wake_up_interruptible(&wq->wait)
  *                          ...
  *                       }
  *
@@ -1356,19 +1422,18 @@ static inline int sk_has_allocations(const struct sock *sk)
  * could then endup calling schedule and sleep forever if there are no more
  * data on the socket.
  *
- * The sk_has_sleeper is always called right after a call to read_lock, so we
- * can use smp_mb__after_lock barrier.
  */
-static inline int sk_has_sleeper(struct sock *sk)
+static inline bool wq_has_sleeper(struct socket_wq *wq)
 {
+
         /*
          * We need to be sure we are in sync with the
          * add_wait_queue modifications to the wait queue.
          *
          * This memory barrier is paired in the sock_poll_wait.
          */
-        smp_mb__after_lock();
-        return sk->sk_sleep && waitqueue_active(sk->sk_sleep);
+        smp_mb();
+        return wq && waitqueue_active(&wq->wait);
 }
 
 /**
@@ -1377,7 +1442,7 @@ static inline int sk_has_sleeper(struct sock *sk)
  * @wait_address:   socket wait queue
  * @p:              poll_table
  *
- * See the comments in the sk_has_sleeper function.
+ * See the comments in the wq_has_sleeper function.
  */
 static inline void sock_poll_wait(struct file *filp,
                 wait_queue_head_t *wait_address, poll_table *p)
@@ -1388,7 +1453,7 @@ static inline void sock_poll_wait(struct file *filp,
                  * We need to be sure we are in sync with the
                  * socket flags modification.
                  *
-                 * This memory barrier is paired in the sk_has_sleeper.
+                 * This memory barrier is paired in the wq_has_sleeper.
                 */
                 smp_mb();
         }
@@ -1570,7 +1635,24 @@ sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
                 sk->sk_stamp = kt;
 }
 
-extern void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk, struct sk_buff *skb);
+extern void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+                                     struct sk_buff *skb);
+
+static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+                                          struct sk_buff *skb)
+{
+#define FLAGS_TS_OR_DROPS ((1UL << SOCK_RXQ_OVFL)                       | \
+                           (1UL << SOCK_RCVTSTAMP)                      | \
+                           (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE)       | \
+                           (1UL << SOCK_TIMESTAMPING_SOFTWARE)          | \
+                           (1UL << SOCK_TIMESTAMPING_RAW_HARDWARE)      | \
+                           (1UL << SOCK_TIMESTAMPING_SYS_HARDWARE))
+
+        if (sk->sk_flags & FLAGS_TS_OR_DROPS)
+                __sock_recv_ts_and_drops(msg, sk, skb);
+        else
+                sk->sk_stamp = skb->tstamp;
+}
 
 /**
  * sock_tx_timestamp - checks whether the outgoing packet is to be time stamped
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 70c5159f4b36..fb5c66b2ab81 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -294,6 +294,7 @@ extern struct proto tcp_prot;
 #define TCP_INC_STATS_BH(net, field)    SNMP_INC_STATS_BH((net)->mib.tcp_statistics, field)
 #define TCP_DEC_STATS(net, field)       SNMP_DEC_STATS((net)->mib.tcp_statistics, field)
 #define TCP_ADD_STATS_USER(net, field, val) SNMP_ADD_STATS_USER((net)->mib.tcp_statistics, field, val)
+#define TCP_ADD_STATS(net, field, val)  SNMP_ADD_STATS((net)->mib.tcp_statistics, field, val)
 
 extern void                     tcp_v4_err(struct sk_buff *skb, u32);
 
@@ -939,7 +940,7 @@ static inline int tcp_prequeue(struct sock *sk, struct sk_buff *skb)
 
                 tp->ucopy.memory = 0;
         } else if (skb_queue_len(&tp->ucopy.prequeue) == 1) {
-                wake_up_interruptible_sync_poll(sk->sk_sleep,
+                wake_up_interruptible_sync_poll(sk_sleep(sk),
                                            POLLIN | POLLRDNORM | POLLRDBAND);
                 if (!inet_csk_ack_scheduled(sk))
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
@@ -1032,6 +1033,14 @@ static inline int keepalive_probes(const struct tcp_sock *tp)
         return tp->keepalive_probes ? : sysctl_tcp_keepalive_probes;
 }
 
+static inline u32 keepalive_time_elapsed(const struct tcp_sock *tp)
+{
+        const struct inet_connection_sock *icsk = &tp->inet_conn;
+
+        return min_t(u32, tcp_time_stamp - icsk->icsk_ack.lrcvtime,
+                          tcp_time_stamp - tp->rcv_tstamp);
+}
+
 static inline int tcp_fin_time(const struct sock *sk)
 {
         int fin_timeout = tcp_sk(sk)->linger2 ? : sysctl_tcp_fin_timeout;
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index d65381cad0fc..42a0eb68b7b6 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -44,7 +44,8 @@ extern int			datagram_send_ctl(struct net *net,
                                                   struct msghdr *msg,
                                                   struct flowi *fl,
                                                   struct ipv6_txoptions *opt,
-                                                  int *hlimit, int *tclass);
+                                                  int *hlimit, int *tclass,
+                                                  int *dontfrag);
 
 #define         LOOPBACK4_IPV6          cpu_to_be32(0x7f000006)
 
diff --git a/include/net/x25device.h b/include/net/x25device.h
index 1415bcf93980..1fa08b49f1c2 100644
--- a/include/net/x25device.h
+++ b/include/net/x25device.h
@@ -3,6 +3,7 @@
 
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
+#include <linux/if_x25.h>
 #include <linux/skbuff.h>
 
 static inline __be16 x25_type_trans(struct sk_buff *skb, struct net_device *dev)