60 files changed, 1533 insertions, 512 deletions
diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index 008711e8e78..a6326ef8ade 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -40,6 +40,7 @@
 * @P9_DEBUG_FID: fid allocation/deallocation tracking
 * @P9_DEBUG_PKT: packet marshalling/unmarshalling
 * @P9_DEBUG_FSC: FS-cache tracing
+ * @P9_DEBUG_VPKT: Verbose packet debugging (full packet dump)
 *
 * These flags are passed at mount time to turn on various levels of
 * verbosity and tracing which will be output to the system logs.
@@ -57,6 +58,7 @@ enum p9_debug_flags {
        P9_DEBUG_FID =          (1<<9),
        P9_DEBUG_PKT =          (1<<10),
        P9_DEBUG_FSC =          (1<<11),
+        P9_DEBUG_VPKT =         (1<<12),
 };
 #ifdef CONFIG_NET_9P_DEBUG
@@ -74,10 +76,14 @@ do {  \
        } \
 } while (0)
+#define P9_DUMP_PKT(way, pdu) p9pdu_dump(way, pdu)
 #else
 #define P9_DPRINTK(level, format, arg...)  do { } while (0)
+#define P9_DUMP_PKT(way, pdu) do { } while (0)
 #endif
 #define P9_EPRINTK(level, format, arg...) \
 do { \
        printk(level "9p: %s (%d): " \
@@ -175,6 +181,10 @@ enum p9_msg_t {
        P9_RLINK,
        P9_TMKDIR = 72,
        P9_RMKDIR,
+        P9_TRENAMEAT = 74,
+        P9_RRENAMEAT,
+        P9_TUNLINKAT = 76,
+        P9_RUNLINKAT,
        P9_TVERSION = 100,
        P9_RVERSION,
        P9_TAUTH = 102,
@@ -278,6 +288,35 @@ enum p9_perm_t {
        P9_DMSETVTX = 0x00010000,
 };
+/* 9p2000.L open flags */
+#define P9_DOTL_RDONLY        00000000
+#define P9_DOTL_WRONLY        00000001
+#define P9_DOTL_RDWR          00000002
+#define P9_DOTL_NOACCESS      00000003
+#define P9_DOTL_CREATE        00000100
+#define P9_DOTL_EXCL          00000200
+#define P9_DOTL_NOCTTY        00000400
+#define P9_DOTL_TRUNC         00001000
+#define P9_DOTL_APPEND        00002000
+#define P9_DOTL_NONBLOCK      00004000
+#define P9_DOTL_DSYNC         00010000
+#define P9_DOTL_FASYNC        00020000
+#define P9_DOTL_DIRECT        00040000
+#define P9_DOTL_LARGEFILE     00100000
+#define P9_DOTL_DIRECTORY     00200000
+#define P9_DOTL_NOFOLLOW      00400000
+#define P9_DOTL_NOATIME       01000000
+#define P9_DOTL_CLOEXEC       02000000
+#define P9_DOTL_SYNC          04000000
+/* 9p2000.L at flags */
+#define P9_DOTL_AT_REMOVEDIR            0x200
+/* 9p2000.L lock type */
+#define P9_LOCK_TYPE_RDLCK 0
+#define P9_LOCK_TYPE_WRLCK 1
+#define P9_LOCK_TYPE_UNLCK 2
 /**
 * enum p9_qid_t - QID types
 * @P9_QTDIR: directory
@@ -321,21 +360,6 @@ enum p9_qid_t {
 #define P9_READDIRHDRSZ 24
 /**
- * struct p9_str - length prefixed string type
- * @len: length of the string
- * @str: the string
- *
- * The protocol uses length prefixed strings for all
- * string data, so we replicate that for our internal
- * string members.
- */
-struct p9_str {
-        u16 len;
-        char *str;
-};
-/**
 * struct p9_qid - file system entity information
 * @type: 8-bit type &p9_qid_t
 * @version: 16-bit monotonically incrementing version number
@@ -371,11 +395,11 @@ struct p9_qid {
 * @atime: Last access/read time
 * @mtime: Last modify/write time
 * @length: file length
- * @name: last element of path (aka filename) in type &p9_str
+ * @name: last element of path (aka filename)
- * @uid: owner name in type &p9_str
+ * @uid: owner name
- * @gid: group owner in type &p9_str
+ * @gid: group owner
- * @muid: last modifier in type &p9_str
+ * @muid: last modifier
- * @extension: area used to encode extended UNIX support in type &p9_str
+ * @extension: area used to encode extended UNIX support
 * @n_uid: numeric user id of owner (part of 9p2000.u extension)
 * @n_gid: numeric group id (part of 9p2000.u extension)
 * @n_muid: numeric user id of laster modifier (part of 9p2000.u extension)
@@ -512,11 +536,6 @@ struct p9_getlock {
        char *client_id;
 };
-/* Structures for Protocol Operations */
-struct p9_tstatfs {
-        u32 fid;
-};
 struct p9_rstatfs {
        u32 type;
        u32 bsize;
@@ -529,159 +548,6 @@ struct p9_rstatfs {
        u32 namelen;
 };
-struct p9_trename {
-        u32 fid;
-        u32 newdirfid;
-        struct p9_str name;
-};
-struct p9_rrename {
-};
-struct p9_tversion {
-        u32 msize;
-        struct p9_str version;
-};
-struct p9_rversion {
-        u32 msize;
-        struct p9_str version;
-};
-struct p9_tauth {
-        u32 afid;
-        struct p9_str uname;
-        struct p9_str aname;
-        u32 n_uname;            /* 9P2000.u extensions */
-};
-struct p9_rauth {
-        struct p9_qid qid;
-};
-struct p9_rerror {
-        struct p9_str error;
-        u32 errno;              /* 9p2000.u extension */
-};
-struct p9_tflush {
-        u16 oldtag;
-};
-struct p9_rflush {
-};
-struct p9_tattach {
-        u32 fid;
-        u32 afid;
-        struct p9_str uname;
-        struct p9_str aname;
-        u32 n_uname;            /* 9P2000.u extensions */
-};
-struct p9_rattach {
-        struct p9_qid qid;
-};
-struct p9_twalk {
-        u32 fid;
-        u32 newfid;
-        u16 nwname;
-        struct p9_str wnames[16];
-};
-struct p9_rwalk {
-        u16 nwqid;
-        struct p9_qid wqids[16];
-};
-struct p9_topen {
-        u32 fid;
-        u8 mode;
-};
-struct p9_ropen {
-        struct p9_qid qid;
-        u32 iounit;
-};
-struct p9_tcreate {
-        u32 fid;
-        struct p9_str name;
-        u32 perm;
-        u8 mode;
-        struct p9_str extension;
-};
-struct p9_rcreate {
-        struct p9_qid qid;
-        u32 iounit;
-};
-struct p9_tread {
-        u32 fid;
-        u64 offset;
-        u32 count;
-};
-struct p9_rread {
-        u32 count;
-        u8 *data;
-};
-struct p9_twrite {
-        u32 fid;
-        u64 offset;
-        u32 count;
-        u8 *data;
-};
-struct p9_rwrite {
-        u32 count;
-};
-struct p9_treaddir {
-        u32 fid;
-        u64 offset;
-        u32 count;
-};
-struct p9_rreaddir {
-        u32 count;
-        u8 *data;
-};
-struct p9_tclunk {
-        u32 fid;
-};
-struct p9_rclunk {
-};
-struct p9_tremove {
-        u32 fid;
-};
-struct p9_rremove {
-};
-struct p9_tstat {
-        u32 fid;
-};
-struct p9_rstat {
-        struct p9_wstat stat;
-};
-struct p9_twstat {
-        u32 fid;
-        struct p9_wstat stat;
-};
-struct p9_rwstat {
-};
 /**
 * struct p9_fcall - primary packet structure
 * @size: prefixed length of the structure
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index d26d5e98a17..55ce72ce986 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -36,9 +36,9 @@
 */
 enum p9_proto_versions{
-        p9_proto_legacy = 0,
+        p9_proto_legacy,
-        p9_proto_2000u = 1,
+        p9_proto_2000u,
-        p9_proto_2000L = 2,
+        p9_proto_2000L,
 };
@@ -211,7 +211,10 @@ struct p9_dirent {
 };
 int p9_client_statfs(struct p9_fid *fid, struct p9_rstatfs *sb);
-int p9_client_rename(struct p9_fid *fid, struct p9_fid *newdirfid, char *name);
+int p9_client_rename(struct p9_fid *fid, struct p9_fid *newdirfid,
+                     const char *name);
+int p9_client_renameat(struct p9_fid *olddirfid, const char *old_name,
+                       struct p9_fid *newdirfid, const char *new_name);
 struct p9_client *p9_client_create(const char *dev_name, char *options);
 void p9_client_destroy(struct p9_client *clnt);
 void p9_client_disconnect(struct p9_client *clnt);
@@ -231,6 +234,7 @@ int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
 int p9_client_clunk(struct p9_fid *fid);
 int p9_client_fsync(struct p9_fid *fid, int datasync);
 int p9_client_remove(struct p9_fid *fid);
+int p9_client_unlinkat(struct p9_fid *dfid, const char *name, int flags);
 int p9_client_read(struct p9_fid *fid, char *data, char __user *udata,
                                                        u64 offset, u32 count);
 int p9_client_write(struct p9_fid *fid, char *data, const char __user *udata,
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index d8549fb9c74..83531ebeee9 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -67,7 +67,7 @@ struct p9_trans_module {
 void v9fs_register_trans(struct p9_trans_module *m);
 void v9fs_unregister_trans(struct p9_trans_module *m);
-struct p9_trans_module *v9fs_get_trans_by_name(const substring_t *name);
+struct p9_trans_module *v9fs_get_trans_by_name(char *s);
 struct p9_trans_module *v9fs_get_default_trans(void);
 void v9fs_put_trans(struct p9_trans_module *m);
 #endif /* NET_9P_TRANSPORT_H */
diff --git a/include/net/act_api.h b/include/net/act_api.h
index bab385f13ac..c739531e156 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -72,7 +72,7 @@ struct tcf_act_hdr {
 struct tc_action {
        void                    *priv;
-        struct tc_action_ops    *ops;
+        const struct tc_action_ops      *ops;
        __u32                   type; /* for backward compat(TCA_OLD_COMPAT) */
        __u32                   order;
        struct tc_action        *next;
@@ -86,7 +86,7 @@ struct tc_action_ops {
        __u32   type; /* TBD to match kind */
        __u32   capab;  /* capabilities includes 4 bit version */
        struct module           *owner;
-        int     (*act)(struct sk_buff *, struct tc_action *, struct tcf_result *);
+        int     (*act)(struct sk_buff *, const struct tc_action *, struct tcf_result *);
        int     (*get_stats)(struct sk_buff *, struct tc_action *);
        int     (*dump)(struct sk_buff *, struct tc_action *, int, int);
        int     (*cleanup)(struct tc_action *, int bind);
@@ -115,7 +115,7 @@ extern void tcf_hash_insert(struct tcf_common *p, struct tcf_hashinfo *hinfo);
 extern int tcf_register_action(struct tc_action_ops *a);
 extern int tcf_unregister_action(struct tc_action_ops *a);
 extern void tcf_action_destroy(struct tc_action *a, int bind);
-extern int tcf_action_exec(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res);
+extern int tcf_action_exec(struct sk_buff *skb, const struct tc_action *a, struct tcf_result *res);
 extern struct tc_action *tcf_action_init(struct nlattr *nla, struct nlattr *est, char *n, int ovr, int bind);
 extern struct tc_action *tcf_action_init_1(struct nlattr *nla, struct nlattr *est, char *n, int ovr, int bind);
 extern int tcf_action_dump(struct sk_buff *skb, struct tc_action *a, int, int);
diff --git a/include/net/activity_stats.h b/include/net/activity_stats.h
new file mode 100644
index 00000000000..10e4c1506ee
--- /dev/null
+++ b/include/net/activity_stats.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2010 Google, Inc.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Author: Mike Chan (mike@android.com)
+ */
+#ifndef __activity_stats_h
+#define __activity_stats_h
+#ifdef CONFIG_NET_ACTIVITY_STATS
+void activity_stats_update(void);
+#else
+#define activity_stats_update(void) {}
+#endif
+#endif /* _NET_ACTIVITY_STATS_H */
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 582e4ae7075..cbc6bb0a683 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -8,7 +8,7 @@
 #define TEMP_VALID_LIFETIME             (7*86400)
 #define TEMP_PREFERRED_LIFETIME         (86400)
-#define REGEN_MAX_RETRY                 (5)
+#define REGEN_MAX_RETRY                 (3)
 #define MAX_DESYNC_FACTOR               (600)
 #define ADDR_CHECK_FREQUENCY            (120*HZ)
diff --git a/include/net/arp.h b/include/net/arp.h
index 91f0568a04e..4979af8b155 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -8,6 +8,36 @@
 extern struct neigh_table arp_tbl;
+static inline u32 arp_hashfn(u32 key, const struct net_device *dev, u32 hash_rnd)
+{
+        u32 val = key ^ dev->ifindex;
+        return val * hash_rnd;
+}
+static inline struct neighbour *__ipv4_neigh_lookup(struct neigh_table *tbl, struct net_device *dev, u32 key)
+{
+        struct neigh_hash_table *nht;
+        struct neighbour *n;
+        u32 hash_val;
+        rcu_read_lock_bh();
+        nht = rcu_dereference_bh(tbl->nht);
+        hash_val = arp_hashfn(key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
+        for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
+             n != NULL;
+             n = rcu_dereference_bh(n->next)) {
+                if (n->dev == dev && *(u32 *)n->primary_key == key) {
+                        if (!atomic_inc_not_zero(&n->refcnt))
+                                n = NULL;
+                        break;
+                }
+        }
+        rcu_read_unlock_bh();
+        return n;
+}
 extern void     arp_init(void);
 extern int      arp_find(unsigned char *haddr, struct sk_buff *skb);
 extern int      arp_ioctl(struct net *net, unsigned int cmd, void __user *arg);
@@ -15,7 +45,6 @@ extern void     arp_send(int type, int ptype, __be32 dest_ip,
                         struct net_device *dev, __be32 src_ip,
                         const unsigned char *dest_hw,
                         const unsigned char *src_hw, const unsigned char *th);
-extern int      arp_bind_neighbour(struct dst_entry *dst);
 extern int      arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir);
 extern void     arp_ifdown(struct net_device *dev);
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 206d22297ac..94e09d361bb 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -11,7 +11,7 @@
 #include <linux/timer.h>
 #include <linux/list.h>
 #include <linux/slab.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #define AX25_T1CLAMPLO                  1
 #define AX25_T1CLAMPHI                  (30 * HZ)
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 43750439c52..e727555d4ee 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -56,6 +56,7 @@
 #define BT_SECURITY     4
 struct bt_security {
        __u8 level;
+        __u8 key_size;
 };
 #define BT_SECURITY_SDP         0
 #define BT_SECURITY_LOW         1
@@ -69,9 +70,19 @@ struct bt_security {
 #define BT_FLUSHABLE_OFF        0
 #define BT_FLUSHABLE_ON         1
-#define BT_INFO(fmt, arg...) printk(KERN_INFO "Bluetooth: " fmt "\n" , ## arg)
+#define BT_POWER        9
-#define BT_ERR(fmt, arg...)  printk(KERN_ERR "%s: " fmt "\n" , __func__ , ## arg)
+struct bt_power {
-#define BT_DBG(fmt, arg...)  pr_debug("%s: " fmt "\n" , __func__ , ## arg)
+        __u8 force_active;
+};
+#define BT_POWER_FORCE_ACTIVE_OFF 0
+#define BT_POWER_FORCE_ACTIVE_ON  1
+__attribute__((format (printf, 2, 3)))
+int bt_printk(const char *level, const char *fmt, ...);
+#define BT_INFO(fmt, arg...)   bt_printk(KERN_INFO, pr_fmt(fmt), ##arg)
+#define BT_ERR(fmt, arg...)    bt_printk(KERN_ERR, pr_fmt(fmt), ##arg)
+#define BT_DBG(fmt, arg...)    pr_debug(fmt "\n", ##arg)
 /* Connection and socket states */
 enum {
@@ -130,7 +141,8 @@ int  bt_sock_register(int proto, const struct net_proto_family *ops);
 int  bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
-int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags);
+int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
+                                struct msghdr *msg, size_t len, int flags);
 int  bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                        struct msghdr *msg, size_t len, int flags);
 uint bt_sock_poll(struct file * file, struct socket *sock, poll_table *wait);
@@ -150,6 +162,7 @@ struct bt_skb_cb {
        __u8 retries;
        __u8 sar;
        unsigned short channel;
+        __u8 force_active;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
@@ -164,8 +177,8 @@ static inline struct sk_buff *bt_skb_alloc(unsigned int len, gfp_t how)
        return skb;
 }
-static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk, unsigned long len, 
+static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk,
-                                                        int nb, int *err)
+                                        unsigned long len, int nb, int *err)
 {
        struct sk_buff *skb;
@@ -195,7 +208,7 @@ out:
        return NULL;
 }
-int bt_err(__u16 code);
+int bt_to_errno(__u16 code);
 extern int hci_sock_init(void);
 extern void hci_sock_cleanup(void);
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 0c20227e57f..915d7ae527b 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -37,6 +37,7 @@
 #define HCI_DEV_DOWN                    4
 #define HCI_DEV_SUSPEND                 5
 #define HCI_DEV_RESUME                  6
+#define HCI_DEV_WRITE                   7
 /* HCI notify events */
 #define HCI_NOTIFY_CONN_ADD             1
@@ -157,8 +158,10 @@ enum {
 #define ESCO_2EV5       0x0100
 #define ESCO_3EV5       0x0200
-#define SCO_ESCO_MASK  (ESCO_HV1 | ESCO_HV2 | ESCO_HV3)
+#define SCO_ESCO_MASK   (ESCO_HV1 | ESCO_HV2 | ESCO_HV3)
-#define EDR_ESCO_MASK  (ESCO_2EV3 | ESCO_3EV3 | ESCO_2EV5 | ESCO_3EV5)
+#define EDR_ESCO_MASK   (ESCO_2EV3 | ESCO_3EV3 | ESCO_2EV5 | ESCO_3EV5)
+#define ALL_ESCO_MASK   (SCO_ESCO_MASK | ESCO_EV3 | ESCO_EV4 | ESCO_EV5 | \
+                        EDR_ESCO_MASK)
 /* ACL flags */
 #define ACL_START_NO_FLUSH      0x00
@@ -211,11 +214,16 @@ enum {
 #define LMP_EDR_3S_ESCO 0x80
 #define LMP_EXT_INQ     0x01
+#define LMP_SIMUL_LE_BR 0x02
 #define LMP_SIMPLE_PAIR 0x08
 #define LMP_NO_FLUSH    0x40
 #define LMP_LSTO        0x01
 #define LMP_INQ_TX_PWR  0x02
+#define LMP_EXTFEATURES 0x80
+/* Extended LMP features */
+#define LMP_HOST_LE     0x02
 /* Connection modes */
 #define HCI_CM_ACTIVE   0x0000
@@ -254,6 +262,10 @@ enum {
 #define HCI_LK_UNAUTH_COMBINATION       0x04
 #define HCI_LK_AUTH_COMBINATION         0x05
 #define HCI_LK_CHANGED_COMBINATION      0x06
+/* The spec doesn't define types for SMP keys */
+#define HCI_LK_SMP_LTK                  0x81
+#define HCI_LK_SMP_IRK                  0x82
+#define HCI_LK_SMP_CSRK                 0x83
 /* -----  HCI Commands ---- */
 #define HCI_OP_NOP                      0x0000
@@ -653,6 +665,12 @@ struct hci_rp_read_local_oob_data {
 #define HCI_OP_READ_INQ_RSP_TX_POWER    0x0c58
+#define HCI_OP_WRITE_LE_HOST_SUPPORTED  0x0c6d
+struct hci_cp_write_le_host_supported {
+        __u8 le;
+        __u8 simul;
+} __packed;
 #define HCI_OP_READ_LOCAL_VERSION       0x1001
 struct hci_rp_read_local_version {
        __u8     status;
@@ -676,6 +694,9 @@ struct hci_rp_read_local_features {
 } __packed;
 #define HCI_OP_READ_LOCAL_EXT_FEATURES  0x1004
+struct hci_cp_read_local_ext_features {
+        __u8     page;
+} __packed;
 struct hci_rp_read_local_ext_features {
        __u8     status;
        __u8     page;
@@ -710,6 +731,12 @@ struct hci_rp_le_read_buffer_size {
        __u8     le_max_pkt;
 } __packed;
+#define HCI_OP_LE_SET_SCAN_ENABLE       0x200c
+struct hci_cp_le_set_scan_enable {
+        __u8     enable;
+        __u8     filter_dup;
+} __packed;
 #define HCI_OP_LE_CREATE_CONN           0x200d
 struct hci_cp_le_create_conn {
        __le16   scan_interval;
@@ -739,6 +766,33 @@ struct hci_cp_le_conn_update {
        __le16   max_ce_len;
 } __packed;
+#define HCI_OP_LE_START_ENC             0x2019
+struct hci_cp_le_start_enc {
+        __le16  handle;
+        __u8    rand[8];
+        __le16  ediv;
+        __u8    ltk[16];
+} __packed;
+#define HCI_OP_LE_LTK_REPLY             0x201a
+struct hci_cp_le_ltk_reply {
+        __le16  handle;
+        __u8    ltk[16];
+} __packed;
+struct hci_rp_le_ltk_reply {
+        __u8    status;
+        __le16  handle;
+} __packed;
+#define HCI_OP_LE_LTK_NEG_REPLY         0x201b
+struct hci_cp_le_ltk_neg_reply {
+        __le16  handle;
+} __packed;
+struct hci_rp_le_ltk_neg_reply {
+        __u8    status;
+        __le16  handle;
+} __packed;
 /* ---- HCI Events ---- */
 #define HCI_EV_INQUIRY_COMPLETE         0x01
@@ -1029,6 +1083,32 @@ struct hci_ev_le_conn_complete {
        __u8     clk_accurancy;
 } __packed;
+#define HCI_EV_LE_LTK_REQ               0x05
+struct hci_ev_le_ltk_req {
+        __le16  handle;
+        __u8    random[8];
+        __le16  ediv;
+} __packed;
+/* Advertising report event types */
+#define ADV_IND         0x00
+#define ADV_DIRECT_IND  0x01
+#define ADV_SCAN_IND    0x02
+#define ADV_NONCONN_IND 0x03
+#define ADV_SCAN_RSP    0x04
+#define ADDR_LE_DEV_PUBLIC      0x00
+#define ADDR_LE_DEV_RANDOM      0x01
+#define HCI_EV_LE_ADVERTISING_REPORT    0x02
+struct hci_ev_le_advertising_info {
+        __u8     evt_type;
+        __u8     bdaddr_type;
+        bdaddr_t bdaddr;
+        __u8     length;
+        __u8     data[0];
+} __packed;
 /* Internal events generated by Bluetooth stack */
 #define HCI_EV_STACK_INTERNAL   0xfd
 struct hci_ev_stack_internal {
@@ -1184,6 +1264,9 @@ struct hci_conn_info {
        __u8     out;
        __u16    state;
        __u32    link_mode;
+        __u32    mtu;
+        __u32    cnt;
+        __u32    pkts;
 };
 struct hci_dev_req {
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 6c994c004d1..626f8b0a679 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -25,6 +25,7 @@
 #ifndef __HCI_CORE_H
 #define __HCI_CORE_H
+#include <linux/interrupt.h>
 #include <net/bluetooth/hci.h>
 /* HCI upper protocols */
@@ -74,12 +75,28 @@ struct bt_uuid {
        u8 svc_hint;
 };
+struct key_master_id {
+        __le16 ediv;
+        u8 rand[8];
+} __packed;
+struct link_key_data {
+        bdaddr_t bdaddr;
+        u8 type;
+        u8 val[16];
+        u8 pin_len;
+        u8 dlen;
+        u8 data[0];
+} __packed;
 struct link_key {
        struct list_head list;
        bdaddr_t bdaddr;
        u8 type;
        u8 val[16];
        u8 pin_len;
+        u8 dlen;
+        u8 data[0];
 };
 struct oob_data {
@@ -89,6 +106,12 @@ struct oob_data {
        u8 randomizer[16];
 };
+struct adv_entry {
+        struct list_head list;
+        bdaddr_t bdaddr;
+        u8 bdaddr_type;
+};
 #define NUM_REASSEMBLY 4
 struct hci_dev {
        struct list_head list;
@@ -107,6 +130,7 @@ struct hci_dev {
        __u8            major_class;
        __u8            minor_class;
        __u8            features[8];
+        __u8            extfeatures[8];
        __u8            commands[64];
        __u8            ssp_mode;
        __u8            hci_ver;
@@ -171,6 +195,8 @@ struct hci_dev {
        __u16                   init_last_cmd;
+        struct crypto_blkcipher *tfm;
        struct inquiry_cache    inq_cache;
        struct hci_conn_hash    conn_hash;
        struct list_head        blacklist;
@@ -181,6 +207,9 @@ struct hci_dev {
        struct list_head        remote_oob_data;
+        struct list_head        adv_entries;
+        struct timer_list       adv_timer;
        struct hci_dev_stats    stat;
        struct sk_buff_head     driver_init;
@@ -212,9 +241,9 @@ struct hci_conn {
        struct list_head list;
        atomic_t        refcnt;
-        spinlock_t      lock;
        bdaddr_t        dst;
+        __u8            dst_type;
        __u16           handle;
        __u16           state;
        __u8            mode;
@@ -233,6 +262,7 @@ struct hci_conn {
        __u8            sec_level;
        __u8            pending_sec_level;
        __u8            pin_length;
+        __u8            enc_key_size;
        __u8            io_capability;
        __u8            power_save;
        __u16           disc_timeout;
@@ -259,7 +289,6 @@ struct hci_conn {
        struct hci_dev  *hdev;
        void            *l2cap_data;
        void            *sco_data;
-        void            *priv;
        struct hci_conn *link;
@@ -307,12 +336,14 @@ static inline long inquiry_entry_age(struct inquiry_entry *e)
        return jiffies - e->timestamp;
 }
-struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
+struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
+                                                        bdaddr_t *bdaddr);
 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data);
 /* ----- HCI Connections ----- */
 enum {
        HCI_CONN_AUTH_PEND,
+        HCI_CONN_REAUTH_PEND,
        HCI_CONN_ENCRYPT_PEND,
        HCI_CONN_RSWITCH_PEND,
        HCI_CONN_MODE_CHANGE_PEND,
@@ -415,19 +446,22 @@ void hci_add_sco(struct hci_conn *conn, __u16 handle);
 void hci_setup_sync(struct hci_conn *conn, __u16 handle);
 void hci_sco_setup(struct hci_conn *conn, __u8 status);
-struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst);
+struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type,
+                                        __u16 pkt_type, bdaddr_t *dst);
 int hci_conn_del(struct hci_conn *conn);
 void hci_conn_hash_flush(struct hci_dev *hdev);
 void hci_conn_check_pending(struct hci_dev *hdev);
-struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type);
+struct hci_conn *hci_connect(struct hci_dev *hdev, int type,
+                                                __u16 pkt_type, bdaddr_t *dst,
+                                                __u8 sec_level, __u8 auth_type);
 int hci_conn_check_link_mode(struct hci_conn *conn);
 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type);
 int hci_conn_change_link_key(struct hci_conn *conn);
 int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
-void hci_conn_enter_active_mode(struct hci_conn *conn);
+void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
 void hci_conn_enter_sniff_mode(struct hci_conn *conn);
 void hci_conn_hold_device(struct hci_conn *conn);
@@ -448,11 +482,13 @@ static inline void hci_conn_put(struct hci_conn *conn)
                        if (conn->state == BT_CONNECTED) {
                                timeo = msecs_to_jiffies(conn->disc_timeout);
                                if (!conn->out)
-                                        timeo *= 2;
+                                        timeo *= 20;
-                        } else
+                        } else {
                                timeo = msecs_to_jiffies(10);
-                } else
+                        }
+                } else {
                        timeo = msecs_to_jiffies(10);
+                }
                mod_timer(&conn->disc_timer, jiffies + timeo);
        }
 }
@@ -511,6 +547,8 @@ int hci_inquiry(void __user *arg);
 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_blacklist_clear(struct hci_dev *hdev);
+int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_uuids_clear(struct hci_dev *hdev);
@@ -518,6 +556,11 @@ int hci_link_keys_clear(struct hci_dev *hdev);
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                        bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
+struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
+struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
+                                        bdaddr_t *bdaddr, u8 type);
+int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
+                        u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16]);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_remote_oob_data_clear(struct hci_dev *hdev);
@@ -527,6 +570,12 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
                                                                u8 *randomizer);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
+#define ADV_CLEAR_TIMEOUT (3*60*HZ) /* Three minutes */
+int hci_adv_entries_clear(struct hci_dev *hdev);
+struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int hci_add_adv_entry(struct hci_dev *hdev,
+                                        struct hci_ev_le_advertising_info *ev);
 void hci_del_off_timer(struct hci_dev *hdev);
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
@@ -553,6 +602,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define lmp_no_flush_capable(dev)  ((dev)->features[6] & LMP_NO_FLUSH)
 #define lmp_le_capable(dev)        ((dev)->features[4] & LMP_LE)
+/* ----- Extended LMP capabilities ----- */
+#define lmp_host_le_capable(dev)   ((dev)->extfeatures[0] & LMP_HOST_LE)
 /* ----- HCI protocols ----- */
 struct hci_proto {
        char            *name;
@@ -561,16 +613,20 @@ struct hci_proto {
        void            *priv;
-        int (*connect_ind)      (struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type);
+        int (*connect_ind)      (struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                                                __u8 type);
        int (*connect_cfm)      (struct hci_conn *conn, __u8 status);
        int (*disconn_ind)      (struct hci_conn *conn);
        int (*disconn_cfm)      (struct hci_conn *conn, __u8 reason);
-        int (*recv_acldata)     (struct hci_conn *conn, struct sk_buff *skb, __u16 flags);
+        int (*recv_acldata)     (struct hci_conn *conn, struct sk_buff *skb,
+                                                                __u16 flags);
        int (*recv_scodata)     (struct hci_conn *conn, struct sk_buff *skb);
-        int (*security_cfm)     (struct hci_conn *conn, __u8 status, __u8 encrypt);
+        int (*security_cfm)     (struct hci_conn *conn, __u8 status,
+                                                                __u8 encrypt);
 };
-static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
+static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                                                __u8 type)
 {
        register struct hci_proto *hp;
        int mask = 0;
@@ -656,7 +712,8 @@ static inline void hci_proto_auth_cfm(struct hci_conn *conn, __u8 status)
                conn->security_cfm_cb(conn, status);
 }
-static inline void hci_proto_encrypt_cfm(struct hci_conn *conn, __u8 status, __u8 encrypt)
+static inline void hci_proto_encrypt_cfm(struct hci_conn *conn, __u8 status,
+                                                                __u8 encrypt)
 {
        register struct hci_proto *hp;
@@ -681,7 +738,8 @@ struct hci_cb {
        char *name;
-        void (*security_cfm)    (struct hci_conn *conn, __u8 status, __u8 encrypt);
+        void (*security_cfm)    (struct hci_conn *conn, __u8 status,
+                                                                __u8 encrypt);
        void (*key_change_cfm)  (struct hci_conn *conn, __u8 status);
        void (*role_switch_cfm) (struct hci_conn *conn, __u8 status, __u8 role);
 };
@@ -707,13 +765,17 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
        read_unlock_bh(&hci_cb_list_lock);
 }
-static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status, __u8 encrypt)
+static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
+                                                                __u8 encrypt)
 {
        struct list_head *p;
        if (conn->sec_level == BT_SECURITY_SDP)
                conn->sec_level = BT_SECURITY_LOW;
+        if (conn->pending_sec_level > conn->sec_level)
+                conn->sec_level = conn->pending_sec_level;
        hci_proto_encrypt_cfm(conn, status, encrypt);
        read_lock_bh(&hci_cb_list_lock);
@@ -738,7 +800,8 @@ static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
        read_unlock_bh(&hci_cb_list_lock);
 }
-static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status, __u8 role)
+static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
+                                                                __u8 role)
 {
        struct list_head *p;
@@ -830,4 +893,9 @@ void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result);
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                        u16 latency, u16 to_multiplier);
+void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
+                                                        __u8 ltk[16]);
+void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]);
+void hci_le_ltk_neg_reply(struct hci_conn *conn);
 #endif /* __HCI_CORE_H */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index d09c9b1118e..4f34ad25e75 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -37,7 +37,6 @@
 #define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
 #define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
 #define L2CAP_DEFAULT_ACK_TO            200
-#define L2CAP_LOCAL_BUSY_TRIES          12
 #define L2CAP_LE_DEFAULT_MTU            23
 #define L2CAP_CONN_TIMEOUT      (40000) /* 40 seconds */
@@ -130,6 +129,12 @@ struct l2cap_conninfo {
 #define L2CAP_SDU_END               0x8000
 #define L2CAP_SDU_CONTINUE          0xC000
+/* L2CAP Command rej. reasons */
+#define L2CAP_REJ_NOT_UNDERSTOOD      0x0000
+#define L2CAP_REJ_MTU_EXCEEDED        0x0001
+#define L2CAP_REJ_INVALID_CID         0x0002
 /* L2CAP structures */
 struct l2cap_hdr {
        __le16     len;
@@ -144,8 +149,19 @@ struct l2cap_cmd_hdr {
 } __packed;
 #define L2CAP_CMD_HDR_SIZE      4
-struct l2cap_cmd_rej {
+struct l2cap_cmd_rej_unk {
+        __le16     reason;
+} __packed;
+struct l2cap_cmd_rej_mtu {
+        __le16     reason;
+        __le16     max_mtu;
+} __packed;
+struct l2cap_cmd_rej_cid {
        __le16     reason;
+        __le16     scid;
+        __le16     dcid;
 } __packed;
 struct l2cap_conn_req {
@@ -287,6 +303,10 @@ struct l2cap_chan {
        struct l2cap_conn       *conn;
+        __u8            state;
+        atomic_t        refcnt;
        __le16          psm;
        __u16           dcid;
        __u16           scid;
@@ -295,6 +315,7 @@ struct l2cap_chan {
        __u16           omtu;
        __u16           flush_to;
        __u8            mode;
+        __u8            chan_type;
        __le16          sport;
@@ -302,6 +323,7 @@ struct l2cap_chan {
        __u8            role_switch;
        __u8            force_reliable;
        __u8            flushable;
+        __u8            force_active;
        __u8            ident;
@@ -318,8 +340,8 @@ struct l2cap_chan {
        __u16           monitor_timeout;
        __u16           mps;
-        __u8            conf_state;
+        unsigned long   conf_state;
-        __u16           conn_state;
+        unsigned long   conn_state;
        __u8            next_tx_seq;
        __u8            expected_ack_seq;
@@ -339,18 +361,29 @@ struct l2cap_chan {
        __u8            remote_max_tx;
        __u16           remote_mps;
+        struct timer_list       chan_timer;
        struct timer_list       retrans_timer;
        struct timer_list       monitor_timer;
        struct timer_list       ack_timer;
        struct sk_buff          *tx_send_head;
        struct sk_buff_head     tx_q;
        struct sk_buff_head     srej_q;
-        struct sk_buff_head     busy_q;
-        struct work_struct      busy_work;
        struct list_head        srej_l;
        struct list_head list;
        struct list_head global_l;
+        void            *data;
+        struct l2cap_ops *ops;
+};
+struct l2cap_ops {
+        char            *name;
+        struct l2cap_chan       *(*new_connection) (void *data);
+        int                     (*recv) (void *data, struct sk_buff *skb);
+        void                    (*close) (void *data);
+        void                    (*state_change) (void *data, int state);
 };
 struct l2cap_conn {
@@ -376,6 +409,15 @@ struct l2cap_conn {
        __u8            disc_reason;
+        __u8            preq[7]; /* SMP Pairing Request */
+        __u8            prsp[7]; /* SMP Pairing Response */
+        __u8            prnd[16]; /* SMP Pairing Random */
+        __u8            pcnf[16]; /* SMP Pairing Confirm */
+        __u8            tk[16]; /* SMP Temporary Key */
+        __u8            smp_key_size;
+        struct timer_list security_timer;
        struct list_head chan_l;
        rwlock_t        chan_lock;
 };
@@ -384,44 +426,57 @@ struct l2cap_conn {
 #define L2CAP_INFO_FEAT_MASK_REQ_SENT   0x04
 #define L2CAP_INFO_FEAT_MASK_REQ_DONE   0x08
+#define L2CAP_CHAN_RAW                  1
+#define L2CAP_CHAN_CONN_LESS            2
+#define L2CAP_CHAN_CONN_ORIENTED        3
 /* ----- L2CAP socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
 struct l2cap_pinfo {
        struct bt_sock  bt;
        struct l2cap_chan       *chan;
+        struct sk_buff  *rx_busy_skb;
 };
-#define L2CAP_CONF_REQ_SENT       0x01
+enum {
-#define L2CAP_CONF_INPUT_DONE     0x02
+        CONF_REQ_SENT,
-#define L2CAP_CONF_OUTPUT_DONE    0x04
+        CONF_INPUT_DONE,
-#define L2CAP_CONF_MTU_DONE       0x08
+        CONF_OUTPUT_DONE,
-#define L2CAP_CONF_MODE_DONE      0x10
+        CONF_MTU_DONE,
-#define L2CAP_CONF_CONNECT_PEND   0x20
+        CONF_MODE_DONE,
-#define L2CAP_CONF_NO_FCS_RECV    0x40
+        CONF_CONNECT_PEND,
-#define L2CAP_CONF_STATE2_DEVICE  0x80
+        CONF_NO_FCS_RECV,
+        CONF_STATE2_DEVICE,
+};
 #define L2CAP_CONF_MAX_CONF_REQ 2
 #define L2CAP_CONF_MAX_CONF_RSP 2
-#define L2CAP_CONN_SAR_SDU         0x0001
+enum {
-#define L2CAP_CONN_SREJ_SENT       0x0002
+        CONN_SAR_SDU,
-#define L2CAP_CONN_WAIT_F          0x0004
+        CONN_SREJ_SENT,
-#define L2CAP_CONN_SREJ_ACT        0x0008
+        CONN_WAIT_F,
-#define L2CAP_CONN_SEND_PBIT       0x0010
+        CONN_SREJ_ACT,
-#define L2CAP_CONN_REMOTE_BUSY     0x0020
+        CONN_SEND_PBIT,
-#define L2CAP_CONN_LOCAL_BUSY      0x0040
+        CONN_REMOTE_BUSY,
-#define L2CAP_CONN_REJ_ACT         0x0080
+        CONN_LOCAL_BUSY,
-#define L2CAP_CONN_SEND_FBIT       0x0100
+        CONN_REJ_ACT,
-#define L2CAP_CONN_RNR_SENT        0x0200
+        CONN_SEND_FBIT,
-#define L2CAP_CONN_SAR_RETRY       0x0400
+        CONN_RNR_SENT,
+};
-#define __mod_retrans_timer() mod_timer(&chan->retrans_timer, \
-                jiffies +  msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
+#define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
-#define __mod_monitor_timer() mod_timer(&chan->monitor_timer, \
+#define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
-                jiffies + msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
+#define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
-#define __mod_ack_timer() mod_timer(&chan->ack_timer, \
+                L2CAP_DEFAULT_RETRANS_TO);
-                jiffies + msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
+#define __clear_retrans_timer(c) l2cap_clear_timer(c, &c->retrans_timer)
+#define __set_monitor_timer(c) l2cap_set_timer(c, &c->monitor_timer, \
+                L2CAP_DEFAULT_MONITOR_TO);
+#define __clear_monitor_timer(c) l2cap_clear_timer(c, &c->monitor_timer)
+#define __set_ack_timer(c) l2cap_set_timer(c, &chan->ack_timer, \
+                L2CAP_DEFAULT_ACK_TO);
+#define __clear_ack_timer(c) l2cap_clear_timer(c, &c->ack_timer)
 static inline int l2cap_tx_window_full(struct l2cap_chan *ch)
 {
@@ -446,32 +501,17 @@ extern int disable_ertm;
 int l2cap_init_sockets(void);
 void l2cap_cleanup_sockets(void);
-void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data);
 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan);
 int __l2cap_wait_ack(struct sock *sk);
-struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
-struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
-struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len, u16 control, u16 sdulen);
-int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
-void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb);
-void l2cap_streaming_send(struct l2cap_chan *chan);
-int l2cap_ertm_send(struct l2cap_chan *chan);
 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm);
 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
-void l2cap_sock_set_timer(struct sock *sk, long timeout);
-void l2cap_sock_clear_timer(struct sock *sk);
-void __l2cap_sock_close(struct sock *sk, int reason);
-void l2cap_sock_kill(struct sock *sk);
-void l2cap_sock_init(struct sock *sk, struct sock *parent);
-struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
-                                                        int proto, gfp_t prio);
-void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err);
 struct l2cap_chan *l2cap_chan_create(struct sock *sk);
-void l2cap_chan_del(struct l2cap_chan *chan, int err);
+void l2cap_chan_close(struct l2cap_chan *chan, int reason);
 void l2cap_chan_destroy(struct l2cap_chan *chan);
 int l2cap_chan_connect(struct l2cap_chan *chan);
+int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
+void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 4899286ed4e..5428fd32cce 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -101,6 +101,8 @@ struct mgmt_key_info {
        u8 type;
        u8 val[16];
        u8 pin_len;
+        u8 dlen;
+        u8 data[0];
 } __packed;
 #define MGMT_OP_LOAD_KEYS               0x000D
@@ -199,6 +201,16 @@ struct mgmt_cp_remove_remote_oob_data {
 #define MGMT_OP_STOP_DISCOVERY          0x001C
+#define MGMT_OP_BLOCK_DEVICE            0x001D
+struct mgmt_cp_block_device {
+        bdaddr_t bdaddr;
+} __packed;
+#define MGMT_OP_UNBLOCK_DEVICE          0x001E
+struct mgmt_cp_unblock_device {
+        bdaddr_t bdaddr;
+} __packed;
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
        __le16 opcode;
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 6eac4a760c3..d5eee2093b1 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -234,7 +234,8 @@ int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 /* ---- RFCOMM DLCs (channels) ---- */
 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio);
 void rfcomm_dlc_free(struct rfcomm_dlc *d);
-int  rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel);
+int  rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst,
+                                                                u8 channel);
 int  rfcomm_dlc_close(struct rfcomm_dlc *d, int reason);
 int  rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb);
 int  rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig);
@@ -271,7 +272,8 @@ static inline void rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 }
 /* ---- RFCOMM sessions ---- */
-void   rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst);
+void   rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src,
+                                                                bdaddr_t *dst);
 static inline void rfcomm_session_hold(struct rfcomm_session *s)
 {
@@ -312,7 +314,8 @@ struct rfcomm_pinfo {
 int  rfcomm_init_sockets(void);
 void rfcomm_cleanup_sockets(void);
-int  rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d);
+int  rfcomm_connect_ind(struct rfcomm_session *s, u8 channel,
+                                                        struct rfcomm_dlc **d);
 /* ---- RFCOMM TTY ---- */
 #define RFCOMM_MAX_DEV  256
diff --git a/include/net/bluetooth/sco.h b/include/net/bluetooth/sco.h
index 1e35c43657c..6d1857ab8e5 100644
--- a/include/net/bluetooth/sco.h
+++ b/include/net/bluetooth/sco.h
@@ -37,6 +37,7 @@
 struct sockaddr_sco {
        sa_family_t     sco_family;
        bdaddr_t        sco_bdaddr;
+        __u16           sco_pkt_type;
 };
 /* SCO socket options */
@@ -72,7 +73,8 @@ struct sco_conn {
 struct sco_pinfo {
        struct bt_sock  bt;
-        __u32           flags;
+        __u16           pkt_type;
        struct sco_conn *conn;
 };
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
index 8f2edbf979d..46c45761230 100644
--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -1,3 +1,25 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
 #ifndef __SMP_H
 #define __SMP_H
@@ -16,6 +38,23 @@ struct smp_cmd_pairing {
        __u8    resp_key_dist;
 } __packed;
+#define SMP_IO_DISPLAY_ONLY     0x00
+#define SMP_IO_DISPLAY_YESNO    0x01
+#define SMP_IO_KEYBOARD_ONLY    0x02
+#define SMP_IO_NO_INPUT_OUTPUT  0x03
+#define SMP_IO_KEYBOARD_DISPLAY 0x04
+#define SMP_OOB_NOT_PRESENT     0x00
+#define SMP_OOB_PRESENT         0x01
+#define SMP_DIST_ENC_KEY        0x01
+#define SMP_DIST_ID_KEY         0x02
+#define SMP_DIST_SIGN           0x04
+#define SMP_AUTH_NONE           0x00
+#define SMP_AUTH_BONDING        0x01
+#define SMP_AUTH_MITM           0x04
 #define SMP_CMD_PAIRING_CONFIRM 0x03
 struct smp_cmd_pairing_confirm {
        __u8    confirm_val[16];
@@ -73,4 +112,12 @@ struct smp_cmd_security_req {
 #define SMP_UNSPECIFIED         0x08
 #define SMP_REPEATED_ATTEMPTS           0x09
+#define SMP_MIN_ENC_KEY_SIZE            7
+#define SMP_MAX_ENC_KEY_SIZE            16
+/* SMP Commands */
+int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level);
+int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
+int smp_distribute_keys(struct l2cap_conn *conn, __u8 force);
 #endif /* __SMP_H */
diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
new file mode 100644
index 00000000000..c5dedd87b4c
--- /dev/null
+++ b/include/net/caif/caif_hsi.h
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) ST-Ericsson AB 2010
+ * Contact: Sjur Brendeland / sjur.brandeland@stericsson.com
+ * Author:  Daniel Martensson / daniel.martensson@stericsson.com
+ *          Dmitry.Tarnyagin  / dmitry.tarnyagin@stericsson.com
+ * License terms: GNU General Public License (GPL) version 2
+ */
+#ifndef CAIF_HSI_H_
+#define CAIF_HSI_H_
+#include <net/caif/caif_layer.h>
+#include <net/caif/caif_device.h>
+#include <linux/atomic.h>
+/*
+ * Maximum number of CAIF frames that can reside in the same HSI frame.
+ */
+#define CFHSI_MAX_PKTS 15
+/*
+ * Maximum number of bytes used for the frame that can be embedded in the
+ * HSI descriptor.
+ */
+#define CFHSI_MAX_EMB_FRM_SZ 96
+/*
+ * Decides if HSI buffers should be prefilled with 0xFF pattern for easier
+ * debugging. Both TX and RX buffers will be filled before the transfer.
+ */
+#define CFHSI_DBG_PREFILL               0
+/* Structure describing a HSI packet descriptor. */
+#pragma pack(1) /* Byte alignment. */
+struct cfhsi_desc {
+        u8 header;
+        u8 offset;
+        u16 cffrm_len[CFHSI_MAX_PKTS];
+        u8 emb_frm[CFHSI_MAX_EMB_FRM_SZ];
+};
+#pragma pack() /* Default alignment. */
+/* Size of the complete HSI packet descriptor. */
+#define CFHSI_DESC_SZ (sizeof(struct cfhsi_desc))
+/*
+ * Size of the complete HSI packet descriptor excluding the optional embedded
+ * CAIF frame.
+ */
+#define CFHSI_DESC_SHORT_SZ (CFHSI_DESC_SZ - CFHSI_MAX_EMB_FRM_SZ)
+/*
+ * Maximum bytes transferred in one transfer.
+ */
+/* TODO: 4096 is temporary... */
+#define CFHSI_MAX_PAYLOAD_SZ (CFHSI_MAX_PKTS * 4096)
+/* Size of the complete HSI TX buffer. */
+#define CFHSI_BUF_SZ_TX (CFHSI_DESC_SZ + CFHSI_MAX_PAYLOAD_SZ)
+/* Size of the complete HSI RX buffer. */
+#define CFHSI_BUF_SZ_RX ((2 * CFHSI_DESC_SZ) + CFHSI_MAX_PAYLOAD_SZ)
+/* Bitmasks for the HSI descriptor. */
+#define CFHSI_PIGGY_DESC                (0x01 << 7)
+#define CFHSI_TX_STATE_IDLE                     0
+#define CFHSI_TX_STATE_XFER                     1
+#define CFHSI_RX_STATE_DESC                     0
+#define CFHSI_RX_STATE_PAYLOAD                  1
+/* Bitmasks for power management. */
+#define CFHSI_WAKE_UP                           0
+#define CFHSI_WAKE_UP_ACK                       1
+#define CFHSI_WAKE_DOWN_ACK                     2
+#define CFHSI_AWAKE                             3
+#define CFHSI_PENDING_RX                        4
+#define CFHSI_SHUTDOWN                          6
+#define CFHSI_FLUSH_FIFO                        7
+#ifndef CFHSI_INACTIVITY_TOUT
+#define CFHSI_INACTIVITY_TOUT                   (1 * HZ)
+#endif /* CFHSI_INACTIVITY_TOUT */
+#ifndef CFHSI_WAKEUP_TOUT
+#define CFHSI_WAKEUP_TOUT                       (3 * HZ)
+#endif /* CFHSI_WAKEUP_TOUT */
+/* Structure implemented by the CAIF HSI driver. */
+struct cfhsi_drv {
+        void (*tx_done_cb) (struct cfhsi_drv *drv);
+        void (*rx_done_cb) (struct cfhsi_drv *drv);
+        void (*wake_up_cb) (struct cfhsi_drv *drv);
+        void (*wake_down_cb) (struct cfhsi_drv *drv);
+};
+/* Structure implemented by HSI device. */
+struct cfhsi_dev {
+        int (*cfhsi_up) (struct cfhsi_dev *dev);
+        int (*cfhsi_down) (struct cfhsi_dev *dev);
+        int (*cfhsi_tx) (u8 *ptr, int len, struct cfhsi_dev *dev);
+        int (*cfhsi_rx) (u8 *ptr, int len, struct cfhsi_dev *dev);
+        int (*cfhsi_wake_up) (struct cfhsi_dev *dev);
+        int (*cfhsi_wake_down) (struct cfhsi_dev *dev);
+        int (*cfhsi_fifo_occupancy)(struct cfhsi_dev *dev, size_t *occupancy);
+        int (*cfhsi_rx_cancel)(struct cfhsi_dev *dev);
+        struct cfhsi_drv *drv;
+};
+/* Structure implemented by CAIF HSI drivers. */
+struct cfhsi {
+        struct caif_dev_common cfdev;
+        struct net_device *ndev;
+        struct platform_device *pdev;
+        struct sk_buff_head qhead;
+        struct cfhsi_drv drv;
+        struct cfhsi_dev *dev;
+        int tx_state;
+        int rx_state;
+        int rx_len;
+        u8 *rx_ptr;
+        u8 *tx_buf;
+        u8 *rx_buf;
+        spinlock_t lock;
+        int flow_off_sent;
+        u32 q_low_mark;
+        u32 q_high_mark;
+        struct list_head list;
+        struct work_struct wake_up_work;
+        struct work_struct wake_down_work;
+        struct work_struct rx_done_work;
+        struct work_struct tx_done_work;
+        struct workqueue_struct *wq;
+        wait_queue_head_t wake_up_wait;
+        wait_queue_head_t wake_down_wait;
+        wait_queue_head_t flush_fifo_wait;
+        struct timer_list timer;
+        unsigned long bits;
+};
+extern struct platform_driver cfhsi_driver;
+#endif          /* CAIF_HSI_H_ */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 396e8fc8910..ffa8aedd70f 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -536,6 +536,11 @@ struct sta_bss_parameters {
 *      This number should increase every time the list of stations
 *      changes, i.e. when a station is added or removed, so that
 *      userspace can tell whether it got a consistent snapshot.
+ * @assoc_req_ies: IEs from (Re)Association Request.
+ *      This is used only when in AP mode with drivers that do not use
+ *      user space MLME/SME implementation. The information is provided for
+ *      the cfg80211_new_sta() calls to notify user space of the IEs.
+ * @assoc_req_ies_len: Length of assoc_req_ies buffer in octets.
 */
 struct station_info {
        u32 filled;
@@ -558,6 +563,14 @@ struct station_info {
        struct sta_bss_parameters bss_param;
        int generation;
+        const u8 *assoc_req_ies;
+        size_t assoc_req_ies_len;
+        /*
+         * Note: Add a new enum station_info_flags value for each new field and
+         * use it to check which fields are initialized.
+         */
 };
 /**
@@ -777,6 +790,7 @@ struct cfg80211_ssid {
 * @n_channels: total number of channels to scan
 * @ie: optional information element(s) to add into Probe Request or %NULL
 * @ie_len: length of ie in octets
+ * @rates: bitmap of rates to advertise for each band
 * @wiphy: the wiphy this was for
 * @dev: the interface
 * @aborted: (internal) scan request was notified as aborted
@@ -788,6 +802,8 @@ struct cfg80211_scan_request {
        const u8 *ie;
        size_t ie_len;
+        u32 rates[IEEE80211_NUM_BANDS];
        /* internal */
        struct wiphy *wiphy;
        struct net_device *dev;
@@ -1146,14 +1162,32 @@ struct cfg80211_wowlan_trig_pkt_pattern {
 * @magic_pkt: wake up on receiving magic packet
 * @patterns: wake up on receiving packet matching a pattern
 * @n_patterns: number of patterns
+ * @gtk_rekey_failure: wake up on GTK rekey failure
+ * @eap_identity_req: wake up on EAP identity request packet
+ * @four_way_handshake: wake up on 4-way handshake
+ * @rfkill_release: wake up when rfkill is released
 */
 struct cfg80211_wowlan {
-        bool any, disconnect, magic_pkt;
+        bool any, disconnect, magic_pkt, gtk_rekey_failure,
+             eap_identity_req, four_way_handshake,
+             rfkill_release;
        struct cfg80211_wowlan_trig_pkt_pattern *patterns;
        int n_patterns;
 };
 /**
+ * struct cfg80211_gtk_rekey_data - rekey data
+ * @kek: key encryption key
+ * @kck: key confirmation key
+ * @replay_ctr: replay counter
+ */
+struct cfg80211_gtk_rekey_data {
+        u8 kek[NL80211_KEK_LEN];
+        u8 kck[NL80211_KCK_LEN];
+        u8 replay_ctr[NL80211_REPLAY_CTR_LEN];
+};
+/**
 * struct cfg80211_ops - backend description for wireless configuration
 *
 * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -1197,6 +1231,8 @@ struct cfg80211_wowlan {
 *
 * @set_default_mgmt_key: set the default management frame key on an interface
 *
+ * @set_rekey_data: give the data necessary for GTK rekeying to the driver
+ *
 * @add_beacon: Add a beacon with given parameters, @head, @interval
 *      and @dtim_period will be valid, @tail is optional.
 * @set_beacon: Change the beacon parameters for an access point mode
@@ -1284,6 +1320,12 @@ struct cfg80211_wowlan {
 *      frame on another channel
 *
 * @testmode_cmd: run a test mode command
+ * @testmode_dump: Implement a test mode dump. The cb->args[2] and up may be
+ *      used by the function, but 0 and 1 must not be touched. Additionally,
+ *      return error codes other than -ENOBUFS and -ENOENT will terminate the
+ *      dump and return to userspace with an error, so be careful. If any data
+ *      was passed in from userspace then the data/len arguments will be present
+ *      and point to the data contained in %NL80211_ATTR_TESTDATA.
 *
 * @set_bitrate_mask: set the bitrate mask configuration
 *
@@ -1433,6 +1475,9 @@ struct cfg80211_ops {
 #ifdef CONFIG_NL80211_TESTMODE
        int     (*testmode_cmd)(struct wiphy *wiphy, void *data, int len);
+        int     (*testmode_dump)(struct wiphy *wiphy, struct sk_buff *skb,
+                                 struct netlink_callback *cb,
+                                 void *data, int len);
 #endif
        int     (*set_bitrate_mask)(struct wiphy *wiphy,
@@ -1490,6 +1535,9 @@ struct cfg80211_ops {
                                struct net_device *dev,
                                struct cfg80211_sched_scan_request *request);
        int     (*sched_scan_stop)(struct wiphy *wiphy, struct net_device *dev);
+        int     (*set_rekey_data)(struct wiphy *wiphy, struct net_device *dev,
+                                  struct cfg80211_gtk_rekey_data *data);
 };
 /*
@@ -1647,11 +1695,21 @@ struct ieee80211_txrx_stypes {
 * @WIPHY_WOWLAN_MAGIC_PKT: supports wakeup on magic packet
 *      (see nl80211.h)
 * @WIPHY_WOWLAN_DISCONNECT: supports wakeup on disconnect
+ * @WIPHY_WOWLAN_SUPPORTS_GTK_REKEY: supports GTK rekeying while asleep
+ * @WIPHY_WOWLAN_GTK_REKEY_FAILURE: supports wakeup on GTK rekey failure
+ * @WIPHY_WOWLAN_EAP_IDENTITY_REQ: supports wakeup on EAP identity request
+ * @WIPHY_WOWLAN_4WAY_HANDSHAKE: supports wakeup on 4-way handshake failure
+ * @WIPHY_WOWLAN_RFKILL_RELEASE: supports wakeup on RF-kill release
 */
 enum wiphy_wowlan_support_flags {
-        WIPHY_WOWLAN_ANY        = BIT(0),
+        WIPHY_WOWLAN_ANY                = BIT(0),
-        WIPHY_WOWLAN_MAGIC_PKT  = BIT(1),
+        WIPHY_WOWLAN_MAGIC_PKT          = BIT(1),
-        WIPHY_WOWLAN_DISCONNECT = BIT(2),
+        WIPHY_WOWLAN_DISCONNECT         = BIT(2),
+        WIPHY_WOWLAN_SUPPORTS_GTK_REKEY = BIT(3),
+        WIPHY_WOWLAN_GTK_REKEY_FAILURE  = BIT(4),
+        WIPHY_WOWLAN_EAP_IDENTITY_REQ   = BIT(5),
+        WIPHY_WOWLAN_4WAY_HANDSHAKE     = BIT(6),
+        WIPHY_WOWLAN_RFKILL_RELEASE     = BIT(7),
 };
 /**
@@ -1699,6 +1757,8 @@ struct wiphy_wowlan_support {
 *      by default for perm_addr. In this case, the mask should be set to
 *      all-zeroes. In this case it is assumed that the device can handle
 *      the same number of arbitrary MAC addresses.
+ * @registered: protects ->resume and ->suspend sysfs callbacks against
+ *      unregister hardware
 * @debugfsdir: debugfs directory used for this wiphy, will be renamed
 *      automatically on wiphy renames
 * @dev: (virtual) struct device for this wiphy
@@ -1716,9 +1776,13 @@ struct wiphy_wowlan_support {
 *      this variable determines its size
 * @max_scan_ssids: maximum number of SSIDs the device can scan for in
 *      any given scan
+ * @max_sched_scan_ssids: maximum number of SSIDs the device can scan
+ *      for in any given scheduled scan
 * @max_scan_ie_len: maximum length of user-controlled IEs device can
 *      add to probe request frames transmitted during a scan, must not
 *      include fixed IEs like supported rates
+ * @max_sched_scan_ie_len: same as max_scan_ie_len, but for scheduled
+ *      scans
 * @coverage_class: current coverage class
 * @fw_version: firmware version for ethtool reporting
 * @hw_version: hardware version for ethtool reporting
@@ -1770,7 +1834,9 @@ struct wiphy {
        int bss_priv_size;
        u8 max_scan_ssids;
+        u8 max_sched_scan_ssids;
        u16 max_scan_ie_len;
+        u16 max_sched_scan_ie_len;
        int n_cipher_suites;
        const u32 *cipher_suites;
@@ -1814,6 +1880,9 @@ struct wiphy {
         * you need use set_wiphy_dev() (see below) */
        struct device dev;
+        /* protects ->resume, ->suspend sysfs callbacks against unregister hw */
+        bool registered;
        /* dir in debugfs: ieee80211/<wiphyname> */
        struct dentry *debugfsdir;
@@ -2849,8 +2918,10 @@ struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp);
 #define CFG80211_TESTMODE_CMD(cmd)      .testmode_cmd = (cmd),
+#define CFG80211_TESTMODE_DUMP(cmd)     .testmode_dump = (cmd),
 #else
 #define CFG80211_TESTMODE_CMD(cmd)
+#define CFG80211_TESTMODE_DUMP(cmd)
 #endif
 /**
@@ -3022,6 +3093,16 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
                                 const u8 *peer, u32 num_packets, gfp_t gfp);
+/**
+ * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+ * @dev: network device
+ * @bssid: BSSID of AP (to avoid races)
+ * @replay_ctr: new replay counter
+ * @gfp: allocation flags
+ */
+void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
+                               const u8 *replay_ctr, gfp_t gfp);
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
index abd443604c9..9808877c2ab 100644
--- a/include/net/cipso_ipv4.h
+++ b/include/net/cipso_ipv4.h
@@ -8,7 +8,7 @@
 * have chosen to adopt the protocol and over the years it has become a
 * de-facto standard for labeled networking.
 *
- * Author: Paul Moore <paul.moore@hp.com>
+ * Author: Paul Moore <paul@paul-moore.com>
 *
 */
@@ -41,7 +41,7 @@
 #include <linux/skbuff.h>
 #include <net/netlabel.h>
 #include <net/request_sock.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 /* known doi values */
 #define CIPSO_V4_DOI_UNKNOWN          0x00000000
diff --git a/include/net/dcbnl.h b/include/net/dcbnl.h
index e5983c9053d..f5aa39997f0 100644
--- a/include/net/dcbnl.h
+++ b/include/net/dcbnl.h
@@ -28,8 +28,16 @@ struct dcb_app_type {
        struct list_head  list;
 };
-u8 dcb_setapp(struct net_device *, struct dcb_app *);
+int dcb_setapp(struct net_device *, struct dcb_app *);
 u8 dcb_getapp(struct net_device *, struct dcb_app *);
+int dcb_ieee_setapp(struct net_device *, struct dcb_app *);
+int dcb_ieee_delapp(struct net_device *, struct dcb_app *);
+u8 dcb_ieee_getapp_mask(struct net_device *, struct dcb_app *);
+int dcbnl_ieee_notify(struct net_device *dev, int event, int cmd,
+                      u32 seq, u32 pid);
+int dcbnl_cee_notify(struct net_device *dev, int event, int cmd,
+                     u32 seq, u32 pid);
 /*
 * Ops struct for the netlink callbacks.  Used by DCB-enabled drivers through
@@ -43,6 +51,7 @@ struct dcbnl_rtnl_ops {
        int (*ieee_setpfc) (struct net_device *, struct ieee_pfc *);
        int (*ieee_getapp) (struct net_device *, struct dcb_app *);
        int (*ieee_setapp) (struct net_device *, struct dcb_app *);
+        int (*ieee_delapp) (struct net_device *, struct dcb_app *);
        int (*ieee_peer_getets) (struct net_device *, struct ieee_ets *);
        int (*ieee_peer_getpfc) (struct net_device *, struct ieee_pfc *);
diff --git a/include/net/dst.h b/include/net/dst.h
index e12ddfb9eb1..82952498b63 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -37,8 +37,7 @@ struct dst_entry {
        unsigned long           _metrics;
        unsigned long           expires;
        struct dst_entry        *path;
-        struct neighbour        *neighbour;
+        struct neighbour __rcu  *_neighbour;
-        struct hh_cache         *hh;
 #ifdef CONFIG_XFRM
        struct xfrm_state       *xfrm;
 #else
@@ -47,6 +46,15 @@ struct dst_entry {
        int                     (*input)(struct sk_buff*);
        int                     (*output)(struct sk_buff*);
+        int                     flags;
+#define DST_HOST                0x0001
+#define DST_NOXFRM              0x0002
+#define DST_NOPOLICY            0x0004
+#define DST_NOHASH              0x0008
+#define DST_NOCACHE             0x0010
+#define DST_NOCOUNT             0x0020
+#define DST_NOPEER              0x0040
        short                   error;
        short                   obsolete;
        unsigned short          header_len;     /* more space at head required */
@@ -62,7 +70,7 @@ struct dst_entry {
         * (L1_CACHE_SIZE would be too much)
         */
 #ifdef CONFIG_64BIT
-        long                    __pad_to_align_refcnt[1];
+        long                    __pad_to_align_refcnt[2];
 #endif
        /*
         * __refcnt wants to be on a different cache line from
@@ -71,13 +79,6 @@ struct dst_entry {
        atomic_t                __refcnt;       /* client references    */
        int                     __use;
        unsigned long           lastuse;
-        int                     flags;
-#define DST_HOST                0x0001
-#define DST_NOXFRM              0x0002
-#define DST_NOPOLICY            0x0004
-#define DST_NOHASH              0x0008
-#define DST_NOCACHE             0x0010
-#define DST_NOCOUNT             0x0020
        union {
                struct dst_entry        *next;
                struct rtable __rcu     *rt_next;
@@ -86,6 +87,21 @@ struct dst_entry {
        };
 };
+static inline struct neighbour *dst_get_neighbour(struct dst_entry *dst)
+{
+        return rcu_dereference(dst->_neighbour);
+}
+static inline struct neighbour *dst_get_neighbour_raw(struct dst_entry *dst)
+{
+        return rcu_dereference_raw(dst->_neighbour);
+}
+static inline void dst_set_neighbour(struct dst_entry *dst, struct neighbour *neigh)
+{
+        rcu_assign_pointer(dst->_neighbour, neigh);
+}
 extern u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
 extern const u32 dst_default_metrics[RTAX_MAX];
@@ -371,8 +387,19 @@ static inline void dst_rcu_free(struct rcu_head *head)
 static inline void dst_confirm(struct dst_entry *dst)
 {
-        if (dst)
+        if (dst) {
-                neigh_confirm(dst->neighbour);
+                struct neighbour *n;
+                rcu_read_lock();
+                n = dst_get_neighbour(dst);
+                neigh_confirm(n);
+                rcu_read_unlock();
+        }
+}
+static inline struct neighbour *dst_neigh_lookup(const struct dst_entry *dst, const void *daddr)
+{
+        return dst->ops->neigh_lookup(dst, daddr);
 }
 static inline void dst_link_failure(struct sk_buff *skb)
diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
index dc074632894..9adb99845a5 100644
--- a/include/net/dst_ops.h
+++ b/include/net/dst_ops.h
@@ -26,6 +26,7 @@ struct dst_ops {
        void                    (*link_failure)(struct sk_buff *);
        void                    (*update_pmtu)(struct dst_entry *dst, u32 mtu);
        int                     (*local_out)(struct sk_buff *skb);
+        struct neighbour *      (*neigh_lookup)(const struct dst_entry *dst, const void *daddr);
        struct kmem_cache       *kmem_cachep;
diff --git a/include/net/flow.h b/include/net/flow.h
index c6d5fe5ec1b..57f15a7f1cd 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -7,8 +7,9 @@
 #ifndef _NET_FLOW_H
 #define _NET_FLOW_H
+#include <linux/socket.h>
 #include <linux/in6.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 struct flowi_common {
        int     flowic_oif;
@@ -68,7 +69,7 @@ struct flowi4 {
 #define fl4_ipsec_spi           uli.spi
 #define fl4_mh_type             uli.mht.type
 #define fl4_gre_key             uli.gre_key
-};
+} __attribute__((__aligned__(BITS_PER_LONG/8)));
 static inline void flowi4_init_output(struct flowi4 *fl4, int oif,
                                      __u32 mark, __u8 tos, __u8 scope,
@@ -112,7 +113,7 @@ struct flowi6 {
 #define fl6_ipsec_spi           uli.spi
 #define fl6_mh_type             uli.mht.type
 #define fl6_gre_key             uli.gre_key
-};
+} __attribute__((__aligned__(BITS_PER_LONG/8)));
 struct flowidn {
        struct flowi_common     __fl_common;
@@ -127,7 +128,7 @@ struct flowidn {
        union flowi_uli         uli;
 #define fld_sport               uli.ports.sport
 #define fld_dport               uli.ports.dport
-};
+} __attribute__((__aligned__(BITS_PER_LONG/8)));
 struct flowi {
        union {
@@ -161,6 +162,24 @@ static inline struct flowi *flowidn_to_flowi(struct flowidn *fldn)
        return container_of(fldn, struct flowi, u.dn);
 }
+typedef unsigned long flow_compare_t;
+static inline size_t flow_key_size(u16 family)
+{
+        switch (family) {
+        case AF_INET:
+                BUILD_BUG_ON(sizeof(struct flowi4) % sizeof(flow_compare_t));
+                return sizeof(struct flowi4) / sizeof(flow_compare_t);
+        case AF_INET6:
+                BUILD_BUG_ON(sizeof(struct flowi6) % sizeof(flow_compare_t));
+                return sizeof(struct flowi6) / sizeof(flow_compare_t);
+        case AF_DECnet:
+                BUILD_BUG_ON(sizeof(struct flowidn) % sizeof(flow_compare_t));
+                return sizeof(struct flowidn) / sizeof(flow_compare_t);
+        }
+        return 0;
+}
 #define FLOW_DIR_IN     0
 #define FLOW_DIR_OUT    1
 #define FLOW_DIR_FWD    2
@@ -188,6 +207,7 @@ extern struct flow_cache_object *flow_cache_lookup(
                u8 dir, flow_resolve_t resolver, void *ctx);
 extern void flow_cache_flush(void);
+extern void flow_cache_flush_deferred(void);
 extern atomic_t flow_cache_genid;
 #endif
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index d420f28b6d6..82d8d09faa4 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -160,6 +160,38 @@ static inline void *genlmsg_put(struct sk_buff *skb, u32 pid, u32 seq,
 }
 /**
+ * genlmsg_nlhdr - Obtain netlink header from user specified header
+ * @user_hdr: user header as returned from genlmsg_put()
+ * @family: generic netlink family
+ *
+ * Returns pointer to netlink header.
+ */
+static inline struct nlmsghdr *genlmsg_nlhdr(void *user_hdr,
+                                             struct genl_family *family)
+{
+        return (struct nlmsghdr *)((char *)user_hdr -
+                                   family->hdrsize -
+                                   GENL_HDRLEN -
+                                   NLMSG_HDRLEN);
+}
+/**
+ * genl_dump_check_consistent - check if sequence is consistent and advertise if not
+ * @cb: netlink callback structure that stores the sequence number
+ * @user_hdr: user header as returned from genlmsg_put()
+ * @family: generic netlink family
+ *
+ * Cf. nl_dump_check_consistent(), this just provides a wrapper to make it
+ * simpler to use with generic netlink.
+ */
+static inline void genl_dump_check_consistent(struct netlink_callback *cb,
+                                              void *user_hdr,
+                                              struct genl_family *family)
+{
+        nl_dump_check_consistent(cb, genlmsg_nlhdr(user_hdr, family));
+}
+/**
 * genlmsg_put_reply - Add generic netlink header to a reply message
 * @skb: socket buffer holding the message
 * @info: receiver info
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 11cf373970a..51a7031b4aa 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -41,6 +41,7 @@ struct inet6_ifaddr {
        struct in6_addr         addr;
        __u32                   prefix_len;
        
+        /* In seconds, relative to tstamp. Expiry is at tstamp + HZ * lft. */
        __u32                   valid_lft;
        __u32                   prefered_lft;
        atomic_t                refcnt;
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index e9c2ed8af86..808fc5f76b0 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -33,7 +33,7 @@
 #include <net/tcp_states.h>
 #include <net/netns/hash.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <asm/byteorder.h>
 /* This is for all connections with a full identity, no wildcards.
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index caaff5f5f39..b897d6e6d0a 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -238,7 +238,7 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
 {
        __u8 flags = 0;
-        if (inet_sk(sk)->transparent)
+        if (inet_sk(sk)->transparent || inet_sk(sk)->hdrincl)
                flags |= FLOWI_FLAG_ANYSRC;
        if (sk->sk_protocol == IPPROTO_TCP)
                flags |= FLOWI_FLAG_PRECOW_METRICS;
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 17404b5388a..f1a770977c4 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -28,7 +28,7 @@
 #include <net/tcp_states.h>
 #include <net/timewait_sock.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 struct inet_hashinfo;
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 8a159cc3d68..e9ff3fc5e68 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -13,7 +13,7 @@
 #include <linux/spinlock.h>
 #include <linux/rtnetlink.h>
 #include <net/ipv6.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 struct inetpeer_addr_base {
        union {
@@ -32,13 +32,18 @@ struct inet_peer {
        struct inet_peer __rcu  *avl_left, *avl_right;
        struct inetpeer_addr    daddr;
        __u32                   avl_height;
-        struct list_head        unused;
-        __u32                   dtime;          /* the time of last use of not
+        u32                     metrics[RTAX_MAX];
-                                                 * referenced entries */
+        u32                     rate_tokens;    /* rate limiting for ICMP */
-        atomic_t                refcnt;
+        int                     redirect_genid;
+        unsigned long           rate_last;
+        unsigned long           pmtu_expires;
+        u32                     pmtu_orig;
+        u32                     pmtu_learned;
+        struct inetpeer_addr_base redirect_learned;
        /*
         * Once inet_peer is queued for deletion (refcnt == -1), following fields
-         * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp, metrics
+         * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
         * We can share memory with rcu_head to help keep inet_peer small.
         */
        union {
@@ -47,16 +52,14 @@ struct inet_peer {
                        atomic_t                        ip_id_count;    /* IP ID for the next packet */
                        __u32                           tcp_ts;
                        __u32                           tcp_ts_stamp;
-                        u32                             metrics[RTAX_MAX];
-                        u32                             rate_tokens;    /* rate limiting for ICMP */
-                        unsigned long                   rate_last;
-                        unsigned long                   pmtu_expires;
-                        u32                             pmtu_orig;
-                        u32                             pmtu_learned;
-                        struct inetpeer_addr_base       redirect_learned;
                };
                struct rcu_head         rcu;
+                struct inet_peer        *gc_next;
        };
+        /* following fields might be frequently dirtied */
+        __u32                   dtime;  /* the time of last use of not referenced entries */
+        atomic_t                refcnt;
 };
 void                    inet_initpeers(void) __init;
@@ -69,7 +72,7 @@ static inline bool inet_metrics_new(const struct inet_peer *p)
 }
 /* can be called with or without local BH being disabled */
-struct inet_peer        *inet_getpeer(struct inetpeer_addr *daddr, int create);
+struct inet_peer        *inet_getpeer(const struct inetpeer_addr *daddr, int create);
 static inline struct inet_peer *inet_getpeer_v4(__be32 v4daddr, int create)
 {
@@ -104,11 +107,18 @@ static inline void inet_peer_refcheck(const struct inet_peer *p)
 /* can be called with or without local BH being disabled */
-static inline __u16     inet_getid(struct inet_peer *p, int more)
+static inline int inet_getid(struct inet_peer *p, int more)
 {
+        int old, new;
        more++;
        inet_peer_refcheck(p);
-        return atomic_add_return(more, &p->ip_id_count) - more;
+        do {
+                old = atomic_read(&p->ip_id_count);
+                new = old + more;
+                if (!new)
+                        new = 1;
+        } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
+        return new;
 }
 #endif /* _NET_INETPEER_H */
diff --git a/include/net/ip.h b/include/net/ip.h
index 66dd4914920..aa76c7a4d9c 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -228,8 +228,6 @@ extern struct ctl_path net_ipv4_ctl_path[];
 extern int inet_peer_threshold;
 extern int inet_peer_minttl;
 extern int inet_peer_maxttl;
-extern int inet_peer_gc_mintime;
-extern int inet_peer_gc_maxtime;
 /* From ip_output.c */
 extern int sysctl_ip_dynaddr;
@@ -238,6 +236,11 @@ extern void ipfrag_init(void);
 extern void ip_static_sysctl_init(void);
+static inline bool ip_is_fragment(const struct iphdr *iph)
+{
+        return (iph->frag_off & htons(IP_MF | IP_OFFSET)) != 0;
+}
 #ifdef CONFIG_INET
 #include <net/dst.h>
@@ -401,7 +404,8 @@ enum ip_defrag_users {
        __IP_DEFRAG_CONNTRACK_BRIDGE_IN = IP_DEFRAG_CONNTRACK_BRIDGE_IN + USHRT_MAX,
        IP_DEFRAG_VS_IN,
        IP_DEFRAG_VS_OUT,
-        IP_DEFRAG_VS_FWD
+        IP_DEFRAG_VS_FWD,
+        IP_DEFRAG_AF_PACKET,
 };
 int ip_defrag(struct sk_buff *skb, u32 user);
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 477ef75f387..5735a0f979c 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -87,7 +87,6 @@ struct rt6_info {
        struct dst_entry                dst;
 #define rt6i_dev                        dst.dev
-#define rt6i_nexthop                    dst.neighbour
 #define rt6i_expires                    dst.expires
        /*
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 481f856c650..8fa4430f99c 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -13,7 +13,7 @@
 #include <linux/sysctl.h>               /* for ctl_path */
 #include <linux/list.h>                 /* for struct list_head */
 #include <linux/spinlock.h>             /* for struct rwlock_t */
-#include <asm/atomic.h>                 /* for struct atomic_t */
+#include <linux/atomic.h>                 /* for struct atomic_t */
 #include <linux/compiler.h>
 #include <linux/timer.h>
@@ -836,8 +836,6 @@ struct netns_ipvs {
        int                     num_services;    /* no of virtual services */
        rwlock_t                rs_lock;         /* real services table */
-        /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
-        struct lock_class_key   ctl_key;        /* ctl_mutex debuging */
        /* Trash for destinations */
        struct list_head        dest_trash;
        /* Service counters */
@@ -902,6 +900,7 @@ struct netns_ipvs {
        volatile int            sync_state;
        volatile int            master_syncid;
        volatile int            backup_syncid;
+        struct mutex            sync_mutex;
        /* multicast interface name */
        char                    master_mcast_ifn[IP_VS_IFNAME_MAXLEN];
        char                    backup_mcast_ifn[IP_VS_IFNAME_MAXLEN];
@@ -1089,19 +1088,19 @@ ip_vs_control_add(struct ip_vs_conn *cp, struct ip_vs_conn *ctl_cp)
 /*
 * IPVS netns init & cleanup functions
 */
-extern int __ip_vs_estimator_init(struct net *net);
+extern int ip_vs_estimator_net_init(struct net *net);
-extern int __ip_vs_control_init(struct net *net);
+extern int ip_vs_control_net_init(struct net *net);
-extern int __ip_vs_protocol_init(struct net *net);
+extern int ip_vs_protocol_net_init(struct net *net);
-extern int __ip_vs_app_init(struct net *net);
+extern int ip_vs_app_net_init(struct net *net);
-extern int __ip_vs_conn_init(struct net *net);
+extern int ip_vs_conn_net_init(struct net *net);
-extern int __ip_vs_sync_init(struct net *net);
+extern int ip_vs_sync_net_init(struct net *net);
-extern void __ip_vs_conn_cleanup(struct net *net);
+extern void ip_vs_conn_net_cleanup(struct net *net);
-extern void __ip_vs_app_cleanup(struct net *net);
+extern void ip_vs_app_net_cleanup(struct net *net);
-extern void __ip_vs_protocol_cleanup(struct net *net);
+extern void ip_vs_protocol_net_cleanup(struct net *net);
-extern void __ip_vs_control_cleanup(struct net *net);
+extern void ip_vs_control_net_cleanup(struct net *net);
-extern void __ip_vs_estimator_cleanup(struct net *net);
+extern void ip_vs_estimator_net_cleanup(struct net *net);
-extern void __ip_vs_sync_cleanup(struct net *net);
+extern void ip_vs_sync_net_cleanup(struct net *net);
-extern void __ip_vs_service_cleanup(struct net *net);
+extern void ip_vs_service_net_cleanup(struct net *net);
 /*
 *      IPVS application functions
@@ -1119,8 +1118,6 @@ extern void ip_vs_app_inc_put(struct ip_vs_app *inc);
 extern int ip_vs_app_pkt_out(struct ip_vs_conn *, struct sk_buff *skb);
 extern int ip_vs_app_pkt_in(struct ip_vs_conn *, struct sk_buff *skb);
-extern int ip_vs_app_init(void);
-extern void ip_vs_app_cleanup(void);
 void ip_vs_bind_pe(struct ip_vs_service *svc, struct ip_vs_pe *pe);
 void ip_vs_unbind_pe(struct ip_vs_service *svc);
@@ -1223,15 +1220,11 @@ extern int start_sync_thread(struct net *net, int state, char *mcast_ifn,
                             __u8 syncid);
 extern int stop_sync_thread(struct net *net, int state);
 extern void ip_vs_sync_conn(struct net *net, struct ip_vs_conn *cp);
-extern int ip_vs_sync_init(void);
-extern void ip_vs_sync_cleanup(void);
 /*
 *      IPVS rate estimator prototypes (from ip_vs_est.c)
 */
-extern int ip_vs_estimator_init(void);
-extern void ip_vs_estimator_cleanup(void);
 extern void ip_vs_start_estimator(struct net *net, struct ip_vs_stats *stats);
 extern void ip_vs_stop_estimator(struct net *net, struct ip_vs_stats *stats);
 extern void ip_vs_zero_estimator(struct ip_vs_stats *stats);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index c033ed00df7..3b5ac1fbff3 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -463,17 +463,7 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
        return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
 }
-static __inline__ void ipv6_select_ident(struct frag_hdr *fhdr)
+extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
-{
-        static u32 ipv6_fragmentation_id = 1;
-        static DEFINE_SPINLOCK(ip6_id_lock);
-        spin_lock_bh(&ip6_id_lock);
-        fhdr->identification = htonl(ipv6_fragmentation_id);
-        if (++ipv6_fragmentation_id == 0)
-                ipv6_fragmentation_id = 1;
-        spin_unlock_bh(&ip6_id_lock);
-}
 /*
 *      Prototypes exported by ipv6
diff --git a/include/net/lib80211.h b/include/net/lib80211.h
index 848cce1bb7a..b95bbb083ee 100644
--- a/include/net/lib80211.h
+++ b/include/net/lib80211.h
@@ -26,7 +26,7 @@
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/module.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <linux/if.h>
 #include <linux/skbuff.h>
 #include <linux/ieee80211.h>
diff --git a/include/net/llc.h b/include/net/llc.h
index 5503b74ab17..226c846cab0 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -20,7 +20,7 @@
 #include <linux/hash.h>
 #include <linux/jhash.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 struct net_device;
 struct packet_type;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index e6d6a66a8f7..9259e97864d 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -20,6 +20,7 @@
 #include <linux/device.h>
 #include <linux/ieee80211.h>
 #include <net/cfg80211.h>
+#include <asm/unaligned.h>
 /**
 * DOC: Introduction
@@ -193,6 +194,17 @@ enum ieee80211_bss_change {
 #define IEEE80211_BSS_ARP_ADDR_LIST_LEN 4
 /**
+ * enum ieee80211_rssi_event - RSSI threshold event
+ * An indicator for when RSSI goes below/above a certain threshold.
+ * @RSSI_EVENT_HIGH: AP's rssi crossed the high threshold set by the driver.
+ * @RSSI_EVENT_LOW: AP's rssi crossed the low threshold set by the driver.
+ */
+enum ieee80211_rssi_event {
+        RSSI_EVENT_HIGH,
+        RSSI_EVENT_LOW,
+};
+/**
 * struct ieee80211_bss_conf - holds the BSS's changing parameters
 *
 * This structure keeps information about a BSS (and an association
@@ -933,6 +945,7 @@ enum set_key_cmd {
 * @aid: AID we assigned to the station if we're an AP
 * @supp_rates: Bitmap of supported rates (per band)
 * @ht_cap: HT capabilities of this STA; restricted to our own TX capabilities
+ * @wme: indicates whether the STA supports WME. Only valid during AP-mode.
 * @drv_priv: data area for driver use, will always be aligned to
 *      sizeof(void *), size is determined in hw information.
 */
@@ -941,6 +954,7 @@ struct ieee80211_sta {
        u8 addr[ETH_ALEN];
        u16 aid;
        struct ieee80211_sta_ht_cap ht_cap;
+        bool wme;
        /* must be last */
        u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
@@ -960,21 +974,6 @@ enum sta_notify_cmd {
 };
 /**
- * enum ieee80211_tkip_key_type - get tkip key
- *
- * Used by drivers which need to get a tkip key for skb. Some drivers need a
- * phase 1 key, others need a phase 2 key. A single function allows the driver
- * to get the key, this enum indicates what type of key is required.
- *
- * @IEEE80211_TKIP_P1_KEY: the driver needs a phase 1 key
- * @IEEE80211_TKIP_P2_KEY: the driver needs a phase 2 key
- */
-enum ieee80211_tkip_key_type {
-        IEEE80211_TKIP_P1_KEY,
-        IEEE80211_TKIP_P2_KEY,
-};
-/**
 * enum ieee80211_hw_flags - hardware flags
 *
 * These flags are used to indicate hardware capabilities to
@@ -1587,6 +1586,20 @@ enum ieee80211_ampdu_mlme_action {
 };
 /**
+ * enum ieee80211_tx_sync_type - TX sync type
+ * @IEEE80211_TX_SYNC_AUTH: sync TX for authentication
+ *      (and possibly also before direct probe)
+ * @IEEE80211_TX_SYNC_ASSOC: sync TX for association
+ * @IEEE80211_TX_SYNC_ACTION: sync TX for action frame
+ *      (not implemented yet)
+ */
+enum ieee80211_tx_sync_type {
+        IEEE80211_TX_SYNC_AUTH,
+        IEEE80211_TX_SYNC_ASSOC,
+        IEEE80211_TX_SYNC_ACTION,
+};
+/**
 * struct ieee80211_ops - callbacks from mac80211 to the driver
 *
 * This structure contains various callbacks that the driver may
@@ -1626,6 +1639,10 @@ enum ieee80211_ampdu_mlme_action {
 *      ask the device to suspend. This is only invoked when WoWLAN is
 *      configured, otherwise the device is deconfigured completely and
 *      reconfigured at resume time.
+ *      The driver may also impose special conditions under which it
+ *      wants to use the "normal" suspend (deconfigure), say if it only
+ *      supports WoWLAN when the device is associated. In this case, it
+ *      must return 1 from this function.
 *
 * @resume: If WoWLAN was configured, this indicates that mac80211 is
 *      now resuming its operation, after this the device must be fully
@@ -1671,6 +1688,26 @@ enum ieee80211_ampdu_mlme_action {
 *      of the bss parameters has changed when a call is made. The callback
 *      can sleep.
 *
+ * @tx_sync: Called before a frame is sent to an AP/GO. In the GO case, the
+ *      driver should sync with the GO's powersaving so the device doesn't
+ *      transmit the frame while the GO is asleep. In the regular AP case
+ *      it may be used by drivers for devices implementing other restrictions
+ *      on talking to APs, e.g. due to regulatory enforcement or just HW
+ *      restrictions.
+ *      This function is called for every authentication, association and
+ *      action frame separately since applications might attempt to auth
+ *      with multiple APs before chosing one to associate to. If it returns
+ *      an error, the corresponding authentication, association or frame
+ *      transmission is aborted and reported as having failed. It is always
+ *      called after tuning to the correct channel.
+ *      The callback might be called multiple times before @finish_tx_sync
+ *      (but @finish_tx_sync will be called once for each) but in practice
+ *      this is unlikely to happen. It can also refuse in that case if the
+ *      driver cannot handle that situation.
+ *      This callback can sleep.
+ * @finish_tx_sync: Called as a counterpart to @tx_sync, unless that returned
+ *      an error. This callback can sleep.
+ *
 * @prepare_multicast: Prepare for multicast filter configuration.
 *      This callback is optional, and its return value is passed
 *      to configure_filter(). This callback must be atomic.
@@ -1694,6 +1731,12 @@ enum ieee80211_ampdu_mlme_action {
 *      which set IEEE80211_KEY_FLAG_TKIP_REQ_RX_P1_KEY.
 *      The callback must be atomic.
 *
+ * @set_rekey_data: If the device supports GTK rekeying, for example while the
+ *      host is suspended, it can assign this callback to retrieve the data
+ *      necessary to do GTK rekeying, this is the KEK, KCK and replay counter.
+ *      After rekeying was done it should (for example during resume) notify
+ *      userspace of the new replay counter using ieee80211_gtk_rekey_notify().
+ *
 * @hw_scan: Ask the hardware to service the scan request, no need to start
 *      the scan state machine in stack. The scan must honour the channel
 *      configuration done by the regulatory agent in the wiphy's
@@ -1708,6 +1751,14 @@ enum ieee80211_ampdu_mlme_action {
 *      any error unless this callback returned a negative error code.
 *      The callback can sleep.
 *
+ * @cancel_hw_scan: Ask the low-level tp cancel the active hw scan.
+ *      The driver should ask the hardware to cancel the scan (if possible),
+ *      but the scan will be completed only after the driver will call
+ *      ieee80211_scan_completed().
+ *      This callback is needed for wowlan, to prevent enqueueing a new
+ *      scan_work after the low-level driver was already suspended.
+ *      The callback can sleep.
+ *
 * @sched_scan_start: Ask the hardware to start scanning repeatedly at
 *      specific intervals.  The driver must call the
 *      ieee80211_sched_scan_results() function whenever it finds results.
@@ -1816,6 +1867,7 @@ enum ieee80211_ampdu_mlme_action {
 *
 * @testmode_cmd: Implement a cfg80211 test mode command.
 *      The callback can sleep.
+ * @testmode_dump: Implement a cfg80211 test mode dump. The callback can sleep.
 *
 * @flush: Flush all pending frames from the hardware queue, making sure
 *      that the hardware queues are empty. If the parameter @drop is set
@@ -1860,6 +1912,8 @@ enum ieee80211_ampdu_mlme_action {
 * @set_bitrate_mask: Set a mask of rates to be used for rate control selection
 *      when transmitting a frame. Currently only legacy rates are handled.
 *      The callback can sleep.
+ * @rssi_callback: Notify driver when the average RSSI goes above/below
+ *      thresholds that were registered previously. The callback can sleep.
 */
 struct ieee80211_ops {
        void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1881,6 +1935,14 @@ struct ieee80211_ops {
                                 struct ieee80211_vif *vif,
                                 struct ieee80211_bss_conf *info,
                                 u32 changed);
+        int (*tx_sync)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                       const u8 *bssid, enum ieee80211_tx_sync_type type);
+        void (*finish_tx_sync)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               const u8 *bssid,
+                               enum ieee80211_tx_sync_type type);
        u64 (*prepare_multicast)(struct ieee80211_hw *hw,
                                 struct netdev_hw_addr_list *mc_list);
        void (*configure_filter)(struct ieee80211_hw *hw,
@@ -1897,8 +1959,13 @@ struct ieee80211_ops {
                                struct ieee80211_key_conf *conf,
                                struct ieee80211_sta *sta,
                                u32 iv32, u16 *phase1key);
+        void (*set_rekey_data)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct cfg80211_gtk_rekey_data *data);
        int (*hw_scan)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                       struct cfg80211_scan_request *req);
+        void (*cancel_hw_scan)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif);
        int (*sched_scan_start)(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                struct cfg80211_sched_scan_request *req,
@@ -1936,6 +2003,9 @@ struct ieee80211_ops {
        void (*set_coverage_class)(struct ieee80211_hw *hw, u8 coverage_class);
 #ifdef CONFIG_NL80211_TESTMODE
        int (*testmode_cmd)(struct ieee80211_hw *hw, void *data, int len);
+        int (*testmode_dump)(struct ieee80211_hw *hw, struct sk_buff *skb,
+                             struct netlink_callback *cb,
+                             void *data, int len);
 #endif
        void (*flush)(struct ieee80211_hw *hw, bool drop);
        void (*channel_switch)(struct ieee80211_hw *hw,
@@ -1960,6 +2030,8 @@ struct ieee80211_ops {
        bool (*tx_frames_pending)(struct ieee80211_hw *hw);
        int (*set_bitrate_mask)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                                const struct cfg80211_bitrate_mask *mask);
+        void (*rssi_callback)(struct ieee80211_hw *hw,
+                              enum ieee80211_rssi_event rssi_event);
 };
 /**
@@ -2550,21 +2622,136 @@ struct sk_buff *
 ieee80211_get_buffered_bc(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 /**
- * ieee80211_get_tkip_key - get a TKIP rc4 for skb
+ * ieee80211_get_tkip_p1k_iv - get a TKIP phase 1 key for IV32
+ *
+ * This function returns the TKIP phase 1 key for the given IV32.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @iv32: IV32 to get the P1K for
+ * @p1k: a buffer to which the key will be written, as 5 u16 values
+ */
+void ieee80211_get_tkip_p1k_iv(struct ieee80211_key_conf *keyconf,
+                               u32 iv32, u16 *p1k);
+/**
+ * ieee80211_get_tkip_p1k - get a TKIP phase 1 key
+ *
+ * This function returns the TKIP phase 1 key for the IV32 taken
+ * from the given packet.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @skb: the packet to take the IV32 value from that will be encrypted
+ *      with this P1K
+ * @p1k: a buffer to which the key will be written, as 5 u16 values
+ */
+static inline void ieee80211_get_tkip_p1k(struct ieee80211_key_conf *keyconf,
+                                          struct sk_buff *skb, u16 *p1k)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        const u8 *data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
+        u32 iv32 = get_unaligned_le32(&data[4]);
+        ieee80211_get_tkip_p1k_iv(keyconf, iv32, p1k);
+}
+/**
+ * ieee80211_get_tkip_rx_p1k - get a TKIP phase 1 key for RX
+ *
+ * This function returns the TKIP phase 1 key for the given IV32
+ * and transmitter address.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @ta: TA that will be used with the key
+ * @iv32: IV32 to get the P1K for
+ * @p1k: a buffer to which the key will be written, as 5 u16 values
+ */
+void ieee80211_get_tkip_rx_p1k(struct ieee80211_key_conf *keyconf,
+                               const u8 *ta, u32 iv32, u16 *p1k);
+/**
+ * ieee80211_get_tkip_p2k - get a TKIP phase 2 key
+ *
+ * This function computes the TKIP RC4 key for the IV values
+ * in the packet.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @skb: the packet to take the IV32/IV16 values from that will be
+ *      encrypted with this key
+ * @p2k: a buffer to which the key will be written, 16 bytes
+ */
+void ieee80211_get_tkip_p2k(struct ieee80211_key_conf *keyconf,
+                            struct sk_buff *skb, u8 *p2k);
+/**
+ * struct ieee80211_key_seq - key sequence counter
 *
- * This function computes a TKIP rc4 key for an skb. It computes
+ * @tkip: TKIP data, containing IV32 and IV16 in host byte order
- * a phase 1 key if needed (iv16 wraps around). This function is to
+ * @ccmp: PN data, most significant byte first (big endian,
- * be used by drivers which can do HW encryption but need to compute
+ *      reverse order than in packet)
- * to phase 1/2 key in SW.
+ * @aes_cmac: PN data, most significant byte first (big endian,
+ *      reverse order than in packet)
+ */
+struct ieee80211_key_seq {
+        union {
+                struct {
+                        u32 iv32;
+                        u16 iv16;
+                } tkip;
+                struct {
+                        u8 pn[6];
+                } ccmp;
+                struct {
+                        u8 pn[6];
+                } aes_cmac;
+        };
+};
+/**
+ * ieee80211_get_key_tx_seq - get key TX sequence counter
+ *
+ * @keyconf: the parameter passed with the set key
+ * @seq: buffer to receive the sequence data
+ *
+ * This function allows a driver to retrieve the current TX IV/PN
+ * for the given key. It must not be called if IV generation is
+ * offloaded to the device.
+ *
+ * Note that this function may only be called when no TX processing
+ * can be done concurrently, for example when queues are stopped
+ * and the stop has been synchronized.
+ */
+void ieee80211_get_key_tx_seq(struct ieee80211_key_conf *keyconf,
+                              struct ieee80211_key_seq *seq);
+/**
+ * ieee80211_get_key_rx_seq - get key RX sequence counter
 *
 * @keyconf: the parameter passed with the set key
- * @skb: the skb for which the key is needed
+ * @tid: The TID, or -1 for the management frame value (CCMP only);
- * @type: TBD
+ *      the value on TID 0 is also used for non-QoS frames. For
- * @key: a buffer to which the key will be written
+ *      CMAC, only TID 0 is valid.
+ * @seq: buffer to receive the sequence data
+ *
+ * This function allows a driver to retrieve the current RX IV/PNs
+ * for the given key. It must not be called if IV checking is done
+ * by the device and not by mac80211.
+ *
+ * Note that this function may only be called when no RX processing
+ * can be done concurrently.
 */
-void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
+void ieee80211_get_key_rx_seq(struct ieee80211_key_conf *keyconf,
-                                struct sk_buff *skb,
+                              int tid, struct ieee80211_key_seq *seq);
-                                enum ieee80211_tkip_key_type type, u8 *key);
+/**
+ * ieee80211_gtk_rekey_notify - notify userspace supplicant of rekeying
+ * @vif: virtual interface the rekeying was done on
+ * @bssid: The BSSID of the AP, for checking association
+ * @replay_ctr: the new replay counter after GTK rekeying
+ * @gfp: allocation flags
+ */
+void ieee80211_gtk_rekey_notify(struct ieee80211_vif *vif, const u8 *bssid,
+                                const u8 *replay_ctr, gfp_t gfp);
 /**
 * ieee80211_wake_queue - wake specific queue
 * @hw: pointer as obtained from ieee80211_alloc_hw().
@@ -2830,6 +3017,33 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
                               struct ieee80211_sta *pubsta, bool block);
 /**
+ * ieee80211_iter_keys - iterate keys programmed into the device
+ * @hw: pointer obtained from ieee80211_alloc_hw()
+ * @vif: virtual interface to iterate, may be %NULL for all
+ * @iter: iterator function that will be called for each key
+ * @iter_data: custom data to pass to the iterator function
+ *
+ * This function can be used to iterate all the keys known to
+ * mac80211, even those that weren't previously programmed into
+ * the device. This is intended for use in WoWLAN if the device
+ * needs reprogramming of the keys during suspend. Note that due
+ * to locking reasons, it is also only safe to call this at few
+ * spots since it must hold the RTNL and be able to sleep.
+ *
+ * The order in which the keys are iterated matches the order
+ * in which they were originally installed and handed to the
+ * set_key callback.
+ */
+void ieee80211_iter_keys(struct ieee80211_hw *hw,
+                         struct ieee80211_vif *vif,
+                         void (*iter)(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      struct ieee80211_sta *sta,
+                                      struct ieee80211_key_conf *key,
+                                      void *data),
+                         void *iter_data);
+/**
 * ieee80211_ap_probereq_get - retrieve a Probe Request template
 * @hw: pointer obtained from ieee80211_alloc_hw().
 * @vif: &struct ieee80211_vif pointer from the add_interface callback.
@@ -2870,6 +3084,29 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif);
 void ieee80211_connection_loss(struct ieee80211_vif *vif);
 /**
+ * ieee80211_resume_disconnect - disconnect from AP after resume
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * Instructs mac80211 to disconnect from the AP after resume.
+ * Drivers can use this after WoWLAN if they know that the
+ * connection cannot be kept up, for example because keys were
+ * used while the device was asleep but the replay counters or
+ * similar cannot be retrieved from the device during resume.
+ *
+ * Note that due to implementation issues, if the driver uses
+ * the reconfiguration functionality during resume the interface
+ * will still be added as associated first during resume and then
+ * disconnect normally later.
+ *
+ * This function can only be called from the resume callback and
+ * the driver must not be holding any of its own locks while it
+ * calls this function, or at least not any locks it needs in the
+ * key configuration paths (if it supports HW crypto).
+ */
+void ieee80211_resume_disconnect(struct ieee80211_vif *vif);
+/**
 * ieee80211_disable_dyn_ps - force mac80211 to temporarily disable dynamic psm
 *
 * @vif: &struct ieee80211_vif pointer from the add_interface callback.
@@ -2916,6 +3153,16 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
                               gfp_t gfp);
 /**
+ * ieee80211_get_operstate - get the operstate of the vif
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * The driver might need to know the operstate of the net_device
+ * (specifically, whether the link is IF_OPER_UP after resume)
+ */
+unsigned char ieee80211_get_operstate(struct ieee80211_vif *vif);
+/**
 * ieee80211_chswitch_done - Complete channel switch process
 * @vif: &struct ieee80211_vif pointer from the add_interface callback.
 * @success: make the channel switch successful or not
@@ -2965,6 +3212,23 @@ void ieee80211_ready_on_channel(struct ieee80211_hw *hw);
 */
 void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw);
+/**
+ * ieee80211_stop_rx_ba_session - callback to stop existing BA sessions
+ *
+ * in order not to harm the system performance and user experience, the device
+ * may request not to allow any rx ba session and tear down existing rx ba
+ * sessions based on system constraints such as periodic BT activity that needs
+ * to limit wlan activity (eg.sco or a2dp)."
+ * in such cases, the intention is to limit the duration of the rx ppdu and
+ * therefore prevent the peer device to use a-mpdu aggregation.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @ba_rx_bitmap: Bit map of open rx ba per tid
+ * @addr: & to bssid mac address
+ */
+void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
+                                  const u8 *addr);
 /* Rate control API */
 /**
@@ -3150,4 +3414,9 @@ ieee80211_vif_type_p2p(struct ieee80211_vif *vif)
        return ieee80211_iftype_p2p(vif->type, vif->p2p);
 }
+void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
+                                   int rssi_min_thold,
+                                   int rssi_max_thold);
+void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif);
 #endif /* MAC80211_H */
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 4014b623880..2720884287c 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -16,7 +16,7 @@
 *              - Add neighbour cache statistics like rtstat
 */
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <linux/rcupdate.h>
@@ -108,8 +108,8 @@ struct neighbour {
        __u8                    dead;
        seqlock_t               ha_lock;
        unsigned char           ha[ALIGN(MAX_ADDR_LEN, sizeof(unsigned long))];
-        struct hh_cache         *hh;
+        struct hh_cache         hh;
-        int                     (*output)(struct sk_buff *skb);
+        int                     (*output)(struct neighbour *, struct sk_buff *);
        const struct neigh_ops  *ops;
        struct rcu_head         rcu;
        struct net_device       *dev;
@@ -118,12 +118,10 @@ struct neighbour {
 struct neigh_ops {
        int                     family;
-        void                    (*solicit)(struct neighbour *, struct sk_buff*);
+        void                    (*solicit)(struct neighbour *, struct sk_buff *);
-        void                    (*error_report)(struct neighbour *, struct sk_buff*);
+        void                    (*error_report)(struct neighbour *, struct sk_buff *);
-        int                     (*output)(struct sk_buff*);
+        int                     (*output)(struct neighbour *, struct sk_buff *);
-        int                     (*connected_output)(struct sk_buff*);
+        int                     (*connected_output)(struct neighbour *, struct sk_buff *);
-        int                     (*hh_output)(struct sk_buff*);
-        int                     (*queue_xmit)(struct sk_buff*);
 };
 struct pneigh_entry {
@@ -142,7 +140,7 @@ struct pneigh_entry {
 struct neigh_hash_table {
        struct neighbour __rcu  **hash_buckets;
-        unsigned int            hash_mask;
+        unsigned int            hash_shift;
        __u32                   hash_rnd;
        struct rcu_head         rcu;
 };
@@ -205,9 +203,10 @@ extern int			neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                                             u32 flags);
 extern void                     neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev);
 extern int                      neigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
-extern int                      neigh_resolve_output(struct sk_buff *skb);
+extern int                      neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb);
-extern int                      neigh_connected_output(struct sk_buff *skb);
+extern int                      neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb);
-extern int                      neigh_compat_output(struct sk_buff *skb);
+extern int                      neigh_compat_output(struct neighbour *neigh, struct sk_buff *skb);
+extern int                      neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb);
 extern struct neighbour         *neigh_event_ns(struct neigh_table *tbl,
                                                u8 *lladdr, void *saddr,
                                                struct net_device *dev);
@@ -341,7 +340,16 @@ static inline int neigh_hh_output(struct hh_cache *hh, struct sk_buff *skb)
        } while (read_seqretry(&hh->hh_lock, seq));
        skb_push(skb, hh_len);
-        return hh->hh_output(skb);
+        return dev_queue_xmit(skb);
+}
+static inline int neigh_output(struct neighbour *n, struct sk_buff *skb)
+{
+        struct hh_cache *hh = &n->hh;
+        if ((n->nud_state & NUD_CONNECTED) && hh->hh_len)
+                return neigh_hh_output(hh, skb);
+        else
+                return n->output(n, skb);
 }
 static inline struct neighbour *
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index aef430d779b..3bb6fa0eace 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -4,7 +4,7 @@
 #ifndef __NET_NET_NAMESPACE_H
 #define __NET_NET_NAMESPACE_H
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <linux/workqueue.h>
 #include <linux/list.h>
 #include <linux/sysctl.h>
@@ -65,6 +65,7 @@ struct net {
        struct list_head        dev_base_head;
        struct hlist_head       *dev_name_head;
        struct hlist_head       *dev_index_head;
+        unsigned int            dev_base_seq;   /* protected by rtnl_mutex */
        /* core fib_rules */
        struct list_head        rules_ops;
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 5d4f8e586e3..0b7f05e4a92 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -16,7 +16,7 @@
 #include <linux/bitops.h>
 #include <linux/compiler.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <linux/netfilter/nf_conntrack_tcp.h>
 #include <linux/netfilter/nf_conntrack_dccp.h>
diff --git a/include/net/netlabel.h b/include/net/netlabel.h
index 9db401a8b4d..f67440970d7 100644
--- a/include/net/netlabel.h
+++ b/include/net/netlabel.h
@@ -4,7 +4,7 @@
 * The NetLabel system manages static and dynamic label mappings for network
 * protocols such as CIPSO and RIPSO.
 *
- * Author: Paul Moore <paul.moore@hp.com>
+ * Author: Paul Moore <paul@paul-moore.com>
 *
 */
@@ -38,7 +38,7 @@
 #include <linux/in6.h>
 #include <net/netlink.h>
 #include <net/request_sock.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 struct cipso_v4_doi;
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 02740a94f10..98c185441be 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -638,6 +638,30 @@ static inline int nlmsg_unicast(struct sock *sk, struct sk_buff *skb, u32 pid)
             nlmsg_ok(pos, rem); \
             pos = nlmsg_next(pos, &(rem)))
+/**
+ * nl_dump_check_consistent - check if sequence is consistent and advertise if not
+ * @cb: netlink callback structure that stores the sequence number
+ * @nlh: netlink message header to write the flag to
+ *
+ * This function checks if the sequence (generation) number changed during dump
+ * and if it did, advertises it in the netlink message header.
+ *
+ * The correct way to use it is to set cb->seq to the generation counter when
+ * all locks for dumping have been acquired, and then call this function for
+ * each message that is generated.
+ *
+ * Note that due to initialisation concerns, 0 is an invalid sequence number
+ * and must not be used by code that uses this functionality.
+ */
+static inline void
+nl_dump_check_consistent(struct netlink_callback *cb,
+                         struct nlmsghdr *nlh)
+{
+        if (cb->prev_seq && cb->seq != cb->prev_seq)
+                nlh->nlmsg_flags |= NLM_F_DUMP_INTR;
+        cb->prev_seq = cb->seq;
+}
 /**************************************************************************
 * Netlink Attributes
 **************************************************************************/
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index 341eb089349..0249399e51a 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -3,7 +3,7 @@
 #include <linux/list.h>
 #include <linux/list_nulls.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 struct ctl_table_header;
 struct nf_conntrack_ecache;
diff --git a/include/net/netns/generic.h b/include/net/netns/generic.h
index 3419bf5cd15..d55f4344333 100644
--- a/include/net/netns/generic.h
+++ b/include/net/netns/generic.h
@@ -41,6 +41,7 @@ static inline void *net_generic(const struct net *net, int id)
        ptr = ng->ptr[id - 1];
        rcu_read_unlock();
+        BUG_ON(!ptr);
        return ptr;
 }
 #endif
diff --git a/include/net/nfc.h b/include/net/nfc.h
new file mode 100644
index 00000000000..cc0130312f7
--- /dev/null
+++ b/include/net/nfc.h
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2011 Instituto Nokia de Tecnologia
+ *
+ * Authors:
+ *    Lauro Ramos Venancio <lauro.venancio@openbossa.org>
+ *    Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+#ifndef __NET_NFC_H
+#define __NET_NFC_H
+#include <linux/device.h>
+#include <linux/skbuff.h>
+#define nfc_dev_info(dev, fmt, arg...) dev_info((dev), "NFC: " fmt "\n", ## arg)
+#define nfc_dev_err(dev, fmt, arg...) dev_err((dev), "NFC: " fmt "\n", ## arg)
+#define nfc_dev_dbg(dev, fmt, arg...) dev_dbg((dev), fmt "\n", ## arg)
+struct nfc_dev;
+/**
+ * data_exchange_cb_t - Definition of nfc_data_exchange callback
+ *
+ * @context: nfc_data_exchange cb_context parameter
+ * @skb: response data
+ * @err: If an error has occurred during data exchange, it is the
+ *      error number. Zero means no error.
+ *
+ * When a rx or tx package is lost or corrupted or the target gets out
+ * of the operating field, err is -EIO.
+ */
+typedef void (*data_exchange_cb_t)(void *context, struct sk_buff *skb,
+                                                                int err);
+struct nfc_ops {
+        int (*start_poll)(struct nfc_dev *dev, u32 protocols);
+        void (*stop_poll)(struct nfc_dev *dev);
+        int (*activate_target)(struct nfc_dev *dev, u32 target_idx,
+                                                        u32 protocol);
+        void (*deactivate_target)(struct nfc_dev *dev, u32 target_idx);
+        int (*data_exchange)(struct nfc_dev *dev, u32 target_idx,
+                                struct sk_buff *skb, data_exchange_cb_t cb,
+                                                        void *cb_context);
+};
+struct nfc_target {
+        u32 idx;
+        u32 supported_protocols;
+        u16 sens_res;
+        u8 sel_res;
+};
+struct nfc_genl_data {
+        u32 poll_req_pid;
+        struct mutex genl_data_mutex;
+};
+struct nfc_dev {
+        unsigned idx;
+        unsigned target_idx;
+        struct nfc_target *targets;
+        int n_targets;
+        int targets_generation;
+        spinlock_t targets_lock;
+        struct device dev;
+        bool polling;
+        struct nfc_genl_data genl_data;
+        u32 supported_protocols;
+        struct nfc_ops *ops;
+};
+#define to_nfc_dev(_dev) container_of(_dev, struct nfc_dev, dev)
+extern struct class nfc_class;
+struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
+                                        u32 supported_protocols);
+/**
+ * nfc_free_device - free nfc device
+ *
+ * @dev: The nfc device to free
+ */
+static inline void nfc_free_device(struct nfc_dev *dev)
+{
+        put_device(&dev->dev);
+}
+int nfc_register_device(struct nfc_dev *dev);
+void nfc_unregister_device(struct nfc_dev *dev);
+/**
+ * nfc_set_parent_dev - set the parent device
+ *
+ * @nfc_dev: The nfc device whose parent is being set
+ * @dev: The parent device
+ */
+static inline void nfc_set_parent_dev(struct nfc_dev *nfc_dev,
+                                        struct device *dev)
+{
+        nfc_dev->dev.parent = dev;
+}
+/**
+ * nfc_set_drvdata - set driver specifc data
+ *
+ * @dev: The nfc device
+ * @data: Pointer to driver specifc data
+ */
+static inline void nfc_set_drvdata(struct nfc_dev *dev, void *data)
+{
+        dev_set_drvdata(&dev->dev, data);
+}
+/**
+ * nfc_get_drvdata - get driver specifc data
+ *
+ * @dev: The nfc device
+ */
+static inline void *nfc_get_drvdata(struct nfc_dev *dev)
+{
+        return dev_get_drvdata(&dev->dev);
+}
+/**
+ * nfc_device_name - get the nfc device name
+ *
+ * @dev: The nfc device whose name to return
+ */
+static inline const char *nfc_device_name(struct nfc_dev *dev)
+{
+        return dev_name(&dev->dev);
+}
+struct sk_buff *nfc_alloc_skb(unsigned int size, gfp_t gfp);
+int nfc_targets_found(struct nfc_dev *dev, struct nfc_target *targets,
+                                                        int ntargets);
+#endif /* __NET_NFC_H */
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 65afc496620..fffdc603f4c 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -99,9 +99,9 @@ static inline void qdisc_run(struct Qdisc *q)
                __qdisc_run(q);
 }
-extern int tc_classify_compat(struct sk_buff *skb, struct tcf_proto *tp,
+extern int tc_classify_compat(struct sk_buff *skb, const struct tcf_proto *tp,
                              struct tcf_result *res);
-extern int tc_classify(struct sk_buff *skb, struct tcf_proto *tp,
+extern int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                       struct tcf_result *res);
 /* Calculate maximal size of packet seen by hard_start_xmit
diff --git a/include/net/red.h b/include/net/red.h
index 3319f16b3be..b72a3b83393 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -116,7 +116,7 @@ struct red_parms {
        u32             qR;             /* Cached random number */
        unsigned long   qavg;           /* Average queue length: A scaled */
-        psched_time_t   qidlestart;     /* Start of current idle period */
+        ktime_t         qidlestart;     /* Start of current idle period */
 };
 static inline u32 red_rmask(u8 Plog)
@@ -148,17 +148,17 @@ static inline void red_set_parms(struct red_parms *p,
 static inline int red_is_idling(struct red_parms *p)
 {
-        return p->qidlestart != PSCHED_PASTPERFECT;
+        return p->qidlestart.tv64 != 0;
 }
 static inline void red_start_of_idle_period(struct red_parms *p)
 {
-        p->qidlestart = psched_get_time();
+        p->qidlestart = ktime_get();
 }
 static inline void red_end_of_idle_period(struct red_parms *p)
 {
-        p->qidlestart = PSCHED_PASTPERFECT;
+        p->qidlestart.tv64 = 0;
 }
 static inline void red_restart(struct red_parms *p)
@@ -170,13 +170,10 @@ static inline void red_restart(struct red_parms *p)
 static inline unsigned long red_calc_qavg_from_idle_time(struct red_parms *p)
 {
-        psched_time_t now;
+        s64 delta = ktime_us_delta(ktime_get(), p->qidlestart);
-        long us_idle;
+        long us_idle = min_t(s64, delta, p->Scell_max);
        int  shift;
-        now = psched_get_time();
-        us_idle = psched_tdiff_bounded(now, p->qidlestart, p->Scell_max);
        /*
         * The problem: ideally, average length queue recalcultion should
         * be done over constant clock intervals. This is too expensive, so
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index 99e6e19b57c..4c0766e201e 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -96,7 +96,8 @@ extern int sysctl_max_syn_backlog;
 */
 struct listen_sock {
        u8                      max_qlen_log;
-        /* 3 bytes hole, try to use */
+        u8                      synflood_warned;
+        /* 2 bytes hole, try to use */
        int                     qlen;
        int                     qlen_young;
        int                     clock_hand;
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 4093ca78cf6..678f1ffaf84 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -6,11 +6,14 @@
 typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *, void *);
 typedef int (*rtnl_dumpit_func)(struct sk_buff *, struct netlink_callback *);
+typedef u16 (*rtnl_calcit_func)(struct sk_buff *);
 extern int      __rtnl_register(int protocol, int msgtype,
-                                rtnl_doit_func, rtnl_dumpit_func);
+                                rtnl_doit_func, rtnl_dumpit_func,
+                                rtnl_calcit_func);
 extern void     rtnl_register(int protocol, int msgtype,
-                              rtnl_doit_func, rtnl_dumpit_func);
+                              rtnl_doit_func, rtnl_dumpit_func,
+                              rtnl_calcit_func);
 extern int      rtnl_unregister(int protocol, int msgtype);
 extern void     rtnl_unregister_all(int protocol);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index b931f021d7a..4fc88f3ccd5 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -181,8 +181,9 @@ struct tcf_proto_ops {
        struct tcf_proto_ops    *next;
        char                    kind[IFNAMSIZ];
-        int                     (*classify)(struct sk_buff*, struct tcf_proto*,
+        int                     (*classify)(struct sk_buff *,
-                                        struct tcf_result *);
+                                            const struct tcf_proto *,
+                                            struct tcf_result *);
        int                     (*init)(struct tcf_proto*);
        void                    (*destroy)(struct tcf_proto*);
@@ -205,8 +206,9 @@ struct tcf_proto {
        /* Fast access part */
        struct tcf_proto        *next;
        void                    *root;
-        int                     (*classify)(struct sk_buff*, struct tcf_proto*,
+        int                     (*classify)(struct sk_buff *,
-                                        struct tcf_result *);
+                                            const struct tcf_proto *,
+                                            struct tcf_result *);
        __be16                  protocol;
        /* All the rest */
@@ -214,7 +216,7 @@ struct tcf_proto {
        u32                     classid;
        struct Qdisc            *q;
        void                    *data;
-        struct tcf_proto_ops    *ops;
+        const struct tcf_proto_ops      *ops;
 };
 struct qdisc_skb_cb {
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 6506458ccd3..712b3bebeda 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -109,6 +109,7 @@ typedef enum {
        SCTP_CMD_SEND_MSG,       /* Send the whole use message */
        SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */
        SCTP_CMD_PURGE_ASCONF_QUEUE, /* Purge all asconf queues.*/
+        SCTP_CMD_SET_ASOC,       /* Restore association context */
        SCTP_CMD_LAST
 } sctp_verb_t;
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index b2c2366676a..6a72a58cde5 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -120,6 +120,7 @@ extern int sctp_copy_local_addr_list(struct sctp_bind_addr *,
                                     int flags);
 extern struct sctp_pf *sctp_get_pf_specific(sa_family_t family);
 extern int sctp_register_pf(struct sctp_pf *, sa_family_t);
+extern void sctp_addr_wq_mgmt(struct sctp_sockaddr_entry *, int);
 /*
 * sctp/socket.c
@@ -134,6 +135,7 @@ void sctp_sock_rfree(struct sk_buff *skb);
 void sctp_copy_sock(struct sock *newsk, struct sock *sk,
                    struct sctp_association *asoc);
 extern struct percpu_counter sctp_sockets_allocated;
+extern int sctp_asconf_mgmt(struct sctp_sock *, struct sctp_sockaddr_entry *);
 /*
 * sctp/primitive.c
@@ -285,20 +287,21 @@ do {							\
                pr_cont(fmt, ##args);                   \
 } while (0)
 #define SCTP_DEBUG_PRINTK_IPADDR(fmt_lead, fmt_trail,                   \
-                                 args_lead, saddr, args_trail...)       \
+                                 args_lead, addr, args_trail...)        \
 do {                                                                    \
+        const union sctp_addr *_addr = (addr);                          \
        if (sctp_debug_flag) {                                          \
-                if (saddr->sa.sa_family == AF_INET6) {                  \
+                if (_addr->sa.sa_family == AF_INET6) {                  \
                        printk(KERN_DEBUG                               \
                               pr_fmt(fmt_lead "%pI6" fmt_trail),       \
                               args_lead,                               \
-                               &saddr->v6.sin6_addr,                    \
+                               &_addr->v6.sin6_addr,                    \
                               args_trail);                             \
                } else {                                                \
                        printk(KERN_DEBUG                               \
                               pr_fmt(fmt_lead "%pI4" fmt_trail),       \
                               args_lead,                               \
-                               &saddr->v4.sin_addr.s_addr,              \
+                               &_addr->v4.sin_addr.s_addr,              \
                               args_trail);                             \
                }                                                       \
        }                                                               \
@@ -598,7 +601,7 @@ static inline int ipver2af(__u8 ipver)
                return AF_INET6;
        default:
                return 0;
-        };
+        }
 }
 /* Convert from an address parameter type to an address family.  */
@@ -611,7 +614,7 @@ static inline int param_type2af(__be16 type)
                return AF_INET6;
        default:
                return 0;
-        };
+        }
 }
 /* Perform some sanity checks. */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 7df327a6d56..ec86952fb57 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -60,7 +60,7 @@
 #include <linux/in6.h>          /* We get struct in6_addr     */
 #include <linux/ipv6.h>
 #include <asm/param.h>          /* We get MAXHOSTNAMELEN.     */
-#include <asm/atomic.h>         /* This gets us atomic counters.  */
+#include <linux/atomic.h>               /* This gets us atomic counters.  */
 #include <linux/skbuff.h>       /* We need sk_buff_head. */
 #include <linux/workqueue.h>    /* We need tq_struct.    */
 #include <linux/sctp.h>         /* We need sctp* header structs.  */
@@ -205,6 +205,11 @@ extern struct sctp_globals {
         * It is a list of sctp_sockaddr_entry.
         */
        struct list_head local_addr_list;
+        int default_auto_asconf;
+        struct list_head addr_waitq;
+        struct timer_list addr_wq_timer;
+        struct list_head auto_asconf_splist;
+        spinlock_t addr_wq_lock;
        /* Lock that protects the local_addr_list writers */
        spinlock_t addr_list_lock;
@@ -236,6 +241,9 @@ extern struct sctp_globals {
         * bits is an indicator of when to send and window update SACK.
         */
        int rwnd_update_shift;
+        /* Threshold for autoclose timeout, in seconds. */
+        unsigned long max_autoclose;
 } sctp_globals;
 #define sctp_rto_initial                (sctp_globals.rto_initial)
@@ -264,6 +272,11 @@ extern struct sctp_globals {
 #define sctp_port_hashtable             (sctp_globals.port_hashtable)
 #define sctp_local_addr_list            (sctp_globals.local_addr_list)
 #define sctp_local_addr_lock            (sctp_globals.addr_list_lock)
+#define sctp_auto_asconf_splist         (sctp_globals.auto_asconf_splist)
+#define sctp_addr_waitq                 (sctp_globals.addr_waitq)
+#define sctp_addr_wq_timer              (sctp_globals.addr_wq_timer)
+#define sctp_addr_wq_lock               (sctp_globals.addr_wq_lock)
+#define sctp_default_auto_asconf        (sctp_globals.default_auto_asconf)
 #define sctp_scope_policy               (sctp_globals.ipv4_scope_policy)
 #define sctp_addip_enable               (sctp_globals.addip_enable)
 #define sctp_addip_noauth               (sctp_globals.addip_noauth_enable)
@@ -271,6 +284,7 @@ extern struct sctp_globals {
 #define sctp_auth_enable                (sctp_globals.auth_enable)
 #define sctp_checksum_disable           (sctp_globals.checksum_disable)
 #define sctp_rwnd_upd_shift             (sctp_globals.rwnd_update_shift)
+#define sctp_max_autoclose              (sctp_globals.max_autoclose)
 /* SCTP Socket type: UDP or TCP style. */
 typedef enum {
@@ -341,6 +355,8 @@ struct sctp_sock {
        atomic_t pd_mode;
        /* Receive to here while partial delivery is in effect. */
        struct sk_buff_head pd_lobby;
+        struct list_head auto_asconf_list;
+        int do_auto_asconf;
 };
 static inline struct sctp_sock *sctp_sk(const struct sock *sk)
@@ -792,6 +808,8 @@ struct sctp_sockaddr_entry {
        __u8 valid;
 };
+#define SCTP_ADDRESS_TICK_DELAY 500
 typedef struct sctp_chunk *(sctp_packet_phandler_t)(struct sctp_association *);
 /* This structure holds lists of chunks as we are assembling for
@@ -1236,6 +1254,7 @@ sctp_scope_t sctp_scope(const union sctp_addr *);
 int sctp_in_scope(const union sctp_addr *addr, const sctp_scope_t scope);
 int sctp_is_any(struct sock *sk, const union sctp_addr *addr);
 int sctp_addr_is_valid(const union sctp_addr *addr);
+int sctp_is_ep_boundall(struct sock *sk);
 /* What type of endpoint?  */
@@ -1898,6 +1917,8 @@ struct sctp_association {
         * after reaching 4294967295.
         */
        __u32 addip_serial;
+        union sctp_addr *asconf_addr_del_pending;
+        int src_out_of_asoc_ok;
        /* SCTP AUTH: list of the endpoint shared keys.  These
         * keys are provided out of band by the user applicaton
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 32fd5127403..0842ef00b2f 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -92,6 +92,7 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_LOCAL_AUTH_CHUNKS  27      /* Read only */
 #define SCTP_GET_ASSOC_NUMBER   28      /* Read only */
 #define SCTP_GET_ASSOC_ID_LIST  29      /* Read only */
+#define SCTP_AUTO_ASCONF       30
 /* Internal Socket Options. Some of the sctp library functions are
 * implemented using these socket options.
diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
new file mode 100644
index 00000000000..d97f6892c01
--- /dev/null
+++ b/include/net/secure_seq.h
@@ -0,0 +1,20 @@
+#ifndef _NET_SECURE_SEQ
+#define _NET_SECURE_SEQ
+#include <linux/types.h>
+extern __u32 secure_ip_id(__be32 daddr);
+extern __u32 secure_ipv6_id(const __be32 daddr[4]);
+extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
+extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+                                      __be16 dport);
+extern __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
+                                        __be16 sport, __be16 dport);
+extern __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
+                                          __be16 sport, __be16 dport);
+extern u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
+                                       __be16 sport, __be16 dport);
+extern u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
+                                         __be16 sport, __be16 dport);
+#endif /* _NET_SECURE_SEQ */
diff --git a/include/net/snmp.h b/include/net/snmp.h
index 479083a78b0..8f0f9ac0307 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -116,57 +116,51 @@ struct linux_xfrm_mib {
        unsigned long   mibs[LINUX_MIB_XFRMMAX];
 };
-/* 
+#define SNMP_ARRAY_SZ 1
- * FIXME: On x86 and some other CPUs the split into user and softirq parts
- * is not needed because addl $1,memory is atomic against interrupts (but 
- * atomic_inc would be overkill because of the lock cycles). Wants new 
- * nonlocked_atomic_inc() primitives -AK
- */ 
 #define DEFINE_SNMP_STAT(type, name)    \
-        __typeof__(type) __percpu *name[2]
+        __typeof__(type) __percpu *name[SNMP_ARRAY_SZ]
 #define DEFINE_SNMP_STAT_ATOMIC(type, name)     \
        __typeof__(type) *name
 #define DECLARE_SNMP_STAT(type, name)   \
-        extern __typeof__(type) __percpu *name[2]
+        extern __typeof__(type) __percpu *name[SNMP_ARRAY_SZ]
-#define SNMP_STAT_BHPTR(name)   (name[0])
-#define SNMP_STAT_USRPTR(name)  (name[1])
 #define SNMP_INC_STATS_BH(mib, field)   \
                        __this_cpu_inc(mib[0]->mibs[field])
 #define SNMP_INC_STATS_USER(mib, field) \
-                        this_cpu_inc(mib[1]->mibs[field])
+                        irqsafe_cpu_inc(mib[0]->mibs[field])
 #define SNMP_INC_STATS_ATOMIC_LONG(mib, field)  \
                        atomic_long_inc(&mib->mibs[field])
 #define SNMP_INC_STATS(mib, field)      \
-                        this_cpu_inc(mib[!in_softirq()]->mibs[field])
+                        irqsafe_cpu_inc(mib[0]->mibs[field])
 #define SNMP_DEC_STATS(mib, field)      \
-                        this_cpu_dec(mib[!in_softirq()]->mibs[field])
+                        irqsafe_cpu_dec(mib[0]->mibs[field])
 #define SNMP_ADD_STATS_BH(mib, field, addend)   \
                        __this_cpu_add(mib[0]->mibs[field], addend)
 #define SNMP_ADD_STATS_USER(mib, field, addend) \
-                        this_cpu_add(mib[1]->mibs[field], addend)
+                        irqsafe_cpu_add(mib[0]->mibs[field], addend)
 #define SNMP_ADD_STATS(mib, field, addend)      \
-                        this_cpu_add(mib[!in_softirq()]->mibs[field], addend)
+                        irqsafe_cpu_add(mib[0]->mibs[field], addend)
 /*
 * Use "__typeof__(*mib[0]) *ptr" instead of "__typeof__(mib[0]) ptr"
 * to make @ptr a non-percpu pointer.
 */
 #define SNMP_UPD_PO_STATS(mib, basefield, addend)       \
        do { \
-                __typeof__(*mib[0]) *ptr; \
+                irqsafe_cpu_inc(mib[0]->mibs[basefield##PKTS]);         \
-                preempt_disable(); \
+                irqsafe_cpu_add(mib[0]->mibs[basefield##OCTETS], addend);       \
-                ptr = this_cpu_ptr((mib)[!in_softirq()]); \
-                ptr->mibs[basefield##PKTS]++; \
-                ptr->mibs[basefield##OCTETS] += addend;\
-                preempt_enable(); \
        } while (0)
 #define SNMP_UPD_PO_STATS_BH(mib, basefield, addend)    \
        do { \
-                __typeof__(*mib[0]) *ptr = \
+                __this_cpu_inc(mib[0]->mibs[basefield##PKTS]);          \
-                        __this_cpu_ptr((mib)[0]); \
+                __this_cpu_add(mib[0]->mibs[basefield##OCTETS], addend);        \
-                ptr->mibs[basefield##PKTS]++; \
-                ptr->mibs[basefield##OCTETS] += addend;\
        } while (0)
@@ -179,40 +173,20 @@ struct linux_xfrm_mib {
                ptr->mibs[field] += addend;                             \
                u64_stats_update_end(&ptr->syncp);                      \
        } while (0)
 #define SNMP_ADD_STATS64_USER(mib, field, addend)                       \
        do {                                                            \
-                __typeof__(*mib[0]) *ptr;                               \
+                local_bh_disable();                                     \
-                preempt_disable();                                      \
+                SNMP_ADD_STATS64_BH(mib, field, addend);                \
-                ptr = __this_cpu_ptr((mib)[1]);                         \
+                local_bh_enable();                                      \
-                u64_stats_update_begin(&ptr->syncp);                    \
-                ptr->mibs[field] += addend;                             \
-                u64_stats_update_end(&ptr->syncp);                      \
-                preempt_enable();                                       \
        } while (0)
 #define SNMP_ADD_STATS64(mib, field, addend)                            \
-        do {                                                            \
+                SNMP_ADD_STATS64_USER(mib, field, addend)
-                __typeof__(*mib[0]) *ptr;                               \
-                preempt_disable();                                      \
-                ptr = __this_cpu_ptr((mib)[!in_softirq()]);             \
-                u64_stats_update_begin(&ptr->syncp);                    \
-                ptr->mibs[field] += addend;                             \
-                u64_stats_update_end(&ptr->syncp);                      \
-                preempt_enable();                                       \
-        } while (0)
 #define SNMP_INC_STATS64_BH(mib, field) SNMP_ADD_STATS64_BH(mib, field, 1)
 #define SNMP_INC_STATS64_USER(mib, field) SNMP_ADD_STATS64_USER(mib, field, 1)
 #define SNMP_INC_STATS64(mib, field) SNMP_ADD_STATS64(mib, field, 1)
-#define SNMP_UPD_PO_STATS64(mib, basefield, addend)                     \
-        do {                                                            \
-                __typeof__(*mib[0]) *ptr;                               \
-                preempt_disable();                                      \
-                ptr = __this_cpu_ptr((mib)[!in_softirq()]);             \
-                u64_stats_update_begin(&ptr->syncp);                    \
-                ptr->mibs[basefield##PKTS]++;                           \
-                ptr->mibs[basefield##OCTETS] += addend;                 \
-                u64_stats_update_end(&ptr->syncp);                      \
-                preempt_enable();                                       \
-        } while (0)
 #define SNMP_UPD_PO_STATS64_BH(mib, basefield, addend)                  \
        do {                                                            \
                __typeof__(*mib[0]) *ptr;                               \
@@ -222,6 +196,12 @@ struct linux_xfrm_mib {
                ptr->mibs[basefield##OCTETS] += addend;                 \
                u64_stats_update_end(&ptr->syncp);                      \
        } while (0)
+#define SNMP_UPD_PO_STATS64(mib, basefield, addend)                     \
+        do {                                                            \
+                local_bh_disable();                                     \
+                SNMP_UPD_PO_STATS64_BH(mib, basefield, addend);         \
+                local_bh_enable();                                      \
+        } while (0)
 #else
 #define SNMP_INC_STATS64_BH(mib, field)         SNMP_INC_STATS_BH(mib, field)
 #define SNMP_INC_STATS64_USER(mib, field)       SNMP_INC_STATS_USER(mib, field)
diff --git a/include/net/sock.h b/include/net/sock.h
index c0b938cb4b1..8e4062f165b 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -40,6 +40,7 @@
 #ifndef _SOCK_H
 #define _SOCK_H
+#include <linux/hardirq.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/list_nulls.h>
@@ -562,6 +563,7 @@ enum sock_flags {
        SOCK_TIMESTAMPING_SYS_HARDWARE, /* %SOF_TIMESTAMPING_SYS_HARDWARE */
        SOCK_FASYNC, /* fasync() active */
        SOCK_RXQ_OVFL,
+        SOCK_ZEROCOPY, /* buffers from userspace */
 };
 static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
@@ -1301,8 +1303,7 @@ extern unsigned long sock_i_ino(struct sock *sk);
 static inline struct dst_entry *
 __sk_dst_get(struct sock *sk)
 {
-        return rcu_dereference_check(sk->sk_dst_cache, rcu_read_lock_held() ||
+        return rcu_dereference_check(sk->sk_dst_cache, sock_owned_by_user(sk) ||
-                                                       sock_owned_by_user(sk) ||
                                                       lockdep_is_held(&sk->sk_lock.slock));
 }
diff --git a/include/net/tcp.h b/include/net/tcp.h
index cda30ea354a..4fcd77af405 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -122,7 +122,13 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #endif
 #define TCP_RTO_MAX     ((unsigned)(120*HZ))
 #define TCP_RTO_MIN     ((unsigned)(HZ/5))
-#define TCP_TIMEOUT_INIT ((unsigned)(3*HZ))     /* RFC 1122 initial RTO value   */
+#define TCP_TIMEOUT_INIT ((unsigned)(1*HZ))     /* RFC2988bis initial RTO value */
+#define TCP_TIMEOUT_FALLBACK ((unsigned)(3*HZ)) /* RFC 1122 initial RTO value, now
+                                                 * used as a fallback RTO for the
+                                                 * initial data transmission if no
+                                                 * valid RTT sample has been acquired,
+                                                 * most likely due to retrans in 3WHS.
+                                                 */
 #define TCP_RESOURCE_PROBE_INTERVAL ((unsigned)(HZ/2U)) /* Maximal interval between probes
                                                         * for local resources.
@@ -295,7 +301,7 @@ static inline void tcp_synq_overflow(struct sock *sk)
 static inline int tcp_synq_no_recent_overflow(const struct sock *sk)
 {
        unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp;
-        return time_after(jiffies, last_overflow + TCP_TIMEOUT_INIT);
+        return time_after(jiffies, last_overflow + TCP_TIMEOUT_FALLBACK);
 }
 extern struct proto tcp_prot;
@@ -425,17 +431,34 @@ extern int tcp_disconnect(struct sock *sk, int flags);
 extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
 extern struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, 
                                    struct ip_options *opt);
+#ifdef CONFIG_SYN_COOKIES
 extern __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, 
                                     __u16 *mss);
+#else
+static inline __u32 cookie_v4_init_sequence(struct sock *sk,
+                                            struct sk_buff *skb,
+                                            __u16 *mss)
+{
+        return 0;
+}
+#endif
 extern __u32 cookie_init_timestamp(struct request_sock *req);
 extern bool cookie_check_timestamp(struct tcp_options_received *opt, bool *);
 /* From net/ipv6/syncookies.c */
 extern struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb);
+#ifdef CONFIG_SYN_COOKIES
 extern __u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb,
                                     __u16 *mss);
+#else
+static inline __u32 cookie_v6_init_sequence(struct sock *sk,
+                                            struct sk_buff *skb,
+                                            __u16 *mss)
+{
+        return 0;
+}
+#endif
 /* tcp_output.c */
 extern void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
@@ -454,6 +477,9 @@ extern int tcp_write_wakeup(struct sock *);
 extern void tcp_send_fin(struct sock *sk);
 extern void tcp_send_active_reset(struct sock *sk, gfp_t priority);
 extern int tcp_send_synack(struct sock *);
+extern int tcp_syn_flood_action(struct sock *sk,
+                                const struct sk_buff *skb,
+                                const char *proto);
 extern void tcp_push_one(struct sock *, unsigned int mss_now);
 extern void tcp_send_ack(struct sock *sk);
 extern void tcp_send_delayed_ack(struct sock *sk);
@@ -508,6 +534,7 @@ extern void tcp_initialize_rcv_mss(struct sock *sk);
 extern int tcp_mtu_to_mss(struct sock *sk, int pmtu);
 extern int tcp_mss_to_mtu(struct sock *sk, int mss);
 extern void tcp_mtup_init(struct sock *sk);
+extern void tcp_valid_rtt_meas(struct sock *sk, u32 seq_rtt);
 static inline void tcp_bound_rto(const struct sock *sk)
 {
@@ -1404,6 +1431,8 @@ extern struct sk_buff **tcp4_gro_receive(struct sk_buff **head,
 extern int tcp_gro_complete(struct sk_buff *skb);
 extern int tcp4_gro_complete(struct sk_buff *skb);
+extern int tcp_nuke_addr(struct net *net, struct sockaddr *addr);
 #ifdef CONFIG_PROC_FS
 extern int tcp4_proc_init(void);
 extern void tcp4_proc_exit(void);
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index 5271a741c3a..498433dd067 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -39,6 +39,7 @@ extern int			datagram_recv_ctl(struct sock *sk,
                                                  struct sk_buff *skb);
 extern int                      datagram_send_ctl(struct net *net,
+                                                  struct sock *sk,
                                                  struct msghdr *msg,
                                                  struct flowi6 *fl6,
                                                  struct ipv6_txoptions *opt,
diff --git a/include/net/udplite.h b/include/net/udplite.h
index 673a024c6b2..5f097ca7d5c 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -66,40 +66,34 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
        return 0;
 }
-static inline int udplite_sender_cscov(struct udp_sock *up, struct udphdr *uh)
+/* Slow-path computation of checksum. Socket is locked. */
+static inline __wsum udplite_csum_outgoing(struct sock *sk, struct sk_buff *skb)
 {
+        const struct udp_sock *up = udp_sk(skb->sk);
        int cscov = up->len;
+        __wsum csum = 0;
-        /*
+        if (up->pcflag & UDPLITE_SEND_CC) {
-         * Sender has set `partial coverage' option on UDP-Lite socket
+                /*
-         */
+                 * Sender has set `partial coverage' option on UDP-Lite socket.
-        if (up->pcflag & UDPLITE_SEND_CC)    {
+                 * The special case "up->pcslen == 0" signifies full coverage.
+                 */
                if (up->pcslen < up->len) {
-                /* up->pcslen == 0 means that full coverage is required,
+                        if (0 < up->pcslen)
-                 * partial coverage only if  0 < up->pcslen < up->len */
+                                cscov = up->pcslen;
-                        if (0 < up->pcslen) {
+                        udp_hdr(skb)->len = htons(up->pcslen);
-                               cscov = up->pcslen;
-                        }
-                        uh->len = htons(up->pcslen);
                }
-        /*
+                /*
-         * NOTE: Causes for the error case  `up->pcslen > up->len':
+                 * NOTE: Causes for the error case  `up->pcslen > up->len':
-         *        (i)  Application error (will not be penalized).
+                 *        (i)  Application error (will not be penalized).
-         *       (ii)  Payload too big for send buffer: data is split
+                 *       (ii)  Payload too big for send buffer: data is split
-         *             into several packets, each with its own header.
+                 *             into several packets, each with its own header.
-         *             In this case (e.g. last segment), coverage may
+                 *             In this case (e.g. last segment), coverage may
-         *             exceed packet length.
+                 *             exceed packet length.
-         *       Since packets with coverage length > packet length are
+                 *       Since packets with coverage length > packet length are
-         *       illegal, we fall back to the defaults here.
+                 *       illegal, we fall back to the defaults here.
-         */
+                 */
        }
-        return cscov;
-}
-static inline __wsum udplite_csum_outgoing(struct sock *sk, struct sk_buff *skb)
-{
-        int cscov = udplite_sender_cscov(udp_sk(sk), udp_hdr(skb));
-        __wsum csum = 0;
        skb->ip_summed = CHECKSUM_NONE;     /* no HW support for checksumming */
@@ -115,16 +109,21 @@ static inline __wsum udplite_csum_outgoing(struct sock *sk, struct sk_buff *skb)
        return csum;
 }
+/* Fast-path computation of checksum. Socket may not be locked. */
 static inline __wsum udplite_csum(struct sk_buff *skb)
 {
-        struct sock *sk = skb->sk;
+        const struct udp_sock *up = udp_sk(skb->sk);
-        int cscov = udplite_sender_cscov(udp_sk(sk), udp_hdr(skb));
        const int off = skb_transport_offset(skb);
-        const int len = skb->len - off;
+        int len = skb->len - off;
+        if ((up->pcflag & UDPLITE_SEND_CC) && up->pcslen < len) {
+                if (0 < up->pcslen)
+                        len = up->pcslen;
+                udp_hdr(skb)->len = htons(up->pcslen);
+        }
        skb->ip_summed = CHECKSUM_NONE;     /* no HW support for checksumming */
-        return skb_checksum(skb, off, min(cscov, len), 0);
+        return skb_checksum(skb, off, len, 0);
 }
 extern void     udplite4_register(void);
diff --git a/include/net/wimax.h b/include/net/wimax.h
index 7328d5019d8..322ff4fbdb4 100644
--- a/include/net/wimax.h
+++ b/include/net/wimax.h
@@ -423,7 +423,6 @@ struct wimax_dev {
        int (*op_reset)(struct wimax_dev *wimax_dev);
        struct rfkill *rfkill;
-        struct input_dev *rfkill_input;
        unsigned rf_hw;
        unsigned rf_sw;
        char name[32];