Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

43 files changed, 1072 insertions, 232 deletions

diff --git a/include/asm-generic/errno.h b/include/asm-generic/errno.h
index e8852c092fea..28cc03bf19e6 100644
--- a/include/asm-generic/errno.h
+++ b/include/asm-generic/errno.h
@@ -106,4 +106,6 @@
 #define EOWNERDEAD      130     /* Owner died */
 #define ENOTRECOVERABLE 131     /* State not recoverable */
 
+#define ERFKILL         132     /* Operation not possible due to RF-kill */
+
 #endif
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 3f0eaa397ef5..7e09c5c1ed02 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -311,6 +311,7 @@ unifdef-y += ptrace.h
 unifdef-y += qnx4_fs.h
 unifdef-y += quota.h
 unifdef-y += random.h
+unifdef-y += rfkill.h
 unifdef-y += irqnr.h
 unifdef-y += reboot.h
 unifdef-y += reiserfs_fs.h
diff --git a/include/linux/can/platform/sja1000.h b/include/linux/can/platform/sja1000.h
index 37966e630ff5..01ee2aeb048d 100644
--- a/include/linux/can/platform/sja1000.h
+++ b/include/linux/can/platform/sja1000.h
@@ -13,6 +13,7 @@
 #define OCR_MODE_TEST     0x01
 #define OCR_MODE_NORMAL   0x02
 #define OCR_MODE_CLOCK    0x03
+#define OCR_MODE_MASK     0x07
 #define OCR_TX0_INVERT    0x04
 #define OCR_TX0_PULLDOWN  0x08
 #define OCR_TX0_PULLUP    0x10
@@ -21,6 +22,8 @@
 #define OCR_TX1_PULLDOWN  0x40
 #define OCR_TX1_PULLUP    0x80
 #define OCR_TX1_PUSHPULL  0xc0
+#define OCR_TX_MASK       0xfc
+#define OCR_TX_SHIFT      2
 
 struct sja1000_platform_data {
         u32 clock;      /* CAN bus oscillator frequency in Hz */
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index 380b04272bf1..9b660bd2e2b3 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -30,7 +30,8 @@ struct ethtool_cmd {
         __u32   maxtxpkt;       /* Tx pkts before generating tx int */
         __u32   maxrxpkt;       /* Rx pkts before generating rx int */
         __u16   speed_hi;
-        __u16   reserved2;
+        __u8    eth_tp_mdix;
+        __u8    reserved2;
         __u32   lp_advertising; /* Features the link partner advertises */
         __u32   reserved[2];
 };
@@ -632,6 +633,11 @@ struct ethtool_ops {
 #define AUTONEG_DISABLE         0x00
 #define AUTONEG_ENABLE          0x01
 
+/* Mode MDI or MDI-X */
+#define ETH_TP_MDI_INVALID      0x00
+#define ETH_TP_MDI              0x01
+#define ETH_TP_MDI_X            0x02
+
 /* Wake-On-Lan options. */
 #define WAKE_PHY                (1 << 0)
 #define WAKE_UCAST              (1 << 1)
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 34de8b21f6d4..a9173d5434d1 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1092,6 +1092,7 @@ enum ieee80211_key_len {
         WLAN_KEY_LEN_WEP104 = 13,
         WLAN_KEY_LEN_CCMP = 16,
         WLAN_KEY_LEN_TKIP = 32,
+        WLAN_KEY_LEN_AES_CMAC = 16,
 };
 
 /*
diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
index 5ff89809a581..b554300ef8bf 100644
--- a/include/linux/if_arp.h
+++ b/include/linux/if_arp.h
@@ -86,6 +86,8 @@
 #define ARPHRD_IEEE80211 801            /* IEEE 802.11                  */
 #define ARPHRD_IEEE80211_PRISM 802      /* IEEE 802.11 + Prism2 header  */
 #define ARPHRD_IEEE80211_RADIOTAP 803   /* IEEE 802.11 + radiotap header */
+#define ARPHRD_IEEE802154         804
+#define ARPHRD_IEEE802154_PHY     805
 
 #define ARPHRD_PHONET   820             /* PhoNet media type            */
 #define ARPHRD_PHONET_PIPE 821          /* PhoNet pipe header           */
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index cfe4fe1b7132..11a60e4f0a66 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -106,6 +106,7 @@
 #define ETH_P_DSA       0x001B          /* Distributed Switch Arch.     */
 #define ETH_P_TRAILER   0x001C          /* Trailer switch tagging       */
 #define ETH_P_PHONET    0x00F5          /* Nokia Phonet frames          */
+#define ETH_P_IEEE802154 0x00F6         /* IEEE802.15.4 frame           */
 
 /*
  *      This is an Ethernet frame header.
diff --git a/include/linux/in.h b/include/linux/in.h
index d60122a3a088..cf196da04ec9 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -107,6 +107,7 @@ struct in_addr {
 #define MCAST_JOIN_SOURCE_GROUP         46
 #define MCAST_LEAVE_SOURCE_GROUP        47
 #define MCAST_MSFILTER                  48
+#define IP_MULTICAST_ALL                49
 
 #define MCAST_EXCLUDE   0
 #define MCAST_INCLUDE   1
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 476d9464ac82..c662efa68289 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -169,6 +169,12 @@ struct ipv6_devconf {
         __s32           accept_dad;
         void            *sysctl;
 };
+
+struct ipv6_params {
+        __s32 disable_ipv6;
+        __s32 autoconf;
+};
+extern struct ipv6_params ipv6_defaults;
 #endif
 
 /* index values for the variables in ipv6_devconf */
diff --git a/include/linux/isdn/capilli.h b/include/linux/isdn/capilli.h
index 35e9b0fd014b..7acb87a44872 100644
--- a/include/linux/isdn/capilli.h
+++ b/include/linux/isdn/capilli.h
@@ -79,7 +79,7 @@ int attach_capi_ctr(struct capi_ctr *);
 int detach_capi_ctr(struct capi_ctr *);
 
 void capi_ctr_ready(struct capi_ctr * card);
-void capi_ctr_reseted(struct capi_ctr * card);
+void capi_ctr_down(struct capi_ctr * card);
 void capi_ctr_suspend_output(struct capi_ctr * card);
 void capi_ctr_resume_output(struct capi_ctr * card);
 void capi_ctr_handle_message(struct capi_ctr * card, u16 appl, struct sk_buff *skb);
diff --git a/include/linux/mdio.h b/include/linux/mdio.h
index 56851646529a..cfdf1df2875e 100644
--- a/include/linux/mdio.h
+++ b/include/linux/mdio.h
@@ -45,6 +45,7 @@
 #define MDIO_PHYXS_LNSTAT       24      /* PHY XGXS lane state */
 
 /* Media-dependent registers. */
+#define MDIO_PMA_10GBT_SWAPPOL  130     /* 10GBASE-T pair swap & polarity */
 #define MDIO_PMA_10GBT_TXPWR    131     /* 10GBASE-T TX power control */
 #define MDIO_PMA_10GBT_SNR      133     /* 10GBASE-T SNR margin, lane A.
                                          * Lanes B-D are numbered 134-136. */
@@ -195,6 +196,14 @@
 #define MDIO_PHYXS_LNSTAT_SYNC3         0x0008
 #define MDIO_PHYXS_LNSTAT_ALIGN         0x1000
 
+/* PMA 10GBASE-T pair swap & polarity */
+#define MDIO_PMA_10GBT_SWAPPOL_ABNX     0x0001  /* Pair A/B uncrossed */
+#define MDIO_PMA_10GBT_SWAPPOL_CDNX     0x0002  /* Pair C/D uncrossed */
+#define MDIO_PMA_10GBT_SWAPPOL_AREV     0x0100  /* Pair A polarity reversed */
+#define MDIO_PMA_10GBT_SWAPPOL_BREV     0x0200  /* Pair B polarity reversed */
+#define MDIO_PMA_10GBT_SWAPPOL_CREV     0x0400  /* Pair C polarity reversed */
+#define MDIO_PMA_10GBT_SWAPPOL_DREV     0x0800  /* Pair D polarity reversed */
+
 /* PMA 10GBASE-T TX power register. */
 #define MDIO_PMA_10GBT_TXPWR_SHORT      0x0001  /* Short-reach mode */
 
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 371ece521e58..9ea8d6dfe540 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -215,9 +215,12 @@ struct netdev_hw_addr {
         struct list_head        list;
         unsigned char           addr[MAX_ADDR_LEN];
         unsigned char           type;
-#define NETDEV_HW_ADDR_T_LAN    1
-#define NETDEV_HW_ADDR_T_SAN    2
-#define NETDEV_HW_ADDR_T_SLAVE  3
+#define NETDEV_HW_ADDR_T_LAN            1
+#define NETDEV_HW_ADDR_T_SAN            2
+#define NETDEV_HW_ADDR_T_SLAVE          3
+#define NETDEV_HW_ADDR_T_UNICAST        4
+        int                     refcount;
+        bool                    synced;
         struct rcu_head         rcu_head;
 };
 
@@ -773,10 +776,11 @@ struct net_device
         unsigned char           addr_len;       /* hardware address length      */
         unsigned short          dev_id;         /* for shared network cards */
 
-        spinlock_t              addr_list_lock;
-        struct dev_addr_list    *uc_list;       /* Secondary unicast mac addresses */
+        struct list_head        uc_list;        /* Secondary unicast mac
+                                                   addresses */
         int                     uc_count;       /* Number of installed ucasts   */
         int                     uc_promisc;
+        spinlock_t              addr_list_lock;
         struct dev_addr_list    *mc_list;       /* Multicast mac addresses      */
         int                     mc_count;       /* Number of installed mcasts   */
         unsigned int            promiscuity;
@@ -905,7 +909,6 @@ struct net_device
 #define to_net_dev(d) container_of(d, struct net_device, dev)
 
 #define NETDEV_ALIGN            32
-#define NETDEV_ALIGN_CONST      (NETDEV_ALIGN - 1)
 
 static inline
 struct netdev_queue *netdev_get_tx_queue(const struct net_device *dev,
@@ -976,9 +979,7 @@ static inline bool netdev_uses_trailer_tags(struct net_device *dev)
  */
 static inline void *netdev_priv(const struct net_device *dev)
 {
-        return (char *)dev + ((sizeof(struct net_device)
-                               + NETDEV_ALIGN_CONST)
-                              & ~NETDEV_ALIGN_CONST);
+        return (char *)dev + ALIGN(sizeof(struct net_device), NETDEV_ALIGN);
 }
 
 /* Set the sysfs physical device reference for the network logical device
@@ -1839,8 +1840,8 @@ extern int dev_addr_del_multiple(struct net_device *to_dev,
 /* Functions used for secondary unicast and multicast support */
 extern void             dev_set_rx_mode(struct net_device *dev);
 extern void             __dev_set_rx_mode(struct net_device *dev);
-extern int              dev_unicast_delete(struct net_device *dev, void *addr, int alen);
-extern int              dev_unicast_add(struct net_device *dev, void *addr, int alen);
+extern int              dev_unicast_delete(struct net_device *dev, void *addr);
+extern int              dev_unicast_add(struct net_device *dev, void *addr);
 extern int              dev_unicast_sync(struct net_device *to, struct net_device *from);
 extern void             dev_unicast_unsync(struct net_device *to, struct net_device *from);
 extern int              dev_mc_delete(struct net_device *dev, void *addr, int alen, int all);
@@ -1902,15 +1903,14 @@ static inline int net_gso_ok(int features, int gso_type)
 
 static inline int skb_gso_ok(struct sk_buff *skb, int features)
 {
-        return net_gso_ok(features, skb_shinfo(skb)->gso_type);
+        return net_gso_ok(features, skb_shinfo(skb)->gso_type) &&
+               (!skb_has_frags(skb) || (features & NETIF_F_FRAGLIST));
 }
 
 static inline int netif_needs_gso(struct net_device *dev, struct sk_buff *skb)
 {
         return skb_is_gso(skb) &&
                (!skb_gso_ok(skb, dev->features) ||
-                (skb_shinfo(skb)->frag_list &&
-                 !(dev->features & NETIF_F_FRAGLIST)) ||
                 unlikely(skb->ip_summed != CHECKSUM_PARTIAL));
 }
 
@@ -1920,6 +1920,16 @@ static inline void netif_set_gso_max_size(struct net_device *dev,
         dev->gso_max_size = size;
 }
 
+static inline void skb_bond_set_mac_by_master(struct sk_buff *skb,
+                                              struct net_device *master)
+{
+        if (skb->pkt_type == PACKET_HOST) {
+                u16 *dest = (u16 *) eth_hdr(skb)->h_dest;
+
+                memcpy(dest, master->dev_addr, ETH_ALEN);
+        }
+}
+
 /* On bonding slaves other than the currently active slave, suppress
  * duplicates except for 802.3ad ETH_P_SLOW, alb non-mcast/bcast, and
  * ARP on active-backup slaves with arp_validate enabled.
@@ -1933,6 +1943,14 @@ static inline int skb_bond_should_drop(struct sk_buff *skb)
                 if (master->priv_flags & IFF_MASTER_ARPMON)
                         dev->last_rx = jiffies;
 
+                if ((master->priv_flags & IFF_MASTER_ALB) && master->br_port) {
+                        /* Do address unmangle. The local destination address
+                         * will be always the one master has. Provides the right
+                         * functionality in a bridge.
+                         */
+                        skb_bond_set_mac_by_master(skb, master);
+                }
+
                 if (dev->priv_flags & IFF_SLAVE_INACTIVE) {
                         if ((dev->priv_flags & IFF_SLAVE_NEEDARP) &&
                             skb->protocol == __cpu_to_be16(ETH_P_ARP))
@@ -1978,4 +1996,4 @@ static inline u32 dev_ethtool_get_flags(struct net_device *dev)
 }
 #endif /* __KERNEL__ */
 
-#endif  /* _LINUX_DEV_H */
+#endif  /* _LINUX_NETDEVICE_H */
diff --git a/include/linux/netfilter/nf_conntrack_tcp.h b/include/linux/netfilter/nf_conntrack_tcp.h
index 74c27ca770e5..4352feed2377 100644
--- a/include/linux/netfilter/nf_conntrack_tcp.h
+++ b/include/linux/netfilter/nf_conntrack_tcp.h
@@ -36,6 +36,9 @@ enum tcp_conntrack {
 /* Has unacknowledged data */
 #define IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED      0x10
 
+/* The field td_maxack has been set */
+#define IP_CT_TCP_FLAG_MAXACK_SET               0x20
+
 struct nf_ct_tcp_flags {
         __u8 flags;
         __u8 mask;
@@ -47,6 +50,7 @@ struct ip_ct_tcp_state {
         u_int32_t       td_end;         /* max of seq + len */
         u_int32_t       td_maxend;      /* max of ack + max(win, 1) */
         u_int32_t       td_maxwin;      /* max(win) */
+        u_int32_t       td_maxack;      /* max of ack */
         u_int8_t        td_scale;       /* window scale factor */
         u_int8_t        flags;          /* per direction options */
 };
diff --git a/include/linux/nl802154.h b/include/linux/nl802154.h
new file mode 100644
index 000000000000..2cda00ccfcca
--- /dev/null
+++ b/include/linux/nl802154.h
@@ -0,0 +1,119 @@
+/*
+ * nl802154.h
+ *
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef NL802154_H
+#define NL802154_H
+
+#define IEEE802154_NL_NAME "802.15.4 MAC"
+#define IEEE802154_MCAST_COORD_NAME "coordinator"
+#define IEEE802154_MCAST_BEACON_NAME "beacon"
+
+enum {
+        __IEEE802154_ATTR_INVALID,
+
+        IEEE802154_ATTR_DEV_NAME,
+        IEEE802154_ATTR_DEV_INDEX,
+
+        IEEE802154_ATTR_STATUS,
+
+        IEEE802154_ATTR_SHORT_ADDR,
+        IEEE802154_ATTR_HW_ADDR,
+        IEEE802154_ATTR_PAN_ID,
+
+        IEEE802154_ATTR_CHANNEL,
+
+        IEEE802154_ATTR_COORD_SHORT_ADDR,
+        IEEE802154_ATTR_COORD_HW_ADDR,
+        IEEE802154_ATTR_COORD_PAN_ID,
+
+        IEEE802154_ATTR_SRC_SHORT_ADDR,
+        IEEE802154_ATTR_SRC_HW_ADDR,
+        IEEE802154_ATTR_SRC_PAN_ID,
+
+        IEEE802154_ATTR_DEST_SHORT_ADDR,
+        IEEE802154_ATTR_DEST_HW_ADDR,
+        IEEE802154_ATTR_DEST_PAN_ID,
+
+        IEEE802154_ATTR_CAPABILITY,
+        IEEE802154_ATTR_REASON,
+        IEEE802154_ATTR_SCAN_TYPE,
+        IEEE802154_ATTR_CHANNELS,
+        IEEE802154_ATTR_DURATION,
+        IEEE802154_ATTR_ED_LIST,
+        IEEE802154_ATTR_BCN_ORD,
+        IEEE802154_ATTR_SF_ORD,
+        IEEE802154_ATTR_PAN_COORD,
+        IEEE802154_ATTR_BAT_EXT,
+        IEEE802154_ATTR_COORD_REALIGN,
+        IEEE802154_ATTR_SEC,
+
+        __IEEE802154_ATTR_MAX,
+};
+
+#define IEEE802154_ATTR_MAX (__IEEE802154_ATTR_MAX - 1)
+
+extern struct nla_policy ieee802154_policy[];
+
+/* commands */
+/* REQ should be responded with CONF
+ * and INDIC with RESP
+ */
+enum {
+        __IEEE802154_COMMAND_INVALID,
+
+        IEEE802154_ASSOCIATE_REQ,
+        IEEE802154_ASSOCIATE_CONF,
+        IEEE802154_DISASSOCIATE_REQ,
+        IEEE802154_DISASSOCIATE_CONF,
+        IEEE802154_GET_REQ,
+        IEEE802154_GET_CONF,
+        IEEE802154_RESET_REQ,
+        IEEE802154_RESET_CONF,
+        IEEE802154_SCAN_REQ,
+        IEEE802154_SCAN_CONF,
+        IEEE802154_SET_REQ,
+        IEEE802154_SET_CONF,
+        IEEE802154_START_REQ,
+        IEEE802154_START_CONF,
+        IEEE802154_SYNC_REQ,
+        IEEE802154_POLL_REQ,
+        IEEE802154_POLL_CONF,
+
+        IEEE802154_ASSOCIATE_INDIC,
+        IEEE802154_ASSOCIATE_RESP,
+        IEEE802154_DISASSOCIATE_INDIC,
+        IEEE802154_BEACON_NOTIFY_INDIC,
+        IEEE802154_ORPHAN_INDIC,
+        IEEE802154_ORPHAN_RESP,
+        IEEE802154_COMM_STATUS_INDIC,
+        IEEE802154_SYNC_LOSS_INDIC,
+
+        IEEE802154_GTS_REQ, /* Not supported yet */
+        IEEE802154_GTS_INDIC, /* Not supported yet */
+        IEEE802154_GTS_CONF, /* Not supported yet */
+        IEEE802154_RX_ENABLE_REQ, /* Not supported yet */
+        IEEE802154_RX_ENABLE_CONF, /* Not supported yet */
+
+        __IEEE802154_CMD_MAX,
+};
+
+#define IEEE802154_CMD_MAX (__IEEE802154_CMD_MAX - 1)
+
+#endif
diff --git a/include/linux/notifier.h b/include/linux/notifier.h
index b86fa2ffca0c..81bc252dc8ac 100644
--- a/include/linux/notifier.h
+++ b/include/linux/notifier.h
@@ -198,6 +198,7 @@ static inline int notifier_to_errno(int ret)
 #define NETDEV_CHANGENAME       0x000A
 #define NETDEV_FEAT_CHANGE      0x000B
 #define NETDEV_BONDING_FAILOVER 0x000C
+#define NETDEV_PRE_UP           0x000D
 
 #define SYS_DOWN        0x0001  /* Notify of system down */
 #define SYS_RESTART     SYS_DOWN
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 12db06cf0e23..b87c51aea14c 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1066,8 +1066,6 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SMBUS 0x0034
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_IDE   0x0035
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA  0x0036
-#define PCI_DEVICE_ID_NVIDIA_NVENET_10          0x0037
-#define PCI_DEVICE_ID_NVIDIA_NVENET_11          0x0038
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP04_SATA2 0x003e
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_6800_ULTRA 0x0040
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_6800       0x0041
@@ -1078,21 +1076,16 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_IDE   0x0053
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_SATA  0x0054
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_CK804_SATA2 0x0055
-#define PCI_DEVICE_ID_NVIDIA_NVENET_8           0x0056
-#define PCI_DEVICE_ID_NVIDIA_NVENET_9           0x0057
 #define PCI_DEVICE_ID_NVIDIA_CK804_AUDIO        0x0059
 #define PCI_DEVICE_ID_NVIDIA_CK804_PCIE         0x005d
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2_SMBUS      0x0064
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2_IDE        0x0065
-#define PCI_DEVICE_ID_NVIDIA_NVENET_2           0x0066
 #define PCI_DEVICE_ID_NVIDIA_MCP2_MODEM         0x0069
 #define PCI_DEVICE_ID_NVIDIA_MCP2_AUDIO         0x006a
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2S_SMBUS     0x0084
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2S_IDE       0x0085
-#define PCI_DEVICE_ID_NVIDIA_NVENET_4           0x0086
 #define PCI_DEVICE_ID_NVIDIA_MCP2S_MODEM        0x0089
 #define PCI_DEVICE_ID_NVIDIA_CK8_AUDIO          0x008a
-#define PCI_DEVICE_ID_NVIDIA_NVENET_5           0x008c
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2S_SATA      0x008e
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_7800_GT   0x0090
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_7800_GTX   0x0091
@@ -1108,15 +1101,12 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3            0x00d1
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3_SMBUS      0x00d4
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3_IDE        0x00d5
-#define PCI_DEVICE_ID_NVIDIA_NVENET_3           0x00d6
 #define PCI_DEVICE_ID_NVIDIA_MCP3_MODEM         0x00d9
 #define PCI_DEVICE_ID_NVIDIA_MCP3_AUDIO         0x00da
-#define PCI_DEVICE_ID_NVIDIA_NVENET_7           0x00df
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S           0x00e1
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_SATA      0x00e3
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_SMBUS     0x00e4
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_IDE       0x00e5
-#define PCI_DEVICE_ID_NVIDIA_NVENET_6           0x00e6
 #define PCI_DEVICE_ID_NVIDIA_CK8S_AUDIO         0x00ea
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_SATA2     0x00ee
 #define PCIE_DEVICE_ID_NVIDIA_GEFORCE_6800_ALT1 0x00f0
@@ -1176,7 +1166,6 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_SMBUS       0x01b4
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_IDE         0x01bc
 #define PCI_DEVICE_ID_NVIDIA_MCP1_MODEM         0x01c1
-#define PCI_DEVICE_ID_NVIDIA_NVENET_1           0x01c3
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2            0x01e0
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE3           0x0200
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE3_1         0x0201
@@ -1199,8 +1188,6 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_IDE   0x036E
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA  0x037E
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2 0x037F
-#define PCI_DEVICE_ID_NVIDIA_NVENET_12          0x0268
-#define PCI_DEVICE_ID_NVIDIA_NVENET_13          0x0269
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_TI_4800   0x0280
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_TI_4800_8X    0x0281
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_TI_4800SE     0x0282
@@ -1247,46 +1234,21 @@
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_FX_GO5700_2    0x0348
 #define PCI_DEVICE_ID_NVIDIA_QUADRO_FX_GO1000       0x034C
 #define PCI_DEVICE_ID_NVIDIA_QUADRO_FX_1100         0x034E
-#define PCI_DEVICE_ID_NVIDIA_NVENET_14              0x0372
 #define PCI_DEVICE_ID_NVIDIA_NVENET_15              0x0373
-#define PCI_DEVICE_ID_NVIDIA_NVENET_16              0x03E5
-#define PCI_DEVICE_ID_NVIDIA_NVENET_17              0x03E6
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA      0x03E7
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SMBUS     0x03EB
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_IDE       0x03EC
-#define PCI_DEVICE_ID_NVIDIA_NVENET_18              0x03EE
-#define PCI_DEVICE_ID_NVIDIA_NVENET_19              0x03EF
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2     0x03F6
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3     0x03F7
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP65_SMBUS     0x0446
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP65_IDE       0x0448
-#define PCI_DEVICE_ID_NVIDIA_NVENET_20              0x0450
-#define PCI_DEVICE_ID_NVIDIA_NVENET_21              0x0451
-#define PCI_DEVICE_ID_NVIDIA_NVENET_22              0x0452
-#define PCI_DEVICE_ID_NVIDIA_NVENET_23              0x0453
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP67_SMBUS     0x0542
-#define PCI_DEVICE_ID_NVIDIA_NVENET_24              0x054C
-#define PCI_DEVICE_ID_NVIDIA_NVENET_25              0x054D
-#define PCI_DEVICE_ID_NVIDIA_NVENET_26              0x054E
-#define PCI_DEVICE_ID_NVIDIA_NVENET_27              0x054F
-#define PCI_DEVICE_ID_NVIDIA_NVENET_28              0x07DC
-#define PCI_DEVICE_ID_NVIDIA_NVENET_29              0x07DD
-#define PCI_DEVICE_ID_NVIDIA_NVENET_30              0x07DE
-#define PCI_DEVICE_ID_NVIDIA_NVENET_31              0x07DF
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP67_IDE       0x0560
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_IDE       0x056C
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP78S_SMBUS    0x0752
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE       0x0759
-#define PCI_DEVICE_ID_NVIDIA_NVENET_32              0x0760
-#define PCI_DEVICE_ID_NVIDIA_NVENET_33              0x0761
-#define PCI_DEVICE_ID_NVIDIA_NVENET_34              0x0762
-#define PCI_DEVICE_ID_NVIDIA_NVENET_35              0x0763
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_SMBUS     0x07D8
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP79_SMBUS     0x0AA2
-#define PCI_DEVICE_ID_NVIDIA_NVENET_36              0x0AB0
-#define PCI_DEVICE_ID_NVIDIA_NVENET_37              0x0AB1
-#define PCI_DEVICE_ID_NVIDIA_NVENET_38              0x0AB2
-#define PCI_DEVICE_ID_NVIDIA_NVENET_39              0x0AB3
 
 #define PCI_VENDOR_ID_IMS               0x10e0
 #define PCI_DEVICE_ID_IMS_TT128         0x9128
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index de18ef227e00..16e39c7a67fc 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -4,6 +4,7 @@
 /*
  * Copyright (C) 2006 - 2007 Ivo van Doorn
  * Copyright (C) 2007 Dmitry Torokhov
+ * Copyright 2009 Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -22,117 +23,331 @@
  */
 
 #include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/list.h>
-#include <linux/mutex.h>
-#include <linux/device.h>
-#include <linux/leds.h>
+
+/* define userspace visible states */
+#define RFKILL_STATE_SOFT_BLOCKED       0
+#define RFKILL_STATE_UNBLOCKED          1
+#define RFKILL_STATE_HARD_BLOCKED       2
 
 /**
  * enum rfkill_type - type of rfkill switch.
- * RFKILL_TYPE_WLAN: switch is on a 802.11 wireless network device.
- * RFKILL_TYPE_BLUETOOTH: switch is on a bluetooth device.
- * RFKILL_TYPE_UWB: switch is on a ultra wideband device.
- * RFKILL_TYPE_WIMAX: switch is on a WiMAX device.
- * RFKILL_TYPE_WWAN: switch is on a wireless WAN device.
+ *
+ * @RFKILL_TYPE_ALL: toggles all switches (userspace only)
+ * @RFKILL_TYPE_WLAN: switch is on a 802.11 wireless network device.
+ * @RFKILL_TYPE_BLUETOOTH: switch is on a bluetooth device.
+ * @RFKILL_TYPE_UWB: switch is on a ultra wideband device.
+ * @RFKILL_TYPE_WIMAX: switch is on a WiMAX device.
+ * @RFKILL_TYPE_WWAN: switch is on a wireless WAN device.
+ * @NUM_RFKILL_TYPES: number of defined rfkill types
  */
 enum rfkill_type {
-        RFKILL_TYPE_WLAN ,
+        RFKILL_TYPE_ALL = 0,
+        RFKILL_TYPE_WLAN,
         RFKILL_TYPE_BLUETOOTH,
         RFKILL_TYPE_UWB,
         RFKILL_TYPE_WIMAX,
         RFKILL_TYPE_WWAN,
-        RFKILL_TYPE_MAX,
+        NUM_RFKILL_TYPES,
 };
 
-enum rfkill_state {
-        RFKILL_STATE_SOFT_BLOCKED = 0,  /* Radio output blocked */
-        RFKILL_STATE_UNBLOCKED    = 1,  /* Radio output allowed */
-        RFKILL_STATE_HARD_BLOCKED = 2,  /* Output blocked, non-overrideable */
-        RFKILL_STATE_MAX,               /* marker for last valid state */
+/**
+ * enum rfkill_operation - operation types
+ * @RFKILL_OP_ADD: a device was added
+ * @RFKILL_OP_DEL: a device was removed
+ * @RFKILL_OP_CHANGE: a device's state changed -- userspace changes one device
+ * @RFKILL_OP_CHANGE_ALL: userspace changes all devices (of a type, or all)
+ */
+enum rfkill_operation {
+        RFKILL_OP_ADD = 0,
+        RFKILL_OP_DEL,
+        RFKILL_OP_CHANGE,
+        RFKILL_OP_CHANGE_ALL,
 };
 
 /**
- * struct rfkill - rfkill control structure.
- * @name: Name of the switch.
- * @type: Radio type which the button controls, the value stored
- *      here should be a value from enum rfkill_type.
- * @state: State of the switch, "UNBLOCKED" means radio can operate.
- * @mutex: Guards switch state transitions.  It serializes callbacks
- *      and also protects the state.
- * @data: Pointer to the RF button drivers private data which will be
- *      passed along when toggling radio state.
- * @toggle_radio(): Mandatory handler to control state of the radio.
- *      only RFKILL_STATE_SOFT_BLOCKED and RFKILL_STATE_UNBLOCKED are
- *      valid parameters.
- * @get_state(): handler to read current radio state from hardware,
- *      may be called from atomic context, should return 0 on success.
- *      Either this handler OR judicious use of rfkill_force_state() is
- *      MANDATORY for any driver capable of RFKILL_STATE_HARD_BLOCKED.
- * @led_trigger: A LED trigger for this button's LED.
- * @dev: Device structure integrating the switch into device tree.
- * @node: Used to place switch into list of all switches known to the
- *      the system.
- *
- * This structure represents a RF switch located on a network device.
- */
-struct rfkill {
-        const char *name;
-        enum rfkill_type type;
-
-        /* the mutex serializes callbacks and also protects
-         * the state */
-        struct mutex mutex;
-        enum rfkill_state state;
-        void *data;
-        int (*toggle_radio)(void *data, enum rfkill_state state);
-        int (*get_state)(void *data, enum rfkill_state *state);
+ * struct rfkill_event - events for userspace on /dev/rfkill
+ * @idx: index of dev rfkill
+ * @type: type of the rfkill struct
+ * @op: operation code
+ * @hard: hard state (0/1)
+ * @soft: soft state (0/1)
+ *
+ * Structure used for userspace communication on /dev/rfkill,
+ * used for events from the kernel and control to the kernel.
+ */
+struct rfkill_event {
+        __u32 idx;
+        __u8  type;
+        __u8  op;
+        __u8  soft, hard;
+} __packed;
 
-#ifdef CONFIG_RFKILL_LEDS
-        struct led_trigger led_trigger;
-#endif
+/* ioctl for turning off rfkill-input (if present) */
+#define RFKILL_IOC_MAGIC        'R'
+#define RFKILL_IOC_NOINPUT      1
+#define RFKILL_IOCTL_NOINPUT    _IO(RFKILL_IOC_MAGIC, RFKILL_IOC_NOINPUT)
+
+/* and that's all userspace gets */
+#ifdef __KERNEL__
+/* don't allow anyone to use these in the kernel */
+enum rfkill_user_states {
+        RFKILL_USER_STATE_SOFT_BLOCKED  = RFKILL_STATE_SOFT_BLOCKED,
+        RFKILL_USER_STATE_UNBLOCKED     = RFKILL_STATE_UNBLOCKED,
+        RFKILL_USER_STATE_HARD_BLOCKED  = RFKILL_STATE_HARD_BLOCKED,
+};
+#undef RFKILL_STATE_SOFT_BLOCKED
+#undef RFKILL_STATE_UNBLOCKED
+#undef RFKILL_STATE_HARD_BLOCKED
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/device.h>
+#include <linux/leds.h>
+#include <linux/err.h>
+
+/* this is opaque */
+struct rfkill;
 
-        struct device dev;
-        struct list_head node;
-        enum rfkill_state state_for_resume;
+/**
+ * struct rfkill_ops - rfkill driver methods
+ *
+ * @poll: poll the rfkill block state(s) -- only assign this method
+ *      when you need polling. When called, simply call one of the
+ *      rfkill_set{,_hw,_sw}_state family of functions. If the hw
+ *      is getting unblocked you need to take into account the return
+ *      value of those functions to make sure the software block is
+ *      properly used.
+ * @query: query the rfkill block state(s) and call exactly one of the
+ *      rfkill_set{,_hw,_sw}_state family of functions. Assign this
+ *      method if input events can cause hardware state changes to make
+ *      the rfkill core query your driver before setting a requested
+ *      block.
+ * @set_block: turn the transmitter on (blocked == false) or off
+ *      (blocked == true) -- ignore and return 0 when hard blocked.
+ *      This callback must be assigned.
+ */
+struct rfkill_ops {
+        void    (*poll)(struct rfkill *rfkill, void *data);
+        void    (*query)(struct rfkill *rfkill, void *data);
+        int     (*set_block)(void *data, bool blocked);
 };
-#define to_rfkill(d)    container_of(d, struct rfkill, dev)
 
-struct rfkill * __must_check rfkill_allocate(struct device *parent,
-                                             enum rfkill_type type);
-void rfkill_free(struct rfkill *rfkill);
+#if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
+/**
+ * rfkill_alloc - allocate rfkill structure
+ * @name: name of the struct -- the string is not copied internally
+ * @parent: device that has rf switch on it
+ * @type: type of the switch (RFKILL_TYPE_*)
+ * @ops: rfkill methods
+ * @ops_data: data passed to each method
+ *
+ * This function should be called by the transmitter driver to allocate an
+ * rfkill structure. Returns %NULL on failure.
+ */
+struct rfkill * __must_check rfkill_alloc(const char *name,
+                                          struct device *parent,
+                                          const enum rfkill_type type,
+                                          const struct rfkill_ops *ops,
+                                          void *ops_data);
+
+/**
+ * rfkill_register - Register a rfkill structure.
+ * @rfkill: rfkill structure to be registered
+ *
+ * This function should be called by the transmitter driver to register
+ * the rfkill structure. Before calling this function the driver needs
+ * to be ready to service method calls from rfkill.
+ *
+ * If the software blocked state is not set before registration,
+ * set_block will be called to initialize it to a default value.
+ *
+ * If the hardware blocked state is not set before registration,
+ * it is assumed to be unblocked.
+ */
 int __must_check rfkill_register(struct rfkill *rfkill);
+
+/**
+ * rfkill_pause_polling(struct rfkill *rfkill)
+ *
+ * Pause polling -- say transmitter is off for other reasons.
+ * NOTE: not necessary for suspend/resume -- in that case the
+ * core stops polling anyway
+ */
+void rfkill_pause_polling(struct rfkill *rfkill);
+
+/**
+ * rfkill_resume_polling(struct rfkill *rfkill)
+ *
+ * Pause polling -- say transmitter is off for other reasons.
+ * NOTE: not necessary for suspend/resume -- in that case the
+ * core stops polling anyway
+ */
+void rfkill_resume_polling(struct rfkill *rfkill);
+
+
+/**
+ * rfkill_unregister - Unregister a rfkill structure.
+ * @rfkill: rfkill structure to be unregistered
+ *
+ * This function should be called by the network driver during device
+ * teardown to destroy rfkill structure. Until it returns, the driver
+ * needs to be able to service method calls.
+ */
 void rfkill_unregister(struct rfkill *rfkill);
 
-int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state);
-int rfkill_set_default(enum rfkill_type type, enum rfkill_state state);
+/**
+ * rfkill_destroy - free rfkill structure
+ * @rfkill: rfkill structure to be destroyed
+ *
+ * Destroys the rfkill structure.
+ */
+void rfkill_destroy(struct rfkill *rfkill);
+
+/**
+ * rfkill_set_hw_state - Set the internal rfkill hardware block state
+ * @rfkill: pointer to the rfkill class to modify.
+ * @state: the current hardware block state to set
+ *
+ * rfkill drivers that get events when the hard-blocked state changes
+ * use this function to notify the rfkill core (and through that also
+ * userspace) of the current state.  They should also use this after
+ * resume if the state could have changed.
+ *
+ * You need not (but may) call this function if poll_state is assigned.
+ *
+ * This function can be called in any context, even from within rfkill
+ * callbacks.
+ *
+ * The function returns the combined block state (true if transmitter
+ * should be blocked) so that drivers need not keep track of the soft
+ * block state -- which they might not be able to.
+ */
+bool __must_check rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
+
+/**
+ * rfkill_set_sw_state - Set the internal rfkill software block state
+ * @rfkill: pointer to the rfkill class to modify.
+ * @state: the current software block state to set
+ *
+ * rfkill drivers that get events when the soft-blocked state changes
+ * (yes, some platforms directly act on input but allow changing again)
+ * use this function to notify the rfkill core (and through that also
+ * userspace) of the current state.  It is not necessary to notify on
+ * resume; since hibernation can always change the soft-blocked state,
+ * the rfkill core will unconditionally restore the previous state.
+ *
+ * This function can be called in any context, even from within rfkill
+ * callbacks.
+ *
+ * The function returns the combined block state (true if transmitter
+ * should be blocked).
+ */
+bool rfkill_set_sw_state(struct rfkill *rfkill, bool blocked);
+
+/**
+ * rfkill_set_states - Set the internal rfkill block states
+ * @rfkill: pointer to the rfkill class to modify.
+ * @sw: the current software block state to set
+ * @hw: the current hardware block state to set
+ *
+ * This function can be called in any context, even from within rfkill
+ * callbacks.
+ */
+void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw);
 
 /**
- * rfkill_state_complement - return complementar state
- * @state: state to return the complement of
+ * rfkill_blocked - query rfkill block
  *
- * Returns RFKILL_STATE_SOFT_BLOCKED if @state is RFKILL_STATE_UNBLOCKED,
- * returns RFKILL_STATE_UNBLOCKED otherwise.
+ * @rfkill: rfkill struct to query
  */
-static inline enum rfkill_state rfkill_state_complement(enum rfkill_state state)
+bool rfkill_blocked(struct rfkill *rfkill);
+#else /* !RFKILL */
+static inline struct rfkill * __must_check
+rfkill_alloc(const char *name,
+             struct device *parent,
+             const enum rfkill_type type,
+             const struct rfkill_ops *ops,
+             void *ops_data)
+{
+        return ERR_PTR(-ENODEV);
+}
+
+static inline int __must_check rfkill_register(struct rfkill *rfkill)
+{
+        if (rfkill == ERR_PTR(-ENODEV))
+                return 0;
+        return -EINVAL;
+}
+
+static inline void rfkill_pause_polling(struct rfkill *rfkill)
+{
+}
+
+static inline void rfkill_resume_polling(struct rfkill *rfkill)
+{
+}
+
+static inline void rfkill_unregister(struct rfkill *rfkill)
+{
+}
+
+static inline void rfkill_destroy(struct rfkill *rfkill)
 {
-        return (state == RFKILL_STATE_UNBLOCKED) ?
-                RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
 }
 
+static inline bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked)
+{
+        return blocked;
+}
+
+static inline bool rfkill_set_sw_state(struct rfkill *rfkill, bool blocked)
+{
+        return blocked;
+}
+
+static inline void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
+{
+}
+
+static inline bool rfkill_blocked(struct rfkill *rfkill)
+{
+        return false;
+}
+#endif /* RFKILL || RFKILL_MODULE */
+
+
+#ifdef CONFIG_RFKILL_LEDS
 /**
- * rfkill_get_led_name - Get the LED trigger name for the button's LED.
+ * rfkill_get_led_trigger_name - Get the LED trigger name for the button's LED.
  * This function might return a NULL pointer if registering of the
- * LED trigger failed.
- * Use this as "default_trigger" for the LED.
+ * LED trigger failed. Use this as "default_trigger" for the LED.
  */
-static inline char *rfkill_get_led_name(struct rfkill *rfkill)
-{
-#ifdef CONFIG_RFKILL_LEDS
-        return (char *)(rfkill->led_trigger.name);
+const char *rfkill_get_led_trigger_name(struct rfkill *rfkill);
+
+/**
+ * rfkill_set_led_trigger_name -- set the LED trigger name
+ * @rfkill: rfkill struct
+ * @name: LED trigger name
+ *
+ * This function sets the LED trigger name of the radio LED
+ * trigger that rfkill creates. It is optional, but if called
+ * must be called before rfkill_register() to be effective.
+ */
+void rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name);
 #else
+static inline const char *rfkill_get_led_trigger_name(struct rfkill *rfkill)
+{
         return NULL;
-#endif
 }
 
+static inline void
+rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name)
+{
+}
+#endif
+
+#endif /* __KERNEL__ */
+
 #endif /* RFKILL_H */
diff --git a/include/linux/sctp.h b/include/linux/sctp.h
index c2731bfe04d8..b464b9d3d242 100644
--- a/include/linux/sctp.h
+++ b/include/linux/sctp.h
@@ -487,17 +487,17 @@ typedef enum {
          *
          * Value          Cause Code
          * ---------      ----------------
-         * 0x0100          Request to Delete Last Remaining IP Address.
-         * 0x0101          Operation Refused Due to Resource Shortage.
-         * 0x0102          Request to Delete Source IP Address.
-         * 0x0103          Association Aborted due to illegal ASCONF-ACK
-         * 0x0104          Request refused - no authorization.
+         * 0x00A0          Request to Delete Last Remaining IP Address.
+         * 0x00A1          Operation Refused Due to Resource Shortage.
+         * 0x00A2          Request to Delete Source IP Address.
+         * 0x00A3          Association Aborted due to illegal ASCONF-ACK
+         * 0x00A4          Request refused - no authorization.
          */
-        SCTP_ERROR_DEL_LAST_IP  = cpu_to_be16(0x0100),
-        SCTP_ERROR_RSRC_LOW     = cpu_to_be16(0x0101),
-        SCTP_ERROR_DEL_SRC_IP   = cpu_to_be16(0x0102),
-        SCTP_ERROR_ASCONF_ACK   = cpu_to_be16(0x0103),
-        SCTP_ERROR_REQ_REFUSED  = cpu_to_be16(0x0104),
+        SCTP_ERROR_DEL_LAST_IP  = cpu_to_be16(0x00A0),
+        SCTP_ERROR_RSRC_LOW     = cpu_to_be16(0x00A1),
+        SCTP_ERROR_DEL_SRC_IP   = cpu_to_be16(0x00A2),
+        SCTP_ERROR_ASCONF_ACK   = cpu_to_be16(0x00A3),
+        SCTP_ERROR_REQ_REFUSED  = cpu_to_be16(0x00A4),
 
         /* AUTH Section 4.  New Error Cause
          *
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index aff494ba6a31..fa51293f2708 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -189,19 +189,19 @@ struct skb_shared_info {
         atomic_t        dataref;
         unsigned short  nr_frags;
         unsigned short  gso_size;
+#ifdef CONFIG_HAS_DMA
+        dma_addr_t      dma_head;
+#endif
         /* Warning: this field is not always filled in (UFO)! */
         unsigned short  gso_segs;
         unsigned short  gso_type;
         __be32          ip6_frag_id;
         union skb_shared_tx tx_flags;
-#ifdef CONFIG_HAS_DMA
-        unsigned int    num_dma_maps;
-#endif
         struct sk_buff  *frag_list;
         struct skb_shared_hwtstamps hwtstamps;
         skb_frag_t      frags[MAX_SKB_FRAGS];
 #ifdef CONFIG_HAS_DMA
-        dma_addr_t      dma_maps[MAX_SKB_FRAGS + 1];
+        dma_addr_t      dma_maps[MAX_SKB_FRAGS];
 #endif
         /* Intermediate layers must ensure that destructor_arg
          * remains valid until skb destructor */
@@ -304,9 +304,6 @@ typedef unsigned char *sk_buff_data_t;
  *      @tc_verd: traffic control verdict
  *      @ndisc_nodetype: router type (from link layer)
  *      @do_not_encrypt: set to prevent encryption of this frame
- *      @requeue: set to indicate that the wireless core should attempt
- *              a software retry on this frame if we failed to
- *              receive an ACK for it
  *      @dma_cookie: a cookie to one of several possible DMA operations
  *              done by skb DMA functions
  *      @secmark: security marking
@@ -322,10 +319,7 @@ struct sk_buff {
         ktime_t                 tstamp;
         struct net_device       *dev;
 
-        union {
-                struct  dst_entry       *dst;
-                struct  rtable          *rtable;
-        };
+        unsigned long           _skb_dst;
 #ifdef CONFIG_XFRM
         struct  sec_path        *sp;
 #endif
@@ -383,7 +377,6 @@ struct sk_buff {
 #endif
 #if defined(CONFIG_MAC80211) || defined(CONFIG_MAC80211_MODULE)
         __u8                    do_not_encrypt:1;
-        __u8                    requeue:1;
 #endif
         /* 0/13/14 bit hole */
 
@@ -426,6 +419,21 @@ extern void skb_dma_unmap(struct device *dev, struct sk_buff *skb,
                           enum dma_data_direction dir);
 #endif
 
+static inline struct dst_entry *skb_dst(const struct sk_buff *skb)
+{
+        return (struct dst_entry *)skb->_skb_dst;
+}
+
+static inline void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)
+{
+        skb->_skb_dst = (unsigned long)dst;
+}
+
+static inline struct rtable *skb_rtable(const struct sk_buff *skb)
+{
+        return (struct rtable *)skb_dst(skb);
+}
+
 extern void kfree_skb(struct sk_buff *skb);
 extern void consume_skb(struct sk_buff *skb);
 extern void            __kfree_skb(struct sk_buff *skb);
@@ -1065,7 +1073,7 @@ extern void skb_add_rx_frag(struct sk_buff *skb, int i, struct page *page,
                             int off, int size);
 
 #define SKB_PAGE_ASSERT(skb)    BUG_ON(skb_shinfo(skb)->nr_frags)
-#define SKB_FRAG_ASSERT(skb)    BUG_ON(skb_shinfo(skb)->frag_list)
+#define SKB_FRAG_ASSERT(skb)    BUG_ON(skb_has_frags(skb))
 #define SKB_LINEAR_ASSERT(skb)  BUG_ON(skb_is_nonlinear(skb))
 
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
@@ -1704,6 +1712,25 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len)
                      skb = skb->prev)
 
 
+static inline bool skb_has_frags(const struct sk_buff *skb)
+{
+        return skb_shinfo(skb)->frag_list != NULL;
+}
+
+static inline void skb_frag_list_init(struct sk_buff *skb)
+{
+        skb_shinfo(skb)->frag_list = NULL;
+}
+
+static inline void skb_frag_add_head(struct sk_buff *skb, struct sk_buff *frag)
+{
+        frag->next = skb_shinfo(skb)->frag_list;
+        skb_shinfo(skb)->frag_list = frag;
+}
+
+#define skb_walk_frags(skb, iter)       \
+        for (iter = skb_shinfo(skb)->frag_list; iter; iter = iter->next)
+
 extern struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
                                            int *peeked, int *err);
 extern struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
diff --git a/include/linux/socket.h b/include/linux/socket.h
index d2310cb45d2f..3b461dffe244 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -194,7 +194,8 @@ struct ucred {
 #define AF_RXRPC        33      /* RxRPC sockets                */
 #define AF_ISDN         34      /* mISDN sockets                */
 #define AF_PHONET       35      /* Phonet sockets               */
-#define AF_MAX          36      /* For now.. */
+#define AF_IEEE802154   36      /* IEEE802154 sockets           */
+#define AF_MAX          37      /* For now.. */
 
 /* Protocol families, same as address families. */
 #define PF_UNSPEC       AF_UNSPEC
@@ -233,6 +234,7 @@ struct ucred {
 #define PF_RXRPC        AF_RXRPC
 #define PF_ISDN         AF_ISDN
 #define PF_PHONET       AF_PHONET
+#define PF_IEEE802154   AF_IEEE802154
 #define PF_MAX          AF_MAX
 
 /* Maximum queue length specifiable by listen.  */
diff --git a/include/linux/spi/libertas_spi.h b/include/linux/spi/libertas_spi.h
index 79506f5f9e67..1b5d5384fcd3 100644
--- a/include/linux/spi/libertas_spi.h
+++ b/include/linux/spi/libertas_spi.h
@@ -22,9 +22,6 @@ struct libertas_spi_platform_data {
          * speed, you may want to use 0 here. */
         u16 use_dummy_writes;
 
-        /* GPIO number to use as chip select */
-        u16 gpio_cs;
-
         /* Board specific setup/teardown */
         int (*setup)(struct spi_device *spi);
         int (*teardown)(struct spi_device *spi);
diff --git a/include/linux/wimax.h b/include/linux/wimax.h
index c89de7f4e5b9..4fdcc5635518 100644
--- a/include/linux/wimax.h
+++ b/include/linux/wimax.h
@@ -59,7 +59,7 @@ enum {
          * M - Major: change if removing or modifying an existing call.
          * m - minor: change when adding a new call
          */
-        WIMAX_GNL_VERSION = 00,
+        WIMAX_GNL_VERSION = 01,
         /* Generic NetLink attributes */
         WIMAX_GNL_ATTR_INVALID = 0x00,
         WIMAX_GNL_ATTR_MAX = 10,
@@ -78,6 +78,7 @@ enum {
         WIMAX_GNL_OP_RFKILL,    /* Run wimax_rfkill() */
         WIMAX_GNL_OP_RESET,     /* Run wimax_rfkill() */
         WIMAX_GNL_RE_STATE_CHANGE,      /* Report: status change */
+        WIMAX_GNL_OP_STATE_GET,         /* Request for current state */
 };
 
 
@@ -113,6 +114,10 @@ enum {
         WIMAX_GNL_RESET_IFIDX = 1,
 };
 
+/* Atributes for wimax_state_get() */
+enum {
+        WIMAX_GNL_STGET_IFIDX = 1,
+};
 
 /*
  * Attributes for the Report State Change
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 3ad5390a4dd5..968166a45f86 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -81,12 +81,6 @@ enum {
         BT_CLOSED
 };
 
-/* Endianness conversions */
-#define htobs(a)        __cpu_to_le16(a)
-#define htobl(a)        __cpu_to_le32(a)
-#define btohs(a)        __le16_to_cpu(a)
-#define btohl(a)        __le32_to_cpu(a)
-
 /* BD Address */
 typedef struct {
         __u8 b[6];
@@ -171,15 +165,6 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk, unsigned long l
         return skb;
 }
 
-static inline int skb_frags_no(struct sk_buff *skb)
-{
-        register struct sk_buff *frag = skb_shinfo(skb)->frag_list;
-        register int n = 1;
-
-        for (; frag; frag=frag->next, n++);
-        return n;
-}
-
 int bt_err(__u16 code);
 
 extern int hci_sock_init(void);
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 73aead222b32..c4ca4228b083 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -137,6 +137,8 @@ struct hci_dev {
         struct device           *parent;
         struct device           dev;
 
+        struct rfkill           *rfkill;
+
         struct module           *owner;
 
         int (*open)(struct hci_dev *hdev);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index f566aa1f0a4c..e919fca1072a 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -26,8 +26,13 @@
 #define __L2CAP_H
 
 /* L2CAP defaults */
-#define L2CAP_DEFAULT_MTU       672
-#define L2CAP_DEFAULT_FLUSH_TO  0xFFFF
+#define L2CAP_DEFAULT_MTU               672
+#define L2CAP_DEFAULT_FLUSH_TO          0xffff
+#define L2CAP_DEFAULT_RX_WINDOW         1
+#define L2CAP_DEFAULT_MAX_RECEIVE       1
+#define L2CAP_DEFAULT_RETRANS_TO        300    /* 300 milliseconds */
+#define L2CAP_DEFAULT_MONITOR_TO        1000   /* 1 second */
+#define L2CAP_DEFAULT_MAX_RX_APDU       0xfff7
 
 #define L2CAP_CONN_TIMEOUT      (40000) /* 40 seconds */
 #define L2CAP_INFO_TIMEOUT      (4000)  /*  4 seconds */
@@ -64,17 +69,29 @@ struct l2cap_conninfo {
 #define L2CAP_LM_SECURE         0x0020
 
 /* L2CAP command codes */
-#define L2CAP_COMMAND_REJ 0x01
-#define L2CAP_CONN_REQ    0x02
-#define L2CAP_CONN_RSP    0x03
-#define L2CAP_CONF_REQ    0x04
-#define L2CAP_CONF_RSP    0x05
-#define L2CAP_DISCONN_REQ 0x06
-#define L2CAP_DISCONN_RSP 0x07
-#define L2CAP_ECHO_REQ    0x08
-#define L2CAP_ECHO_RSP    0x09
-#define L2CAP_INFO_REQ    0x0a
-#define L2CAP_INFO_RSP    0x0b
+#define L2CAP_COMMAND_REJ       0x01
+#define L2CAP_CONN_REQ          0x02
+#define L2CAP_CONN_RSP          0x03
+#define L2CAP_CONF_REQ          0x04
+#define L2CAP_CONF_RSP          0x05
+#define L2CAP_DISCONN_REQ       0x06
+#define L2CAP_DISCONN_RSP       0x07
+#define L2CAP_ECHO_REQ          0x08
+#define L2CAP_ECHO_RSP          0x09
+#define L2CAP_INFO_REQ          0x0a
+#define L2CAP_INFO_RSP          0x0b
+
+/* L2CAP feature mask */
+#define L2CAP_FEAT_FLOWCTL      0x00000001
+#define L2CAP_FEAT_RETRANS      0x00000002
+#define L2CAP_FEAT_ERTM         0x00000008
+#define L2CAP_FEAT_STREAMING    0x00000010
+#define L2CAP_FEAT_FCS          0x00000020
+#define L2CAP_FEAT_FIXED_CHAN   0x00000080
+
+/* L2CAP checksum option */
+#define L2CAP_FCS_NONE          0x00
+#define L2CAP_FCS_CRC16         0x01
 
 /* L2CAP structures */
 struct l2cap_hdr {
@@ -106,17 +123,23 @@ struct l2cap_conn_rsp {
         __le16     status;
 } __attribute__ ((packed));
 
+/* channel indentifier */
+#define L2CAP_CID_SIGNALING     0x0001
+#define L2CAP_CID_CONN_LESS     0x0002
+#define L2CAP_CID_DYN_START     0x0040
+#define L2CAP_CID_DYN_END       0xffff
+
 /* connect result */
-#define L2CAP_CR_SUCCESS    0x0000
-#define L2CAP_CR_PEND       0x0001
-#define L2CAP_CR_BAD_PSM    0x0002
-#define L2CAP_CR_SEC_BLOCK  0x0003
-#define L2CAP_CR_NO_MEM     0x0004
+#define L2CAP_CR_SUCCESS        0x0000
+#define L2CAP_CR_PEND           0x0001
+#define L2CAP_CR_BAD_PSM        0x0002
+#define L2CAP_CR_SEC_BLOCK      0x0003
+#define L2CAP_CR_NO_MEM         0x0004
 
 /* connect status */
-#define L2CAP_CS_NO_INFO      0x0000
-#define L2CAP_CS_AUTHEN_PEND  0x0001
-#define L2CAP_CS_AUTHOR_PEND  0x0002
+#define L2CAP_CS_NO_INFO        0x0000
+#define L2CAP_CS_AUTHEN_PEND    0x0001
+#define L2CAP_CS_AUTHOR_PEND    0x0002
 
 struct l2cap_conf_req {
         __le16     dcid;
@@ -143,10 +166,14 @@ struct l2cap_conf_opt {
 } __attribute__ ((packed));
 #define L2CAP_CONF_OPT_SIZE     2
 
+#define L2CAP_CONF_HINT         0x80
+#define L2CAP_CONF_MASK         0x7f
+
 #define L2CAP_CONF_MTU          0x01
 #define L2CAP_CONF_FLUSH_TO     0x02
 #define L2CAP_CONF_QOS          0x03
 #define L2CAP_CONF_RFC          0x04
+#define L2CAP_CONF_FCS          0x05
 
 #define L2CAP_CONF_MAX_SIZE     22
 
@@ -162,6 +189,8 @@ struct l2cap_conf_rfc {
 #define L2CAP_MODE_BASIC        0x00
 #define L2CAP_MODE_RETRANS      0x01
 #define L2CAP_MODE_FLOWCTL      0x02
+#define L2CAP_MODE_ERTM         0x03
+#define L2CAP_MODE_STREAM       0x04
 
 struct l2cap_disconn_req {
         __le16     dcid;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index f20da7d63b1e..1a21895b732b 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -752,6 +752,19 @@ enum wiphy_params_flags {
 };
 
 /**
+ * enum tx_power_setting - TX power adjustment
+ *
+ * @TX_POWER_AUTOMATIC: the dbm parameter is ignored
+ * @TX_POWER_LIMITED: limit TX power by the dbm parameter
+ * @TX_POWER_FIXED: fix TX power to the dbm parameter
+ */
+enum tx_power_setting {
+        TX_POWER_AUTOMATIC,
+        TX_POWER_LIMITED,
+        TX_POWER_FIXED,
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -837,6 +850,13 @@ enum wiphy_params_flags {
  *      @changed bitfield (see &enum wiphy_params_flags) describes which values
  *      have changed. The actual parameter values are available in
  *      struct wiphy. If returning an error, no value should be changed.
+ *
+ * @set_tx_power: set the transmit power according to the parameters
+ * @get_tx_power: store the current TX power into the dbm variable;
+ *      return 0 if successful
+ *
+ * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
+ *      functions to adjust rfkill hw state
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy);
@@ -928,6 +948,12 @@ struct cfg80211_ops {
         int     (*leave_ibss)(struct wiphy *wiphy, struct net_device *dev);
 
         int     (*set_wiphy_params)(struct wiphy *wiphy, u32 changed);
+
+        int     (*set_tx_power)(struct wiphy *wiphy,
+                                enum tx_power_setting type, int dbm);
+        int     (*get_tx_power)(struct wiphy *wiphy, int *dbm);
+
+        void    (*rfkill_poll)(struct wiphy *wiphy);
 };
 
 /*
@@ -1451,6 +1477,12 @@ int cfg80211_wext_siwencode(struct net_device *dev,
 int cfg80211_wext_giwencode(struct net_device *dev,
                             struct iw_request_info *info,
                             struct iw_point *erq, char *keybuf);
+int cfg80211_wext_siwtxpower(struct net_device *dev,
+                             struct iw_request_info *info,
+                             union iwreq_data *data, char *keybuf);
+int cfg80211_wext_giwtxpower(struct net_device *dev,
+                             struct iw_request_info *info,
+                             union iwreq_data *data, char *keybuf);
 
 /*
  * callbacks for asynchronous cfg80211 methods, notification
@@ -1636,4 +1668,23 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
  */
 void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
 
+/**
+ * wiphy_rfkill_set_hw_state - notify cfg80211 about hw block state
+ * @wiphy: the wiphy
+ * @blocked: block status
+ */
+void wiphy_rfkill_set_hw_state(struct wiphy *wiphy, bool blocked);
+
+/**
+ * wiphy_rfkill_start_polling - start polling rfkill
+ * @wiphy: the wiphy
+ */
+void wiphy_rfkill_start_polling(struct wiphy *wiphy);
+
+/**
+ * wiphy_rfkill_stop_polling - stop polling rfkill
+ * @wiphy: the wiphy
+ */
+void wiphy_rfkill_stop_polling(struct wiphy *wiphy);
+
 #endif /* __NET_CFG80211_H */
diff --git a/include/net/dst.h b/include/net/dst.h
index 6be3b082a070..7fc409c19b37 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -195,6 +195,12 @@ struct dst_entry * dst_clone(struct dst_entry * dst)
 }
 
 extern void dst_release(struct dst_entry *dst);
+static inline void skb_dst_drop(struct sk_buff *skb)
+{
+        if (skb->_skb_dst)
+                dst_release(skb_dst(skb));
+        skb->_skb_dst = 0UL;
+}
 
 /* Children define the path of the packet through the
  * Linux networking.  Thus, destinations are stackable.
@@ -246,7 +252,7 @@ static inline void dst_negative_advice(struct dst_entry **dst_p)
 
 static inline void dst_link_failure(struct sk_buff *skb)
 {
-        struct dst_entry * dst = skb->dst;
+        struct dst_entry *dst = skb_dst(skb);
         if (dst && dst->ops && dst->ops->link_failure)
                 dst->ops->link_failure(skb);
 }
@@ -265,13 +271,13 @@ static inline void dst_set_expires(struct dst_entry *dst, int timeout)
 /* Output packet to network from transport.  */
 static inline int dst_output(struct sk_buff *skb)
 {
-        return skb->dst->output(skb);
+        return skb_dst(skb)->output(skb);
 }
 
 /* Input packet from network to transport.  */
 static inline int dst_input(struct sk_buff *skb)
 {
-        return skb->dst->input(skb);
+        return skb_dst(skb)->input(skb);
 }
 
 static inline struct dst_entry *dst_check(struct dst_entry *dst, u32 cookie)
diff --git a/include/net/ieee802154/af_ieee802154.h b/include/net/ieee802154/af_ieee802154.h
new file mode 100644
index 000000000000..0d78605fb1a6
--- /dev/null
+++ b/include/net/ieee802154/af_ieee802154.h
@@ -0,0 +1,60 @@
+/*
+ * IEEE 802.15.4 inteface for userspace
+ *
+ * Copyright 2007, 2008 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Sergey Lapin <slapin@ossfans.org>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ */
+
+#ifndef _AF_IEEE802154_H
+#define _AF_IEEE802154_H
+
+#include <linux/socket.h> /* for sa_family_t */
+
+enum {
+        IEEE802154_ADDR_NONE = 0x0,
+        /* RESERVED = 0x01, */
+        IEEE802154_ADDR_SHORT = 0x2, /* 16-bit address + PANid */
+        IEEE802154_ADDR_LONG = 0x3, /* 64-bit address + PANid */
+};
+
+/* address length, octets */
+#define IEEE802154_ADDR_LEN     8
+
+struct ieee802154_addr {
+        int addr_type;
+        u16 pan_id;
+        union {
+                u8 hwaddr[IEEE802154_ADDR_LEN];
+                u16 short_addr;
+        };
+};
+
+#define IEEE802154_PANID_BROADCAST      0xffff
+#define IEEE802154_ADDR_BROADCAST       0xffff
+#define IEEE802154_ADDR_UNDEF           0xfffe
+
+struct sockaddr_ieee802154 {
+        sa_family_t family; /* AF_IEEE802154 */
+        struct ieee802154_addr addr;
+};
+
+/* master device */
+#define IEEE802154_SIOC_ADD_SLAVE               (SIOCDEVPRIVATE + 0)
+
+#endif
diff --git a/include/net/ieee802154/mac_def.h b/include/net/ieee802154/mac_def.h
new file mode 100644
index 000000000000..8cb684635650
--- /dev/null
+++ b/include/net/ieee802154/mac_def.h
@@ -0,0 +1,160 @@
+/*
+ * IEEE802.15.4-2003 specification
+ *
+ * Copyright (C) 2007, 2008 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Maxim Osipov <maxim.osipov@siemens.com>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ */
+
+#ifndef IEEE802154_MAC_DEF_H
+#define IEEE802154_MAC_DEF_H
+
+#define IEEE802154_FC_TYPE_BEACON       0x0     /* Frame is beacon */
+#define IEEE802154_FC_TYPE_DATA         0x1     /* Frame is data */
+#define IEEE802154_FC_TYPE_ACK          0x2     /* Frame is acknowledgment */
+#define IEEE802154_FC_TYPE_MAC_CMD      0x3     /* Frame is MAC command */
+
+#define IEEE802154_FC_TYPE_SHIFT                0
+#define IEEE802154_FC_TYPE_MASK         ((1 << 3) - 1)
+#define IEEE802154_FC_TYPE(x)           ((x & IEEE802154_FC_TYPE_MASK) >> IEEE802154_FC_TYPE_SHIFT)
+#define IEEE802154_FC_SET_TYPE(v, x)    do {    \
+        v = (((v) & ~IEEE802154_FC_TYPE_MASK) | \
+            (((x) << IEEE802154_FC_TYPE_SHIFT) & IEEE802154_FC_TYPE_MASK)); \
+        } while (0)
+
+#define IEEE802154_FC_SECEN             (1 << 3)
+#define IEEE802154_FC_FRPEND            (1 << 4)
+#define IEEE802154_FC_ACK_REQ           (1 << 5)
+#define IEEE802154_FC_INTRA_PAN         (1 << 6)
+
+#define IEEE802154_FC_SAMODE_SHIFT      14
+#define IEEE802154_FC_SAMODE_MASK       (3 << IEEE802154_FC_SAMODE_SHIFT)
+#define IEEE802154_FC_DAMODE_SHIFT      10
+#define IEEE802154_FC_DAMODE_MASK       (3 << IEEE802154_FC_DAMODE_SHIFT)
+
+#define IEEE802154_FC_SAMODE(x)         \
+        (((x) & IEEE802154_FC_SAMODE_MASK) >> IEEE802154_FC_SAMODE_SHIFT)
+
+#define IEEE802154_FC_DAMODE(x)         \
+        (((x) & IEEE802154_FC_DAMODE_MASK) >> IEEE802154_FC_DAMODE_SHIFT)
+
+
+/* MAC's Command Frames Identifiers */
+#define IEEE802154_CMD_ASSOCIATION_REQ          0x01
+#define IEEE802154_CMD_ASSOCIATION_RESP         0x02
+#define IEEE802154_CMD_DISASSOCIATION_NOTIFY    0x03
+#define IEEE802154_CMD_DATA_REQ                 0x04
+#define IEEE802154_CMD_PANID_CONFLICT_NOTIFY    0x05
+#define IEEE802154_CMD_ORPHAN_NOTIFY            0x06
+#define IEEE802154_CMD_BEACON_REQ               0x07
+#define IEEE802154_CMD_COORD_REALIGN_NOTIFY     0x08
+#define IEEE802154_CMD_GTS_REQ                  0x09
+
+/*
+ * The return values of MAC operations
+ */
+enum {
+        /*
+         * The requested operation was completed successfully.
+         * For a transmission request, this value indicates
+         * a successful transmission.
+         */
+        IEEE802154_SUCCESS = 0x0,
+
+        /* The beacon was lost following a synchronization request. */
+        IEEE802154_BEACON_LOSS = 0xe0,
+        /*
+         * A transmission could not take place due to activity on the
+         * channel, i.e., the CSMA-CA mechanism has failed.
+         */
+        IEEE802154_CHNL_ACCESS_FAIL = 0xe1,
+        /* The GTS request has been denied by the PAN coordinator. */
+        IEEE802154_DENINED = 0xe2,
+        /* The attempt to disable the transceiver has failed. */
+        IEEE802154_DISABLE_TRX_FAIL = 0xe3,
+        /*
+         * The received frame induces a failed security check according to
+         * the security suite.
+         */
+        IEEE802154_FAILED_SECURITY_CHECK = 0xe4,
+        /*
+         * The frame resulting from secure processing has a length that is
+         * greater than aMACMaxFrameSize.
+         */
+        IEEE802154_FRAME_TOO_LONG = 0xe5,
+        /*
+         * The requested GTS transmission failed because the specified GTS
+         * either did not have a transmit GTS direction or was not defined.
+         */
+        IEEE802154_INVALID_GTS = 0xe6,
+        /*
+         * A request to purge an MSDU from the transaction queue was made using
+         * an MSDU handle that was not found in the transaction table.
+         */
+        IEEE802154_INVALID_HANDLE = 0xe7,
+        /* A parameter in the primitive is out of the valid range.*/
+        IEEE802154_INVALID_PARAMETER = 0xe8,
+        /* No acknowledgment was received after aMaxFrameRetries. */
+        IEEE802154_NO_ACK = 0xe9,
+        /* A scan operation failed to find any network beacons.*/
+        IEEE802154_NO_BEACON = 0xea,
+        /* No response data were available following a request. */
+        IEEE802154_NO_DATA = 0xeb,
+        /* The operation failed because a short address was not allocated. */
+        IEEE802154_NO_SHORT_ADDRESS = 0xec,
+        /*
+         * A receiver enable request was unsuccessful because it could not be
+         * completed within the CAP.
+         */
+        IEEE802154_OUT_OF_CAP = 0xed,
+        /*
+         * A PAN identifier conflict has been detected and communicated to the
+         * PAN coordinator.
+         */
+        IEEE802154_PANID_CONFLICT = 0xee,
+        /* A coordinator realignment command has been received. */
+        IEEE802154_REALIGMENT = 0xef,
+        /* The transaction has expired and its information discarded. */
+        IEEE802154_TRANSACTION_EXPIRED = 0xf0,
+        /* There is no capacity to store the transaction. */
+        IEEE802154_TRANSACTION_OVERFLOW = 0xf1,
+        /*
+         * The transceiver was in the transmitter enabled state when the
+         * receiver was requested to be enabled.
+         */
+        IEEE802154_TX_ACTIVE = 0xf2,
+        /* The appropriate key is not available in the ACL. */
+        IEEE802154_UNAVAILABLE_KEY = 0xf3,
+        /*
+         * A SET/GET request was issued with the identifier of a PIB attribute
+         * that is not supported.
+         */
+        IEEE802154_UNSUPPORTED_ATTR = 0xf4,
+        /*
+         * A request to perform a scan operation failed because the MLME was
+         * in the process of performing a previously initiated scan operation.
+         */
+        IEEE802154_SCAN_IN_PROGRESS = 0xfc,
+};
+
+
+#endif
+
+
diff --git a/include/net/ieee802154/netdevice.h b/include/net/ieee802154/netdevice.h
new file mode 100644
index 000000000000..e2506af3e7c8
--- /dev/null
+++ b/include/net/ieee802154/netdevice.h
@@ -0,0 +1,115 @@
+/*
+ * An interface between IEEE802.15.4 device and rest of the kernel.
+ *
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Maxim Osipov <maxim.osipov@siemens.com>
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ */
+
+#ifndef IEEE802154_NETDEVICE_H
+#define IEEE802154_NETDEVICE_H
+
+/*
+ * A control block of skb passed between the ARPHRD_IEEE802154 device
+ * and other stack parts.
+ */
+struct ieee802154_mac_cb {
+        u8 lqi;
+        struct ieee802154_addr sa;
+        struct ieee802154_addr da;
+        u8 flags;
+        u8 seq;
+};
+
+static inline struct ieee802154_mac_cb *mac_cb(struct sk_buff *skb)
+{
+        return (struct ieee802154_mac_cb *)skb->cb;
+}
+
+#define MAC_CB_FLAG_TYPEMASK            ((1 << 3) - 1)
+
+#define MAC_CB_FLAG_ACKREQ              (1 << 3)
+#define MAC_CB_FLAG_SECEN               (1 << 4)
+#define MAC_CB_FLAG_INTRAPAN            (1 << 5)
+
+static inline int mac_cb_is_ackreq(struct sk_buff *skb)
+{
+        return mac_cb(skb)->flags & MAC_CB_FLAG_ACKREQ;
+}
+
+static inline int mac_cb_is_secen(struct sk_buff *skb)
+{
+        return mac_cb(skb)->flags & MAC_CB_FLAG_SECEN;
+}
+
+static inline int mac_cb_is_intrapan(struct sk_buff *skb)
+{
+        return mac_cb(skb)->flags & MAC_CB_FLAG_INTRAPAN;
+}
+
+static inline int mac_cb_type(struct sk_buff *skb)
+{
+        return mac_cb(skb)->flags & MAC_CB_FLAG_TYPEMASK;
+}
+
+#define IEEE802154_MAC_SCAN_ED          0
+#define IEEE802154_MAC_SCAN_ACTIVE      1
+#define IEEE802154_MAC_SCAN_PASSIVE     2
+#define IEEE802154_MAC_SCAN_ORPHAN      3
+
+/*
+ * This should be located at net_device->ml_priv
+ */
+struct ieee802154_mlme_ops {
+        int (*assoc_req)(struct net_device *dev,
+                        struct ieee802154_addr *addr,
+                        u8 channel, u8 cap);
+        int (*assoc_resp)(struct net_device *dev,
+                        struct ieee802154_addr *addr,
+                        u16 short_addr, u8 status);
+        int (*disassoc_req)(struct net_device *dev,
+                        struct ieee802154_addr *addr,
+                        u8 reason);
+        int (*start_req)(struct net_device *dev,
+                        struct ieee802154_addr *addr,
+                        u8 channel, u8 bcn_ord, u8 sf_ord,
+                        u8 pan_coord, u8 blx, u8 coord_realign);
+        int (*scan_req)(struct net_device *dev,
+                        u8 type, u32 channels, u8 duration);
+
+        /*
+         * FIXME: these should become the part of PIB/MIB interface.
+         * However we still don't have IB interface of any kind
+         */
+        u16 (*get_pan_id)(struct net_device *dev);
+        u16 (*get_short_addr)(struct net_device *dev);
+        u8 (*get_dsn)(struct net_device *dev);
+        u8 (*get_bsn)(struct net_device *dev);
+};
+
+static inline struct ieee802154_mlme_ops *ieee802154_mlme_ops(
+                struct net_device *dev)
+{
+        return dev->ml_priv;
+}
+
+#endif
+
+
diff --git a/include/net/ieee802154/nl802154.h b/include/net/ieee802154/nl802154.h
new file mode 100644
index 000000000000..78efcdf52b59
--- /dev/null
+++ b/include/net/ieee802154/nl802154.h
@@ -0,0 +1,41 @@
+/*
+ * nl802154.h
+ *
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef IEEE802154_NL_H
+#define IEEE802154_NL_H
+
+struct net_device;
+struct ieee802154_addr;
+
+int ieee802154_nl_assoc_indic(struct net_device *dev,
+                struct ieee802154_addr *addr, u8 cap);
+int ieee802154_nl_assoc_confirm(struct net_device *dev,
+                u16 short_addr, u8 status);
+int ieee802154_nl_disassoc_indic(struct net_device *dev,
+                struct ieee802154_addr *addr, u8 reason);
+int ieee802154_nl_disassoc_confirm(struct net_device *dev,
+                u8 status);
+int ieee802154_nl_scan_confirm(struct net_device *dev,
+                u8 status, u8 scan_type, u32 unscanned,
+                u8 *edl/*, struct list_head *pan_desc_list */);
+int ieee802154_nl_beacon_indic(struct net_device *dev, u16 panid,
+                u16 coord_addr);
+
+#endif
diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h
index f74665d7bea8..22c73a77cd99 100644
--- a/include/net/inet6_hashtables.h
+++ b/include/net/inet6_hashtables.h
@@ -100,7 +100,7 @@ static inline struct sock *__inet6_lookup_skb(struct inet_hashinfo *hashinfo,
 
         if (unlikely(sk = skb_steal_sock(skb)))
                 return sk;
-        else return __inet6_lookup(dev_net(skb->dst->dev), hashinfo,
+        else return __inet6_lookup(dev_net(skb_dst(skb)->dev), hashinfo,
                                    &ipv6_hdr(skb)->saddr, sport,
                                    &ipv6_hdr(skb)->daddr, ntohs(dport),
                                    inet6_iif(skb));
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index a44e2248b2ef..d522dcf3031a 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -385,7 +385,7 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo,
         if (unlikely(sk = skb_steal_sock(skb)))
                 return sk;
         else
-                return __inet_lookup(dev_net(skb->dst->dev), hashinfo,
+                return __inet_lookup(dev_net(skb_dst(skb)->dev), hashinfo,
                                      iph->saddr, sport,
                                      iph->daddr, dport, inet_iif(skb));
 }
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index de0ecc71cf03..20a6957af870 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -130,7 +130,8 @@ struct inet_sock {
                                 freebind:1,
                                 hdrincl:1,
                                 mc_loop:1,
-                                transparent:1;
+                                transparent:1,
+                                mc_all:1;
         int                     mc_index;
         __be32                  mc_addr;
         struct ip_mc_socklist   *mc_list;
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 5f53db7e4e57..0e1b8aebaff8 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -142,7 +142,7 @@ static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
 
 static inline int ipv6_unicast_destination(struct sk_buff *skb)
 {
-        struct rt6_info *rt = (struct rt6_info *) skb->dst;
+        struct rt6_info *rt = (struct rt6_info *) skb_dst(skb);
 
         return rt->rt6i_flags & RTF_LOCAL;
 }
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index d72346ff3247..c06104476973 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -239,6 +239,8 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_INTFL_NEED_TXPROCESSING: completely internal to mac80211,
  *      used to indicate that a pending frame requires TX processing before
  *      it can be sent out.
+ * @IEEE80211_TX_INTFL_RETRIED: completely internal to mac80211,
+ *      used to indicate that a frame was already retried due to PS
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -256,6 +258,7 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_RATE_CTRL_PROBE        = BIT(12),
         IEEE80211_TX_INTFL_RCALGO               = BIT(13),
         IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
+        IEEE80211_TX_INTFL_RETRIED              = BIT(15),
 };
 
 /**
@@ -526,8 +529,7 @@ enum ieee80211_conf_flags {
 /**
  * enum ieee80211_conf_changed - denotes which configuration changed
  *
- * @IEEE80211_CONF_CHANGE_RADIO_ENABLED: the value of radio_enabled changed
- * @_IEEE80211_CONF_CHANGE_BEACON_INTERVAL: DEPRECATED
+ * @_IEEE80211_CONF_CHANGE_RADIO_ENABLED: DEPRECATED
  * @IEEE80211_CONF_CHANGE_LISTEN_INTERVAL: the listen interval changed
  * @IEEE80211_CONF_CHANGE_RADIOTAP: the radiotap flag changed
  * @IEEE80211_CONF_CHANGE_PS: the PS flag or dynamic PS timeout changed
@@ -537,8 +539,7 @@ enum ieee80211_conf_flags {
  * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
  */
 enum ieee80211_conf_changed {
-        IEEE80211_CONF_CHANGE_RADIO_ENABLED     = BIT(0),
-        _IEEE80211_CONF_CHANGE_BEACON_INTERVAL  = BIT(1),
+        _IEEE80211_CONF_CHANGE_RADIO_ENABLED    = BIT(0),
         IEEE80211_CONF_CHANGE_LISTEN_INTERVAL   = BIT(2),
         IEEE80211_CONF_CHANGE_RADIOTAP          = BIT(3),
         IEEE80211_CONF_CHANGE_PS                = BIT(4),
@@ -549,12 +550,12 @@ enum ieee80211_conf_changed {
 };
 
 static inline __deprecated enum ieee80211_conf_changed
-__IEEE80211_CONF_CHANGE_BEACON_INTERVAL(void)
+__IEEE80211_CONF_CHANGE_RADIO_ENABLED(void)
 {
-        return _IEEE80211_CONF_CHANGE_BEACON_INTERVAL;
+        return _IEEE80211_CONF_CHANGE_RADIO_ENABLED;
 }
-#define IEEE80211_CONF_CHANGE_BEACON_INTERVAL \
-        __IEEE80211_CONF_CHANGE_BEACON_INTERVAL()
+#define IEEE80211_CONF_CHANGE_RADIO_ENABLED \
+        __IEEE80211_CONF_CHANGE_RADIO_ENABLED()
 
 /**
  * struct ieee80211_conf - configuration of the device
@@ -564,7 +565,7 @@ __IEEE80211_CONF_CHANGE_BEACON_INTERVAL(void)
  * @flags: configuration flags defined above
  *
  * @radio_enabled: when zero, driver is required to switch off the radio.
- * @beacon_int: beacon interval (TODO make interface config)
+ * @beacon_int: DEPRECATED, DO NOT USE
  *
  * @listen_interval: listen interval in units of beacon interval
  * @max_sleep_period: the maximum number of beacon intervals to sleep for
@@ -589,13 +590,13 @@ __IEEE80211_CONF_CHANGE_BEACON_INTERVAL(void)
  *    number of transmissions not the number of retries
  */
 struct ieee80211_conf {
-        int beacon_int;
+        int __deprecated beacon_int;
         u32 flags;
         int power_level, dynamic_ps_timeout;
         int max_sleep_period;
 
         u16 listen_interval;
-        bool radio_enabled;
+        bool __deprecated radio_enabled;
 
         u8 long_frame_max_tx_count, short_frame_max_tx_count;
 
@@ -1406,6 +1407,10 @@ enum ieee80211_ampdu_mlme_action {
  *      is the first frame we expect to perform the action on. Notice
  *      that TX/RX_STOP can pass NULL for this parameter.
  *      Returns a negative error code on failure.
+ *
+ * @rfkill_poll: Poll rfkill hardware state. If you need this, you also
+ *      need to set wiphy->rfkill_poll to %true before registration,
+ *      and need to call wiphy_rfkill_set_hw_state() in the callback.
  */
 struct ieee80211_ops {
         int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1454,6 +1459,8 @@ struct ieee80211_ops {
         int (*ampdu_action)(struct ieee80211_hw *hw,
                             enum ieee80211_ampdu_mlme_action action,
                             struct ieee80211_sta *sta, u16 tid, u16 *ssn);
+
+        void (*rfkill_poll)(struct ieee80211_hw *hw);
 };
 
 /**
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index e37fe3129c17..120935b2abd8 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -41,9 +41,10 @@ static inline void *qdisc_priv(struct Qdisc *q)
 typedef u64     psched_time_t;
 typedef long    psched_tdiff_t;
 
-/* Avoid doing 64 bit divide by 1000 */
-#define PSCHED_US2NS(x)                 ((s64)(x) << 10)
-#define PSCHED_NS2US(x)                 ((x) >> 10)
+/* Avoid doing 64 bit divide */
+#define PSCHED_SHIFT                    6
+#define PSCHED_US2NS(x)                 ((s64)(x) << PSCHED_SHIFT)
+#define PSCHED_NS2US(x)                 ((x) >> PSCHED_SHIFT)
 
 #define PSCHED_TICKS_PER_SEC            PSCHED_NS2US(NSEC_PER_SEC)
 #define PSCHED_PASTPERFECT              0
diff --git a/include/net/route.h b/include/net/route.h
index 4e8cae0e5841..40f6346ef496 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -210,7 +210,7 @@ static inline struct inet_peer *rt_get_peer(struct rtable *rt)
 
 static inline int inet_iif(const struct sk_buff *skb)
 {
-        return skb->rtable->rt_iif;
+        return skb_rtable(skb)->rt_iif;
 }
 
 #endif  /* _ROUTE_H */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 23f08fe1d50a..edfcacf3250e 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1939,10 +1939,8 @@ void sctp_association_free(struct sctp_association *);
 void sctp_association_put(struct sctp_association *);
 void sctp_association_hold(struct sctp_association *);
 
-struct sctp_transport *sctp_assoc_choose_init_transport(
-        struct sctp_association *);
-struct sctp_transport *sctp_assoc_choose_shutdown_transport(
-        struct sctp_association *);
+struct sctp_transport *sctp_assoc_choose_alter_transport(
+        struct sctp_association *, struct sctp_transport *);
 void sctp_assoc_update_retran_path(struct sctp_association *);
 struct sctp_transport *sctp_assoc_lookup_paddr(const struct sctp_association *,
                                           const union sctp_addr *);
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index b259fc5798fb..1580c04f68bc 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -147,6 +147,8 @@ enum sctp_optname {
 #define SCTP_GET_LOCAL_ADDRS    SCTP_GET_LOCAL_ADDRS
         SCTP_SOCKOPT_CONNECTX, /* CONNECTX requests. */
 #define SCTP_SOCKOPT_CONNECTX   SCTP_SOCKOPT_CONNECTX
+        SCTP_SOCKOPT_CONNECTX3, /* CONNECTX requests. (new implementation) */
+#define SCTP_SOCKOPT_CONNECTX3  SCTP_SOCKOPT_CONNECTX3
 };
 
 /*
diff --git a/include/net/sock.h b/include/net/sock.h
index 4bb1ff9fd15b..010e14a93c92 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1217,9 +1217,13 @@ static inline int skb_copy_to_page(struct sock *sk, char __user *from,
 
 static inline void skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
 {
-        sock_hold(sk);
         skb->sk = sk;
         skb->destructor = sock_wfree;
+        /*
+         * We used to take a refcount on sk, but following operation
+         * is enough to guarantee sk_free() wont free this sock until
+         * all in-flight packets are completed
+         */
         atomic_add(skb->truesize, &sk->sk_wmem_alloc);
 }
 
diff --git a/include/net/wimax.h b/include/net/wimax.h
index 6b3824edb39e..2af7bf839f23 100644
--- a/include/net/wimax.h
+++ b/include/net/wimax.h
@@ -253,7 +253,6 @@
 struct net_device;
 struct genl_info;
 struct wimax_dev;
-struct input_dev;
 
 /**
  * struct wimax_dev - Generic WiMAX device
@@ -293,8 +292,8 @@ struct input_dev;
  *     See wimax_reset()'s documentation.
  *
  * @name: [fill] A way to identify this device. We need to register a
- *     name with many subsystems (input for RFKILL, workqueue
- *     creation, etc). We can't use the network device name as that
+ *     name with many subsystems (rfkill, workqueue creation, etc).
+ *     We can't use the network device name as that
  *     might change and in some instances we don't know it yet (until
  *     we don't call register_netdev()). So we generate an unique one
  *     using the driver name and device bus id, place it here and use
@@ -316,9 +315,6 @@ struct input_dev;
  *
  * @rfkill: [private] integration into the RF-Kill infrastructure.
  *
- * @rfkill_input: [private] virtual input device to process the
- *     hardware RF Kill switches.
- *
  * @rf_sw: [private] State of the software radio switch (OFF/ON)
  *
  * @rf_hw: [private] State of the hardware radio switch (OFF/ON)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 2e9f5c0018ae..736bca450886 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -994,7 +994,7 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir,
                 return __xfrm_policy_check(sk, ndir, skb, family);
 
         return  (!net->xfrm.policy_count[dir] && !skb->sp) ||
-                (skb->dst->flags & DST_NOPOLICY) ||
+                (skb_dst(skb)->flags & DST_NOPOLICY) ||
                 __xfrm_policy_check(sk, ndir, skb, family);
 }
 
@@ -1048,7 +1048,7 @@ static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
         struct net *net = dev_net(skb->dev);
 
         return  !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
-                (skb->dst->flags & DST_NOXFRM) ||
+                (skb_dst(skb)->flags & DST_NOXFRM) ||
                 __xfrm_route_forward(skb, family);
 }