Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1341 commits)
  virtio_net: remove forgotten assignment
  be2net: fix tx completion polling
  sis190: fix cable detect via link status poll
  net: fix protocol sk_buff field
  bridge: Fix build error when IGMP_SNOOPING is not enabled
  bnx2x: Tx barriers and locks
  scm: Only support SCM_RIGHTS on unix domain sockets.
  vhost-net: restart tx poll on sk_sndbuf full
  vhost: fix get_user_pages_fast error handling
  vhost: initialize log eventfd context pointer
  vhost: logging thinko fix
  wireless: convert to use netdev_for_each_mc_addr
  ethtool: do not set some flags, if others failed
  ipoib: returned back addrlen check for mc addresses
  netlink: Adding inode field to /proc/net/netlink
  axnet_cs: add new id
  bridge: Make IGMP snooping depend upon BRIDGE.
  bridge: Add multicast count/interval sysfs entries
  bridge: Add hash elasticity/max sysfs entries
  bridge: Add multicast_snooping sysfs toggle
  ...

Trivial conflicts in Documentation/feature-removal-schedule.txt

93 files changed, 2092 insertions, 468 deletions

diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 91be0d896322..5b0d997f23ef 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -363,6 +363,7 @@ unifdef-y += uio.h
 unifdef-y += unistd.h
 unifdef-y += usbdevice_fs.h
 unifdef-y += utsname.h
+unifdef-y += vhost.h
 unifdef-y += videodev2.h
 unifdef-y += videodev.h
 unifdef-y += virtio_config.h
diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h
index 2b31b91f5871..7f437ca1ed44 100644
--- a/include/linux/brcmphy.h
+++ b/include/linux/brcmphy.h
@@ -1,3 +1,14 @@
+#define PHY_ID_BCM50610                 0x0143bd60
+#define PHY_ID_BCM50610M                0x0143bd70
+#define PHY_ID_BCMAC131                 0x0143bc70
+#define PHY_ID_BCM57780                 0x03625d90
+
+#define PHY_BCM_OUI_MASK                0xfffffc00
+#define PHY_BCM_OUI_1                   0x00206000
+#define PHY_BCM_OUI_2                   0x0143bc00
+#define PHY_BCM_OUI_3                   0x03625c00
+
+
 #define PHY_BCM_FLAGS_MODE_COPPER       0x00000001
 #define PHY_BCM_FLAGS_MODE_1000BX       0x00000002
 #define PHY_BCM_FLAGS_INTF_SGMII        0x00000010
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index 3db7767d2a17..6e5a7f00223d 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -38,6 +38,7 @@ struct can_priv {
 
         enum can_state state;
         u32 ctrlmode;
+        u32 ctrlmode_supported;
 
         int restart_ms;
         struct timer_list restart_timer;
@@ -46,6 +47,8 @@ struct can_priv {
         int (*do_set_mode)(struct net_device *dev, enum can_mode mode);
         int (*do_get_state)(const struct net_device *dev,
                             enum can_state *state);
+        int (*do_get_berr_counter)(const struct net_device *dev,
+                                   struct can_berr_counter *bec);
 
         unsigned int echo_skb_max;
         struct sk_buff **echo_skb;
@@ -60,6 +63,21 @@ struct can_priv {
  */
 #define get_can_dlc(i)  (min_t(__u8, (i), 8))
 
+/* Drop a given socketbuffer if it does not contain a valid CAN frame. */
+static inline int can_dropped_invalid_skb(struct net_device *dev,
+                                          struct sk_buff *skb)
+{
+        const struct can_frame *cf = (struct can_frame *)skb->data;
+
+        if (unlikely(skb->len != sizeof(*cf) || cf->can_dlc > 8)) {
+                kfree_skb(skb);
+                dev->stats.tx_dropped++;
+                return 1;
+        }
+
+        return 0;
+}
+
 struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max);
 void free_candev(struct net_device *dev);
 
diff --git a/include/linux/can/netlink.h b/include/linux/can/netlink.h
index 9ecbb7871c0e..3250de935e1a 100644
--- a/include/linux/can/netlink.h
+++ b/include/linux/can/netlink.h
@@ -70,6 +70,14 @@ enum can_state {
 };
 
 /*
+ * CAN bus error counters
+ */
+struct can_berr_counter {
+        __u16 txerr;
+        __u16 rxerr;
+};
+
+/*
  * CAN controller mode
  */
 struct can_ctrlmode {
@@ -77,9 +85,11 @@ struct can_ctrlmode {
         __u32 flags;
 };
 
-#define CAN_CTRLMODE_LOOPBACK   0x1     /* Loopback mode */
-#define CAN_CTRLMODE_LISTENONLY 0x2     /* Listen-only mode */
-#define CAN_CTRLMODE_3_SAMPLES  0x4     /* Triple sampling mode */
+#define CAN_CTRLMODE_LOOPBACK           0x01    /* Loopback mode */
+#define CAN_CTRLMODE_LISTENONLY         0x02    /* Listen-only mode */
+#define CAN_CTRLMODE_3_SAMPLES          0x04    /* Triple sampling mode */
+#define CAN_CTRLMODE_ONE_SHOT           0x08    /* One-Shot mode */
+#define CAN_CTRLMODE_BERR_REPORTING     0x10    /* Bus-error reporting */
 
 /*
  * CAN device statistics
@@ -105,6 +115,7 @@ enum {
         IFLA_CAN_CTRLMODE,
         IFLA_CAN_RESTART_MS,
         IFLA_CAN_RESTART,
+        IFLA_CAN_BERR_COUNTER,
         __IFLA_CAN_MAX
 };
 
diff --git a/include/linux/can/platform/ti_hecc.h b/include/linux/can/platform/ti_hecc.h
index 4688c7bb1bd1..af17cb3f7a84 100644
--- a/include/linux/can/platform/ti_hecc.h
+++ b/include/linux/can/platform/ti_hecc.h
@@ -1,3 +1,6 @@
+#ifndef __CAN_PLATFORM_TI_HECC_H__
+#define __CAN_PLATFORM_TI_HECC_H__
+
 /*
  * TI HECC (High End CAN Controller) driver platform header
  *
@@ -23,6 +26,7 @@
  * @mbx_offset:         Mailbox RAM offset
  * @int_line:           Interrupt line to use - 0 or 1
  * @version:            version for future use
+ * @transceiver_switch: platform specific callback fn for transceiver control
  *
  * Platform data structure to get all platform specific settings.
  * this structure also accounts the fact that the IP may have different
@@ -35,6 +39,6 @@ struct ti_hecc_platform_data {
         u32 mbx_offset;
         u32 int_line;
         u32 version;
+        void (*transceiver_switch) (int);
 };
-
-
+#endif
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index ef4a2d84d922..cca1c3de140d 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -242,6 +242,7 @@ enum ethtool_stringset {
         ETH_SS_TEST             = 0,
         ETH_SS_STATS,
         ETH_SS_PRIV_FLAGS,
+        ETH_SS_NTUPLE_FILTERS,
 };
 
 /* for passing string sets for data tagging */
@@ -290,6 +291,7 @@ struct ethtool_perm_addr {
  */
 enum ethtool_flags {
         ETH_FLAG_LRO            = (1 << 15),    /* LRO is enabled */
+        ETH_FLAG_NTUPLE         = (1 << 27),    /* N-tuple filters enabled */
 };
 
 /* The following structures are for supporting RX network flow
@@ -363,6 +365,35 @@ struct ethtool_rxnfc {
         __u32                           rule_locs[0];
 };
 
+struct ethtool_rx_ntuple_flow_spec {
+        __u32            flow_type;
+        union {
+                struct ethtool_tcpip4_spec              tcp_ip4_spec;
+                struct ethtool_tcpip4_spec              udp_ip4_spec;
+                struct ethtool_tcpip4_spec              sctp_ip4_spec;
+                struct ethtool_ah_espip4_spec           ah_ip4_spec;
+                struct ethtool_ah_espip4_spec           esp_ip4_spec;
+                struct ethtool_rawip4_spec              raw_ip4_spec;
+                struct ethtool_ether_spec               ether_spec;
+                struct ethtool_usrip4_spec              usr_ip4_spec;
+                __u8                                    hdata[64];
+        } h_u, m_u; /* entry, mask */
+
+        __u16           vlan_tag;
+        __u16           vlan_tag_mask;
+        __u64           data;      /* user-defined flow spec data */
+        __u64           data_mask; /* user-defined flow spec mask */
+
+        /* signed to distinguish between queue and actions (DROP) */
+        __s32           action;
+#define ETHTOOL_RXNTUPLE_ACTION_DROP -1
+};
+
+struct ethtool_rx_ntuple {
+        __u32                                   cmd;
+        struct ethtool_rx_ntuple_flow_spec      fs;
+};
+
 #define ETHTOOL_FLASH_MAX_FILENAME      128
 enum ethtool_flash_op_type {
         ETHTOOL_FLASH_ALL_REGIONS       = 0,
@@ -377,6 +408,20 @@ struct ethtool_flash {
 
 #ifdef __KERNEL__
 
+#include <linux/rculist.h>
+
+struct ethtool_rx_ntuple_flow_spec_container {
+        struct ethtool_rx_ntuple_flow_spec fs;
+        struct list_head list;
+};
+
+struct ethtool_rx_ntuple_list {
+#define ETHTOOL_MAX_NTUPLE_LIST_ENTRY 1024
+#define ETHTOOL_MAX_NTUPLE_STRING_PER_ENTRY 14
+        struct list_head        list;
+        unsigned int            count;
+};
+
 struct net_device;
 
 /* Some generic methods drivers may use in their ethtool_ops */
@@ -394,6 +439,7 @@ u32 ethtool_op_get_ufo(struct net_device *dev);
 int ethtool_op_set_ufo(struct net_device *dev, u32 data);
 u32 ethtool_op_get_flags(struct net_device *dev);
 int ethtool_op_set_flags(struct net_device *dev, u32 data);
+void ethtool_ntuple_flush(struct net_device *dev);
 
 /**
  * &ethtool_ops - Alter and report network device settings
@@ -500,6 +546,8 @@ struct ethtool_ops {
         int     (*set_rxnfc)(struct net_device *, struct ethtool_rxnfc *);
         int     (*flash_device)(struct net_device *, struct ethtool_flash *);
         int     (*reset)(struct net_device *, u32 *);
+        int     (*set_rx_ntuple)(struct net_device *, struct ethtool_rx_ntuple *);
+        int     (*get_rx_ntuple)(struct net_device *, u32 stringset, void *);
 };
 #endif /* __KERNEL__ */
 
@@ -559,6 +607,9 @@ struct ethtool_ops {
 #define ETHTOOL_FLASHDEV        0x00000033 /* Flash firmware to device */
 #define ETHTOOL_RESET           0x00000034 /* Reset hardware */
 
+#define ETHTOOL_SRXNTUPLE       0x00000035 /* Add an n-tuple filter to device */
+#define ETHTOOL_GRXNTUPLE       0x00000036 /* Get n-tuple filters from device */
+
 /* compatibility with older code */
 #define SPARC_ETH_GSET          ETHTOOL_GSET
 #define SPARC_ETH_SSET          ETHTOOL_SSET
diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h
index c0d8357917e2..4c4c74ec5987 100644
--- a/include/linux/icmpv6.h
+++ b/include/linux/icmpv6.h
@@ -174,8 +174,7 @@ struct icmp6_filter {
 
 extern void                             icmpv6_send(struct sk_buff *skb,
                                                     u8 type, u8 code,
-                                                    __u32 info, 
-                                                    struct net_device *dev);
+                                                    __u32 info);
 
 extern int                              icmpv6_init(void);
 extern int                              icmpv6_err_convert(u8 type, u8 code,
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 163c840437d6..19984958ab7b 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -120,6 +120,26 @@
 #define IEEE80211_QOS_CTL_TID_MASK      0x000F
 #define IEEE80211_QOS_CTL_TAG1D_MASK    0x0007
 
+/* U-APSD queue for WMM IEs sent by AP */
+#define IEEE80211_WMM_IE_AP_QOSINFO_UAPSD       (1<<7)
+
+/* U-APSD queues for WMM IEs sent by STA */
+#define IEEE80211_WMM_IE_STA_QOSINFO_AC_VO      (1<<0)
+#define IEEE80211_WMM_IE_STA_QOSINFO_AC_VI      (1<<1)
+#define IEEE80211_WMM_IE_STA_QOSINFO_AC_BK      (1<<2)
+#define IEEE80211_WMM_IE_STA_QOSINFO_AC_BE      (1<<3)
+#define IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK    0x0f
+
+/* U-APSD max SP length for WMM IEs sent by STA */
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL     0x00
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_2       0x01
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_4       0x02
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_6       0x03
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK    0x03
+#define IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT   5
+
+#define IEEE80211_HT_CTL_LEN            4
+
 struct ieee80211_hdr {
         __le16 frame_control;
         __le16 duration_id;
@@ -130,6 +150,25 @@ struct ieee80211_hdr {
         u8 addr4[6];
 } __attribute__ ((packed));
 
+struct ieee80211_hdr_3addr {
+        __le16 frame_control;
+        __le16 duration_id;
+        u8 addr1[6];
+        u8 addr2[6];
+        u8 addr3[6];
+        __le16 seq_ctrl;
+} __attribute__ ((packed));
+
+struct ieee80211_qos_hdr {
+        __le16 frame_control;
+        __le16 duration_id;
+        u8 addr1[6];
+        u8 addr2[6];
+        u8 addr3[6];
+        __le16 seq_ctrl;
+        __le16 qos_ctrl;
+} __attribute__ ((packed));
+
 /**
  * ieee80211_has_tods - check if IEEE80211_FCTL_TODS is set
  * @fc: frame control bytes in little-endian byteorder
@@ -707,6 +746,10 @@ struct ieee80211_mgmt {
                                         u8 action;
                                         u8 trans_id[WLAN_SA_QUERY_TR_ID_LEN];
                                 } __attribute__ ((packed)) sa_query;
+                                struct {
+                                        u8 action;
+                                        u8 smps_control;
+                                } __attribute__ ((packed)) ht_smps;
                         } u;
                 } __attribute__ ((packed)) action;
         } u;
@@ -771,7 +814,10 @@ struct ieee80211_bar {
 /**
  * struct ieee80211_mcs_info - MCS information
  * @rx_mask: RX mask
- * @rx_highest: highest supported RX rate
+ * @rx_highest: highest supported RX rate. If set represents
+ *      the highest supported RX data rate in units of 1 Mbps.
+ *      If this field is 0 this value should not be used to
+ *      consider the highest RX data rate supported.
  * @tx_params: TX parameters
  */
 struct ieee80211_mcs_info {
@@ -824,6 +870,7 @@ struct ieee80211_ht_cap {
 #define IEEE80211_HT_CAP_LDPC_CODING            0x0001
 #define IEEE80211_HT_CAP_SUP_WIDTH_20_40        0x0002
 #define IEEE80211_HT_CAP_SM_PS                  0x000C
+#define         IEEE80211_HT_CAP_SM_PS_SHIFT    2
 #define IEEE80211_HT_CAP_GRN_FLD                0x0010
 #define IEEE80211_HT_CAP_SGI_20                 0x0020
 #define IEEE80211_HT_CAP_SGI_40                 0x0040
@@ -839,6 +886,7 @@ struct ieee80211_ht_cap {
 /* 802.11n HT capability AMPDU settings (for ampdu_params_info) */
 #define IEEE80211_HT_AMPDU_PARM_FACTOR          0x03
 #define IEEE80211_HT_AMPDU_PARM_DENSITY         0x1C
+#define         IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT   2
 
 /*
  * Maximum length of AMPDU that the STA can receive.
@@ -922,12 +970,17 @@ struct ieee80211_ht_info {
 #define IEEE80211_MAX_AMPDU_BUF 0x40
 
 
-/* Spatial Multiplexing Power Save Modes */
+/* Spatial Multiplexing Power Save Modes (for capability) */
 #define WLAN_HT_CAP_SM_PS_STATIC        0
 #define WLAN_HT_CAP_SM_PS_DYNAMIC       1
 #define WLAN_HT_CAP_SM_PS_INVALID       2
 #define WLAN_HT_CAP_SM_PS_DISABLED      3
 
+/* for SM power control field lower two bits */
+#define WLAN_HT_SMPS_CONTROL_DISABLED   0
+#define WLAN_HT_SMPS_CONTROL_STATIC     1
+#define WLAN_HT_SMPS_CONTROL_DYNAMIC    3
+
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
 #define WLAN_AUTH_SHARED_KEY 1
@@ -1071,12 +1124,12 @@ enum ieee80211_eid {
         WLAN_EID_TIM = 5,
         WLAN_EID_IBSS_PARAMS = 6,
         WLAN_EID_CHALLENGE = 16,
-        /* 802.11d */
+
         WLAN_EID_COUNTRY = 7,
         WLAN_EID_HP_PARAMS = 8,
         WLAN_EID_HP_TABLE = 9,
         WLAN_EID_REQUEST = 10,
-        /* 802.11e */
+
         WLAN_EID_QBSS_LOAD = 11,
         WLAN_EID_EDCA_PARAM_SET = 12,
         WLAN_EID_TSPEC = 13,
@@ -1099,7 +1152,7 @@ enum ieee80211_eid {
         WLAN_EID_PREP = 69,
         WLAN_EID_PERR = 70,
         WLAN_EID_RANN = 49,     /* compatible with FreeBSD */
-        /* 802.11h */
+
         WLAN_EID_PWR_CONSTRAINT = 32,
         WLAN_EID_PWR_CAPABILITY = 33,
         WLAN_EID_TPC_REQUEST = 34,
@@ -1110,20 +1163,41 @@ enum ieee80211_eid {
         WLAN_EID_MEASURE_REPORT = 39,
         WLAN_EID_QUIET = 40,
         WLAN_EID_IBSS_DFS = 41,
-        /* 802.11g */
+
         WLAN_EID_ERP_INFO = 42,
         WLAN_EID_EXT_SUPP_RATES = 50,
-        /* 802.11n */
+
         WLAN_EID_HT_CAPABILITY = 45,
         WLAN_EID_HT_INFORMATION = 61,
-        /* 802.11i */
+
         WLAN_EID_RSN = 48,
-        WLAN_EID_TIMEOUT_INTERVAL = 56,
-        WLAN_EID_MMIE = 76 /* 802.11w */,
+        WLAN_EID_MMIE = 76,
         WLAN_EID_WPA = 221,
         WLAN_EID_GENERIC = 221,
         WLAN_EID_VENDOR_SPECIFIC = 221,
-        WLAN_EID_QOS_PARAMETER = 222
+        WLAN_EID_QOS_PARAMETER = 222,
+
+        WLAN_EID_AP_CHAN_REPORT = 51,
+        WLAN_EID_NEIGHBOR_REPORT = 52,
+        WLAN_EID_RCPI = 53,
+        WLAN_EID_BSS_AVG_ACCESS_DELAY = 63,
+        WLAN_EID_ANTENNA_INFO = 64,
+        WLAN_EID_RSNI = 65,
+        WLAN_EID_MEASUREMENT_PILOT_TX_INFO = 66,
+        WLAN_EID_BSS_AVAILABLE_CAPACITY = 67,
+        WLAN_EID_BSS_AC_ACCESS_DELAY = 68,
+        WLAN_EID_RRM_ENABLED_CAPABILITIES = 70,
+        WLAN_EID_MULTIPLE_BSSID = 71,
+
+        WLAN_EID_MOBILITY_DOMAIN = 54,
+        WLAN_EID_FAST_BSS_TRANSITION = 55,
+        WLAN_EID_TIMEOUT_INTERVAL = 56,
+        WLAN_EID_RIC_DATA = 57,
+        WLAN_EID_RIC_DESCRIPTOR = 75,
+
+        WLAN_EID_DSE_REGISTERED_LOCATION = 58,
+        WLAN_EID_SUPPORTED_REGULATORY_CLASSES = 59,
+        WLAN_EID_EXT_CHANSWITCH_ANN = 60,
 };
 
 /* Action category code */
@@ -1150,6 +1224,18 @@ enum ieee80211_spectrum_mgmt_actioncode {
         WLAN_ACTION_SPCT_CHL_SWITCH = 4,
 };
 
+/* HT action codes */
+enum ieee80211_ht_actioncode {
+        WLAN_HT_ACTION_NOTIFY_CHANWIDTH = 0,
+        WLAN_HT_ACTION_SMPS = 1,
+        WLAN_HT_ACTION_PSMP = 2,
+        WLAN_HT_ACTION_PCO_PHASE = 3,
+        WLAN_HT_ACTION_CSI = 4,
+        WLAN_HT_ACTION_NONCOMPRESSED_BF = 5,
+        WLAN_HT_ACTION_COMPRESSED_BF = 6,
+        WLAN_HT_ACTION_ASEL_IDX_FEEDBACK = 7,
+};
+
 /* Security key length */
 enum ieee80211_key_len {
         WLAN_KEY_LEN_WEP40 = 5,
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index 6674791622ca..c9bf92cd7653 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -78,6 +78,11 @@ enum {
 #define IFLA_LINKINFO IFLA_LINKINFO
         IFLA_NET_NS_PID,
         IFLA_IFALIAS,
+        IFLA_NUM_VF,            /* Number of VFs if device is SR-IOV PF */
+        IFLA_VF_MAC,            /* Hardware queue specific attributes */
+        IFLA_VF_VLAN,
+        IFLA_VF_TX_RATE,        /* TX Bandwidth Allocation */
+        IFLA_VFINFO,
         __IFLA_MAX
 };
 
@@ -196,4 +201,29 @@ enum macvlan_mode {
         MACVLAN_MODE_BRIDGE  = 4, /* talk to bridge ports directly */
 };
 
+/* SR-IOV virtual function managment section */
+
+struct ifla_vf_mac {
+        __u32 vf;
+        __u8 mac[32]; /* MAX_ADDR_LEN */
+};
+
+struct ifla_vf_vlan {
+        __u32 vf;
+        __u32 vlan; /* 0 - 4095, 0 disables VLAN filter */
+        __u32 qos;
+};
+
+struct ifla_vf_tx_rate {
+        __u32 vf;
+        __u32 rate; /* Max TX bandwidth in Mbps, 0 disables throttling */
+};
+
+struct ifla_vf_info {
+        __u32 vf;
+        __u8 mac[32];
+        __u32 vlan;
+        __u32 qos;
+        __u32 tx_rate;
+};
 #endif /* _LINUX_IF_LINK_H */
diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
index 5f200bac3749..b78a712247da 100644
--- a/include/linux/if_macvlan.h
+++ b/include/linux/if_macvlan.h
@@ -1,6 +1,90 @@
 #ifndef _LINUX_IF_MACVLAN_H
 #define _LINUX_IF_MACVLAN_H
 
+#include <linux/if_link.h>
+#include <linux/list.h>
+#include <linux/netdevice.h>
+#include <linux/netlink.h>
+#include <net/netlink.h>
+
+#if defined(CONFIG_MACVTAP) || defined(CONFIG_MACVTAP_MODULE)
+struct socket *macvtap_get_socket(struct file *);
+#else
+#include <linux/err.h>
+#include <linux/errno.h>
+struct file;
+struct socket;
+static inline struct socket *macvtap_get_socket(struct file *f)
+{
+        return ERR_PTR(-EINVAL);
+}
+#endif /* CONFIG_MACVTAP */
+
+struct macvlan_port;
+struct macvtap_queue;
+
+/**
+ *      struct macvlan_rx_stats - MACVLAN percpu rx stats
+ *      @rx_packets: number of received packets
+ *      @rx_bytes: number of received bytes
+ *      @multicast: number of received multicast packets
+ *      @rx_errors: number of errors
+ */
+struct macvlan_rx_stats {
+        unsigned long rx_packets;
+        unsigned long rx_bytes;
+        unsigned long multicast;
+        unsigned long rx_errors;
+};
+
+struct macvlan_dev {
+        struct net_device       *dev;
+        struct list_head        list;
+        struct hlist_node       hlist;
+        struct macvlan_port     *port;
+        struct net_device       *lowerdev;
+        struct macvlan_rx_stats __percpu *rx_stats;
+        enum macvlan_mode       mode;
+        int (*receive)(struct sk_buff *skb);
+        int (*forward)(struct net_device *dev, struct sk_buff *skb);
+        struct macvtap_queue    *tap;
+};
+
+static inline void macvlan_count_rx(const struct macvlan_dev *vlan,
+                                    unsigned int len, bool success,
+                                    bool multicast)
+{
+        struct macvlan_rx_stats *rx_stats;
+
+        rx_stats = per_cpu_ptr(vlan->rx_stats, smp_processor_id());
+        if (likely(success)) {
+                rx_stats->rx_packets++;;
+                rx_stats->rx_bytes += len;
+                if (multicast)
+                        rx_stats->multicast++;
+        } else {
+                rx_stats->rx_errors++;
+        }
+}
+
+extern int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
+                                  struct nlattr *tb[], struct nlattr *data[],
+                                  int (*receive)(struct sk_buff *skb),
+                                  int (*forward)(struct net_device *dev,
+                                                 struct sk_buff *skb));
+
+extern void macvlan_count_rx(const struct macvlan_dev *vlan,
+                             unsigned int len, bool success,
+                             bool multicast);
+
+extern void macvlan_dellink(struct net_device *dev, struct list_head *head);
+
+extern int macvlan_link_register(struct rtnl_link_ops *ops);
+
+extern netdev_tx_t macvlan_start_xmit(struct sk_buff *skb,
+                                      struct net_device *dev);
+
+
 extern struct sk_buff *(*macvlan_handle_frame_hook)(struct sk_buff *);
 
 #endif /* _LINUX_IF_MACVLAN_H */
diff --git a/include/linux/if_packet.h b/include/linux/if_packet.h
index 4021d47cc437..aa57a5f993fc 100644
--- a/include/linux/if_packet.h
+++ b/include/linux/if_packet.h
@@ -46,6 +46,7 @@ struct sockaddr_ll {
 #define PACKET_RESERVE                  12
 #define PACKET_TX_RING                  13
 #define PACKET_LOSS                     14
+#define PACKET_VNET_HDR                 15
 
 struct tpacket_stats {
         unsigned int    tp_packets;
diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
index 3f5fd523b49d..1350a246893a 100644
--- a/include/linux/if_tun.h
+++ b/include/linux/if_tun.h
@@ -18,6 +18,7 @@
 
 #include <linux/types.h>
 #include <linux/if_ether.h>
+#include <linux/filter.h>
 
 /* Read queue size */
 #define TUN_READQ_SIZE  500
@@ -48,6 +49,8 @@
 #define TUNGETIFF      _IOR('T', 210, unsigned int)
 #define TUNGETSNDBUF   _IOR('T', 211, int)
 #define TUNSETSNDBUF   _IOW('T', 212, int)
+#define TUNATTACHFILTER _IOW('T', 213, struct sock_fprog)
+#define TUNDETACHFILTER _IOW('T', 214, struct sock_fprog)
 
 /* TUNSETIFF ifr flags */
 #define IFF_TUN         0x0001
@@ -86,4 +89,18 @@ struct tun_filter {
         __u8   addr[0][ETH_ALEN];
 };
 
+#ifdef __KERNEL__
+#if defined(CONFIG_TUN) || defined(CONFIG_TUN_MODULE)
+struct socket *tun_get_socket(struct file *);
+#else
+#include <linux/err.h>
+#include <linux/errno.h>
+struct file;
+struct socket;
+static inline struct socket *tun_get_socket(struct file *f)
+{
+        return ERR_PTR(-EINVAL);
+}
+#endif /* CONFIG_TUN */
+#endif /* __KERNEL__ */
 #endif /* __IF_TUN_H */
diff --git a/include/linux/igmp.h b/include/linux/igmp.h
index 724c27e5d173..93fc2449af10 100644
--- a/include/linux/igmp.h
+++ b/include/linux/igmp.h
@@ -153,6 +153,7 @@ extern int sysctl_igmp_max_msf;
 struct ip_sf_socklist {
         unsigned int            sl_max;
         unsigned int            sl_count;
+        struct rcu_head         rcu;
         __be32                  sl_addr[0];
 };
 
@@ -170,6 +171,7 @@ struct ip_mc_socklist {
         struct ip_mreqn         multi;
         unsigned int            sfmode;         /* MCAST_{INCLUDE,EXCLUDE} */
         struct ip_sf_socklist   *sflist;
+        struct rcu_head         rcu;
 };
 
 struct ip_sf_list {
diff --git a/include/linux/in.h b/include/linux/in.h
index b615649db129..583c76f9c30f 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -84,6 +84,8 @@ struct in_addr {
 #define IP_ORIGDSTADDR       20
 #define IP_RECVORIGDSTADDR   IP_ORIGDSTADDR
 
+#define IP_MINTTL       21
+
 /* IP_MTU_DISCOVER values */
 #define IP_PMTUDISC_DONT                0       /* Never send DF frames */
 #define IP_PMTUDISC_WANT                1       /* Use per route hints  */
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index b2304929434e..2be1a1a2beb9 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -10,10 +10,40 @@
 #include <linux/timer.h>
 #include <linux/sysctl.h>
 
+enum
+{
+        IPV4_DEVCONF_FORWARDING=1,
+        IPV4_DEVCONF_MC_FORWARDING,
+        IPV4_DEVCONF_PROXY_ARP,
+        IPV4_DEVCONF_ACCEPT_REDIRECTS,
+        IPV4_DEVCONF_SECURE_REDIRECTS,
+        IPV4_DEVCONF_SEND_REDIRECTS,
+        IPV4_DEVCONF_SHARED_MEDIA,
+        IPV4_DEVCONF_RP_FILTER,
+        IPV4_DEVCONF_ACCEPT_SOURCE_ROUTE,
+        IPV4_DEVCONF_BOOTP_RELAY,
+        IPV4_DEVCONF_LOG_MARTIANS,
+        IPV4_DEVCONF_TAG,
+        IPV4_DEVCONF_ARPFILTER,
+        IPV4_DEVCONF_MEDIUM_ID,
+        IPV4_DEVCONF_NOXFRM,
+        IPV4_DEVCONF_NOPOLICY,
+        IPV4_DEVCONF_FORCE_IGMP_VERSION,
+        IPV4_DEVCONF_ARP_ANNOUNCE,
+        IPV4_DEVCONF_ARP_IGNORE,
+        IPV4_DEVCONF_PROMOTE_SECONDARIES,
+        IPV4_DEVCONF_ARP_ACCEPT,
+        IPV4_DEVCONF_ARP_NOTIFY,
+        IPV4_DEVCONF_ACCEPT_LOCAL,
+        IPV4_DEVCONF_SRC_VMARK,
+        IPV4_DEVCONF_PROXY_ARP_PVLAN,
+        __IPV4_DEVCONF_MAX
+};
+
 struct ipv4_devconf {
         void    *sysctl;
-        int     data[__NET_IPV4_CONF_MAX - 1];
-        DECLARE_BITMAP(state, __NET_IPV4_CONF_MAX - 1);
+        int     data[__IPV4_DEVCONF_MAX - 1];
+        DECLARE_BITMAP(state, __IPV4_DEVCONF_MAX - 1);
 };
 
 struct in_device {
@@ -40,7 +70,7 @@ struct in_device {
         struct rcu_head         rcu_head;
 };
 
-#define IPV4_DEVCONF(cnf, attr) ((cnf).data[NET_IPV4_CONF_ ## attr - 1])
+#define IPV4_DEVCONF(cnf, attr) ((cnf).data[IPV4_DEVCONF_ ## attr - 1])
 #define IPV4_DEVCONF_ALL(net, attr) \
         IPV4_DEVCONF((*(net)->ipv4.devconf_all), attr)
 
@@ -60,13 +90,13 @@ static inline void ipv4_devconf_set(struct in_device *in_dev, int index,
 
 static inline void ipv4_devconf_setall(struct in_device *in_dev)
 {
-        bitmap_fill(in_dev->cnf.state, __NET_IPV4_CONF_MAX - 1);
+        bitmap_fill(in_dev->cnf.state, __IPV4_DEVCONF_MAX - 1);
 }
 
 #define IN_DEV_CONF_GET(in_dev, attr) \
-        ipv4_devconf_get((in_dev), NET_IPV4_CONF_ ## attr)
+        ipv4_devconf_get((in_dev), IPV4_DEVCONF_ ## attr)
 #define IN_DEV_CONF_SET(in_dev, attr, val) \
-        ipv4_devconf_set((in_dev), NET_IPV4_CONF_ ## attr, (val))
+        ipv4_devconf_set((in_dev), IPV4_DEVCONF_ ## attr, (val))
 
 #define IN_DEV_ANDCONF(in_dev, attr) \
         (IPV4_DEVCONF_ALL(dev_net(in_dev->dev), attr) && \
@@ -89,6 +119,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 
 #define IN_DEV_LOG_MARTIANS(in_dev)     IN_DEV_ORCONF((in_dev), LOG_MARTIANS)
 #define IN_DEV_PROXY_ARP(in_dev)        IN_DEV_ORCONF((in_dev), PROXY_ARP)
+#define IN_DEV_PROXY_ARP_PVLAN(in_dev)  IN_DEV_CONF_GET(in_dev, PROXY_ARP_PVLAN)
 #define IN_DEV_SHARED_MEDIA(in_dev)     IN_DEV_ORCONF((in_dev), SHARED_MEDIA)
 #define IN_DEV_TX_REDIRECTS(in_dev)     IN_DEV_ORCONF((in_dev), SEND_REDIRECTS)
 #define IN_DEV_SEC_REDIRECTS(in_dev)    IN_DEV_ORCONF((in_dev), \
diff --git a/include/linux/isdn/capilli.h b/include/linux/isdn/capilli.h
index 7acb87a44872..11b57c485854 100644
--- a/include/linux/isdn/capilli.h
+++ b/include/linux/isdn/capilli.h
@@ -50,8 +50,7 @@ struct capi_ctr {
         u16  (*send_message)(struct capi_ctr *, struct sk_buff *skb);
         
         char *(*procinfo)(struct capi_ctr *);
-        int (*ctr_read_proc)(char *page, char **start, off_t off,
-                             int count, int *eof, struct capi_ctr *card);
+        const struct file_operations *proc_fops;
 
         /* filled in before calling ready callback */
         u8 manu[CAPI_MANUFACTURER_LEN];         /* CAPI_GET_MANUFACTURER */
@@ -67,9 +66,10 @@ struct capi_ctr {
         unsigned long nsentdatapkt;
 
         int cnr;                                /* controller number */
-        volatile unsigned short cardstate;      /* controller state */
-        volatile int blocked;                   /* output blocked */
+        unsigned short state;                   /* controller state */
+        int blocked;                            /* output blocked */
         int traceflag;                          /* capi trace */
+        wait_queue_head_t state_wait_queue;
 
         struct proc_dir_entry *procent;
         char procfn[128];
diff --git a/include/linux/kernelcapi.h b/include/linux/kernelcapi.h
index a53e932f80fb..9c2683929fd3 100644
--- a/include/linux/kernelcapi.h
+++ b/include/linux/kernelcapi.h
@@ -48,9 +48,7 @@ typedef struct kcapi_carddef {
 #include <linux/list.h>
 #include <linux/skbuff.h>
 #include <linux/workqueue.h>
-
-#define KCI_CONTRUP     0       /* arg: struct capi_profile */
-#define KCI_CONTRDOWN   1       /* arg: NULL */
+#include <linux/notifier.h>
 
 struct capi20_appl {
         u16 applid;
@@ -67,11 +65,6 @@ struct capi20_appl {
         struct sk_buff_head recv_queue;
         struct work_struct recv_work;
         int release_in_progress;
-
-        /* ugly hack to allow for notification of added/removed
-         * controllers. The Right Way (tm) is known. XXX
-         */
-        void (*callback) (unsigned int cmd, __u32 contr, void *data);
 };
 
 u16 capi20_isinstalled(void);
@@ -84,11 +77,11 @@ u16 capi20_get_serial(u32 contr, u8 serial[CAPI_SERIAL_LEN]);
 u16 capi20_get_profile(u32 contr, struct capi_profile *profp);
 int capi20_manufacturer(unsigned int cmd, void __user *data);
 
-/* temporary hack XXX */
-void capi20_set_callback(struct capi20_appl *ap, 
-                         void (*callback) (unsigned int cmd, __u32 contr, void *data));
-
+#define CAPICTR_UP                      0
+#define CAPICTR_DOWN                    1
 
+int register_capictr_notifier(struct notifier_block *nb);
+int unregister_capictr_notifier(struct notifier_block *nb);
 
 #define CAPI_NOERROR                      0x0000
 
diff --git a/include/linux/llc.h b/include/linux/llc.h
index 7733585603f1..ad7074ba81af 100644
--- a/include/linux/llc.h
+++ b/include/linux/llc.h
@@ -36,6 +36,7 @@ enum llc_sockopts {
         LLC_OPT_BUSY_TMR_EXP,   /* busy state expire time (secs). */
         LLC_OPT_TX_WIN,         /* tx window size. */
         LLC_OPT_RX_WIN,         /* rx window size. */
+        LLC_OPT_PKTINFO,        /* ancillary packet information. */
         LLC_OPT_MAX
 };
 
@@ -70,6 +71,12 @@ enum llc_sockopts {
 #define LLC_SAP_RM      0xD4            /* Resource Management          */
 #define LLC_SAP_GLOBAL  0xFF            /* Global SAP.                  */
 
+struct llc_pktinfo {
+        int lpi_ifindex;
+        unsigned char lpi_sap;
+        unsigned char lpi_mac[IFHWADDRLEN];
+};
+
 #ifdef __KERNEL__
 #define LLC_SAP_DYN_START       0xC0
 #define LLC_SAP_DYN_STOP        0xDE
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index adaf3c15e449..8b5f7cc0fba6 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -30,6 +30,7 @@
 #define HPET_MINOR              228
 #define FUSE_MINOR              229
 #define KVM_MINOR               232
+#define VHOST_NET_MINOR         233
 #define MISC_DYNAMIC_MINOR      255
 
 struct device;
diff --git a/include/linux/net.h b/include/linux/net.h
index 5e8083cacc8b..4157b5d42bd6 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -174,18 +174,22 @@ struct proto_ops {
                                       struct poll_table_struct *wait);
         int             (*ioctl)     (struct socket *sock, unsigned int cmd,
                                       unsigned long arg);
+#ifdef CONFIG_COMPAT
         int             (*compat_ioctl) (struct socket *sock, unsigned int cmd,
                                       unsigned long arg);
+#endif
         int             (*listen)    (struct socket *sock, int len);
         int             (*shutdown)  (struct socket *sock, int flags);
         int             (*setsockopt)(struct socket *sock, int level,
                                       int optname, char __user *optval, unsigned int optlen);
         int             (*getsockopt)(struct socket *sock, int level,
                                       int optname, char __user *optval, int __user *optlen);
+#ifdef CONFIG_COMPAT
         int             (*compat_setsockopt)(struct socket *sock, int level,
                                       int optname, char __user *optval, unsigned int optlen);
         int             (*compat_getsockopt)(struct socket *sock, int level,
                                       int optname, char __user *optval, int __user *optlen);
+#endif
         int             (*sendmsg)   (struct kiocb *iocb, struct socket *sock,
                                       struct msghdr *m, size_t total_len);
         int             (*recvmsg)   (struct kiocb *iocb, struct socket *sock,
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index a3fccc85b1a0..c79a88be7c33 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -28,6 +28,7 @@
 #include <linux/if.h>
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
+#include <linux/if_link.h>
 
 #ifdef __KERNEL__
 #include <linux/timer.h>
@@ -136,7 +137,7 @@ static inline bool dev_xmit_complete(int rc)
  *      used.
  */
 
-#if defined(CONFIG_WLAN_80211) || defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+#if defined(CONFIG_WLAN) || defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
 # if defined(CONFIG_MAC80211_MESH)
 #  define LL_MAX_HEADER 128
 # else
@@ -263,6 +264,17 @@ struct netdev_hw_addr_list {
         int                     count;
 };
 
+#define netdev_uc_count(dev) ((dev)->uc.count)
+#define netdev_uc_empty(dev) ((dev)->uc.count == 0)
+#define netdev_for_each_uc_addr(ha, dev) \
+        list_for_each_entry(ha, &dev->uc.list, list)
+
+#define netdev_mc_count(dev) ((dev)->mc_count)
+#define netdev_mc_empty(dev) (netdev_mc_count(dev) == 0)
+
+#define netdev_for_each_mc_addr(mclist, dev) \
+        for (mclist = dev->mc_list; mclist; mclist = mclist->next)
+
 struct hh_cache {
         struct hh_cache *hh_next;       /* Next entry                        */
         atomic_t        hh_refcnt;      /* number of users                   */
@@ -610,6 +622,13 @@ struct netdev_queue {
  *      this function is called when a VLAN id is unregistered.
  *
  * void (*ndo_poll_controller)(struct net_device *dev);
+ *
+ *      SR-IOV management functions.
+ * int (*ndo_set_vf_mac)(struct net_device *dev, int vf, u8* mac);
+ * int (*ndo_set_vf_vlan)(struct net_device *dev, int vf, u16 vlan, u8 qos);
+ * int (*ndo_set_vf_tx_rate)(struct net_device *dev, int vf, int rate);
+ * int (*ndo_get_vf_config)(struct net_device *dev,
+ *                          int vf, struct ifla_vf_info *ivf);
  */
 #define HAVE_NET_DEVICE_OPS
 struct net_device_ops {
@@ -621,30 +640,21 @@ struct net_device_ops {
                                                    struct net_device *dev);
         u16                     (*ndo_select_queue)(struct net_device *dev,
                                                     struct sk_buff *skb);
-#define HAVE_CHANGE_RX_FLAGS
         void                    (*ndo_change_rx_flags)(struct net_device *dev,
                                                        int flags);
-#define HAVE_SET_RX_MODE
         void                    (*ndo_set_rx_mode)(struct net_device *dev);
-#define HAVE_MULTICAST
         void                    (*ndo_set_multicast_list)(struct net_device *dev);
-#define HAVE_SET_MAC_ADDR
         int                     (*ndo_set_mac_address)(struct net_device *dev,
                                                        void *addr);
-#define HAVE_VALIDATE_ADDR
         int                     (*ndo_validate_addr)(struct net_device *dev);
-#define HAVE_PRIVATE_IOCTL
         int                     (*ndo_do_ioctl)(struct net_device *dev,
                                                 struct ifreq *ifr, int cmd);
-#define HAVE_SET_CONFIG
         int                     (*ndo_set_config)(struct net_device *dev,
                                                   struct ifmap *map);
-#define HAVE_CHANGE_MTU
         int                     (*ndo_change_mtu)(struct net_device *dev,
                                                   int new_mtu);
         int                     (*ndo_neigh_setup)(struct net_device *dev,
                                                    struct neigh_parms *);
-#define HAVE_TX_TIMEOUT
         void                    (*ndo_tx_timeout) (struct net_device *dev);
 
         struct net_device_stats* (*ndo_get_stats)(struct net_device *dev);
@@ -656,9 +666,17 @@ struct net_device_ops {
         void                    (*ndo_vlan_rx_kill_vid)(struct net_device *dev,
                                                         unsigned short vid);
 #ifdef CONFIG_NET_POLL_CONTROLLER
-#define HAVE_NETDEV_POLL
         void                    (*ndo_poll_controller)(struct net_device *dev);
 #endif
+        int                     (*ndo_set_vf_mac)(struct net_device *dev,
+                                                  int queue, u8 *mac);
+        int                     (*ndo_set_vf_vlan)(struct net_device *dev,
+                                                   int queue, u16 vlan, u8 qos);
+        int                     (*ndo_set_vf_tx_rate)(struct net_device *dev,
+                                                      int vf, int rate);
+        int                     (*ndo_get_vf_config)(struct net_device *dev,
+                                                     int vf,
+                                                     struct ifla_vf_info *ivf);
 #if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
         int                     (*ndo_fcoe_enable)(struct net_device *dev);
         int                     (*ndo_fcoe_disable)(struct net_device *dev);
@@ -745,6 +763,7 @@ struct net_device {
 #define NETIF_F_FCOE_CRC        (1 << 24) /* FCoE CRC32 */
 #define NETIF_F_SCTP_CSUM       (1 << 25) /* SCTP checksum offload */
 #define NETIF_F_FCOE_MTU        (1 << 26) /* Supports max FCoE MTU, 2158 bytes*/
+#define NETIF_F_NTUPLE          (1 << 27) /* N-tuple filters supported */
 
         /* Segmentation offload features */
 #define NETIF_F_GSO_SHIFT       16
@@ -905,7 +924,12 @@ struct net_device {
                NETREG_UNREGISTERED,     /* completed unregister todo */
                NETREG_RELEASED,         /* called free_netdev */
                NETREG_DUMMY,            /* dummy device for NAPI poll */
-        } reg_state;
+        } reg_state:16;
+
+        enum {
+                RTNL_LINK_INITIALIZED,
+                RTNL_LINK_INITIALIZING,
+        } rtnl_link_state:16;
 
         /* Called from unregister, can be used to call free_netdev */
         void (*destructor)(struct net_device *dev);
@@ -953,6 +977,8 @@ struct net_device {
         /* max exchange id for FCoE LRO by ddp */
         unsigned int            fcoe_ddp_xid;
 #endif
+        /* n-tuple filter list attached to this device */
+        struct ethtool_rx_ntuple_list ethtool_ntuple_list;
 };
 #define to_net_dev(d) container_of(d, struct net_device, dev)
 
@@ -1009,6 +1035,15 @@ static inline bool netdev_uses_dsa_tags(struct net_device *dev)
         return 0;
 }
 
+#ifndef CONFIG_NET_NS
+static inline void skb_set_dev(struct sk_buff *skb, struct net_device *dev)
+{
+        skb->dev = dev;
+}
+#else /* CONFIG_NET_NS */
+void skb_set_dev(struct sk_buff *skb, struct net_device *dev);
+#endif
+
 static inline bool netdev_uses_trailer_tags(struct net_device *dev)
 {
 #ifdef CONFIG_NET_DSA_TAG_TRAILER
@@ -1527,7 +1562,6 @@ extern int		netif_rx(struct sk_buff *skb);
 extern int              netif_rx_ni(struct sk_buff *skb);
 #define HAVE_NETIF_RECEIVE_SKB 1
 extern int              netif_receive_skb(struct sk_buff *skb);
-extern void             napi_gro_flush(struct napi_struct *napi);
 extern gro_result_t     dev_gro_receive(struct napi_struct *napi,
                                         struct sk_buff *skb);
 extern gro_result_t     napi_skb_finish(gro_result_t ret, struct sk_buff *skb);
@@ -1553,7 +1587,9 @@ extern int		dev_valid_name(const char *name);
 extern int              dev_ioctl(struct net *net, unsigned int cmd, void __user *);
 extern int              dev_ethtool(struct net *net, struct ifreq *);
 extern unsigned         dev_get_flags(const struct net_device *);
+extern int              __dev_change_flags(struct net_device *, unsigned int flags);
 extern int              dev_change_flags(struct net_device *, unsigned);
+extern void             __dev_notify_flags(struct net_device *, unsigned int old_flags);
 extern int              dev_change_name(struct net_device *, const char *);
 extern int              dev_set_alias(struct net_device *, const char *, size_t);
 extern int              dev_change_net_namespace(struct net_device *,
@@ -2083,6 +2119,130 @@ static inline u32 dev_ethtool_get_flags(struct net_device *dev)
                 return 0;
         return dev->ethtool_ops->get_flags(dev);
 }
+
+/* Logging, debugging and troubleshooting/diagnostic helpers. */
+
+/* netdev_printk helpers, similar to dev_printk */
+
+static inline const char *netdev_name(const struct net_device *dev)
+{
+        if (dev->reg_state != NETREG_REGISTERED)
+                return "(unregistered net_device)";
+        return dev->name;
+}
+
+#define netdev_printk(level, netdev, format, args...)           \
+        dev_printk(level, (netdev)->dev.parent,                 \
+                   "%s: " format,                               \
+                   netdev_name(netdev), ##args)
+
+#define netdev_emerg(dev, format, args...)                      \
+        netdev_printk(KERN_EMERG, dev, format, ##args)
+#define netdev_alert(dev, format, args...)                      \
+        netdev_printk(KERN_ALERT, dev, format, ##args)
+#define netdev_crit(dev, format, args...)                       \
+        netdev_printk(KERN_CRIT, dev, format, ##args)
+#define netdev_err(dev, format, args...)                        \
+        netdev_printk(KERN_ERR, dev, format, ##args)
+#define netdev_warn(dev, format, args...)                       \
+        netdev_printk(KERN_WARNING, dev, format, ##args)
+#define netdev_notice(dev, format, args...)                     \
+        netdev_printk(KERN_NOTICE, dev, format, ##args)
+#define netdev_info(dev, format, args...)                       \
+        netdev_printk(KERN_INFO, dev, format, ##args)
+
+#if defined(DEBUG)
+#define netdev_dbg(__dev, format, args...)                      \
+        netdev_printk(KERN_DEBUG, __dev, format, ##args)
+#elif defined(CONFIG_DYNAMIC_DEBUG)
+#define netdev_dbg(__dev, format, args...)                      \
+do {                                                            \
+        dynamic_dev_dbg((__dev)->dev.parent, "%s: " format,     \
+                        netdev_name(__dev), ##args);            \
+} while (0)
+#else
+#define netdev_dbg(__dev, format, args...)                      \
+({                                                              \
+        if (0)                                                  \
+                netdev_printk(KERN_DEBUG, __dev, format, ##args); \
+        0;                                                      \
+})
+#endif
+
+#if defined(VERBOSE_DEBUG)
+#define netdev_vdbg     netdev_dbg
+#else
+
+#define netdev_vdbg(dev, format, args...)                       \
+({                                                              \
+        if (0)                                                  \
+                netdev_printk(KERN_DEBUG, dev, format, ##args); \
+        0;                                                      \
+})
+#endif
+
+/*
+ * netdev_WARN() acts like dev_printk(), but with the key difference
+ * of using a WARN/WARN_ON to get the message out, including the
+ * file/line information and a backtrace.
+ */
+#define netdev_WARN(dev, format, args...)                       \
+        WARN(1, "netdevice: %s\n" format, netdev_name(dev), ##args);
+
+/* netif printk helpers, similar to netdev_printk */
+
+#define netif_printk(priv, type, level, dev, fmt, args...)      \
+do {                                                            \
+        if (netif_msg_##type(priv))                             \
+                netdev_printk(level, (dev), fmt, ##args);       \
+} while (0)
+
+#define netif_emerg(priv, type, dev, fmt, args...)              \
+        netif_printk(priv, type, KERN_EMERG, dev, fmt, ##args)
+#define netif_alert(priv, type, dev, fmt, args...)              \
+        netif_printk(priv, type, KERN_ALERT, dev, fmt, ##args)
+#define netif_crit(priv, type, dev, fmt, args...)               \
+        netif_printk(priv, type, KERN_CRIT, dev, fmt, ##args)
+#define netif_err(priv, type, dev, fmt, args...)                \
+        netif_printk(priv, type, KERN_ERR, dev, fmt, ##args)
+#define netif_warn(priv, type, dev, fmt, args...)               \
+        netif_printk(priv, type, KERN_WARNING, dev, fmt, ##args)
+#define netif_notice(priv, type, dev, fmt, args...)             \
+        netif_printk(priv, type, KERN_NOTICE, dev, fmt, ##args)
+#define netif_info(priv, type, dev, fmt, args...)               \
+        netif_printk(priv, type, KERN_INFO, (dev), fmt, ##args)
+
+#if defined(DEBUG)
+#define netif_dbg(priv, type, dev, format, args...)             \
+        netif_printk(priv, type, KERN_DEBUG, dev, format, ##args)
+#elif defined(CONFIG_DYNAMIC_DEBUG)
+#define netif_dbg(priv, type, netdev, format, args...)          \
+do {                                                            \
+        if (netif_msg_##type(priv))                             \
+                dynamic_dev_dbg((netdev)->dev.parent,           \
+                                "%s: " format,                  \
+                                netdev_name(netdev), ##args);   \
+} while (0)
+#else
+#define netif_dbg(priv, type, dev, format, args...)                     \
+({                                                                      \
+        if (0)                                                          \
+                netif_printk(priv, type, KERN_DEBUG, dev, format, ##args); \
+        0;                                                              \
+})
+#endif
+
+#if defined(VERBOSE_DEBUG)
+#define netif_vdbg      netdev_dbg
+#else
+#define netif_vdbg(priv, type, dev, format, args...)            \
+({                                                              \
+        if (0)                                                  \
+                netif_printk(KERN_DEBUG, dev, format, ##args);  \
+        0;                                                      \
+})
+#endif
+
 #endif /* __KERNEL__ */
 
 #endif  /* _LINUX_NETDEVICE_H */
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 48c54960773c..89341c32631a 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -114,15 +114,17 @@ struct nf_sockopt_ops {
         int set_optmin;
         int set_optmax;
         int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
+#ifdef CONFIG_COMPAT
         int (*compat_set)(struct sock *sk, int optval,
                         void __user *user, unsigned int len);
-
+#endif
         int get_optmin;
         int get_optmax;
         int (*get)(struct sock *sk, int optval, void __user *user, int *len);
+#ifdef CONFIG_COMPAT
         int (*compat_get)(struct sock *sk, int optval,
                         void __user *user, int *len);
-
+#endif
         /* Use the module struct to lock set/get code in place */
         struct module *owner;
 };
@@ -161,11 +163,8 @@ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
                                  struct sk_buff *skb,
                                  struct net_device *indev,
                                  struct net_device *outdev,
-                                 int (*okfn)(struct sk_buff *), int thresh,
-                                 int cond)
+                                 int (*okfn)(struct sk_buff *), int thresh)
 {
-        if (!cond)
-                return 1;
 #ifndef CONFIG_NETFILTER_DEBUG
         if (list_empty(&nf_hooks[pf][hook]))
                 return 1;
@@ -177,7 +176,7 @@ static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
                           struct net_device *indev, struct net_device *outdev,
                           int (*okfn)(struct sk_buff *))
 {
-        return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN, 1);
+        return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN);
 }
                    
 /* Activate hook; either okfn or kfree_skb called, unless a hook
@@ -197,36 +196,49 @@ static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
    coders :)
 */
 
-/* This is gross, but inline doesn't cut it for avoiding the function
-   call in fast path: gcc doesn't inline (needs value tracking?). --RR */
-
-/* HX: It's slightly less gross now. */
+static inline int
+NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct sk_buff *skb,
+               struct net_device *in, struct net_device *out,
+               int (*okfn)(struct sk_buff *), int thresh)
+{
+        int ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, thresh);
+        if (ret == 1)
+                ret = okfn(skb);
+        return ret;
+}
 
-#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)             \
-({int __ret;                                                                   \
-if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, thresh, 1)) == 1)\
-        __ret = (okfn)(skb);                                                   \
-__ret;})
+static inline int
+NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sk_buff *skb,
+             struct net_device *in, struct net_device *out,
+             int (*okfn)(struct sk_buff *), bool cond)
+{
+        int ret;
 
-#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond)                 \
-({int __ret;                                                                   \
-if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
-        __ret = (okfn)(skb);                                                   \
-__ret;})
+        if (!cond ||
+            (ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN) == 1))
+                ret = okfn(skb);
+        return ret;
+}
 
-#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
-        NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, INT_MIN)
+static inline int
+NF_HOOK(uint8_t pf, unsigned int hook, struct sk_buff *skb,
+        struct net_device *in, struct net_device *out,
+        int (*okfn)(struct sk_buff *))
+{
+        return NF_HOOK_THRESH(pf, hook, skb, in, out, okfn, INT_MIN);
+}
 
 /* Call setsockopt() */
 int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
                   unsigned int len);
 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
                   int *len);
-
+#ifdef CONFIG_COMPAT
 int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval,
                 char __user *opt, unsigned int len);
 int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval,
                 char __user *opt, int *len);
+#endif
 
 /* Call this before modifying an existing packet: ensures it is
    modifiable and linear to the point you care about (writable_len).
@@ -325,8 +337,7 @@ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
                                  struct sk_buff *skb,
                                  struct net_device *indev,
                                  struct net_device *outdev,
-                                 int (*okfn)(struct sk_buff *), int thresh,
-                                 int cond)
+                                 int (*okfn)(struct sk_buff *), int thresh)
 {
         return okfn(skb);
 }
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index 2aea50399c0b..a5a63e41b8af 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -6,6 +6,7 @@ header-y += nfnetlink_queue.h
 header-y += xt_CLASSIFY.h
 header-y += xt_CONNMARK.h
 header-y += xt_CONNSECMARK.h
+header-y += xt_CT.h
 header-y += xt_DSCP.h
 header-y += xt_LED.h
 header-y += xt_MARK.h
diff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h
index a374787ed9b0..c608677dda60 100644
--- a/include/linux/netfilter/nf_conntrack_common.h
+++ b/include/linux/netfilter/nf_conntrack_common.h
@@ -72,6 +72,28 @@ enum ip_conntrack_status {
         /* Connection has fixed timeout. */
         IPS_FIXED_TIMEOUT_BIT = 10,
         IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
+
+        /* Conntrack is a template */
+        IPS_TEMPLATE_BIT = 11,
+        IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
+};
+
+/* Connection tracking event types */
+enum ip_conntrack_events {
+        IPCT_NEW,               /* new conntrack */
+        IPCT_RELATED,           /* related conntrack */
+        IPCT_DESTROY,           /* destroyed conntrack */
+        IPCT_REPLY,             /* connection has seen two-way traffic */
+        IPCT_ASSURED,           /* connection status has changed to assured */
+        IPCT_PROTOINFO,         /* protocol information has changed */
+        IPCT_HELPER,            /* new helper has been set */
+        IPCT_MARK,              /* new mark has been set */
+        IPCT_NATSEQADJ,         /* NAT is doing sequence adjustment */
+        IPCT_SECMARK,           /* new security mark has been set */
+};
+
+enum ip_conntrack_expect_events {
+        IPEXP_NEW,              /* new expectation */
 };
 
 #ifdef __KERNEL__
diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h
index 23aa2ec6b7b7..ff8cfbcf3b81 100644
--- a/include/linux/netfilter/nf_conntrack_sip.h
+++ b/include/linux/netfilter/nf_conntrack_sip.h
@@ -14,6 +14,7 @@ enum sip_expectation_classes {
         SIP_EXPECT_SIGNALLING,
         SIP_EXPECT_AUDIO,
         SIP_EXPECT_VIDEO,
+        SIP_EXPECT_IMAGE,
         __SIP_EXPECT_MAX
 };
 #define SIP_EXPECT_MAX  (__SIP_EXPECT_MAX - 1)
@@ -34,10 +35,10 @@ struct sdp_media_type {
 struct sip_handler {
         const char      *method;
         unsigned int    len;
-        int             (*request)(struct sk_buff *skb,
+        int             (*request)(struct sk_buff *skb, unsigned int dataoff,
                                    const char **dptr, unsigned int *datalen,
                                    unsigned int cseq);
-        int             (*response)(struct sk_buff *skb,
+        int             (*response)(struct sk_buff *skb, unsigned int dataoff,
                                     const char **dptr, unsigned int *datalen,
                                     unsigned int cseq, unsigned int code);
 };
@@ -84,7 +85,8 @@ enum sip_header_types {
         SIP_HDR_FROM,
         SIP_HDR_TO,
         SIP_HDR_CONTACT,
-        SIP_HDR_VIA,
+        SIP_HDR_VIA_UDP,
+        SIP_HDR_VIA_TCP,
         SIP_HDR_EXPIRES,
         SIP_HDR_CONTENT_LENGTH,
 };
@@ -100,33 +102,40 @@ enum sdp_header_types {
 };
 
 extern unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb,
+                                       unsigned int dataoff,
                                        const char **dptr,
                                        unsigned int *datalen);
+extern void (*nf_nat_sip_seq_adjust_hook)(struct sk_buff *skb, s16 off);
 extern unsigned int (*nf_nat_sip_expect_hook)(struct sk_buff *skb,
+                                              unsigned int dataoff,
                                               const char **dptr,
                                               unsigned int *datalen,
                                               struct nf_conntrack_expect *exp,
                                               unsigned int matchoff,
                                               unsigned int matchlen);
 extern unsigned int (*nf_nat_sdp_addr_hook)(struct sk_buff *skb,
-                                            const char **dptr,
                                             unsigned int dataoff,
+                                            const char **dptr,
                                             unsigned int *datalen,
+                                            unsigned int sdpoff,
                                             enum sdp_header_types type,
                                             enum sdp_header_types term,
                                             const union nf_inet_addr *addr);
 extern unsigned int (*nf_nat_sdp_port_hook)(struct sk_buff *skb,
+                                            unsigned int dataoff,
                                             const char **dptr,
                                             unsigned int *datalen,
                                             unsigned int matchoff,
                                             unsigned int matchlen,
                                             u_int16_t port);
 extern unsigned int (*nf_nat_sdp_session_hook)(struct sk_buff *skb,
-                                               const char **dptr,
                                                unsigned int dataoff,
+                                               const char **dptr,
                                                unsigned int *datalen,
+                                               unsigned int sdpoff,
                                                const union nf_inet_addr *addr);
 extern unsigned int (*nf_nat_sdp_media_hook)(struct sk_buff *skb,
+                                             unsigned int dataoff,
                                              const char **dptr,
                                              unsigned int *datalen,
                                              struct nf_conntrack_expect *rtp_exp,
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index 49d321f3ccd2..53923868c9bd 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -73,11 +73,11 @@ struct nfnetlink_subsystem {
 extern int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n);
 extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
 
-extern int nfnetlink_has_listeners(unsigned int group);
-extern int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, 
+extern int nfnetlink_has_listeners(struct net *net, unsigned int group);
+extern int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned group,
                           int echo, gfp_t flags);
-extern void nfnetlink_set_err(u32 pid, u32 group, int error);
-extern int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags);
+extern void nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);
+extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags);
 
 extern void nfnl_lock(void);
 extern void nfnl_unlock(void);
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h
index ed4ef8d0b11b..9ed534c991b9 100644
--- a/include/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/linux/netfilter/nfnetlink_conntrack.h
@@ -40,6 +40,7 @@ enum ctattr_type {
         CTA_NAT_SEQ_ADJ_ORIG,
         CTA_NAT_SEQ_ADJ_REPLY,
         CTA_SECMARK,
+        CTA_ZONE,
         __CTA_MAX
 };
 #define CTA_MAX (__CTA_MAX - 1)
@@ -159,6 +160,7 @@ enum ctattr_expect {
         CTA_EXPECT_TIMEOUT,
         CTA_EXPECT_ID,
         CTA_EXPECT_HELP_NAME,
+        CTA_EXPECT_ZONE,
         __CTA_EXPECT_MAX
 };
 #define CTA_EXPECT_MAX (__CTA_EXPECT_MAX - 1)
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 378f27ae7772..84c7c928e9eb 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -93,8 +93,7 @@ struct _xt_align {
         __u64 u64;
 };
 
-#define XT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1))  \
-                        & ~(__alignof__(struct _xt_align)-1))
+#define XT_ALIGN(s) ALIGN((s), __alignof__(struct _xt_align))
 
 /* Standard return verdict, or do jump. */
 #define XT_STANDARD_TARGET ""
@@ -121,6 +120,7 @@ struct xt_counters_info {
 
 #define XT_INV_PROTO            0x40    /* Invert the sense of PROTO. */
 
+#ifndef __KERNEL__
 /* fn returns 0 to continue iteration */
 #define XT_MATCH_ITERATE(type, e, fn, args...)                  \
 ({                                                              \
@@ -164,6 +164,22 @@ struct xt_counters_info {
 #define XT_ENTRY_ITERATE(type, entries, size, fn, args...) \
         XT_ENTRY_ITERATE_CONTINUE(type, entries, size, 0, fn, args)
 
+#endif /* !__KERNEL__ */
+
+/* pos is normally a struct ipt_entry/ip6t_entry/etc. */
+#define xt_entry_foreach(pos, ehead, esize) \
+        for ((pos) = (typeof(pos))(ehead); \
+             (pos) < (typeof(pos))((char *)(ehead) + (esize)); \
+             (pos) = (typeof(pos))((char *)(pos) + (pos)->next_offset))
+
+/* can only be xt_entry_match, so no use of typeof here */
+#define xt_ematch_foreach(pos, entry) \
+        for ((pos) = (struct xt_entry_match *)entry->elems; \
+             (pos) < (struct xt_entry_match *)((char *)(entry) + \
+                     (entry)->target_offset); \
+             (pos) = (struct xt_entry_match *)((char *)(pos) + \
+                     (pos)->u.match_size))
+
 #ifdef __KERNEL__
 
 #include <linux/netdevice.h>
@@ -205,6 +221,7 @@ struct xt_match_param {
  * @hook_mask:  via which hooks the new rule is reachable
  */
 struct xt_mtchk_param {
+        struct net *net;
         const char *table;
         const void *entryinfo;
         const struct xt_match *match;
@@ -215,6 +232,7 @@ struct xt_mtchk_param {
 
 /* Match destructor parameters */
 struct xt_mtdtor_param {
+        struct net *net;
         const struct xt_match *match;
         void *matchinfo;
         u_int8_t family;
@@ -247,6 +265,7 @@ struct xt_target_param {
  * Other fields see above.
  */
 struct xt_tgchk_param {
+        struct net *net;
         const char *table;
         const void *entryinfo;
         const struct xt_target *target;
@@ -257,6 +276,7 @@ struct xt_tgchk_param {
 
 /* Target destructor parameters */
 struct xt_tgdtor_param {
+        struct net *net;
         const struct xt_target *target;
         void *targinfo;
         u_int8_t family;
@@ -281,11 +301,11 @@ struct xt_match {
 
         /* Called when entry of this type deleted. */
         void (*destroy)(const struct xt_mtdtor_param *);
-
+#ifdef CONFIG_COMPAT
         /* Called when userspace align differs from kernel space one */
-        void (*compat_from_user)(void *dst, void *src);
-        int (*compat_to_user)(void __user *dst, void *src);
-
+        void (*compat_from_user)(void *dst, const void *src);
+        int (*compat_to_user)(void __user *dst, const void *src);
+#endif
         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
         struct module *me;
 
@@ -294,7 +314,9 @@ struct xt_match {
 
         const char *table;
         unsigned int matchsize;
+#ifdef CONFIG_COMPAT
         unsigned int compatsize;
+#endif
         unsigned int hooks;
         unsigned short proto;
 
@@ -321,17 +343,19 @@ struct xt_target {
 
         /* Called when entry of this type deleted. */
         void (*destroy)(const struct xt_tgdtor_param *);
-
+#ifdef CONFIG_COMPAT
         /* Called when userspace align differs from kernel space one */
-        void (*compat_from_user)(void *dst, void *src);
-        int (*compat_to_user)(void __user *dst, void *src);
-
+        void (*compat_from_user)(void *dst, const void *src);
+        int (*compat_to_user)(void __user *dst, const void *src);
+#endif
         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
         struct module *me;
 
         const char *table;
         unsigned int targetsize;
+#ifdef CONFIG_COMPAT
         unsigned int compatsize;
+#endif
         unsigned int hooks;
         unsigned short proto;
 
@@ -353,6 +377,7 @@ struct xt_table {
         struct module *me;
 
         u_int8_t af;            /* address/protocol family */
+        int priority;           /* hook order */
 
         /* A unique name... */
         const char name[XT_TABLE_MAXNAMELEN];
@@ -514,6 +539,9 @@ static inline unsigned long ifname_compare_aligned(const char *_a,
         return ret;
 }
 
+extern struct nf_hook_ops *xt_hook_link(const struct xt_table *, nf_hookfn *);
+extern void xt_hook_unlink(const struct xt_table *, struct nf_hook_ops *);
+
 #ifdef CONFIG_COMPAT
 #include <net/compat.h>
 
@@ -554,11 +582,7 @@ struct compat_xt_entry_target {
  * current task alignment */
 
 struct compat_xt_counters {
-#if defined(CONFIG_X86_64) || defined(CONFIG_IA64)
-        u_int32_t cnt[4];
-#else
-        u_int64_t cnt[2];
-#endif
+        compat_u64 pcnt, bcnt;                  /* Packet and byte counters */
 };
 
 struct compat_xt_counters_info {
@@ -567,26 +591,32 @@ struct compat_xt_counters_info {
         struct compat_xt_counters counters[0];
 };
 
-#define COMPAT_XT_ALIGN(s) (((s) + (__alignof__(struct compat_xt_counters)-1)) \
-                & ~(__alignof__(struct compat_xt_counters)-1))
+struct _compat_xt_align {
+        __u8 u8;
+        __u16 u16;
+        __u32 u32;
+        compat_u64 u64;
+};
+
+#define COMPAT_XT_ALIGN(s) ALIGN((s), __alignof__(struct _compat_xt_align))
 
 extern void xt_compat_lock(u_int8_t af);
 extern void xt_compat_unlock(u_int8_t af);
 
 extern int xt_compat_add_offset(u_int8_t af, unsigned int offset, short delta);
 extern void xt_compat_flush_offsets(u_int8_t af);
-extern short xt_compat_calc_jump(u_int8_t af, unsigned int offset);
+extern int xt_compat_calc_jump(u_int8_t af, unsigned int offset);
 
 extern int xt_compat_match_offset(const struct xt_match *match);
 extern int xt_compat_match_from_user(struct xt_entry_match *m,
                                      void **dstptr, unsigned int *size);
-extern int xt_compat_match_to_user(struct xt_entry_match *m,
+extern int xt_compat_match_to_user(const struct xt_entry_match *m,
                                    void __user **dstptr, unsigned int *size);
 
 extern int xt_compat_target_offset(const struct xt_target *target);
 extern void xt_compat_target_from_user(struct xt_entry_target *t,
                                        void **dstptr, unsigned int *size);
-extern int xt_compat_target_to_user(struct xt_entry_target *t,
+extern int xt_compat_target_to_user(const struct xt_entry_target *t,
                                     void __user **dstptr, unsigned int *size);
 
 #endif /* CONFIG_COMPAT */
diff --git a/include/linux/netfilter/xt_CT.h b/include/linux/netfilter/xt_CT.h
new file mode 100644
index 000000000000..1b564106891d
--- /dev/null
+++ b/include/linux/netfilter/xt_CT.h
@@ -0,0 +1,17 @@
+#ifndef _XT_CT_H
+#define _XT_CT_H
+
+#define XT_CT_NOTRACK   0x1
+
+struct xt_ct_target_info {
+        u_int16_t       flags;
+        u_int16_t       zone;
+        u_int32_t       ct_events;
+        u_int32_t       exp_events;
+        char            helper[16];
+
+        /* Used internally by the kernel */
+        struct nf_conn  *ct __attribute__((aligned(8)));
+};
+
+#endif /* _XT_CT_H */
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index f2336523a9df..e9948c0560f6 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -211,9 +211,11 @@ static __inline__ struct arpt_entry_target *arpt_get_target(struct arpt_entry *e
         return (void *)e + e->target_offset;
 }
 
+#ifndef __KERNEL__
 /* fn returns 0 to continue iteration */
 #define ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
         XT_ENTRY_ITERATE(struct arpt_entry, entries, size, fn, ## args)
+#endif
 
 /*
  *      Main firewall chains definitions and global var's definitions.
@@ -258,6 +260,7 @@ struct arpt_error {
         .target.errorname = "ERROR",                                           \
 }
 
+extern void *arpt_alloc_initial_table(const struct xt_table *);
 extern struct xt_table *arpt_register_table(struct net *net,
                                             const struct xt_table *table,
                                             const struct arpt_replace *repl);
@@ -290,14 +293,6 @@ compat_arpt_get_target(struct compat_arpt_entry *e)
 
 #define COMPAT_ARPT_ALIGN(s)    COMPAT_XT_ALIGN(s)
 
-/* fn returns 0 to continue iteration */
-#define COMPAT_ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
-        XT_ENTRY_ITERATE(struct compat_arpt_entry, entries, size, fn, ## args)
-
-#define COMPAT_ARPT_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
-        XT_ENTRY_ITERATE_CONTINUE(struct compat_arpt_entry, entries, size, n, \
-                                  fn, ## args)
-
 #endif /* CONFIG_COMPAT */
 #endif /*__KERNEL__*/
 #endif /* _ARPTABLES_H */
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 3cc40c131cc3..1c6f0c5f530e 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -289,7 +289,7 @@ struct ebt_table {
                      ~(__alignof__(struct ebt_replace)-1))
 extern struct ebt_table *ebt_register_table(struct net *net,
                                             const struct ebt_table *table);
-extern void ebt_unregister_table(struct ebt_table *table);
+extern void ebt_unregister_table(struct net *net, struct ebt_table *table);
 extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff *skb,
    const struct net_device *in, const struct net_device *out,
    struct ebt_table *table);
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index 27b3f5807305..704a7b6e8169 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -223,6 +223,7 @@ ipt_get_target(struct ipt_entry *e)
         return (void *)e + e->target_offset;
 }
 
+#ifndef __KERNEL__
 /* fn returns 0 to continue iteration */
 #define IPT_MATCH_ITERATE(e, fn, args...) \
         XT_MATCH_ITERATE(struct ipt_entry, e, fn, ## args)
@@ -230,6 +231,7 @@ ipt_get_target(struct ipt_entry *e)
 /* fn returns 0 to continue iteration */
 #define IPT_ENTRY_ITERATE(entries, size, fn, args...) \
         XT_ENTRY_ITERATE(struct ipt_entry, entries, size, fn, ## args)
+#endif
 
 /*
  *      Main firewall chains definitions and global var's definitions.
@@ -242,7 +244,7 @@ extern void ipt_init(void) __init;
 extern struct xt_table *ipt_register_table(struct net *net,
                                            const struct xt_table *table,
                                            const struct ipt_replace *repl);
-extern void ipt_unregister_table(struct xt_table *table);
+extern void ipt_unregister_table(struct net *net, struct xt_table *table);
 
 /* Standard entry. */
 struct ipt_standard {
@@ -282,6 +284,7 @@ struct ipt_error {
         .target.errorname = "ERROR",                                           \
 }
 
+extern void *ipt_alloc_initial_table(const struct xt_table *);
 extern unsigned int ipt_do_table(struct sk_buff *skb,
                                  unsigned int hook,
                                  const struct net_device *in,
@@ -312,19 +315,6 @@ compat_ipt_get_target(struct compat_ipt_entry *e)
 
 #define COMPAT_IPT_ALIGN(s)     COMPAT_XT_ALIGN(s)
 
-/* fn returns 0 to continue iteration */
-#define COMPAT_IPT_MATCH_ITERATE(e, fn, args...) \
-        XT_MATCH_ITERATE(struct compat_ipt_entry, e, fn, ## args)
-
-/* fn returns 0 to continue iteration */
-#define COMPAT_IPT_ENTRY_ITERATE(entries, size, fn, args...) \
-        XT_ENTRY_ITERATE(struct compat_ipt_entry, entries, size, fn, ## args)
-
-/* fn returns 0 to continue iteration */
-#define COMPAT_IPT_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
-        XT_ENTRY_ITERATE_CONTINUE(struct compat_ipt_entry, entries, size, n, \
-                                  fn, ## args)
-
 #endif /* CONFIG_COMPAT */
 #endif /*__KERNEL__*/
 #endif /* _IPTABLES_H */
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index b31050d20ae4..e5ba03d783c6 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -280,6 +280,7 @@ ip6t_get_target(struct ip6t_entry *e)
         return (void *)e + e->target_offset;
 }
 
+#ifndef __KERNEL__
 /* fn returns 0 to continue iteration */
 #define IP6T_MATCH_ITERATE(e, fn, args...) \
         XT_MATCH_ITERATE(struct ip6t_entry, e, fn, ## args)
@@ -287,6 +288,7 @@ ip6t_get_target(struct ip6t_entry *e)
 /* fn returns 0 to continue iteration */
 #define IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
         XT_ENTRY_ITERATE(struct ip6t_entry, entries, size, fn, ## args)
+#endif
 
 /*
  *      Main firewall chains definitions and global var's definitions.
@@ -297,10 +299,11 @@ ip6t_get_target(struct ip6t_entry *e)
 #include <linux/init.h>
 extern void ip6t_init(void) __init;
 
+extern void *ip6t_alloc_initial_table(const struct xt_table *);
 extern struct xt_table *ip6t_register_table(struct net *net,
                                             const struct xt_table *table,
                                             const struct ip6t_replace *repl);
-extern void ip6t_unregister_table(struct xt_table *table);
+extern void ip6t_unregister_table(struct net *net, struct xt_table *table);
 extern unsigned int ip6t_do_table(struct sk_buff *skb,
                                   unsigned int hook,
                                   const struct net_device *in,
@@ -340,18 +343,6 @@ compat_ip6t_get_target(struct compat_ip6t_entry *e)
 
 #define COMPAT_IP6T_ALIGN(s)    COMPAT_XT_ALIGN(s)
 
-/* fn returns 0 to continue iteration */
-#define COMPAT_IP6T_MATCH_ITERATE(e, fn, args...) \
-        XT_MATCH_ITERATE(struct compat_ip6t_entry, e, fn, ## args)
-
-/* fn returns 0 to continue iteration */
-#define COMPAT_IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
-        XT_ENTRY_ITERATE(struct compat_ip6t_entry, entries, size, fn, ## args)
-
-#define COMPAT_IP6T_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
-        XT_ENTRY_ITERATE_CONTINUE(struct compat_ip6t_entry, entries, size, n, \
-                                  fn, ## args)
-
 #endif /* CONFIG_COMPAT */
 #endif /*__KERNEL__*/
 #endif /* _IP6_TABLES_H */
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index 2524267210d3..a765ea898549 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -21,15 +21,20 @@ struct netpoll {
         __be32 local_ip, remote_ip;
         u16 local_port, remote_port;
         u8 remote_mac[ETH_ALEN];
+
+        struct list_head rx; /* rx_np list element */
 };
 
 struct netpoll_info {
         atomic_t refcnt;
+
         int rx_flags;
         spinlock_t rx_lock;
-        struct netpoll *rx_np; /* netpoll that registered an rx_hook */
+        struct list_head rx_np; /* netpolls that registered an rx_hook */
+
         struct sk_buff_head arp_tx; /* list of arp requests to reply to */
         struct sk_buff_head txq;
+
         struct delayed_work tx_work;
 };
 
@@ -51,7 +56,7 @@ static inline int netpoll_rx(struct sk_buff *skb)
         unsigned long flags;
         int ret = 0;
 
-        if (!npinfo || (!npinfo->rx_np && !npinfo->rx_flags))
+        if (!npinfo || (list_empty(&npinfo->rx_np) && !npinfo->rx_flags))
                 return 0;
 
         spin_lock_irqsave(&npinfo->rx_lock, flags);
@@ -67,7 +72,7 @@ static inline int netpoll_rx_on(struct sk_buff *skb)
 {
         struct netpoll_info *npinfo = skb->dev->npinfo;
 
-        return npinfo && (npinfo->rx_np || npinfo->rx_flags);
+        return npinfo && (!list_empty(&npinfo->rx_np) || npinfo->rx_flags);
 }
 
 static inline int netpoll_receive_skb(struct sk_buff *skb)
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index da8ea2e19273..28ba20fda3e2 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -3,7 +3,7 @@
 /*
  * 802.11 netlink interface public header
  *
- * Copyright 2006, 2007, 2008 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2008 Michael Wu <flamingice@sourmilk.net>
  * Copyright 2008 Luis Carlos Cobo <luisca@cozybit.com>
  * Copyright 2008 Michael Buesch <mb@bu3sch.de>
@@ -270,6 +270,60 @@
  * @NL80211_CMD_SET_WIPHY_NETNS: Set a wiphy's netns. Note that all devices
  *      associated with this wiphy must be down and will follow.
  *
+ * @NL80211_CMD_REMAIN_ON_CHANNEL: Request to remain awake on the specified
+ *      channel for the specified amount of time. This can be used to do
+ *      off-channel operations like transmit a Public Action frame and wait for
+ *      a response while being associated to an AP on another channel.
+ *      %NL80211_ATTR_WIPHY or %NL80211_ATTR_IFINDEX is used to specify which
+ *      radio is used. %NL80211_ATTR_WIPHY_FREQ is used to specify the
+ *      frequency for the operation and %NL80211_ATTR_WIPHY_CHANNEL_TYPE may be
+ *      optionally used to specify additional channel parameters.
+ *      %NL80211_ATTR_DURATION is used to specify the duration in milliseconds
+ *      to remain on the channel. This command is also used as an event to
+ *      notify when the requested duration starts (it may take a while for the
+ *      driver to schedule this time due to other concurrent needs for the
+ *      radio).
+ *      When called, this operation returns a cookie (%NL80211_ATTR_COOKIE)
+ *      that will be included with any events pertaining to this request;
+ *      the cookie is also used to cancel the request.
+ * @NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL: This command can be used to cancel a
+ *      pending remain-on-channel duration if the desired operation has been
+ *      completed prior to expiration of the originally requested duration.
+ *      %NL80211_ATTR_WIPHY or %NL80211_ATTR_IFINDEX is used to specify the
+ *      radio. The %NL80211_ATTR_COOKIE attribute must be given as well to
+ *      uniquely identify the request.
+ *      This command is also used as an event to notify when a requested
+ *      remain-on-channel duration has expired.
+ *
+ * @NL80211_CMD_SET_TX_BITRATE_MASK: Set the mask of rates to be used in TX
+ *      rate selection. %NL80211_ATTR_IFINDEX is used to specify the interface
+ *      and @NL80211_ATTR_TX_RATES the set of allowed rates.
+ *
+ * @NL80211_CMD_REGISTER_ACTION: Register for receiving certain action frames
+ *      (via @NL80211_CMD_ACTION) for processing in userspace. This command
+ *      requires an interface index and a match attribute containing the first
+ *      few bytes of the frame that should match, e.g. a single byte for only
+ *      a category match or four bytes for vendor frames including the OUI.
+ *      The registration cannot be dropped, but is removed automatically
+ *      when the netlink socket is closed. Multiple registrations can be made.
+ * @NL80211_CMD_ACTION: Action frame TX request and RX notification. This
+ *      command is used both as a request to transmit an Action frame and as an
+ *      event indicating reception of an Action frame that was not processed in
+ *      kernel code, but is for us (i.e., which may need to be processed in a
+ *      user space application). %NL80211_ATTR_FRAME is used to specify the
+ *      frame contents (including header). %NL80211_ATTR_WIPHY_FREQ (and
+ *      optionally %NL80211_ATTR_WIPHY_CHANNEL_TYPE) is used to indicate on
+ *      which channel the frame is to be transmitted or was received. This
+ *      channel has to be the current channel (remain-on-channel or the
+ *      operational channel). When called, this operation returns a cookie
+ *      (%NL80211_ATTR_COOKIE) that will be included with the TX status event
+ *      pertaining to the TX request.
+ * @NL80211_CMD_ACTION_TX_STATUS: Report TX status of an Action frame
+ *      transmitted with %NL80211_CMD_ACTION. %NL80211_ATTR_COOKIE identifies
+ *      the TX command and %NL80211_ATTR_FRAME includes the contents of the
+ *      frame. %NL80211_ATTR_ACK flag is included if the recipient acknowledged
+ *      the frame.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -353,6 +407,18 @@ enum nl80211_commands {
         NL80211_CMD_DEL_PMKSA,
         NL80211_CMD_FLUSH_PMKSA,
 
+        NL80211_CMD_REMAIN_ON_CHANNEL,
+        NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
+
+        NL80211_CMD_SET_TX_BITRATE_MASK,
+
+        NL80211_CMD_REGISTER_ACTION,
+        NL80211_CMD_ACTION,
+        NL80211_CMD_ACTION_TX_STATUS,
+
+        NL80211_CMD_SET_POWER_SAVE,
+        NL80211_CMD_GET_POWER_SAVE,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -402,6 +468,8 @@ enum nl80211_commands {
  * @NL80211_ATTR_WIPHY_RTS_THRESHOLD: RTS threshold (TX frames with length
  *      larger than or equal to this use RTS/CTS handshake); allowed range:
  *      0..65536, disable with (u32)-1; dot11RTSThreshold; u32
+ * @NL80211_ATTR_WIPHY_COVERAGE_CLASS: Coverage Class as defined by IEEE 802.11
+ *      section 7.3.2.9; dot11CoverageClass; u8
  *
  * @NL80211_ATTR_IFINDEX: network interface index of the device to operate on
  * @NL80211_ATTR_IFNAME: network interface name
@@ -606,6 +674,23 @@ enum nl80211_commands {
  * @NL80211_ATTR_MAX_NUM_PMKIDS: maximum number of PMKIDs a firmware can
  *      cache, a wiphy attribute.
  *
+ * @NL80211_ATTR_DURATION: Duration of an operation in milliseconds, u32.
+ *
+ * @NL80211_ATTR_COOKIE: Generic 64-bit cookie to identify objects.
+ *
+ * @NL80211_ATTR_TX_RATES: Nested set of attributes
+ *      (enum nl80211_tx_rate_attributes) describing TX rates per band. The
+ *      enum nl80211_band value is used as the index (nla_type() of the nested
+ *      data. If a band is not included, it will be configured to allow all
+ *      rates based on negotiated supported rates information. This attribute
+ *      is used with %NL80211_CMD_SET_TX_BITRATE_MASK.
+ *
+ * @NL80211_ATTR_FRAME_MATCH: A binary attribute which typically must contain
+ *      at least one byte, currently used with @NL80211_CMD_REGISTER_ACTION.
+ *
+ * @NL80211_ATTR_ACK: Flag attribute indicating that the frame was
+ *      acknowledged by the recipient.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -743,6 +828,20 @@ enum nl80211_attrs {
         NL80211_ATTR_PMKID,
         NL80211_ATTR_MAX_NUM_PMKIDS,
 
+        NL80211_ATTR_DURATION,
+
+        NL80211_ATTR_COOKIE,
+
+        NL80211_ATTR_WIPHY_COVERAGE_CLASS,
+
+        NL80211_ATTR_TX_RATES,
+
+        NL80211_ATTR_FRAME_MATCH,
+
+        NL80211_ATTR_ACK,
+
+        NL80211_ATTR_PS_STATE,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1323,13 +1422,20 @@ enum nl80211_channel_type {
  * @NL80211_BSS_BEACON_INTERVAL: beacon interval of the (I)BSS (u16)
  * @NL80211_BSS_CAPABILITY: capability field (CPU order, u16)
  * @NL80211_BSS_INFORMATION_ELEMENTS: binary attribute containing the
- *      raw information elements from the probe response/beacon (bin)
+ *      raw information elements from the probe response/beacon (bin);
+ *      if the %NL80211_BSS_BEACON_IES attribute is present, the IEs here are
+ *      from a Probe Response frame; otherwise they are from a Beacon frame.
+ *      However, if the driver does not indicate the source of the IEs, these
+ *      IEs may be from either frame subtype.
  * @NL80211_BSS_SIGNAL_MBM: signal strength of probe response/beacon
  *      in mBm (100 * dBm) (s32)
  * @NL80211_BSS_SIGNAL_UNSPEC: signal strength of the probe response/beacon
  *      in unspecified units, scaled to 0..100 (u8)
  * @NL80211_BSS_STATUS: status, if this BSS is "used"
  * @NL80211_BSS_SEEN_MS_AGO: age of this BSS entry in ms
+ * @NL80211_BSS_BEACON_IES: binary attribute containing the raw information
+ *      elements from a Beacon frame (bin); not present if no Beacon frame has
+ *      yet been received
  * @__NL80211_BSS_AFTER_LAST: internal
  * @NL80211_BSS_MAX: highest BSS attribute
  */
@@ -1345,6 +1451,7 @@ enum nl80211_bss {
         NL80211_BSS_SIGNAL_UNSPEC,
         NL80211_BSS_STATUS,
         NL80211_BSS_SEEN_MS_AGO,
+        NL80211_BSS_BEACON_IES,
 
         /* keep last */
         __NL80211_BSS_AFTER_LAST,
@@ -1442,4 +1549,38 @@ enum nl80211_key_attributes {
         NL80211_KEY_MAX = __NL80211_KEY_AFTER_LAST - 1
 };
 
+/**
+ * enum nl80211_tx_rate_attributes - TX rate set attributes
+ * @__NL80211_TXRATE_INVALID: invalid
+ * @NL80211_TXRATE_LEGACY: Legacy (non-MCS) rates allowed for TX rate selection
+ *      in an array of rates as defined in IEEE 802.11 7.3.2.2 (u8 values with
+ *      1 = 500 kbps) but without the IE length restriction (at most
+ *      %NL80211_MAX_SUPP_RATES in a single array).
+ * @__NL80211_TXRATE_AFTER_LAST: internal
+ * @NL80211_TXRATE_MAX: highest TX rate attribute
+ */
+enum nl80211_tx_rate_attributes {
+        __NL80211_TXRATE_INVALID,
+        NL80211_TXRATE_LEGACY,
+
+        /* keep last */
+        __NL80211_TXRATE_AFTER_LAST,
+        NL80211_TXRATE_MAX = __NL80211_TXRATE_AFTER_LAST - 1
+};
+
+/**
+ * enum nl80211_band - Frequency band
+ * @NL80211_BAND_2GHZ - 2.4 GHz ISM band
+ * @NL80211_BAND_5GHZ - around 5 GHz band (4.9 - 5.7 GHz)
+ */
+enum nl80211_band {
+        NL80211_BAND_2GHZ,
+        NL80211_BAND_5GHZ,
+};
+
+enum nl80211_ps_state {
+        NL80211_PS_DISABLED,
+        NL80211_PS_ENABLED,
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 25813738c71a..ec95ebe629f1 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -662,6 +662,9 @@ extern void pci_remove_bus_device(struct pci_dev *dev);
 extern void pci_stop_bus_device(struct pci_dev *dev);
 void pci_setup_cardbus(struct pci_bus *bus);
 extern void pci_sort_breadthfirst(void);
+#define dev_is_pci(d) ((d)->bus == &pci_bus_type)
+#define dev_is_pf(d) ((dev_is_pci(d) ? to_pci_dev(d)->is_physfn : false))
+#define dev_num_vf(d) ((dev_is_pci(d) ? pci_num_vf(to_pci_dev(d)) : 0))
 
 /* Generic PCI functions exported to card drivers */
 
@@ -1195,6 +1198,9 @@ static inline struct pci_dev *pci_get_bus_and_slot(unsigned int bus,
                                                 unsigned int devfn)
 { return NULL; }
 
+#define dev_is_pci(d) (false)
+#define dev_is_pf(d) (false)
+#define dev_num_vf(d) (0)
 #endif /* CONFIG_PCI */
 
 /* Include architecture-dependent settings and functions */
@@ -1356,6 +1362,7 @@ void __iomem *pci_ioremap_bar(struct pci_dev *pdev, int bar);
 extern int pci_enable_sriov(struct pci_dev *dev, int nr_virtfn);
 extern void pci_disable_sriov(struct pci_dev *dev);
 extern irqreturn_t pci_sriov_migration(struct pci_dev *dev);
+extern int pci_num_vf(struct pci_dev *dev);
 #else
 static inline int pci_enable_sriov(struct pci_dev *dev, int nr_virtfn)
 {
@@ -1368,6 +1375,10 @@ static inline irqreturn_t pci_sriov_migration(struct pci_dev *dev)
 {
         return IRQ_NONE;
 }
+static inline int pci_num_vf(struct pci_dev *dev)
+{
+        return 0;
+}
 #endif
 
 #if defined(CONFIG_HOTPLUG_PCI) || defined(CONFIG_HOTPLUG_PCI_MODULE)
@@ -1404,5 +1415,93 @@ static inline bool pci_is_pcie(struct pci_dev *dev)
 
 void pci_request_acs(void);
 
+
+#define PCI_VPD_LRDT                    0x80    /* Large Resource Data Type */
+#define PCI_VPD_LRDT_ID(x)              (x | PCI_VPD_LRDT)
+
+/* Large Resource Data Type Tag Item Names */
+#define PCI_VPD_LTIN_ID_STRING          0x02    /* Identifier String */
+#define PCI_VPD_LTIN_RO_DATA            0x10    /* Read-Only Data */
+#define PCI_VPD_LTIN_RW_DATA            0x11    /* Read-Write Data */
+
+#define PCI_VPD_LRDT_ID_STRING          PCI_VPD_LRDT_ID(PCI_VPD_LTIN_ID_STRING)
+#define PCI_VPD_LRDT_RO_DATA            PCI_VPD_LRDT_ID(PCI_VPD_LTIN_RO_DATA)
+#define PCI_VPD_LRDT_RW_DATA            PCI_VPD_LRDT_ID(PCI_VPD_LTIN_RW_DATA)
+
+/* Small Resource Data Type Tag Item Names */
+#define PCI_VPD_STIN_END                0x78    /* End */
+
+#define PCI_VPD_SRDT_END                PCI_VPD_STIN_END
+
+#define PCI_VPD_SRDT_TIN_MASK           0x78
+#define PCI_VPD_SRDT_LEN_MASK           0x07
+
+#define PCI_VPD_LRDT_TAG_SIZE           3
+#define PCI_VPD_SRDT_TAG_SIZE           1
+
+#define PCI_VPD_INFO_FLD_HDR_SIZE       3
+
+#define PCI_VPD_RO_KEYWORD_PARTNO       "PN"
+#define PCI_VPD_RO_KEYWORD_MFR_ID       "MN"
+#define PCI_VPD_RO_KEYWORD_VENDOR0      "V0"
+
+/**
+ * pci_vpd_lrdt_size - Extracts the Large Resource Data Type length
+ * @lrdt: Pointer to the beginning of the Large Resource Data Type tag
+ *
+ * Returns the extracted Large Resource Data Type length.
+ */
+static inline u16 pci_vpd_lrdt_size(const u8 *lrdt)
+{
+        return (u16)lrdt[1] + ((u16)lrdt[2] << 8);
+}
+
+/**
+ * pci_vpd_srdt_size - Extracts the Small Resource Data Type length
+ * @lrdt: Pointer to the beginning of the Small Resource Data Type tag
+ *
+ * Returns the extracted Small Resource Data Type length.
+ */
+static inline u8 pci_vpd_srdt_size(const u8 *srdt)
+{
+        return (*srdt) & PCI_VPD_SRDT_LEN_MASK;
+}
+
+/**
+ * pci_vpd_info_field_size - Extracts the information field length
+ * @lrdt: Pointer to the beginning of an information field header
+ *
+ * Returns the extracted information field length.
+ */
+static inline u8 pci_vpd_info_field_size(const u8 *info_field)
+{
+        return info_field[2];
+}
+
+/**
+ * pci_vpd_find_tag - Locates the Resource Data Type tag provided
+ * @buf: Pointer to buffered vpd data
+ * @off: The offset into the buffer at which to begin the search
+ * @len: The length of the vpd buffer
+ * @rdt: The Resource Data Type to search for
+ *
+ * Returns the index where the Resource Data Type was found or
+ * -ENOENT otherwise.
+ */
+int pci_vpd_find_tag(const u8 *buf, unsigned int off, unsigned int len, u8 rdt);
+
+/**
+ * pci_vpd_find_info_keyword - Locates an information field keyword in the VPD
+ * @buf: Pointer to buffered vpd data
+ * @off: The offset into the buffer at which to begin the search
+ * @len: The length of the buffer area, relative to off, in which to search
+ * @kw: The keyword to search for
+ *
+ * Returns the index where the information field keyword was found or
+ * -ENOENT otherwise.
+ */
+int pci_vpd_find_info_keyword(const u8 *buf, unsigned int off,
+                              unsigned int len, const char *kw);
+
 #endif /* __KERNEL__ */
 #endif /* LINUX_PCI_H */
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 6a7eb402165d..14d7fdf6a90a 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -452,6 +452,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                 u32 flags, phy_interface_t interface);
 struct phy_device * phy_attach(struct net_device *dev,
                 const char *bus_id, u32 flags, phy_interface_t interface);
+struct phy_device *phy_find_first(struct mii_bus *bus);
 int phy_connect_direct(struct net_device *dev, struct phy_device *phydev,
                 void (*handler)(struct net_device *), u32 flags,
                 phy_interface_t interface);
diff --git a/include/linux/rculist.h b/include/linux/rculist.h
index 779d70749beb..2c9b46cff3d7 100644
--- a/include/linux/rculist.h
+++ b/include/linux/rculist.h
@@ -406,6 +406,11 @@ static inline void hlist_add_after_rcu(struct hlist_node *prev,
                 n->next->pprev = &n->next;
 }
 
+#define __hlist_for_each_rcu(pos, head)                 \
+        for (pos = rcu_dereference((head)->first);      \
+             pos && ({ prefetch(pos->next); 1; });      \
+             pos = rcu_dereference(pos->next))
+
 /**
  * hlist_for_each_entry_rcu - iterate over rcu list of given type
  * @tpos:       the type * to use as a loop cursor.
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 5c52fa43785c..d1c7c90e9cd4 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -362,6 +362,8 @@ enum {
 #define RTAX_FEATURES RTAX_FEATURES
         RTAX_RTO_MIN,
 #define RTAX_RTO_MIN RTAX_RTO_MIN
+        RTAX_INITRWND,
+#define RTAX_INITRWND RTAX_INITRWND
         __RTAX_MAX
 };
 
diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
index 8366d8f12e53..03c0232b4169 100644
--- a/include/linux/seq_file.h
+++ b/include/linux/seq_file.h
@@ -135,4 +135,22 @@ extern struct list_head *seq_list_start_head(struct list_head *head,
 extern struct list_head *seq_list_next(void *v, struct list_head *head,
                 loff_t *ppos);
 
+/*
+ * Helpers for iteration over hlist_head-s in seq_files
+ */
+
+extern struct hlist_node *seq_hlist_start(struct hlist_head *head,
+                                          loff_t pos);
+extern struct hlist_node *seq_hlist_start_head(struct hlist_head *head,
+                                               loff_t pos);
+extern struct hlist_node *seq_hlist_next(void *v, struct hlist_head *head,
+                                         loff_t *ppos);
+
+extern struct hlist_node *seq_hlist_start_rcu(struct hlist_head *head,
+                                              loff_t pos);
+extern struct hlist_node *seq_hlist_start_head_rcu(struct hlist_head *head,
+                                                   loff_t pos);
+extern struct hlist_node *seq_hlist_next_rcu(void *v,
+                                                   struct hlist_head *head,
+                                                   loff_t *ppos);
 #endif
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index ae836fded530..03f816a9b659 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -315,22 +315,23 @@ struct sk_buff {
         struct sk_buff          *next;
         struct sk_buff          *prev;
 
-        struct sock             *sk;
         ktime_t                 tstamp;
+
+        struct sock             *sk;
         struct net_device       *dev;
 
-        unsigned long           _skb_dst;
-#ifdef CONFIG_XFRM
-        struct  sec_path        *sp;
-#endif
         /*
          * This is the control buffer. It is free to use for every
          * layer. Please put your private variables there. If you
          * want to keep them across layers you have to do a skb_clone()
          * first. This is owned by whoever has the skb queued ATM.
          */
-        char                    cb[48];
+        char                    cb[48] __aligned(8);
 
+        unsigned long           _skb_dst;
+#ifdef CONFIG_XFRM
+        struct  sec_path        *sp;
+#endif
         unsigned int            len,
                                 data_len;
         __u16                   mac_len,
@@ -354,8 +355,8 @@ struct sk_buff {
                                 ipvs_property:1,
                                 peeked:1,
                                 nf_trace:1;
-        __be16                  protocol:16;
         kmemcheck_bitfield_end(flags1);
+        __be16                  protocol;
 
         void                    (*destructor)(struct sk_buff *skb);
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
@@ -738,7 +739,7 @@ static inline struct sk_buff *skb_unshare(struct sk_buff *skb,
 }
 
 /**
- *      skb_peek
+ *      skb_peek - peek at the head of an &sk_buff_head
  *      @list_: list to peek at
  *
  *      Peek an &sk_buff. Unlike most other operations you _MUST_
@@ -759,7 +760,7 @@ static inline struct sk_buff *skb_peek(struct sk_buff_head *list_)
 }
 
 /**
- *      skb_peek_tail
+ *      skb_peek_tail - peek at the tail of an &sk_buff_head
  *      @list_: list to peek at
  *
  *      Peek an &sk_buff. Unlike most other operations you _MUST_
diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index 0f953fe40413..e28f5a0182e8 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -257,6 +257,7 @@ enum
         LINUX_MIB_XFRMOUTPOLBLOCK,              /* XfrmOutPolBlock */
         LINUX_MIB_XFRMOUTPOLDEAD,               /* XfrmOutPolDead */
         LINUX_MIB_XFRMOUTPOLERROR,              /* XfrmOutPolError */
+        LINUX_MIB_XFRMFWDHDRERROR,              /* XfrmFwdHdrError*/
         __LINUX_MIB_XFRMMAX
 };
 
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
new file mode 100644
index 000000000000..32bfd1a8a48d
--- /dev/null
+++ b/include/linux/stmmac.h
@@ -0,0 +1,53 @@
+/*******************************************************************************
+
+  Header file for stmmac platform data
+
+  Copyright (C) 2009  STMicroelectronics Ltd
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms and conditions of the GNU General Public License,
+  version 2, as published by the Free Software Foundation.
+
+  This program is distributed in the hope it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc.,
+  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+
+  The full GNU General Public License is included in this distribution in
+  the file called "COPYING".
+
+  Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+*******************************************************************************/
+
+#ifndef __STMMAC_PLATFORM_DATA
+#define __STMMAC_PLATFORM_DATA
+
+/* platfrom data for platfrom device structure's platfrom_data field */
+
+/* Private data for the STM on-board ethernet driver */
+struct plat_stmmacenet_data {
+        int bus_id;
+        int pbl;
+        int has_gmac;
+        void (*fix_mac_speed)(void *priv, unsigned int speed);
+        void (*bus_setup)(unsigned long ioaddr);
+#ifdef CONFIG_STM_DRIVERS
+        struct stm_pad_config *pad_config;
+#endif
+        void *bsp_priv;
+};
+
+struct plat_stmmacphy_data {
+        int bus_id;
+        int phy_addr;
+        unsigned int phy_mask;
+        int interface;
+        int (*phy_reset)(void *priv);
+        void *priv;
+};
+#endif
+
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index bd27fbc9db62..f66014c90c9f 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -481,9 +481,6 @@ enum
         NET_IPV4_CONF_PROMOTE_SECONDARIES=20,
         NET_IPV4_CONF_ARP_ACCEPT=21,
         NET_IPV4_CONF_ARP_NOTIFY=22,
-        NET_IPV4_CONF_ACCEPT_LOCAL=23,
-        NET_IPV4_CONF_SRC_VMARK=24,
-        __NET_IPV4_CONF_MAX
 };
 
 /* /proc/sys/net/ipv4/netfilter */
@@ -599,7 +596,6 @@ enum {
         NET_NEIGH_GC_THRESH3=16,
         NET_NEIGH_RETRANS_TIME_MS=17,
         NET_NEIGH_REACHABLE_TIME_MS=18,
-        __NET_NEIGH_MAX
 };
 
 /* /proc/sys/net/dccp */
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 7fee8a4df931..a778ee024590 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -103,6 +103,8 @@ enum {
 #define TCP_CONGESTION          13      /* Congestion control algorithm */
 #define TCP_MD5SIG              14      /* TCP MD5 Signature (RFC2385) */
 #define TCP_COOKIE_TRANSACTIONS 15      /* TCP Cookie Transactions */
+#define TCP_THIN_LINEAR_TIMEOUTS 16      /* Use linear timeouts for thin streams*/
+#define TCP_THIN_DUPACK         17      /* Fast retrans. after 1 dupack */
 
 /* for TCP_INFO socket option */
 #define TCPI_OPT_TIMESTAMPS     1
@@ -340,7 +342,10 @@ struct tcp_sock {
         u32     frto_highmark;  /* snd_nxt when RTO occurred */
         u16     advmss;         /* Advertised MSS                       */
         u8      frto_counter;   /* Number of new acks after RTO */
-        u8      nonagle;        /* Disable Nagle algorithm?             */
+        u8      nonagle     : 4,/* Disable Nagle algorithm?             */
+                thin_lto    : 1,/* Use linear timeouts for thin streams */
+                thin_dupack : 1,/* Fast retransmit on first dupack      */
+                unused      : 2;
 
 /* RTT measurement */
         u32     srtt;           /* smoothed round trip time << 3        */
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 8ce61359bf73..df1e83dd9a54 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -214,25 +214,4 @@ extern void usbnet_set_msglevel (struct net_device *, u32);
 extern void usbnet_get_drvinfo (struct net_device *, struct ethtool_drvinfo *);
 extern int usbnet_nway_reset(struct net_device *net);
 
-/* messaging support includes the interface name, so it must not be
- * used before it has one ... notably, in minidriver bind() calls.
- */
-#ifdef DEBUG
-#define devdbg(usbnet, fmt, arg...) \
-        printk(KERN_DEBUG "%s: " fmt "\n" , (usbnet)->net->name , ## arg)
-#else
-#define devdbg(usbnet, fmt, arg...) \
-        ({ if (0) printk(KERN_DEBUG "%s: " fmt "\n" , (usbnet)->net->name , \
-                ## arg); 0; })
-#endif
-
-#define deverr(usbnet, fmt, arg...) \
-        printk(KERN_ERR "%s: " fmt "\n" , (usbnet)->net->name , ## arg)
-#define devwarn(usbnet, fmt, arg...) \
-        printk(KERN_WARNING "%s: " fmt "\n" , (usbnet)->net->name , ## arg)
-
-#define devinfo(usbnet, fmt, arg...) \
-        printk(KERN_INFO "%s: " fmt "\n" , (usbnet)->net->name , ## arg); \
-
-
 #endif /* __LINUX_USB_USBNET_H */
diff --git a/include/linux/vhost.h b/include/linux/vhost.h
new file mode 100644
index 000000000000..e847f1e30756
--- /dev/null
+++ b/include/linux/vhost.h
@@ -0,0 +1,130 @@
+#ifndef _LINUX_VHOST_H
+#define _LINUX_VHOST_H
+/* Userspace interface for in-kernel virtio accelerators. */
+
+/* vhost is used to reduce the number of system calls involved in virtio.
+ *
+ * Existing virtio net code is used in the guest without modification.
+ *
+ * This header includes interface used by userspace hypervisor for
+ * device configuration.
+ */
+
+#include <linux/types.h>
+#include <linux/compiler.h>
+#include <linux/ioctl.h>
+#include <linux/virtio_config.h>
+#include <linux/virtio_ring.h>
+
+struct vhost_vring_state {
+        unsigned int index;
+        unsigned int num;
+};
+
+struct vhost_vring_file {
+        unsigned int index;
+        int fd; /* Pass -1 to unbind from file. */
+
+};
+
+struct vhost_vring_addr {
+        unsigned int index;
+        /* Option flags. */
+        unsigned int flags;
+        /* Flag values: */
+        /* Whether log address is valid. If set enables logging. */
+#define VHOST_VRING_F_LOG 0
+
+        /* Start of array of descriptors (virtually contiguous) */
+        __u64 desc_user_addr;
+        /* Used structure address. Must be 32 bit aligned */
+        __u64 used_user_addr;
+        /* Available structure address. Must be 16 bit aligned */
+        __u64 avail_user_addr;
+        /* Logging support. */
+        /* Log writes to used structure, at offset calculated from specified
+         * address. Address must be 32 bit aligned. */
+        __u64 log_guest_addr;
+};
+
+struct vhost_memory_region {
+        __u64 guest_phys_addr;
+        __u64 memory_size; /* bytes */
+        __u64 userspace_addr;
+        __u64 flags_padding; /* No flags are currently specified. */
+};
+
+/* All region addresses and sizes must be 4K aligned. */
+#define VHOST_PAGE_SIZE 0x1000
+
+struct vhost_memory {
+        __u32 nregions;
+        __u32 padding;
+        struct vhost_memory_region regions[0];
+};
+
+/* ioctls */
+
+#define VHOST_VIRTIO 0xAF
+
+/* Features bitmask for forward compatibility.  Transport bits are used for
+ * vhost specific features. */
+#define VHOST_GET_FEATURES      _IOR(VHOST_VIRTIO, 0x00, __u64)
+#define VHOST_SET_FEATURES      _IOW(VHOST_VIRTIO, 0x00, __u64)
+
+/* Set current process as the (exclusive) owner of this file descriptor.  This
+ * must be called before any other vhost command.  Further calls to
+ * VHOST_OWNER_SET fail until VHOST_OWNER_RESET is called. */
+#define VHOST_SET_OWNER _IO(VHOST_VIRTIO, 0x01)
+/* Give up ownership, and reset the device to default values.
+ * Allows subsequent call to VHOST_OWNER_SET to succeed. */
+#define VHOST_RESET_OWNER _IO(VHOST_VIRTIO, 0x02)
+
+/* Set up/modify memory layout */
+#define VHOST_SET_MEM_TABLE     _IOW(VHOST_VIRTIO, 0x03, struct vhost_memory)
+
+/* Write logging setup. */
+/* Memory writes can optionally be logged by setting bit at an offset
+ * (calculated from the physical address) from specified log base.
+ * The bit is set using an atomic 32 bit operation. */
+/* Set base address for logging. */
+#define VHOST_SET_LOG_BASE _IOW(VHOST_VIRTIO, 0x04, __u64)
+/* Specify an eventfd file descriptor to signal on log write. */
+#define VHOST_SET_LOG_FD _IOW(VHOST_VIRTIO, 0x07, int)
+
+/* Ring setup. */
+/* Set number of descriptors in ring. This parameter can not
+ * be modified while ring is running (bound to a device). */
+#define VHOST_SET_VRING_NUM _IOW(VHOST_VIRTIO, 0x10, struct vhost_vring_state)
+/* Set addresses for the ring. */
+#define VHOST_SET_VRING_ADDR _IOW(VHOST_VIRTIO, 0x11, struct vhost_vring_addr)
+/* Base value where queue looks for available descriptors */
+#define VHOST_SET_VRING_BASE _IOW(VHOST_VIRTIO, 0x12, struct vhost_vring_state)
+/* Get accessor: reads index, writes value in num */
+#define VHOST_GET_VRING_BASE _IOWR(VHOST_VIRTIO, 0x12, struct vhost_vring_state)
+
+/* The following ioctls use eventfd file descriptors to signal and poll
+ * for events. */
+
+/* Set eventfd to poll for added buffers */
+#define VHOST_SET_VRING_KICK _IOW(VHOST_VIRTIO, 0x20, struct vhost_vring_file)
+/* Set eventfd to signal when buffers have beed used */
+#define VHOST_SET_VRING_CALL _IOW(VHOST_VIRTIO, 0x21, struct vhost_vring_file)
+/* Set eventfd to signal an error */
+#define VHOST_SET_VRING_ERR _IOW(VHOST_VIRTIO, 0x22, struct vhost_vring_file)
+
+/* VHOST_NET specific defines */
+
+/* Attach virtio net ring to a raw socket, or tap device.
+ * The socket must be already bound to an ethernet device, this device will be
+ * used for transmit.  Pass fd -1 to unbind from the socket and the transmit
+ * device.  This can be used to stop the ring (e.g. for migration). */
+#define VHOST_NET_SET_BACKEND _IOW(VHOST_VIRTIO, 0x30, struct vhost_vring_file)
+
+/* Feature bits */
+/* Log all write descriptors. Can be changed while device is active. */
+#define VHOST_F_LOG_ALL 26
+/* vhost-net should add virtio_net_hdr for RX, and strip for TX packets. */
+#define VHOST_NET_F_VIRTIO_NET_HDR 27
+
+#endif
diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index 29e04beb1fc9..b971e3848493 100644
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -267,8 +267,8 @@ enum xfrm_attr_type_t {
         XFRMA_ALG_COMP,         /* struct xfrm_algo */
         XFRMA_ENCAP,            /* struct xfrm_algo + struct xfrm_encap_tmpl */
         XFRMA_TMPL,             /* 1 or more struct xfrm_user_tmpl */
-        XFRMA_SA,
-        XFRMA_POLICY,
+        XFRMA_SA,               /* struct xfrm_usersa_info  */
+        XFRMA_POLICY,           /*struct xfrm_userpolicy_info */
         XFRMA_SEC_CTX,          /* struct xfrm_sec_ctx */
         XFRMA_LTIME_VAL,
         XFRMA_REPLAY_VAL,
@@ -276,17 +276,23 @@ enum xfrm_attr_type_t {
         XFRMA_ETIMER_THRESH,
         XFRMA_SRCADDR,          /* xfrm_address_t */
         XFRMA_COADDR,           /* xfrm_address_t */
-        XFRMA_LASTUSED,
+        XFRMA_LASTUSED,         /* unsigned long  */
         XFRMA_POLICY_TYPE,      /* struct xfrm_userpolicy_type */
         XFRMA_MIGRATE,
         XFRMA_ALG_AEAD,         /* struct xfrm_algo_aead */
         XFRMA_KMADDRESS,        /* struct xfrm_user_kmaddress */
         XFRMA_ALG_AUTH_TRUNC,   /* struct xfrm_algo_auth */
+        XFRMA_MARK,             /* struct xfrm_mark */
         __XFRMA_MAX
 
 #define XFRMA_MAX (__XFRMA_MAX - 1)
 };
 
+struct xfrm_mark {
+        __u32           v; /* value */
+        __u32           m; /* mask */
+};
+
 enum xfrm_sadattr_type_t {
         XFRMA_SAD_UNSPEC,
         XFRMA_SAD_CNT,
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index ed3aea1605e8..fc0c502d9fd1 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -43,7 +43,7 @@
 #define HCI_NOTIFY_CONN_DEL             2
 #define HCI_NOTIFY_VOICE_SETTING        3
 
-/* HCI device types */
+/* HCI bus types */
 #define HCI_VIRTUAL     0
 #define HCI_USB         1
 #define HCI_PCCARD      2
@@ -52,6 +52,10 @@
 #define HCI_PCI         5
 #define HCI_SDIO        6
 
+/* HCI controller types */
+#define HCI_BREDR       0x00
+#define HCI_80211       0x01
+
 /* HCI device quirks */
 enum {
         HCI_QUIRK_NO_RESET,
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 7b86094a894b..ce3c99e5fa25 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -70,7 +70,8 @@ struct hci_dev {
         char            name[8];
         unsigned long   flags;
         __u16           id;
-        __u8            type;
+        __u8            bus;
+        __u8            dev_type;
         bdaddr_t        bdaddr;
         __u8            dev_name[248];
         __u8            dev_class[3];
@@ -134,6 +135,8 @@ struct hci_dev {
 
         atomic_t                promisc;
 
+        struct dentry           *debugfs;
+
         struct device           *parent;
         struct device           dev;
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 0884b9a0f778..3d134a1fb96b 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -3,7 +3,7 @@
 /*
  * 802.11 device and configuration interface
  *
- * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -39,8 +39,8 @@
  * @IEEE80211_BAND_5GHZ: around 5GHz band (4.9-5.7)
  */
 enum ieee80211_band {
-        IEEE80211_BAND_2GHZ,
-        IEEE80211_BAND_5GHZ,
+        IEEE80211_BAND_2GHZ = NL80211_BAND_2GHZ,
+        IEEE80211_BAND_5GHZ = NL80211_BAND_5GHZ,
 
         /* keep last */
         IEEE80211_NUM_BANDS
@@ -626,8 +626,14 @@ enum cfg80211_signal_type {
  * @beacon_interval: the beacon interval as from the frame
  * @capability: the capability field in host byte order
  * @information_elements: the information elements (Note that there
- *      is no guarantee that these are well-formed!)
+ *      is no guarantee that these are well-formed!); this is a pointer to
+ *      either the beacon_ies or proberesp_ies depending on whether Probe
+ *      Response frame has been received
  * @len_information_elements: total length of the information elements
+ * @beacon_ies: the information elements from the last Beacon frame
+ * @len_beacon_ies: total length of the beacon_ies
+ * @proberesp_ies: the information elements from the last Probe Response frame
+ * @len_proberesp_ies: total length of the proberesp_ies
  * @signal: signal strength value (type depends on the wiphy's signal_type)
  * @free_priv: function pointer to free private data
  * @priv: private area for driver use, has at least wiphy->bss_priv_size bytes
@@ -641,6 +647,10 @@ struct cfg80211_bss {
         u16 capability;
         u8 *information_elements;
         size_t len_information_elements;
+        u8 *beacon_ies;
+        size_t len_beacon_ies;
+        u8 *proberesp_ies;
+        size_t len_proberesp_ies;
 
         s32 signal;
 
@@ -837,6 +847,7 @@ enum wiphy_params_flags {
         WIPHY_PARAM_RETRY_LONG          = 1 << 1,
         WIPHY_PARAM_FRAG_THRESHOLD      = 1 << 2,
         WIPHY_PARAM_RTS_THRESHOLD       = 1 << 3,
+        WIPHY_PARAM_COVERAGE_CLASS      = 1 << 4,
 };
 
 /**
@@ -856,20 +867,11 @@ enum tx_power_setting {
  * cfg80211_bitrate_mask - masks for bitrate control
  */
 struct cfg80211_bitrate_mask {
-/*
- * As discussed in Berlin, this struct really
- * should look like this:
-
         struct {
                 u32 legacy;
-                u8 mcs[IEEE80211_HT_MCS_MASK_LEN];
+                /* TODO: add support for masking MCS rates; e.g.: */
+                /* u8 mcs[IEEE80211_HT_MCS_MASK_LEN]; */
         } control[IEEE80211_NUM_BANDS];
-
- * Since we can always fix in-kernel users, let's keep
- * it simpler for now:
- */
-        u32 fixed;   /* fixed bitrate, 0 == not fixed */
-        u32 maxrate; /* in kbps, 0 == no limit */
 };
 /**
  * struct cfg80211_pmksa - PMK Security Association
@@ -988,6 +990,16 @@ struct cfg80211_pmksa {
  *
  * @dump_survey: get site survey information.
  *
+ * @remain_on_channel: Request the driver to remain awake on the specified
+ *      channel for the specified duration to complete an off-channel
+ *      operation (e.g., public action frame exchange). When the driver is
+ *      ready on the requested channel, it must indicate this with an event
+ *      notification by calling cfg80211_ready_on_channel().
+ * @cancel_remain_on_channel: Cancel an on-going remain-on-channel operation.
+ *      This allows the operation to be terminated prior to timeout based on
+ *      the duration value.
+ * @action: Transmit an action frame
+ *
  * @testmode_cmd: run a test mode command
  *
  * @set_pmksa: Cache a PMKID for a BSSID. This is mostly useful for fullmac
@@ -1123,7 +1135,21 @@ struct cfg80211_ops {
                              struct cfg80211_pmksa *pmksa);
         int     (*flush_pmksa)(struct wiphy *wiphy, struct net_device *netdev);
 
-        /* some temporary stuff to finish wext */
+        int     (*remain_on_channel)(struct wiphy *wiphy,
+                                     struct net_device *dev,
+                                     struct ieee80211_channel *chan,
+                                     enum nl80211_channel_type channel_type,
+                                     unsigned int duration,
+                                     u64 *cookie);
+        int     (*cancel_remain_on_channel)(struct wiphy *wiphy,
+                                            struct net_device *dev,
+                                            u64 cookie);
+
+        int     (*action)(struct wiphy *wiphy, struct net_device *dev,
+                          struct ieee80211_channel *chan,
+                          enum nl80211_channel_type channel_type,
+                          const u8 *buf, size_t len, u64 *cookie);
+
         int     (*set_power_mgmt)(struct wiphy *wiphy, struct net_device *dev,
                                   bool enabled, int timeout);
 };
@@ -1174,6 +1200,10 @@ enum wiphy_flags {
         WIPHY_FLAG_4ADDR_STATION        = BIT(6),
 };
 
+struct mac_address {
+        u8 addr[ETH_ALEN];
+};
+
 /**
  * struct wiphy - wireless hardware description
  * @idx: the wiphy index assigned to this item
@@ -1192,12 +1222,28 @@ enum wiphy_flags {
  *      -1 = fragmentation disabled, only odd values >= 256 used
  * @rts_threshold: RTS threshold (dot11RTSThreshold); -1 = RTS/CTS disabled
  * @net: the network namespace this wiphy currently lives in
+ * @perm_addr: permanent MAC address of this device
+ * @addr_mask: If the device supports multiple MAC addresses by masking,
+ *      set this to a mask with variable bits set to 1, e.g. if the last
+ *      four bits are variable then set it to 00:...:00:0f. The actual
+ *      variable bits shall be determined by the interfaces added, with
+ *      interfaces not matching the mask being rejected to be brought up.
+ * @n_addresses: number of addresses in @addresses.
+ * @addresses: If the device has more than one address, set this pointer
+ *      to a list of addresses (6 bytes each). The first one will be used
+ *      by default for perm_addr. In this case, the mask should be set to
+ *      all-zeroes. In this case it is assumed that the device can handle
+ *      the same number of arbitrary MAC addresses.
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
 
-        /* permanent MAC address */
+        /* permanent MAC address(es) */
         u8 perm_addr[ETH_ALEN];
+        u8 addr_mask[ETH_ALEN];
+
+        u16 n_addresses;
+        struct mac_address *addresses;
 
         /* Supported interface modes, OR together BIT(NL80211_IFTYPE_...) */
         u16 interface_modes;
@@ -1217,6 +1263,7 @@ struct wiphy {
         u8 retry_long;
         u32 frag_threshold;
         u32 rts_threshold;
+        u8 coverage_class;
 
         char fw_version[ETHTOOL_BUSINFO_LEN];
         u32 hw_version;
@@ -1403,6 +1450,8 @@ struct cfg80211_cached_keys;
  *      set by driver (if supported) on add_interface BEFORE registering the
  *      netdev and may otherwise be used by driver read-only, will be update
  *      by cfg80211 on change_interface
+ * @action_registrations: list of registrations for action frames
+ * @action_registrations_lock: lock for the list
  */
 struct wireless_dev {
         struct wiphy *wiphy;
@@ -1412,6 +1461,9 @@ struct wireless_dev {
         struct list_head list;
         struct net_device *netdev;
 
+        struct list_head action_registrations;
+        spinlock_t action_registrations_lock;
+
         struct mutex mtx;
 
         struct work_struct cleanup_work;
@@ -1436,6 +1488,9 @@ struct wireless_dev {
         struct cfg80211_internal_bss *auth_bsses[MAX_AUTH_BSSES];
         struct cfg80211_internal_bss *current_bss; /* associated / joined */
 
+        bool ps;
+        int ps_timeout;
+
 #ifdef CONFIG_CFG80211_WEXT
         /* wext data */
         struct {
@@ -1447,8 +1502,7 @@ struct wireless_dev {
                 u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
                 u8 ssid[IEEE80211_MAX_SSID_LEN];
                 s8 default_key, default_mgmt_key;
-                bool ps, prev_bssid_valid;
-                int ps_timeout;
+                bool prev_bssid_valid;
         } wext;
 #endif
 };
@@ -1519,37 +1573,82 @@ ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
  * Documentation in Documentation/networking/radiotap-headers.txt
  */
 
+struct radiotap_align_size {
+        uint8_t align:4, size:4;
+};
+
+struct ieee80211_radiotap_namespace {
+        const struct radiotap_align_size *align_size;
+        int n_bits;
+        uint32_t oui;
+        uint8_t subns;
+};
+
+struct ieee80211_radiotap_vendor_namespaces {
+        const struct ieee80211_radiotap_namespace *ns;
+        int n_ns;
+};
+
 /**
  * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args
- * @rtheader: pointer to the radiotap header we are walking through
- * @max_length: length of radiotap header in cpu byte ordering
- * @this_arg_index: IEEE80211_RADIOTAP_... index of current arg
- * @this_arg: pointer to current radiotap arg
- * @arg_index: internal next argument index
- * @arg: internal next argument pointer
- * @next_bitmap: internal pointer to next present u32
- * @bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present
+ * @this_arg_index: index of current arg, valid after each successful call
+ *      to ieee80211_radiotap_iterator_next()
+ * @this_arg: pointer to current radiotap arg; it is valid after each
+ *      call to ieee80211_radiotap_iterator_next() but also after
+ *      ieee80211_radiotap_iterator_init() where it will point to
+ *      the beginning of the actual data portion
+ * @this_arg_size: length of the current arg, for convenience
+ * @current_namespace: pointer to the current namespace definition
+ *      (or internally %NULL if the current namespace is unknown)
+ * @is_radiotap_ns: indicates whether the current namespace is the default
+ *      radiotap namespace or not
+ *
+ * @overrides: override standard radiotap fields
+ * @n_overrides: number of overrides
+ *
+ * @_rtheader: pointer to the radiotap header we are walking through
+ * @_max_length: length of radiotap header in cpu byte ordering
+ * @_arg_index: next argument index
+ * @_arg: next argument pointer
+ * @_next_bitmap: internal pointer to next present u32
+ * @_bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present
+ * @_vns: vendor namespace definitions
+ * @_next_ns_data: beginning of the next namespace's data
+ * @_reset_on_ext: internal; reset the arg index to 0 when going to the
+ *      next bitmap word
+ *
+ * Describes the radiotap parser state. Fields prefixed with an underscore
+ * must not be used by users of the parser, only by the parser internally.
  */
 
 struct ieee80211_radiotap_iterator {
-        struct ieee80211_radiotap_header *rtheader;
-        int max_length;
+        struct ieee80211_radiotap_header *_rtheader;
+        const struct ieee80211_radiotap_vendor_namespaces *_vns;
+        const struct ieee80211_radiotap_namespace *current_namespace;
+
+        unsigned char *_arg, *_next_ns_data;
+        uint32_t *_next_bitmap;
+
+        unsigned char *this_arg;
         int this_arg_index;
-        u8 *this_arg;
+        int this_arg_size;
+
+        int is_radiotap_ns;
 
-        int arg_index;
-        u8 *arg;
-        __le32 *next_bitmap;
-        u32 bitmap_shifter;
+        int _max_length;
+        int _arg_index;
+        uint32_t _bitmap_shifter;
+        int _reset_on_ext;
 };
 
 extern int ieee80211_radiotap_iterator_init(
-   struct ieee80211_radiotap_iterator *iterator,
-   struct ieee80211_radiotap_header *radiotap_header,
-   int max_length);
+        struct ieee80211_radiotap_iterator *iterator,
+        struct ieee80211_radiotap_header *radiotap_header,
+        int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns);
 
 extern int ieee80211_radiotap_iterator_next(
-   struct ieee80211_radiotap_iterator *iterator);
+        struct ieee80211_radiotap_iterator *iterator);
+
 
 extern const unsigned char rfc1042_header[6];
 extern const unsigned char bridge_tunnel_header[6];
@@ -1578,7 +1677,7 @@ unsigned int ieee80211_hdrlen(__le16 fc);
  * @addr: the device MAC address
  * @iftype: the virtual interface type
  */
-int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
+int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                            enum nl80211_iftype iftype);
 
 /**
@@ -1589,15 +1688,49 @@ int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
  * @bssid: the network bssid (used only for iftype STATION and ADHOC)
  * @qos: build 802.11 QoS data frame
  */
-int ieee80211_data_from_8023(struct sk_buff *skb, u8 *addr,
+int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
                              enum nl80211_iftype iftype, u8 *bssid, bool qos);
 
 /**
+ * ieee80211_amsdu_to_8023s - decode an IEEE 802.11n A-MSDU frame
+ *
+ * Decode an IEEE 802.11n A-MSDU frame and convert it to a list of
+ * 802.3 frames. The @list will be empty if the decode fails. The
+ * @skb is consumed after the function returns.
+ *
+ * @skb: The input IEEE 802.11n A-MSDU frame.
+ * @list: The output list of 802.3 frames. It must be allocated and
+ *      initialized by by the caller.
+ * @addr: The device MAC address.
+ * @iftype: The device interface type.
+ * @extra_headroom: The hardware extra headroom for SKBs in the @list.
+ */
+void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+                              const u8 *addr, enum nl80211_iftype iftype,
+                              const unsigned int extra_headroom);
+
+/**
  * cfg80211_classify8021d - determine the 802.1p/1d tag for a data frame
  * @skb: the data frame
  */
 unsigned int cfg80211_classify8021d(struct sk_buff *skb);
 
+/**
+ * cfg80211_find_ie - find information element in data
+ *
+ * @eid: element ID
+ * @ies: data consisting of IEs
+ * @len: length of data
+ *
+ * This function will return %NULL if the element ID could
+ * not be found or if the element is invalid (claims to be
+ * longer than the given data), or a pointer to the first byte
+ * of the requested element, that is the byte containing the
+ * element ID. There are no checks on the element length
+ * other than having to fit into the given data.
+ */
+const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len);
+
 /*
  * Regulatory helper functions for wiphys
  */
@@ -2129,5 +2262,79 @@ void cfg80211_roamed(struct net_device *dev, const u8 *bssid,
 void cfg80211_disconnected(struct net_device *dev, u16 reason,
                            u8 *ie, size_t ie_len, gfp_t gfp);
 
+/**
+ * cfg80211_ready_on_channel - notification of remain_on_channel start
+ * @dev: network device
+ * @cookie: the request cookie
+ * @chan: The current channel (from remain_on_channel request)
+ * @channel_type: Channel type
+ * @duration: Duration in milliseconds that the driver intents to remain on the
+ *      channel
+ * @gfp: allocation flags
+ */
+void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
+                               struct ieee80211_channel *chan,
+                               enum nl80211_channel_type channel_type,
+                               unsigned int duration, gfp_t gfp);
+
+/**
+ * cfg80211_remain_on_channel_expired - remain_on_channel duration expired
+ * @dev: network device
+ * @cookie: the request cookie
+ * @chan: The current channel (from remain_on_channel request)
+ * @channel_type: Channel type
+ * @gfp: allocation flags
+ */
+void cfg80211_remain_on_channel_expired(struct net_device *dev,
+                                        u64 cookie,
+                                        struct ieee80211_channel *chan,
+                                        enum nl80211_channel_type channel_type,
+                                        gfp_t gfp);
+
+
+/**
+ * cfg80211_new_sta - notify userspace about station
+ *
+ * @dev: the netdev
+ * @mac_addr: the station's address
+ * @sinfo: the station information
+ * @gfp: allocation flags
+ */
+void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
+                      struct station_info *sinfo, gfp_t gfp);
+
+/**
+ * cfg80211_rx_action - notification of received, unprocessed Action frame
+ * @dev: network device
+ * @freq: Frequency on which the frame was received in MHz
+ * @buf: Action frame (header + body)
+ * @len: length of the frame data
+ * @gfp: context flags
+ * Returns %true if a user space application is responsible for rejecting the
+ *      unrecognized Action frame; %false if no such application is registered
+ *      (i.e., the driver is responsible for rejecting the unrecognized Action
+ *      frame)
+ *
+ * This function is called whenever an Action frame is received for a station
+ * mode interface, but is not processed in kernel.
+ */
+bool cfg80211_rx_action(struct net_device *dev, int freq, const u8 *buf,
+                        size_t len, gfp_t gfp);
+
+/**
+ * cfg80211_action_tx_status - notification of TX status for Action frame
+ * @dev: network device
+ * @cookie: Cookie returned by cfg80211_ops::action()
+ * @buf: Action frame (header + body)
+ * @len: length of the frame data
+ * @ack: Whether frame was acknowledged
+ * @gfp: context flags
+ *
+ * This function is called whenever an Action frame was requested to be
+ * transmitted with cfg80211_ops::action() to report the TX status of the
+ * transmission attempt.
+ */
+void cfg80211_action_tx_status(struct net_device *dev, u64 cookie,
+                               const u8 *buf, size_t len, bool ack, gfp_t gfp);
 
 #endif /* __NET_CFG80211_H */
diff --git a/include/net/dst.h b/include/net/dst.h
index 39c4a5963e12..ce078cda6b74 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -83,8 +83,6 @@ struct dst_entry {
          * (L1_CACHE_SIZE would be too much)
          */
 #ifdef CONFIG_64BIT
-        long                    __pad_to_align_refcnt[2];
-#else
         long                    __pad_to_align_refcnt[1];
 #endif
         /*
diff --git a/include/net/icmp.h b/include/net/icmp.h
index dfa72d4e8907..15b3dfe9fce8 100644
--- a/include/net/icmp.h
+++ b/include/net/icmp.h
@@ -28,7 +28,7 @@ struct icmp_err {
   unsigned      fatal:1;
 };
 
-extern struct icmp_err icmp_err_convert[];
+extern const struct icmp_err icmp_err_convert[];
 #define ICMP_INC_STATS(net, field)      SNMP_INC_STATS((net)->mib.icmp_statistics, field)
 #define ICMP_INC_STATS_BH(net, field)   SNMP_INC_STATS_BH((net)->mib.icmp_statistics, field)
 #define ICMPMSGOUT_INC_STATS(net, field)        SNMP_INC_STATS((net)->mib.icmpmsg_statistics, field+256)
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index 9d3d86aaccbb..af49f8ab7f81 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -198,6 +198,10 @@ enum ieee80211_radiotap_type {
         IEEE80211_RADIOTAP_TX_FLAGS = 15,
         IEEE80211_RADIOTAP_RTS_RETRIES = 16,
         IEEE80211_RADIOTAP_DATA_RETRIES = 17,
+
+        /* valid in every it_present bitmap, even vendor namespaces */
+        IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE = 29,
+        IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30,
         IEEE80211_RADIOTAP_EXT = 31
 };
 
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index e9d69d198495..545d8b059bef 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -157,7 +157,7 @@ struct inet6_dev {
 
         struct ifmcaddr6        *mc_list;
         struct ifmcaddr6        *mc_tomb;
-        rwlock_t                mc_lock;
+        spinlock_t              mc_lock;
         unsigned char           mc_qrv;
         unsigned char           mc_gq_running;
         unsigned char           mc_ifc_count;
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index bd4c53f75ac0..83fd34437cf1 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -122,10 +122,12 @@ struct inet_sock {
         __be32                  inet_saddr;
         __s16                   uc_ttl;
         __u16                   cmsg_flags;
-        struct ip_options       *opt;
         __be16                  inet_sport;
         __u16                   inet_id;
+
+        struct ip_options       *opt;
         __u8                    tos;
+        __u8                    min_ttl;
         __u8                    mc_ttl;
         __u8                    pmtudisc;
         __u8                    recverr:1,
diff --git a/include/net/ip.h b/include/net/ip.h
index fb63371c07a8..503994a38ed1 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -174,9 +174,9 @@ extern struct ipv4_config ipv4_config;
 #define NET_ADD_STATS_BH(net, field, adnd) SNMP_ADD_STATS_BH((net)->mib.net_statistics, field, adnd)
 #define NET_ADD_STATS_USER(net, field, adnd) SNMP_ADD_STATS_USER((net)->mib.net_statistics, field, adnd)
 
-extern unsigned long snmp_fold_field(void *mib[], int offt);
-extern int snmp_mib_init(void *ptr[2], size_t mibsize);
-extern void snmp_mib_free(void *ptr[2]);
+extern unsigned long snmp_fold_field(void __percpu *mib[], int offt);
+extern int snmp_mib_init(void __percpu *ptr[2], size_t mibsize);
+extern void snmp_mib_free(void __percpu *ptr[2]);
 
 extern struct local_ports {
         seqlock_t       lock;
@@ -352,8 +352,11 @@ enum ip_defrag_users {
         IP_DEFRAG_LOCAL_DELIVER,
         IP_DEFRAG_CALL_RA_CHAIN,
         IP_DEFRAG_CONNTRACK_IN,
+        __IP_DEFRAG_CONNTRACK_IN_END    = IP_DEFRAG_CONNTRACK_IN + USHORT_MAX,
         IP_DEFRAG_CONNTRACK_OUT,
+        __IP_DEFRAG_CONNTRACK_OUT_END   = IP_DEFRAG_CONNTRACK_OUT + USHORT_MAX,
         IP_DEFRAG_CONNTRACK_BRIDGE_IN,
+        __IP_DEFRAG_CONNTRACK_BRIDGE_IN = IP_DEFRAG_CONNTRACK_BRIDGE_IN + USHORT_MAX,
         IP_DEFRAG_VS_IN,
         IP_DEFRAG_VS_OUT,
         IP_DEFRAG_VS_FWD
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 257808188add..86f46c49e318 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -124,11 +124,13 @@ static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
 }
 
 struct fib6_walker_t {
-        struct fib6_walker_t *prev, *next;
+        struct list_head lh;
         struct fib6_node *root, *node;
         struct rt6_info *leaf;
         unsigned char state;
         unsigned char prune;
+        unsigned int skip;
+        unsigned int count;
         int (*func)(struct fib6_walker_t *);
         void *args;
 };
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 8dc3296b7bea..fe82b1e10a29 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -26,6 +26,11 @@
 #include <linux/ipv6.h>                 /* for struct ipv6hdr */
 #include <net/ipv6.h>                   /* for ipv6_addr_copy */
 
+
+/* Connections' size value needed by ip_vs_ctl.c */
+extern int ip_vs_conn_tab_size;
+
+
 struct ip_vs_iphdr {
         int len;
         __u8 protocol;
@@ -220,6 +225,26 @@ enum {
 };
 
 /*
+ *      SCTP State Values
+ */
+enum ip_vs_sctp_states {
+        IP_VS_SCTP_S_NONE,
+        IP_VS_SCTP_S_INIT_CLI,
+        IP_VS_SCTP_S_INIT_SER,
+        IP_VS_SCTP_S_INIT_ACK_CLI,
+        IP_VS_SCTP_S_INIT_ACK_SER,
+        IP_VS_SCTP_S_ECHO_CLI,
+        IP_VS_SCTP_S_ECHO_SER,
+        IP_VS_SCTP_S_ESTABLISHED,
+        IP_VS_SCTP_S_SHUT_CLI,
+        IP_VS_SCTP_S_SHUT_SER,
+        IP_VS_SCTP_S_SHUT_ACK_CLI,
+        IP_VS_SCTP_S_SHUT_ACK_SER,
+        IP_VS_SCTP_S_CLOSED,
+        IP_VS_SCTP_S_LAST
+};
+
+/*
  *      Delta sequence info structure
  *      Each ip_vs_conn has 2 (output AND input seq. changes).
  *      Only used in the VS/NAT.
@@ -592,17 +617,6 @@ extern void ip_vs_init_hash_table(struct list_head *table, int rows);
  *     (from ip_vs_conn.c)
  */
 
-/*
- *     IPVS connection entry hash table
- */
-#ifndef CONFIG_IP_VS_TAB_BITS
-#define CONFIG_IP_VS_TAB_BITS   12
-#endif
-
-#define IP_VS_CONN_TAB_BITS     CONFIG_IP_VS_TAB_BITS
-#define IP_VS_CONN_TAB_SIZE     (1 << IP_VS_CONN_TAB_BITS)
-#define IP_VS_CONN_TAB_MASK     (IP_VS_CONN_TAB_SIZE - 1)
-
 enum {
         IP_VS_DIR_INPUT = 0,
         IP_VS_DIR_OUTPUT,
@@ -747,7 +761,7 @@ extern struct ip_vs_protocol ip_vs_protocol_udp;
 extern struct ip_vs_protocol ip_vs_protocol_icmp;
 extern struct ip_vs_protocol ip_vs_protocol_esp;
 extern struct ip_vs_protocol ip_vs_protocol_ah;
-
+extern struct ip_vs_protocol ip_vs_protocol_sctp;
 
 /*
  *      Registering/unregistering scheduler functions
diff --git a/include/net/ipcomp.h b/include/net/ipcomp.h
index 2a1092abaa07..cc4f30cd7315 100644
--- a/include/net/ipcomp.h
+++ b/include/net/ipcomp.h
@@ -9,7 +9,7 @@ struct crypto_comp;
 
 struct ipcomp_data {
         u16 threshold;
-        struct crypto_comp **tfms;
+        struct crypto_comp * __percpu *tfms;
 };
 
 struct ip_comp_hdr;
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index ccab5946c830..e72fb10ce573 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -73,7 +73,6 @@
 #define IPV6_ADDR_SCOPE_MASK    0x00f0U
 
 #define IPV6_ADDR_MAPPED        0x1000U
-#define IPV6_ADDR_RESERVED      0x2000U /* reserved address space */
 
 /*
  *      Addr scopes
@@ -246,7 +245,9 @@ extern int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb);
 int ip6_frag_nqueues(struct net *net);
 int ip6_frag_mem(struct net *net);
 
-#define IPV6_FRAG_TIMEOUT       (60*HZ)         /* 60 seconds */
+#define IPV6_FRAG_HIGH_THRESH   (256 * 1024)    /* 262144 */
+#define IPV6_FRAG_LOW_THRESH    (192 * 1024)    /* 196608 */
+#define IPV6_FRAG_TIMEOUT       (60 * HZ)       /* 60 seconds */
 
 extern int __ipv6_addr_type(const struct in6_addr *addr);
 static inline int ipv6_addr_type(const struct in6_addr *addr)
@@ -353,8 +354,11 @@ struct inet_frag_queue;
 enum ip6_defrag_users {
         IP6_DEFRAG_LOCAL_DELIVER,
         IP6_DEFRAG_CONNTRACK_IN,
+        __IP6_DEFRAG_CONNTRACK_IN       = IP6_DEFRAG_CONNTRACK_IN + USHORT_MAX,
         IP6_DEFRAG_CONNTRACK_OUT,
+        __IP6_DEFRAG_CONNTRACK_OUT      = IP6_DEFRAG_CONNTRACK_OUT + USHORT_MAX,
         IP6_DEFRAG_CONNTRACK_BRIDGE_IN,
+        __IP6_DEFRAG_CONNTRACK_BRIDGE_IN = IP6_DEFRAG_CONNTRACK_BRIDGE_IN + USHORT_MAX,
 };
 
 struct ip6_create_arg {
diff --git a/include/net/llc.h b/include/net/llc.h
index 7940da1606e7..5503b74ab170 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -16,6 +16,9 @@
 #include <linux/if_ether.h>
 #include <linux/list.h>
 #include <linux/spinlock.h>
+#include <linux/rculist_nulls.h>
+#include <linux/hash.h>
+#include <linux/jhash.h>
 
 #include <asm/atomic.h>
 
@@ -31,6 +34,12 @@ struct llc_addr {
 #define LLC_SAP_STATE_INACTIVE  1
 #define LLC_SAP_STATE_ACTIVE    2
 
+#define LLC_SK_DEV_HASH_BITS 6
+#define LLC_SK_DEV_HASH_ENTRIES (1<<LLC_SK_DEV_HASH_BITS)
+
+#define LLC_SK_LADDR_HASH_BITS 6
+#define LLC_SK_LADDR_HASH_ENTRIES (1<<LLC_SK_LADDR_HASH_BITS)
+
 /**
  * struct llc_sap - Defines the SAP component
  *
@@ -53,18 +62,38 @@ struct llc_sap {
                                      struct net_device *orig_dev);
         struct llc_addr  laddr;
         struct list_head node;
-        struct {
-                rwlock_t          lock;
-                struct hlist_head list;
-        } sk_list;
+        spinlock_t sk_lock;
+        int sk_count;
+        struct hlist_nulls_head sk_laddr_hash[LLC_SK_LADDR_HASH_ENTRIES];
+        struct hlist_head sk_dev_hash[LLC_SK_DEV_HASH_ENTRIES];
 };
 
+static inline
+struct hlist_head *llc_sk_dev_hash(struct llc_sap *sap, int ifindex)
+{
+        return &sap->sk_dev_hash[ifindex % LLC_SK_DEV_HASH_ENTRIES];
+}
+
+static inline
+u32 llc_sk_laddr_hashfn(struct llc_sap *sap, const struct llc_addr *laddr)
+{
+        return hash_32(jhash(laddr->mac, sizeof(laddr->mac), 0),
+                       LLC_SK_LADDR_HASH_BITS);
+}
+
+static inline
+struct hlist_nulls_head *llc_sk_laddr_hash(struct llc_sap *sap,
+                                           const struct llc_addr *laddr)
+{
+        return &sap->sk_laddr_hash[llc_sk_laddr_hashfn(sap, laddr)];
+}
+
 #define LLC_DEST_INVALID         0      /* Invalid LLC PDU type */
 #define LLC_DEST_SAP             1      /* Type 1 goes here */
 #define LLC_DEST_CONN            2      /* Type 2 goes here */
 
 extern struct list_head llc_sap_list;
-extern rwlock_t llc_sap_list_lock;
+extern spinlock_t llc_sap_list_lock;
 
 extern int llc_rcv(struct sk_buff *skb, struct net_device *dev,
                    struct packet_type *pt, struct net_device *orig_dev);
diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
index e2374e34989f..2f97d8ddce92 100644
--- a/include/net/llc_conn.h
+++ b/include/net/llc_conn.h
@@ -76,6 +76,8 @@ struct llc_sock {
         u32                 rx_pdu_hdr;    /* used for saving header of last pdu
                                               received and caused sending FRMR.
                                               Used for resending FRMR */
+        u32                 cmsg_flags;
+        struct hlist_node   dev_hash_node;
 };
 
 static inline struct llc_sock *llc_sk(const struct sock *sk)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 0bf369752274..80eb7cc42ce9 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3,7 +3,7 @@
  *
  * Copyright 2002-2005, Devicescape Software, Inc.
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
- * Copyright 2007-2008  Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2007-2010  Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -107,25 +107,14 @@ enum ieee80211_max_queues {
  *      2^n-1 in the range 1..32767]
  * @cw_max: maximum contention window [like @cw_min]
  * @txop: maximum burst time in units of 32 usecs, 0 meaning disabled
+ * @uapsd: is U-APSD mode enabled for the queue
  */
 struct ieee80211_tx_queue_params {
         u16 txop;
         u16 cw_min;
         u16 cw_max;
         u8 aifs;
-};
-
-/**
- * struct ieee80211_tx_queue_stats - transmit queue statistics
- *
- * @len: number of packets in queue
- * @limit: queue length limit
- * @count: number of frames sent
- */
-struct ieee80211_tx_queue_stats {
-        unsigned int len;
-        unsigned int limit;
-        unsigned int count;
+        bool uapsd;
 };
 
 struct ieee80211_low_level_stats {
@@ -184,7 +173,8 @@ enum ieee80211_bss_change {
  * @use_short_slot: use short slot time (only relevant for ERP);
  *      if the hardware cannot handle this it must set the
  *      IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE hardware flag
- * @dtim_period: num of beacons before the next DTIM, for PSM
+ * @dtim_period: num of beacons before the next DTIM, for beaconing,
+ *      not valid in station mode (cf. hw conf ps_dtim_period)
  * @timestamp: beacon timestamp
  * @beacon_int: beacon interval
  * @assoc_capability: capabilities taken from assoc resp
@@ -255,9 +245,6 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_RATE_CTRL_PROBE: internal to mac80211, can be
  *      set by rate control algorithms to indicate probe rate, will
  *      be cleared for fragmented frames (except on the last fragment)
- * @IEEE80211_TX_INTFL_RCALGO: mac80211 internal flag, do not test or
- *      set this flag in the driver; indicates that the rate control
- *      algorithm was used and should be notified of TX status
  * @IEEE80211_TX_INTFL_NEED_TXPROCESSING: completely internal to mac80211,
  *      used to indicate that a pending frame requires TX processing before
  *      it can be sent out.
@@ -272,6 +259,14 @@ struct ieee80211_bss_conf {
  *      transmit function after the current frame, this can be used
  *      by drivers to kick the DMA queue only if unset or when the
  *      queue gets full.
+ * @IEEE80211_TX_INTFL_RETRANSMISSION: This frame is being retransmitted
+ *      after TX status because the destination was asleep, it must not
+ *      be modified again (no seqno assignment, crypto, etc.)
+ * @IEEE80211_TX_INTFL_HAS_RADIOTAP: This frame was injected and still
+ *      has a radiotap header at skb->data.
+ * @IEEE80211_TX_INTFL_NL80211_FRAME_TX: Frame was requested through nl80211
+ *      MLME command (internal to mac80211 to figure out whether to send TX
+ *      status to user space)
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -287,12 +282,14 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_STAT_AMPDU                 = BIT(10),
         IEEE80211_TX_STAT_AMPDU_NO_BACK         = BIT(11),
         IEEE80211_TX_CTL_RATE_CTRL_PROBE        = BIT(12),
-        IEEE80211_TX_INTFL_RCALGO               = BIT(13),
         IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
         IEEE80211_TX_INTFL_RETRIED              = BIT(15),
         IEEE80211_TX_INTFL_DONT_ENCRYPT         = BIT(16),
         IEEE80211_TX_CTL_PSPOLL_RESPONSE        = BIT(17),
         IEEE80211_TX_CTL_MORE_FRAMES            = BIT(18),
+        IEEE80211_TX_INTFL_RETRANSMISSION       = BIT(19),
+        IEEE80211_TX_INTFL_HAS_RADIOTAP         = BIT(20),
+        IEEE80211_TX_INTFL_NL80211_FRAME_TX     = BIT(21),
 };
 
 /**
@@ -571,7 +568,13 @@ struct ieee80211_rx_status {
  * @IEEE80211_CONF_MONITOR: there's a monitor interface present -- use this
  *      to determine for example whether to calculate timestamps for packets
  *      or not, do not use instead of filter flags!
- * @IEEE80211_CONF_PS: Enable 802.11 power save mode (managed mode only)
+ * @IEEE80211_CONF_PS: Enable 802.11 power save mode (managed mode only).
+ *      This is the power save mode defined by IEEE 802.11-2007 section 11.2,
+ *      meaning that the hardware still wakes up for beacons, is able to
+ *      transmit frames and receive the possible acknowledgment frames.
+ *      Not to be confused with hardware specific wakeup/sleep states,
+ *      driver is responsible for that. See the section "Powersave support"
+ *      for more.
  * @IEEE80211_CONF_IDLE: The device is running, but idle; if the flag is set
  *      the driver should be prepared to handle configuration requests but
  *      may turn the device off as much as possible. Typically, this flag will
@@ -595,8 +598,10 @@ enum ieee80211_conf_flags {
  * @IEEE80211_CONF_CHANGE_CHANNEL: the channel/channel_type changed
  * @IEEE80211_CONF_CHANGE_RETRY_LIMITS: retry limits changed
  * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
+ * @IEEE80211_CONF_CHANGE_SMPS: Spatial multiplexing powersave mode changed
  */
 enum ieee80211_conf_changed {
+        IEEE80211_CONF_CHANGE_SMPS              = BIT(1),
         IEEE80211_CONF_CHANGE_LISTEN_INTERVAL   = BIT(2),
         IEEE80211_CONF_CHANGE_MONITOR           = BIT(3),
         IEEE80211_CONF_CHANGE_PS                = BIT(4),
@@ -607,6 +612,25 @@ enum ieee80211_conf_changed {
 };
 
 /**
+ * enum ieee80211_smps_mode - spatial multiplexing power save mode
+ *
+ * @IEEE80211_SMPS_AUTOMATIC: automatic
+ * @IEEE80211_SMPS_OFF: off
+ * @IEEE80211_SMPS_STATIC: static
+ * @IEEE80211_SMPS_DYNAMIC: dynamic
+ * @IEEE80211_SMPS_NUM_MODES: internal, don't use
+ */
+enum ieee80211_smps_mode {
+        IEEE80211_SMPS_AUTOMATIC,
+        IEEE80211_SMPS_OFF,
+        IEEE80211_SMPS_STATIC,
+        IEEE80211_SMPS_DYNAMIC,
+
+        /* keep last */
+        IEEE80211_SMPS_NUM_MODES,
+};
+
+/**
  * struct ieee80211_conf - configuration of the device
  *
  * This struct indicates how the driver shall configure the hardware.
@@ -619,6 +643,9 @@ enum ieee80211_conf_changed {
  *      value will be only achievable between DTIM frames, the hardware
  *      needs to check for the multicast traffic bit in DTIM beacons.
  *      This variable is valid only when the CONF_PS flag is set.
+ * @ps_dtim_period: The DTIM period of the AP we're connected to, for use
+ *      in power saving. Power saving will not be enabled until a beacon
+ *      has been received and the DTIM period is known.
  * @dynamic_ps_timeout: The dynamic powersave timeout (in ms), see the
  *      powersave documentation below. This variable is valid only when
  *      the CONF_PS flag is set.
@@ -634,6 +661,10 @@ enum ieee80211_conf_changed {
  * @short_frame_max_tx_count: Maximum number of transmissions for a "short"
  *    frame, called "dot11ShortRetryLimit" in 802.11, but actually means the
  *    number of transmissions not the number of retries
+ *
+ * @smps_mode: spatial multiplexing powersave mode; note that
+ *      %IEEE80211_SMPS_STATIC is used when the device is not
+ *      configured for an HT channel
  */
 struct ieee80211_conf {
         u32 flags;
@@ -641,11 +672,13 @@ struct ieee80211_conf {
         int max_sleep_period;
 
         u16 listen_interval;
+        u8 ps_dtim_period;
 
         u8 long_frame_max_tx_count, short_frame_max_tx_count;
 
         struct ieee80211_channel *channel;
         enum nl80211_channel_type channel_type;
+        enum ieee80211_smps_mode smps_mode;
 };
 
 /**
@@ -657,12 +690,14 @@ struct ieee80211_conf {
  * @type: type of this virtual interface
  * @bss_conf: BSS configuration for this interface, either our own
  *      or the BSS we're associated to
+ * @addr: address of this interface
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *).
  */
 struct ieee80211_vif {
         enum nl80211_iftype type;
         struct ieee80211_bss_conf bss_conf;
+        u8 addr[ETH_ALEN];
         /* must be last */
         u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
 };
@@ -676,33 +711,6 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
 }
 
 /**
- * struct ieee80211_if_init_conf - initial configuration of an interface
- *
- * @vif: pointer to a driver-use per-interface structure. The pointer
- *      itself is also used for various functions including
- *      ieee80211_beacon_get() and ieee80211_get_buffered_bc().
- * @type: one of &enum nl80211_iftype constants. Determines the type of
- *      added/removed interface.
- * @mac_addr: pointer to MAC address of the interface. This pointer is valid
- *      until the interface is removed (i.e. it cannot be used after
- *      remove_interface() callback was called for this interface).
- *
- * This structure is used in add_interface() and remove_interface()
- * callbacks of &struct ieee80211_hw.
- *
- * When you allow multiple interfaces to be added to your PHY, take care
- * that the hardware can actually handle multiple MAC addresses. However,
- * also take care that when there's no interface left with mac_addr != %NULL
- * you remove the MAC address from the device to avoid acknowledging packets
- * in pure monitor mode.
- */
-struct ieee80211_if_init_conf {
-        enum nl80211_iftype type;
-        struct ieee80211_vif *vif;
-        void *mac_addr;
-};
-
-/**
  * enum ieee80211_key_alg - key algorithm
  * @ALG_WEP: WEP40 or WEP104
  * @ALG_TKIP: TKIP
@@ -797,7 +805,7 @@ enum set_key_cmd {
  * mac80211, any ieee80211_sta pointer you get access to must
  * either be protected by rcu_read_lock() explicitly or implicitly,
  * or you must take good care to not use such a pointer after a
- * call to your sta_notify callback that removed it.
+ * call to your sta_remove callback that removed it.
  *
  * @addr: MAC address
  * @aid: AID we assigned to the station if we're an AP
@@ -823,8 +831,8 @@ struct ieee80211_sta {
  * indicates addition and removal of a station to station table,
  * or if a associated station made a power state transition.
  *
- * @STA_NOTIFY_ADD: a station was added to the station table
- * @STA_NOTIFY_REMOVE: a station being removed from the station table
+ * @STA_NOTIFY_ADD: (DEPRECATED) a station was added to the station table
+ * @STA_NOTIFY_REMOVE: (DEPRECATED) a station being removed from the station table
  * @STA_NOTIFY_SLEEP: a station is now sleeping
  * @STA_NOTIFY_AWAKE: a sleeping station woke up
  */
@@ -926,6 +934,26 @@ enum ieee80211_tkip_key_type {
  * @IEEE80211_HW_BEACON_FILTER:
  *      Hardware supports dropping of irrelevant beacon frames to
  *      avoid waking up cpu.
+ *
+ * @IEEE80211_HW_SUPPORTS_STATIC_SMPS:
+ *      Hardware supports static spatial multiplexing powersave,
+ *      ie. can turn off all but one chain even on HT connections
+ *      that should be using more chains.
+ *
+ * @IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS:
+ *      Hardware supports dynamic spatial multiplexing powersave,
+ *      ie. can turn off all but one chain and then wake the rest
+ *      up as required after, for example, rts/cts handshake.
+ *
+ * @IEEE80211_HW_SUPPORTS_UAPSD:
+ *      Hardware supports Unscheduled Automatic Power Save Delivery
+ *      (U-APSD) in managed mode. The mode is configured with
+ *      conf_tx() operation.
+ *
+ * @IEEE80211_HW_REPORTS_TX_ACK_STATUS:
+ *      Hardware can provide ack status reports of Tx frames to
+ *      the stack.
+ *
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -943,6 +971,10 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_SUPPORTS_DYNAMIC_PS                = 1<<12,
         IEEE80211_HW_MFP_CAPABLE                        = 1<<13,
         IEEE80211_HW_BEACON_FILTER                      = 1<<14,
+        IEEE80211_HW_SUPPORTS_STATIC_SMPS               = 1<<15,
+        IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS              = 1<<16,
+        IEEE80211_HW_SUPPORTS_UAPSD                     = 1<<17,
+        IEEE80211_HW_REPORTS_TX_ACK_STATUS              = 1<<18,
 };
 
 /**
@@ -1121,18 +1153,24 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  *
  * mac80211 has support for various powersave implementations.
  *
- * First, it can support hardware that handles all powersaving by
- * itself, such hardware should simply set the %IEEE80211_HW_SUPPORTS_PS
- * hardware flag. In that case, it will be told about the desired
- * powersave mode depending on the association status, and the driver
- * must take care of sending nullfunc frames when necessary, i.e. when
- * entering and leaving powersave mode. The driver is required to look at
- * the AID in beacons and signal to the AP that it woke up when it finds
- * traffic directed to it. This mode supports dynamic PS by simply
- * enabling/disabling PS.
- *
- * Additionally, such hardware may set the %IEEE80211_HW_SUPPORTS_DYNAMIC_PS
- * flag to indicate that it can support dynamic PS mode itself (see below).
+ * First, it can support hardware that handles all powersaving by itself,
+ * such hardware should simply set the %IEEE80211_HW_SUPPORTS_PS hardware
+ * flag. In that case, it will be told about the desired powersave mode
+ * with the %IEEE80211_CONF_PS flag depending on the association status.
+ * The hardware must take care of sending nullfunc frames when necessary,
+ * i.e. when entering and leaving powersave mode. The hardware is required
+ * to look at the AID in beacons and signal to the AP that it woke up when
+ * it finds traffic directed to it.
+ *
+ * %IEEE80211_CONF_PS flag enabled means that the powersave mode defined in
+ * IEEE 802.11-2007 section 11.2 is enabled. This is not to be confused
+ * with hardware wakeup and sleep states. Driver is responsible for waking
+ * up the hardware before issueing commands to the hardware and putting it
+ * back to sleep at approriate times.
+ *
+ * When PS is enabled, hardware needs to wakeup for beacons and receive the
+ * buffered multicast/broadcast frames after the beacon. Also it must be
+ * possible to send frames and receive the acknowledment frame.
  *
  * Other hardware designs cannot send nullfunc frames by themselves and also
  * need software support for parsing the TIM bitmap. This is also supported
@@ -1140,14 +1178,35 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * %IEEE80211_HW_PS_NULLFUNC_STACK flags. The hardware is of course still
  * required to pass up beacons. The hardware is still required to handle
  * waking up for multicast traffic; if it cannot the driver must handle that
- * as best as it can, mac80211 is too slow.
- *
- * Dynamic powersave mode is an extension to normal powersave mode in which
- * the hardware stays awake for a user-specified period of time after sending
- * a frame so that reply frames need not be buffered and therefore delayed
- * to the next wakeup. This can either be supported by hardware, in which case
- * the driver needs to look at the @dynamic_ps_timeout hardware configuration
- * value, or by the stack if all nullfunc handling is in the stack.
+ * as best as it can, mac80211 is too slow to do that.
+ *
+ * Dynamic powersave is an extension to normal powersave in which the
+ * hardware stays awake for a user-specified period of time after sending a
+ * frame so that reply frames need not be buffered and therefore delayed to
+ * the next wakeup. It's compromise of getting good enough latency when
+ * there's data traffic and still saving significantly power in idle
+ * periods.
+ *
+ * Dynamic powersave is supported by simply mac80211 enabling and disabling
+ * PS based on traffic. Driver needs to only set %IEEE80211_HW_SUPPORTS_PS
+ * flag and mac80211 will handle everything automatically. Additionally,
+ * hardware having support for the dynamic PS feature may set the
+ * %IEEE80211_HW_SUPPORTS_DYNAMIC_PS flag to indicate that it can support
+ * dynamic PS mode itself. The driver needs to look at the
+ * @dynamic_ps_timeout hardware configuration value and use it that value
+ * whenever %IEEE80211_CONF_PS is set. In this case mac80211 will disable
+ * dynamic PS feature in stack and will just keep %IEEE80211_CONF_PS
+ * enabled whenever user has enabled powersave.
+ *
+ * Driver informs U-APSD client support by enabling
+ * %IEEE80211_HW_SUPPORTS_UAPSD flag. The mode is configured through the
+ * uapsd paramater in conf_tx() operation. Hardware needs to send the QoS
+ * Nullfunc frames and stay awake until the service period has ended. To
+ * utilize U-APSD, dynamic powersave is disabled for voip AC and all frames
+ * from that AC are transmitted with powersave enabled.
+ *
+ * Note: U-APSD client mode is not yet supported with
+ * %IEEE80211_HW_PS_NULLFUNC_STACK.
  */
 
 /**
@@ -1211,6 +1270,31 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  */
 
 /**
+ * DOC: Spatial multiplexing power save
+ *
+ * SMPS (Spatial multiplexing power save) is a mechanism to conserve
+ * power in an 802.11n implementation. For details on the mechanism
+ * and rationale, please refer to 802.11 (as amended by 802.11n-2009)
+ * "11.2.3 SM power save".
+ *
+ * The mac80211 implementation is capable of sending action frames
+ * to update the AP about the station's SMPS mode, and will instruct
+ * the driver to enter the specific mode. It will also announce the
+ * requested SMPS mode during the association handshake. Hardware
+ * support for this feature is required, and can be indicated by
+ * hardware flags.
+ *
+ * The default mode will be "automatic", which nl80211/cfg80211
+ * defines to be dynamic SMPS in (regular) powersave, and SMPS
+ * turned off otherwise.
+ *
+ * To support this feature, the driver must set the appropriate
+ * hardware support flags, and handle the SMPS flag to the config()
+ * operation. It will then with this mechanism be instructed to
+ * enter the requested SMPS mode while associated to an HT AP.
+ */
+
+/**
  * DOC: Frame filtering
  *
  * mac80211 requires to see many management frames for proper
@@ -1347,7 +1431,7 @@ enum ieee80211_ampdu_mlme_action {
  *      When the device is started it should not have a MAC address
  *      to avoid acknowledging frames before a non-monitor device
  *      is added.
- *      Must be implemented.
+ *      Must be implemented and can sleep.
  *
  * @stop: Called after last netdevice attached to the hardware
  *      is disabled. This should turn off the hardware (at least
@@ -1355,7 +1439,7 @@ enum ieee80211_ampdu_mlme_action {
  *      May be called right after add_interface if that rejects
  *      an interface. If you added any work onto the mac80211 workqueue
  *      you should ensure to cancel it on this callback.
- *      Must be implemented.
+ *      Must be implemented and can sleep.
  *
  * @add_interface: Called when a netdevice attached to the hardware is
  *      enabled. Because it is not called for monitor mode devices, @start
@@ -1365,7 +1449,7 @@ enum ieee80211_ampdu_mlme_action {
  *      interface is given in the conf parameter.
  *      The callback may refuse to add an interface by returning a
  *      negative error code (which will be seen in userspace.)
- *      Must be implemented.
+ *      Must be implemented and can sleep.
  *
  * @remove_interface: Notifies a driver that an interface is going down.
  *      The @stop callback is called after this if it is the last interface
@@ -1374,19 +1458,20 @@ enum ieee80211_ampdu_mlme_action {
  *      must be cleared so the device no longer acknowledges packets,
  *      the mac_addr member of the conf structure is, however, set to the
  *      MAC address of the device going away.
- *      Hence, this callback must be implemented.
+ *      Hence, this callback must be implemented. It can sleep.
  *
  * @config: Handler for configuration requests. IEEE 802.11 code calls this
  *      function to change hardware configuration, e.g., channel.
  *      This function should never fail but returns a negative error code
- *      if it does.
+ *      if it does. The callback can sleep.
  *
  * @bss_info_changed: Handler for configuration requests related to BSS
  *      parameters that may vary during BSS's lifespan, and may affect low
  *      level driver (e.g. assoc/disassoc status, erp parameters).
  *      This function should not be used if no BSS has been set, unless
  *      for association indication. The @changed parameter indicates which
- *      of the bss parameters has changed when a call is made.
+ *      of the bss parameters has changed when a call is made. The callback
+ *      can sleep.
  *
  * @prepare_multicast: Prepare for multicast filter configuration.
  *      This callback is optional, and its return value is passed
@@ -1394,20 +1479,22 @@ enum ieee80211_ampdu_mlme_action {
  *
  * @configure_filter: Configure the device's RX filter.
  *      See the section "Frame filtering" for more information.
- *      This callback must be implemented.
+ *      This callback must be implemented and can sleep.
  *
  * @set_tim: Set TIM bit. mac80211 calls this function when a TIM bit
  *      must be set or cleared for a given STA. Must be atomic.
  *
  * @set_key: See the section "Hardware crypto acceleration"
- *      This callback can sleep, and is only called between add_interface
- *      and remove_interface calls, i.e. while the given virtual interface
+ *      This callback is only called between add_interface and
+ *      remove_interface calls, i.e. while the given virtual interface
  *      is enabled.
  *      Returns a negative error code if the key can't be added.
+ *      The callback can sleep.
  *
  * @update_tkip_key: See the section "Hardware crypto acceleration"
  *      This callback will be called in the context of Rx. Called for drivers
  *      which set IEEE80211_KEY_FLAG_TKIP_REQ_RX_P1_KEY.
+ *      The callback must be atomic.
  *
  * @hw_scan: Ask the hardware to service the scan request, no need to start
  *      the scan state machine in stack. The scan must honour the channel
@@ -1421,53 +1508,64 @@ enum ieee80211_ampdu_mlme_action {
  *      When the scan finishes, ieee80211_scan_completed() must be called;
  *      note that it also must be called when the scan cannot finish due to
  *      any error unless this callback returned a negative error code.
+ *      The callback can sleep.
  *
  * @sw_scan_start: Notifier function that is called just before a software scan
  *      is started. Can be NULL, if the driver doesn't need this notification.
+ *      The callback can sleep.
  *
- * @sw_scan_complete: Notifier function that is called just after a software scan
- *      finished. Can be NULL, if the driver doesn't need this notification.
+ * @sw_scan_complete: Notifier function that is called just after a
+ *      software scan finished. Can be NULL, if the driver doesn't need
+ *      this notification.
+ *      The callback can sleep.
  *
  * @get_stats: Return low-level statistics.
  *      Returns zero if statistics are available.
+ *      The callback can sleep.
  *
  * @get_tkip_seq: If your device implements TKIP encryption in hardware this
  *      callback should be provided to read the TKIP transmit IVs (both IV32
  *      and IV16) for the given key from hardware.
+ *      The callback must be atomic.
  *
  * @set_rts_threshold: Configuration of RTS threshold (if device needs it)
+ *      The callback can sleep.
+ *
+ * @sta_add: Notifies low level driver about addition of an associated station,
+ *      AP, IBSS/WDS/mesh peer etc. This callback can sleep.
+ *
+ * @sta_remove: Notifies low level driver about removal of an associated
+ *      station, AP, IBSS/WDS/mesh peer etc. This callback can sleep.
  *
- * @sta_notify: Notifies low level driver about addition, removal or power
- *      state transition of an associated station, AP,  IBSS/WDS/mesh peer etc.
- *      Must be atomic.
+ * @sta_notify: Notifies low level driver about power state transition of an
+ *      associated station, AP,  IBSS/WDS/mesh peer etc. Must be atomic.
  *
  * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
  *      bursting) for a hardware TX queue.
  *      Returns a negative error code on failure.
- *
- * @get_tx_stats: Get statistics of the current TX queue status. This is used
- *      to get number of currently queued packets (queue length), maximum queue
- *      size (limit), and total number of packets sent using each TX queue
- *      (count). The 'stats' pointer points to an array that has hw->queues
- *      items.
+ *      The callback can sleep.
  *
  * @get_tsf: Get the current TSF timer value from firmware/hardware. Currently,
  *      this is only used for IBSS mode BSSID merging and debugging. Is not a
  *      required function.
+ *      The callback can sleep.
  *
  * @set_tsf: Set the TSF timer to the specified value in the firmware/hardware.
  *      Currently, this is only used for IBSS mode debugging. Is not a
  *      required function.
+ *      The callback can sleep.
  *
  * @reset_tsf: Reset the TSF timer and allow firmware/hardware to synchronize
  *      with other STAs in the IBSS. This is only used in IBSS mode. This
  *      function is optional if the firmware/hardware takes full care of
  *      TSF synchronization.
+ *      The callback can sleep.
  *
  * @tx_last_beacon: Determine whether the last IBSS beacon was sent by us.
  *      This is needed only for IBSS mode and the result of this function is
  *      used to determine whether to reply to Probe Requests.
  *      Returns non-zero if this device sent the last beacon.
+ *      The callback can sleep.
  *
  * @ampdu_action: Perform a certain A-MPDU action
  *      The RA/TID combination determines the destination and TID we want
@@ -1476,21 +1574,32 @@ enum ieee80211_ampdu_mlme_action {
  *      is the first frame we expect to perform the action on. Notice
  *      that TX/RX_STOP can pass NULL for this parameter.
  *      Returns a negative error code on failure.
+ *      The callback must be atomic.
  *
  * @rfkill_poll: Poll rfkill hardware state. If you need this, you also
  *      need to set wiphy->rfkill_poll to %true before registration,
  *      and need to call wiphy_rfkill_set_hw_state() in the callback.
+ *      The callback can sleep.
+ *
+ * @set_coverage_class: Set slot time for given coverage class as specified
+ *      in IEEE 802.11-2007 section 17.3.8.6 and modify ACK timeout
+ *      accordingly. This callback is not required and may sleep.
  *
  * @testmode_cmd: Implement a cfg80211 test mode command.
+ *      The callback can sleep.
+ *
+ * @flush: Flush all pending frames from the hardware queue, making sure
+ *      that the hardware queues are empty. If the parameter @drop is set
+ *      to %true, pending frames may be dropped. The callback can sleep.
  */
 struct ieee80211_ops {
         int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
         int (*start)(struct ieee80211_hw *hw);
         void (*stop)(struct ieee80211_hw *hw);
         int (*add_interface)(struct ieee80211_hw *hw,
-                             struct ieee80211_if_init_conf *conf);
+                             struct ieee80211_vif *vif);
         void (*remove_interface)(struct ieee80211_hw *hw,
-                                 struct ieee80211_if_init_conf *conf);
+                                 struct ieee80211_vif *vif);
         int (*config)(struct ieee80211_hw *hw, u32 changed);
         void (*bss_info_changed)(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
@@ -1508,8 +1617,10 @@ struct ieee80211_ops {
                        struct ieee80211_vif *vif, struct ieee80211_sta *sta,
                        struct ieee80211_key_conf *key);
         void (*update_tkip_key)(struct ieee80211_hw *hw,
-                        struct ieee80211_key_conf *conf, const u8 *address,
-                        u32 iv32, u16 *phase1key);
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_key_conf *conf,
+                                struct ieee80211_sta *sta,
+                                u32 iv32, u16 *phase1key);
         int (*hw_scan)(struct ieee80211_hw *hw,
                        struct cfg80211_scan_request *req);
         void (*sw_scan_start)(struct ieee80211_hw *hw);
@@ -1519,12 +1630,14 @@ struct ieee80211_ops {
         void (*get_tkip_seq)(struct ieee80211_hw *hw, u8 hw_key_idx,
                              u32 *iv32, u16 *iv16);
         int (*set_rts_threshold)(struct ieee80211_hw *hw, u32 value);
+        int (*sta_add)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta);
+        int (*sta_remove)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                          struct ieee80211_sta *sta);
         void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         enum sta_notify_cmd, struct ieee80211_sta *sta);
         int (*conf_tx)(struct ieee80211_hw *hw, u16 queue,
                        const struct ieee80211_tx_queue_params *params);
-        int (*get_tx_stats)(struct ieee80211_hw *hw,
-                            struct ieee80211_tx_queue_stats *stats);
         u64 (*get_tsf)(struct ieee80211_hw *hw);
         void (*set_tsf)(struct ieee80211_hw *hw, u64 tsf);
         void (*reset_tsf)(struct ieee80211_hw *hw);
@@ -1535,9 +1648,11 @@ struct ieee80211_ops {
                             struct ieee80211_sta *sta, u16 tid, u16 *ssn);
 
         void (*rfkill_poll)(struct ieee80211_hw *hw);
+        void (*set_coverage_class)(struct ieee80211_hw *hw, u8 coverage_class);
 #ifdef CONFIG_NL80211_TESTMODE
         int (*testmode_cmd)(struct ieee80211_hw *hw, void *data, int len);
 #endif
+        void (*flush)(struct ieee80211_hw *hw, bool drop);
 };
 
 /**
@@ -1777,7 +1892,7 @@ void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
 /**
  * ieee80211_beacon_get_tim - beacon generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @tim_offset: pointer to variable that will receive the TIM IE offset.
  *      Set to 0 if invalid (in non-AP modes).
  * @tim_length: pointer to variable that will receive the TIM IE length,
@@ -1805,7 +1920,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 /**
  * ieee80211_beacon_get - beacon generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
  * See ieee80211_beacon_get_tim().
  */
@@ -1816,9 +1931,56 @@ static inline struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
 }
 
 /**
+ * ieee80211_pspoll_get - retrieve a PS Poll template
+ * @hw: pointer obtained from ieee80211_alloc_hw().
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * Creates a PS Poll a template which can, for example, uploaded to
+ * hardware. The template must be updated after association so that correct
+ * AID, BSSID and MAC address is used.
+ *
+ * Note: Caller (or hardware) is responsible for setting the
+ * &IEEE80211_FCTL_PM bit.
+ */
+struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif);
+
+/**
+ * ieee80211_nullfunc_get - retrieve a nullfunc template
+ * @hw: pointer obtained from ieee80211_alloc_hw().
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * Creates a Nullfunc template which can, for example, uploaded to
+ * hardware. The template must be updated after association so that correct
+ * BSSID and address is used.
+ *
+ * Note: Caller (or hardware) is responsible for setting the
+ * &IEEE80211_FCTL_PM bit as well as Duration and Sequence Control fields.
+ */
+struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif);
+
+/**
+ * ieee80211_probereq_get - retrieve a Probe Request template
+ * @hw: pointer obtained from ieee80211_alloc_hw().
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @ssid: SSID buffer
+ * @ssid_len: length of SSID
+ * @ie: buffer containing all IEs except SSID for the template
+ * @ie_len: length of the IE buffer
+ *
+ * Creates a Probe Request template which can, for example, be uploaded to
+ * hardware.
+ */
+struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       const u8 *ssid, size_t ssid_len,
+                                       const u8 *ie, size_t ie_len);
+
+/**
  * ieee80211_rts_get - RTS frame generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @frame: pointer to the frame that is going to be protected by the RTS.
  * @frame_len: the frame length (in octets).
  * @frame_txctl: &struct ieee80211_tx_info of the frame.
@@ -1837,7 +1999,7 @@ void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 /**
  * ieee80211_rts_duration - Get the duration field for an RTS frame
  * @hw: pointer obtained from ieee80211_alloc_hw().
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @frame_len: the length of the frame that is going to be protected by the RTS.
  * @frame_txctl: &struct ieee80211_tx_info of the frame.
  *
@@ -1852,7 +2014,7 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
 /**
  * ieee80211_ctstoself_get - CTS-to-self frame generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @frame: pointer to the frame that is going to be protected by the CTS-to-self.
  * @frame_len: the frame length (in octets).
  * @frame_txctl: &struct ieee80211_tx_info of the frame.
@@ -1872,7 +2034,7 @@ void ieee80211_ctstoself_get(struct ieee80211_hw *hw,
 /**
  * ieee80211_ctstoself_duration - Get the duration field for a CTS-to-self frame
  * @hw: pointer obtained from ieee80211_alloc_hw().
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @frame_len: the length of the frame that is going to be protected by the CTS-to-self.
  * @frame_txctl: &struct ieee80211_tx_info of the frame.
  *
@@ -1888,7 +2050,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 /**
  * ieee80211_generic_frame_duration - Calculate the duration field for a frame
  * @hw: pointer obtained from ieee80211_alloc_hw().
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @frame_len: the length of the frame.
  * @rate: the rate at which the frame is going to be transmitted.
  *
@@ -1903,7 +2065,7 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
 /**
  * ieee80211_get_buffered_bc - accessing buffered broadcast and multicast frames
  * @hw: pointer as obtained from ieee80211_alloc_hw().
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
  * Function for accessing buffered broadcast and multicast frames. If
  * hardware/firmware does not implement buffering of broadcast/multicast
@@ -2071,7 +2233,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, u16 tid);
 
 /**
  * ieee80211_start_tx_ba_cb - low level driver ready to aggregate.
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback
  * @ra: receiver address of the BA session recipient.
  * @tid: the TID to BA on.
  *
@@ -2082,7 +2244,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
 
 /**
  * ieee80211_start_tx_ba_cb_irqsafe - low level driver ready to aggregate.
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback
  * @ra: receiver address of the BA session recipient.
  * @tid: the TID to BA on.
  *
@@ -2110,7 +2272,7 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *sta, u16 tid,
 
 /**
  * ieee80211_stop_tx_ba_cb - low level driver ready to stop aggregate.
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback
  * @ra: receiver address of the BA session recipient.
  * @tid: the desired TID to BA on.
  *
@@ -2121,7 +2283,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
 
 /**
  * ieee80211_stop_tx_ba_cb_irqsafe - low level driver ready to stop aggregate.
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback
  * @ra: receiver address of the BA session recipient.
  * @tid: the desired TID to BA on.
  *
@@ -2200,7 +2362,7 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
 /**
  * ieee80211_beacon_loss - inform hardware does not receive beacons
  *
- * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
  * When beacon filtering is enabled with IEEE80211_HW_BEACON_FILTERING and
  * IEEE80211_CONF_PS is set, the driver needs to inform whenever the
@@ -2234,8 +2396,12 @@ enum rate_control_changed {
  * @short_preamble: whether mac80211 will request short-preamble transmission
  *      if the selected rate supports it
  * @max_rate_idx: user-requested maximum rate (not MCS for now)
+ *      (deprecated; this will be removed once drivers get updated to use
+ *      rate_idx_mask)
+ * @rate_idx_mask: user-requested rate mask (not MCS for now)
  * @skb: the skb that will be transmitted, the control information in it needs
  *      to be filled in
+ * @ap: whether this frame is sent out in AP mode
  */
 struct ieee80211_tx_rate_control {
         struct ieee80211_hw *hw;
@@ -2245,6 +2411,8 @@ struct ieee80211_tx_rate_control {
         struct ieee80211_tx_rate reported_rate;
         bool rts, short_preamble;
         u8 max_rate_idx;
+        u32 rate_idx_mask;
+        bool ap;
 };
 
 struct rate_control_ops {
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index b0173202cad9..da1d58be31b7 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -164,7 +164,7 @@ struct neigh_table {
         rwlock_t                lock;
         unsigned long           last_rand;
         struct kmem_cache               *kmem_cachep;
-        struct neigh_statistics *stats;
+        struct neigh_statistics __percpu *stats;
         struct neighbour        **hash_buckets;
         unsigned int            hash_mask;
         __u32                   hash_rnd;
@@ -251,7 +251,6 @@ extern void neigh_seq_stop(struct seq_file *, void *);
 
 extern int                      neigh_sysctl_register(struct net_device *dev, 
                                                       struct neigh_parms *p,
-                                                      int p_id, int pdev_id,
                                                       char *p_name,
                                                       proc_handler *proc_handler);
 extern void                     neigh_sysctl_unregister(struct neigh_parms *p);
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index f307e133d14c..82b7be4db89a 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -81,6 +81,8 @@ struct net {
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
         struct netns_ct         ct;
 #endif
+        struct sock             *nfnl;
+        struct sock             *nfnl_stash;
 #endif
 #ifdef CONFIG_XFRM
         struct netns_xfrm       xfrm;
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index a0904adfb8f7..bde095f7e845 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -70,7 +70,7 @@ union nf_conntrack_help {
 struct nf_conntrack_helper;
 
 /* Must be kept in sync with the classes defined by helpers */
-#define NF_CT_MAX_EXPECT_CLASSES        3
+#define NF_CT_MAX_EXPECT_CLASSES        4
 
 /* nf_conn feature for connections that have a helper */
 struct nf_conn_help {
@@ -198,7 +198,8 @@ extern void *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced, int null
 extern void nf_ct_free_hashtable(void *hash, int vmalloced, unsigned int size);
 
 extern struct nf_conntrack_tuple_hash *
-__nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple);
+__nf_conntrack_find(struct net *net, u16 zone,
+                    const struct nf_conntrack_tuple *tuple);
 
 extern void nf_conntrack_hash_insert(struct nf_conn *ct);
 extern void nf_ct_delete_from_lists(struct nf_conn *ct);
@@ -267,11 +268,16 @@ extern void
 nf_ct_iterate_cleanup(struct net *net, int (*iter)(struct nf_conn *i, void *data), void *data);
 extern void nf_conntrack_free(struct nf_conn *ct);
 extern struct nf_conn *
-nf_conntrack_alloc(struct net *net,
+nf_conntrack_alloc(struct net *net, u16 zone,
                    const struct nf_conntrack_tuple *orig,
                    const struct nf_conntrack_tuple *repl,
                    gfp_t gfp);
 
+static inline int nf_ct_is_template(const struct nf_conn *ct)
+{
+        return test_bit(IPS_TEMPLATE_BIT, &ct->status);
+}
+
 /* It's confirmed if it is, or has been in the hash table. */
 static inline int nf_ct_is_confirmed(struct nf_conn *ct)
 {
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 5a449b44ba33..dffde8e6920e 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -49,7 +49,8 @@ nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
 
 /* Find a connection corresponding to a tuple. */
 extern struct nf_conntrack_tuple_hash *
-nf_conntrack_find_get(struct net *net, const struct nf_conntrack_tuple *tuple);
+nf_conntrack_find_get(struct net *net, u16 zone,
+                      const struct nf_conntrack_tuple *tuple);
 
 extern int __nf_conntrack_confirm(struct sk_buff *skb);
 
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index 475facc3051a..96ba5f7dcab6 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -12,27 +12,12 @@
 #include <linux/netfilter/nf_conntrack_tuple_common.h>
 #include <net/netfilter/nf_conntrack_extend.h>
 
-/* Connection tracking event types */
-enum ip_conntrack_events {
-        IPCT_NEW                = 0,    /* new conntrack */
-        IPCT_RELATED            = 1,    /* related conntrack */
-        IPCT_DESTROY            = 2,    /* destroyed conntrack */
-        IPCT_STATUS             = 3,    /* status has changed */
-        IPCT_PROTOINFO          = 4,    /* protocol information has changed */
-        IPCT_HELPER             = 5,    /* new helper has been set */
-        IPCT_MARK               = 6,    /* new mark has been set */
-        IPCT_NATSEQADJ          = 7,    /* NAT is doing sequence adjustment */
-        IPCT_SECMARK            = 8,    /* new security mark has been set */
-};
-
-enum ip_conntrack_expect_events {
-        IPEXP_NEW               = 0,    /* new expectation */
-};
-
 struct nf_conntrack_ecache {
-        unsigned long cache;            /* bitops want long */
-        unsigned long missed;           /* missed events */
-        u32 pid;                        /* netlink pid of destroyer */
+        unsigned long cache;    /* bitops want long */
+        unsigned long missed;   /* missed events */
+        u16 ctmask;             /* bitmask of ct events to be delivered */
+        u16 expmask;            /* bitmask of expect events to be delivered */
+        u32 pid;                /* netlink pid of destroyer */
 };
 
 static inline struct nf_conntrack_ecache *
@@ -42,14 +27,24 @@ nf_ct_ecache_find(const struct nf_conn *ct)
 }
 
 static inline struct nf_conntrack_ecache *
-nf_ct_ecache_ext_add(struct nf_conn *ct, gfp_t gfp)
+nf_ct_ecache_ext_add(struct nf_conn *ct, u16 ctmask, u16 expmask, gfp_t gfp)
 {
         struct net *net = nf_ct_net(ct);
+        struct nf_conntrack_ecache *e;
 
-        if (!net->ct.sysctl_events)
+        if (!ctmask && !expmask && net->ct.sysctl_events) {
+                ctmask = ~0;
+                expmask = ~0;
+        }
+        if (!ctmask && !expmask)
                 return NULL;
 
-        return nf_ct_ext_add(ct, NF_CT_EXT_ECACHE, gfp);
+        e = nf_ct_ext_add(ct, NF_CT_EXT_ECACHE, gfp);
+        if (e) {
+                e->ctmask  = ctmask;
+                e->expmask = expmask;
+        }
+        return e;
 };
 
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
@@ -82,6 +77,9 @@ nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
         if (e == NULL)
                 return;
 
+        if (!(e->ctmask & (1 << event)))
+                return;
+
         set_bit(event, &e->cache);
 }
 
@@ -92,7 +90,6 @@ nf_conntrack_eventmask_report(unsigned int eventmask,
                               int report)
 {
         int ret = 0;
-        struct net *net = nf_ct_net(ct);
         struct nf_ct_event_notifier *notify;
         struct nf_conntrack_ecache *e;
 
@@ -101,9 +98,6 @@ nf_conntrack_eventmask_report(unsigned int eventmask,
         if (notify == NULL)
                 goto out_unlock;
 
-        if (!net->ct.sysctl_events)
-                goto out_unlock;
-
         e = nf_ct_ecache_find(ct);
         if (e == NULL)
                 goto out_unlock;
@@ -117,6 +111,9 @@ nf_conntrack_eventmask_report(unsigned int eventmask,
                 /* This is a resent of a destroy event? If so, skip missed */
                 unsigned long missed = e->pid ? 0 : e->missed;
 
+                if (!((eventmask | missed) & e->ctmask))
+                        goto out_unlock;
+
                 ret = notify->fcn(eventmask | missed, &item);
                 if (unlikely(ret < 0 || missed)) {
                         spin_lock_bh(&ct->lock);
@@ -172,18 +169,19 @@ nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
                           u32 pid,
                           int report)
 {
-        struct net *net = nf_ct_exp_net(exp);
         struct nf_exp_event_notifier *notify;
+        struct nf_conntrack_ecache *e;
 
         rcu_read_lock();
         notify = rcu_dereference(nf_expect_event_cb);
         if (notify == NULL)
                 goto out_unlock;
 
-        if (!net->ct.sysctl_events)
+        e = nf_ct_ecache_find(exp->master);
+        if (e == NULL)
                 goto out_unlock;
 
-        {
+        if (e->expmask & (1 << event)) {
                 struct nf_exp_event item = {
                         .exp    = exp,
                         .pid    = pid,
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index 9a2b9cb52271..11e815084fcf 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -56,16 +56,13 @@ struct nf_conntrack_expect {
 
 static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
 {
-#ifdef CONFIG_NET_NS
-        return exp->master->ct_net;     /* by definition */
-#else
-        return &init_net;
-#endif
+        return nf_ct_net(exp->master);
 }
 
 struct nf_conntrack_expect_policy {
         unsigned int    max_expected;
         unsigned int    timeout;
+        const char      *name;
 };
 
 #define NF_CT_EXPECT_CLASS_DEFAULT      0
@@ -77,13 +74,16 @@ int nf_conntrack_expect_init(struct net *net);
 void nf_conntrack_expect_fini(struct net *net);
 
 struct nf_conntrack_expect *
-__nf_ct_expect_find(struct net *net, const struct nf_conntrack_tuple *tuple);
+__nf_ct_expect_find(struct net *net, u16 zone,
+                    const struct nf_conntrack_tuple *tuple);
 
 struct nf_conntrack_expect *
-nf_ct_expect_find_get(struct net *net, const struct nf_conntrack_tuple *tuple);
+nf_ct_expect_find_get(struct net *net, u16 zone,
+                      const struct nf_conntrack_tuple *tuple);
 
 struct nf_conntrack_expect *
-nf_ct_find_expectation(struct net *net, const struct nf_conntrack_tuple *tuple);
+nf_ct_find_expectation(struct net *net, u16 zone,
+                       const struct nf_conntrack_tuple *tuple);
 
 void nf_ct_unlink_expect(struct nf_conntrack_expect *exp);
 void nf_ct_remove_expectations(struct nf_conn *ct);
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index e192dc17c583..2d2a1f9a61d8 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -8,6 +8,7 @@ enum nf_ct_ext_id {
         NF_CT_EXT_NAT,
         NF_CT_EXT_ACCT,
         NF_CT_EXT_ECACHE,
+        NF_CT_EXT_ZONE,
         NF_CT_EXT_NUM,
 };
 
@@ -15,6 +16,7 @@ enum nf_ct_ext_id {
 #define NF_CT_EXT_NAT_TYPE struct nf_conn_nat
 #define NF_CT_EXT_ACCT_TYPE struct nf_conn_counter
 #define NF_CT_EXT_ECACHE_TYPE struct nf_conntrack_ecache
+#define NF_CT_EXT_ZONE_TYPE struct nf_conntrack_zone
 
 /* Extensions: optional stuff which isn't permanently in struct. */
 struct nf_ct_ext {
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index d015de92e03f..32c305dbdab6 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -40,14 +40,18 @@ struct nf_conntrack_helper {
 };
 
 extern struct nf_conntrack_helper *
-__nf_conntrack_helper_find_byname(const char *name);
+__nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum);
+
+extern struct nf_conntrack_helper *
+nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum);
 
 extern int nf_conntrack_helper_register(struct nf_conntrack_helper *);
 extern void nf_conntrack_helper_unregister(struct nf_conntrack_helper *);
 
 extern struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp);
 
-extern int __nf_ct_try_assign_helper(struct nf_conn *ct, gfp_t flags);
+extern int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
+                                     gfp_t flags);
 
 extern void nf_ct_helper_destroy(struct nf_conn *ct);
 
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index ca6dcf3445ab..e3d3ee3c06a2 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -49,8 +49,8 @@ struct nf_conntrack_l4proto {
         /* Called when a conntrack entry is destroyed */
         void (*destroy)(struct nf_conn *ct);
 
-        int (*error)(struct net *net, struct sk_buff *skb, unsigned int dataoff,
-                     enum ip_conntrack_info *ctinfo,
+        int (*error)(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
+                     unsigned int dataoff, enum ip_conntrack_info *ctinfo,
                      u_int8_t pf, unsigned int hooknum);
 
         /* Print out the per-protocol part of the tuple. Return like seq_* */
diff --git a/include/net/netfilter/nf_conntrack_zones.h b/include/net/netfilter/nf_conntrack_zones.h
new file mode 100644
index 000000000000..034efe8d45a5
--- /dev/null
+++ b/include/net/netfilter/nf_conntrack_zones.h
@@ -0,0 +1,25 @@
+#ifndef _NF_CONNTRACK_ZONES_H
+#define _NF_CONNTRACK_ZONES_H
+
+#define NF_CT_DEFAULT_ZONE      0
+
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#include <net/netfilter/nf_conntrack_extend.h>
+
+struct nf_conntrack_zone {
+        u16     id;
+};
+
+static inline u16 nf_ct_zone(const struct nf_conn *ct)
+{
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+        struct nf_conntrack_zone *nf_ct_zone;
+        nf_ct_zone = nf_ct_ext_find(ct, NF_CT_EXT_ZONE);
+        if (nf_ct_zone)
+                return nf_ct_zone->id;
+#endif
+        return NF_CT_DEFAULT_ZONE;
+}
+
+#endif /* CONFIG_NF_CONNTRACK || CONFIG_NF_CONNTRACK_MODULE */
+#endif /* _NF_CONNTRACK_ZONES_H */
diff --git a/include/net/netfilter/nf_nat_helper.h b/include/net/netfilter/nf_nat_helper.h
index 4222220920a5..02bb6c29dc3d 100644
--- a/include/net/netfilter/nf_nat_helper.h
+++ b/include/net/netfilter/nf_nat_helper.h
@@ -7,13 +7,27 @@
 struct sk_buff;
 
 /* These return true or false. */
-extern int nf_nat_mangle_tcp_packet(struct sk_buff *skb,
-                                    struct nf_conn *ct,
-                                    enum ip_conntrack_info ctinfo,
-                                    unsigned int match_offset,
-                                    unsigned int match_len,
-                                    const char *rep_buffer,
-                                    unsigned int rep_len);
+extern int __nf_nat_mangle_tcp_packet(struct sk_buff *skb,
+                                      struct nf_conn *ct,
+                                      enum ip_conntrack_info ctinfo,
+                                      unsigned int match_offset,
+                                      unsigned int match_len,
+                                      const char *rep_buffer,
+                                      unsigned int rep_len, bool adjust);
+
+static inline int nf_nat_mangle_tcp_packet(struct sk_buff *skb,
+                                           struct nf_conn *ct,
+                                           enum ip_conntrack_info ctinfo,
+                                           unsigned int match_offset,
+                                           unsigned int match_len,
+                                           const char *rep_buffer,
+                                           unsigned int rep_len)
+{
+        return __nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
+                                          match_offset, match_len,
+                                          rep_buffer, rep_len, true);
+}
+
 extern int nf_nat_mangle_udp_packet(struct sk_buff *skb,
                                     struct nf_conn *ct,
                                     enum ip_conntrack_info ctinfo,
@@ -21,6 +35,10 @@ extern int nf_nat_mangle_udp_packet(struct sk_buff *skb,
                                     unsigned int match_len,
                                     const char *rep_buffer,
                                     unsigned int rep_len);
+
+extern void nf_nat_set_seq_adjust(struct nf_conn *ct,
+                                  enum ip_conntrack_info ctinfo,
+                                  __be32 seq, s16 off);
 extern int nf_nat_seq_adjust(struct sk_buff *skb,
                              struct nf_conn *ct,
                              enum ip_conntrack_info ctinfo);
diff --git a/include/net/netlink.h b/include/net/netlink.h
index a63b2192ac1c..f82e463c875a 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -196,7 +196,7 @@ enum {
  *    All other            Exact length of attribute payload
  *
  * Example:
- * static struct nla_policy my_policy[ATTR_MAX+1] __read_mostly = {
+ * static const struct nla_policy my_policy[ATTR_MAX+1] = {
  *      [ATTR_FOO] = { .type = NLA_U16 },
  *      [ATTR_BAR] = { .type = NLA_STRING, .len = BARSIZ },
  *      [ATTR_BAZ] = { .len = sizeof(struct mystruct) },
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index 63d449807d9b..d4958d4c6574 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -17,7 +17,7 @@ struct netns_ct {
         struct hlist_head       *expect_hash;
         struct hlist_nulls_head unconfirmed;
         struct hlist_nulls_head dying;
-        struct ip_conntrack_stat *stat;
+        struct ip_conntrack_stat __percpu *stat;
         int                     sysctl_events;
         unsigned int            sysctl_events_retry_timeout;
         int                     sysctl_acct;
diff --git a/include/net/netns/core.h b/include/net/netns/core.h
index 24d4be76bbd1..78eb1ff75475 100644
--- a/include/net/netns/core.h
+++ b/include/net/netns/core.h
@@ -10,7 +10,7 @@ struct netns_core {
 
         int     sysctl_somaxconn;
 
-        struct prot_inuse       *inuse;
+        struct prot_inuse __percpu *inuse;
 };
 
 #endif
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 9a4b8b714079..2764994c9136 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -37,7 +37,9 @@ struct netns_ipv4 {
         struct xt_table         *iptable_mangle;
         struct xt_table         *iptable_raw;
         struct xt_table         *arptable_filter;
+#ifdef CONFIG_SECURITY
         struct xt_table         *iptable_security;
+#endif
         struct xt_table         *nat_table;
         struct hlist_head       *nat_bysource;
         unsigned int            nat_htable_size;
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index dfeb2d7c425b..1f11ebc22151 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -36,8 +36,10 @@ struct netns_ipv6 {
         struct xt_table         *ip6table_filter;
         struct xt_table         *ip6table_mangle;
         struct xt_table         *ip6table_raw;
+#ifdef CONFIG_SECURITY
         struct xt_table         *ip6table_security;
 #endif
+#endif
         struct rt6_info         *ip6_null_entry;
         struct rt6_statistics   *rt6_stats;
         struct timer_list       ip6_fib_timer;
diff --git a/include/net/netns/packet.h b/include/net/netns/packet.h
index 637daf698884..cb4e894c0f8d 100644
--- a/include/net/netns/packet.h
+++ b/include/net/netns/packet.h
@@ -4,11 +4,11 @@
 #ifndef __NETNS_PACKET_H__
 #define __NETNS_PACKET_H__
 
-#include <linux/list.h>
+#include <linux/rculist.h>
 #include <linux/spinlock.h>
 
 struct netns_packet {
-        rwlock_t                sklist_lock;
+        spinlock_t              sklist_lock;
         struct hlist_head       sklist;
 };
 
diff --git a/include/net/phonet/pep.h b/include/net/phonet/pep.h
index 4c61cdce4e5f..35672b1cf44a 100644
--- a/include/net/phonet/pep.h
+++ b/include/net/phonet/pep.h
@@ -44,6 +44,7 @@ struct pep_sock {
         u8                      rx_fc;  /* RX flow control */
         u8                      tx_fc;  /* TX flow control */
         u8                      init_enable;    /* auto-enable at creation */
+        u8                      aligned;
 };
 
 static inline struct pep_sock *pep_sk(struct sock *sk)
@@ -77,6 +78,7 @@ static inline struct pnpipehdr *pnp_hdr(struct sk_buff *skb)
 
 enum {
         PNS_PIPE_DATA = 0x20,
+        PNS_PIPE_ALIGNED_DATA,
 
         PNS_PEP_CONNECT_REQ = 0x40,
         PNS_PEP_CONNECT_RESP,
@@ -138,6 +140,7 @@ enum {
         PN_PIPE_SB_NEGOTIATED_FC,
         PN_PIPE_SB_REQUIRED_FC_TX,
         PN_PIPE_SB_PREFERRED_FC_RX,
+        PN_PIPE_SB_ALIGNED_DATA,
 };
 
 /* Phonet pipe flow control models */
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 2d567265363e..b6cdc33b39c1 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -71,6 +71,7 @@ extern void qdisc_watchdog_cancel(struct qdisc_watchdog *wd);
 
 extern struct Qdisc_ops pfifo_qdisc_ops;
 extern struct Qdisc_ops bfifo_qdisc_ops;
+extern struct Qdisc_ops pfifo_head_drop_qdisc_ops;
 
 extern int fifo_set_limit(struct Qdisc *q, unsigned int limit);
 extern struct Qdisc *fifo_create_dflt(struct Qdisc *sch, struct Qdisc_ops *ops,
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 47995b81c5d7..f873ee37f7e4 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -39,6 +39,7 @@ enum environment_cap {
  *      00 - World regulatory domain
  *      99 - built by driver but a specific alpha2 cannot be determined
  *      98 - result of an intersection between two regulatory domains
+ *      97 - regulatory domain has not yet been configured
  * @intersect: indicates whether the wireless core should intersect
  *      the requested regulatory domain with the presently set regulatory
  *      domain.
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index c9b50ebd9ce9..99e6e19b57c2 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -45,6 +45,8 @@ struct request_sock_ops {
         void            (*send_reset)(struct sock *sk,
                                       struct sk_buff *skb);
         void            (*destructor)(struct request_sock *req);
+        void            (*syn_ack_timeout)(struct sock *sk,
+                                           struct request_sock *req);
 };
 
 /* struct request_sock - mini sock to represent a connection request
diff --git a/include/net/route.h b/include/net/route.h
index bce6dd68d27b..2c9fba7f7731 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -101,7 +101,7 @@ struct rt_cache_stat {
         unsigned int out_hlist_search;
 };
 
-extern struct ip_rt_acct *ip_rt_acct;
+extern struct ip_rt_acct __percpu *ip_rt_acct;
 
 struct in_device;
 extern int              ip_rt_init(void);
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 48d3efcb0880..af60fd050844 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -87,6 +87,8 @@ extern void	rtnl_link_unregister(struct rtnl_link_ops *ops);
 extern struct net *rtnl_link_get_net(struct net *src_net, struct nlattr *tb[]);
 extern struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
         char *ifname, const struct rtnl_link_ops *ops, struct nlattr *tb[]);
+extern int rtnl_configure_link(struct net_device *dev,
+                               const struct ifinfomsg *ifm);
 extern const struct nla_policy ifla_policy[IFLA_MAX+1];
 
 #define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index dad558bc06fa..67dc08eaaa45 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -427,6 +427,25 @@ static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch)
         return __qdisc_dequeue_head(sch, &sch->q);
 }
 
+static inline unsigned int __qdisc_queue_drop_head(struct Qdisc *sch,
+                                              struct sk_buff_head *list)
+{
+        struct sk_buff *skb = __qdisc_dequeue_head(sch, list);
+
+        if (likely(skb != NULL)) {
+                unsigned int len = qdisc_pkt_len(skb);
+                kfree_skb(skb);
+                return len;
+        }
+
+        return 0;
+}
+
+static inline unsigned int qdisc_queue_drop_head(struct Qdisc *sch)
+{
+        return __qdisc_queue_drop_head(sch, &sch->q);
+}
+
 static inline struct sk_buff *__qdisc_dequeue_tail(struct Qdisc *sch,
                                                    struct sk_buff_head *list)
 {
diff --git a/include/net/snmp.h b/include/net/snmp.h
index f0d756f2ac99..692ee0061dc4 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -32,7 +32,7 @@
  *  - name of entries.
  */
 struct snmp_mib {
-        char *name;
+        const char *name;
         int entry;
 };
 
@@ -129,9 +129,9 @@ struct linux_xfrm_mib {
  * nonlocked_atomic_inc() primitives -AK
  */ 
 #define DEFINE_SNMP_STAT(type, name)    \
-        __typeof__(type) *name[2]
+        __typeof__(type) __percpu *name[2]
 #define DECLARE_SNMP_STAT(type, name)   \
-        extern __typeof__(type) *name[2]
+        extern __typeof__(type) __percpu *name[2]
 
 #define SNMP_STAT_BHPTR(name)   (name[0])
 #define SNMP_STAT_USRPTR(name)  (name[1])
@@ -148,9 +148,13 @@ struct linux_xfrm_mib {
                         __this_cpu_add(mib[0]->mibs[field], addend)
 #define SNMP_ADD_STATS_USER(mib, field, addend) \
                         this_cpu_add(mib[1]->mibs[field], addend)
+/*
+ * Use "__typeof__(*mib[0]) *ptr" instead of "__typeof__(mib[0]) ptr"
+ * to make @ptr a non-percpu pointer.
+ */
 #define SNMP_UPD_PO_STATS(mib, basefield, addend)       \
         do { \
-                __typeof__(mib[0]) ptr; \
+                __typeof__(*mib[0]) *ptr; \
                 preempt_disable(); \
                 ptr = this_cpu_ptr((mib)[!in_softirq()]); \
                 ptr->mibs[basefield##PKTS]++; \
@@ -159,7 +163,7 @@ struct linux_xfrm_mib {
         } while (0)
 #define SNMP_UPD_PO_STATS_BH(mib, basefield, addend)    \
         do { \
-                __typeof__(mib[0]) ptr = \
+                __typeof__(*mib[0]) *ptr = \
                         __this_cpu_ptr((mib)[!in_softirq()]); \
                 ptr->mibs[basefield##PKTS]++; \
                 ptr->mibs[basefield##OCTETS] += addend;\
diff --git a/include/net/sock.h b/include/net/sock.h
index 3f1a4804bb3f..6cb1676e409a 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -317,6 +317,11 @@ struct sock {
 /*
  * Hashed lists helper routines
  */
+static inline struct sock *sk_entry(const struct hlist_node *node)
+{
+        return hlist_entry(node, struct sock, sk_node);
+}
+
 static inline struct sock *__sk_head(const struct hlist_head *head)
 {
         return hlist_entry(head->first, struct sock, sk_node);
@@ -376,6 +381,7 @@ static __inline__ void __sk_del_node(struct sock *sk)
         __hlist_del(&sk->sk_node);
 }
 
+/* NB: equivalent to hlist_del_init_rcu */
 static __inline__ int __sk_del_node_init(struct sock *sk)
 {
         if (sk_hashed(sk)) {
@@ -416,6 +422,7 @@ static __inline__ int sk_del_node_init(struct sock *sk)
         }
         return rc;
 }
+#define sk_del_node_init_rcu(sk)        sk_del_node_init(sk)
 
 static __inline__ int __sk_nulls_del_node_init_rcu(struct sock *sk)
 {
@@ -449,6 +456,12 @@ static __inline__ void sk_add_node(struct sock *sk, struct hlist_head *list)
         __sk_add_node(sk, list);
 }
 
+static __inline__ void sk_add_node_rcu(struct sock *sk, struct hlist_head *list)
+{
+        sock_hold(sk);
+        hlist_add_head_rcu(&sk->sk_node, list);
+}
+
 static __inline__ void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
 {
         hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
@@ -473,6 +486,8 @@ static __inline__ void sk_add_bind_node(struct sock *sk,
 
 #define sk_for_each(__sk, node, list) \
         hlist_for_each_entry(__sk, node, list, sk_node)
+#define sk_for_each_rcu(__sk, node, list) \
+        hlist_for_each_entry_rcu(__sk, node, list, sk_node)
 #define sk_nulls_for_each(__sk, node, list) \
         hlist_nulls_for_each_entry(__sk, node, list, sk_nulls_node)
 #define sk_nulls_for_each_rcu(__sk, node, list) \
@@ -1044,7 +1059,7 @@ extern void sk_common_release(struct sock *sk);
 extern void sock_init_data(struct socket *sock, struct sock *sk);
 
 /**
- *      sk_filter_release: Release a socket filter
+ *      sk_filter_release - release a socket filter
  *      @fp: filter to remove
  *
  *      Remove a filter from a socket and release its resources.
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 34f5cc24d903..56f0aec40ed6 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -196,6 +196,9 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCP_NAGLE_CORK          2       /* Socket is corked         */
 #define TCP_NAGLE_PUSH          4       /* Cork is overridden for already queued data */
 
+/* TCP thin-stream limits */
+#define TCP_THIN_LINEAR_RETRIES 6       /* After 6 linear retries, do exp. backoff */
+
 extern struct inet_timewait_death_row tcp_death_row;
 
 /* sysctl variables for tcp */
@@ -241,6 +244,8 @@ extern int sysctl_tcp_workaround_signed_windows;
 extern int sysctl_tcp_slow_start_after_idle;
 extern int sysctl_tcp_max_ssthresh;
 extern int sysctl_tcp_cookie_size;
+extern int sysctl_tcp_thin_linear_timeouts;
+extern int sysctl_tcp_thin_dupack;
 
 extern atomic_t tcp_memory_allocated;
 extern struct percpu_counter tcp_sockets_allocated;
@@ -400,6 +405,8 @@ extern int			compat_tcp_setsockopt(struct sock *sk,
                                         int level, int optname,
                                         char __user *optval, unsigned int optlen);
 extern void                     tcp_set_keepalive(struct sock *sk, int val);
+extern void                     tcp_syn_ack_timeout(struct sock *sk,
+                                                    struct request_sock *req);
 extern int                      tcp_recvmsg(struct kiocb *iocb, struct sock *sk,
                                             struct msghdr *msg,
                                             size_t len, int nonblock, 
@@ -856,13 +863,6 @@ static inline void tcp_check_probe_timer(struct sock *sk)
                                           icsk->icsk_rto, TCP_RTO_MAX);
 }
 
-static inline void tcp_push_pending_frames(struct sock *sk)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        __tcp_push_pending_frames(sk, tcp_current_mss(sk), tp->nonagle);
-}
-
 static inline void tcp_init_wl(struct tcp_sock *tp, u32 seq)
 {
         tp->snd_wl1 = seq;
@@ -972,7 +972,8 @@ static inline void tcp_sack_reset(struct tcp_options_received *rx_opt)
 /* Determine a window scaling and initial window to offer. */
 extern void tcp_select_initial_window(int __space, __u32 mss,
                                       __u32 *rcv_wnd, __u32 *window_clamp,
-                                      int wscale_ok, __u8 *rcv_wscale);
+                                      int wscale_ok, __u8 *rcv_wscale,
+                                      __u32 init_rcv_wnd);
 
 static inline int tcp_win_from_space(int space)
 {
@@ -1193,7 +1194,7 @@ extern int			tcp_v4_md5_do_del(struct sock *sk,
 #define tcp_twsk_md5_key(twsk)  NULL
 #endif
 
-extern struct tcp_md5sig_pool   **tcp_alloc_md5sig_pool(struct sock *);
+extern struct tcp_md5sig_pool * __percpu *tcp_alloc_md5sig_pool(struct sock *);
 extern void                     tcp_free_md5sig_pool(void);
 
 extern struct tcp_md5sig_pool   *__tcp_get_md5sig_pool(int cpu);
@@ -1342,6 +1343,15 @@ static inline int tcp_write_queue_empty(struct sock *sk)
         return skb_queue_empty(&sk->sk_write_queue);
 }
 
+static inline void tcp_push_pending_frames(struct sock *sk)
+{
+        if (tcp_send_head(sk)) {
+                struct tcp_sock *tp = tcp_sk(sk);
+
+                __tcp_push_pending_frames(sk, tcp_current_mss(sk), tp->nonagle);
+        }
+}
+
 /* Start sequence of the highest skb with SACKed bit, valid only if
  * sacked > 0 or when the caller has ensured validity by itself.
  */
@@ -1381,6 +1391,14 @@ static inline void tcp_highest_sack_combine(struct sock *sk,
                 tcp_sk(sk)->highest_sack = new;
 }
 
+/* Determines whether this is a thin stream (which may suffer from
+ * increased latency). Used to trigger latency-reducing mechanisms.
+ */
+static inline unsigned int tcp_stream_is_thin(struct tcp_sock *tp)
+{
+        return tp->packets_out < 4 && !tcp_in_initial_slowstart(tp);
+}
+
 /* /proc */
 enum tcp_seq_states {
         TCP_SEQ_STATE_LISTENING,
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 60c27706e7b9..a7df3275b860 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -140,6 +140,7 @@ struct xfrm_state {
 
         struct xfrm_id          id;
         struct xfrm_selector    sel;
+        struct xfrm_mark        mark;
 
         u32                     genid;
 
@@ -317,8 +318,8 @@ extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
 struct xfrm_type {
         char                    *description;
         struct module           *owner;
-        __u8                    proto;
-        __u8                    flags;
+        u8                      proto;
+        u8                      flags;
 #define XFRM_TYPE_NON_FRAGMENT  1
 #define XFRM_TYPE_REPLAY_PROT   2
 #define XFRM_TYPE_LOCAL_COADDR  4
@@ -434,24 +435,24 @@ struct xfrm_tmpl {
 
         unsigned short          encap_family;
 
-        __u32                   reqid;
+        u32                     reqid;
 
 /* Mode: transport, tunnel etc. */
-        __u8                    mode;
+        u8                      mode;
 
 /* Sharing mode: unique, this session only, this user only etc. */
-        __u8                    share;
+        u8                      share;
 
 /* May skip this transfomration if no SA is found */
-        __u8                    optional;
+        u8                      optional;
 
 /* Skip aalgos/ealgos/calgos checks. */
-        __u8                    allalgs;
+        u8                      allalgs;
 
 /* Bit mask of algos allowed for acquisition */
-        __u32                   aalgos;
-        __u32                   ealgos;
-        __u32                   calgos;
+        u32                     aalgos;
+        u32                     ealgos;
+        u32                     calgos;
 };
 
 #define XFRM_MAX_DEPTH          6
@@ -481,6 +482,7 @@ struct xfrm_policy {
 
         u32                     priority;
         u32                     index;
+        struct xfrm_mark        mark;
         struct xfrm_selector    selector;
         struct xfrm_lifetime_cfg lft;
         struct xfrm_lifetime_cur curlft;
@@ -770,7 +772,7 @@ static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
         int pdw;
         int pbi;
 
-        pdw = prefixlen >> 5;     /* num of whole __u32 in prefix */
+        pdw = prefixlen >> 5;     /* num of whole u32 in prefix */
         pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
 
         if (pdw)
@@ -1259,7 +1261,7 @@ struct xfrm_algo_desc {
 /* XFRM tunnel handlers.  */
 struct xfrm_tunnel {
         int (*handler)(struct sk_buff *skb);
-        int (*err_handler)(struct sk_buff *skb, __u32 info);
+        int (*err_handler)(struct sk_buff *skb, u32 info);
 
         struct xfrm_tunnel *next;
         int priority;
@@ -1317,7 +1319,7 @@ extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t
                                           struct flowi *fl, struct xfrm_tmpl *tmpl,
                                           struct xfrm_policy *pol, int *err,
                                           unsigned short family);
-extern struct xfrm_state * xfrm_stateonly_find(struct net *net,
+extern struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
                                                xfrm_address_t *daddr,
                                                xfrm_address_t *saddr,
                                                unsigned short family,
@@ -1326,8 +1328,14 @@ extern int xfrm_state_check_expire(struct xfrm_state *x);
 extern void xfrm_state_insert(struct xfrm_state *x);
 extern int xfrm_state_add(struct xfrm_state *x);
 extern int xfrm_state_update(struct xfrm_state *x);
-extern struct xfrm_state *xfrm_state_lookup(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family);
-extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family);
+extern struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
+                                            xfrm_address_t *daddr, __be32 spi,
+                                            u8 proto, unsigned short family);
+extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
+                                                   xfrm_address_t *daddr,
+                                                   xfrm_address_t *saddr,
+                                                   u8 proto,
+                                                   unsigned short family);
 #ifdef CONFIG_XFRM_SUB_POLICY
 extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
                           int n, unsigned short family);
@@ -1364,7 +1372,8 @@ struct xfrmk_spdinfo {
         u32 spdhmcnt;
 };
 
-extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 seq);
+extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark,
+                                              u32 seq);
 extern int xfrm_state_delete(struct xfrm_state *x);
 extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
 extern void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
@@ -1408,9 +1417,9 @@ extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                             xfrm_address_t *saddr, u8 proto);
 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
-extern __be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
-extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
-extern __be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
+extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
+extern void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr);
+extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr);
 extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_output(struct sk_buff *skb);
@@ -1441,17 +1450,20 @@ extern int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
         int (*func)(struct xfrm_policy *, int, int, void*), void *);
 extern void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
-struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u8 type, int dir,
+struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
+                                          u8 type, int dir,
                                           struct xfrm_selector *sel,
                                           struct xfrm_sec_ctx *ctx, int delete,
                                           int *err);
-struct xfrm_policy *xfrm_policy_byid(struct net *net, u8, int dir, u32 id, int delete, int *err);
+struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, u32 id, int delete, int *err);
 int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
 u32 xfrm_get_acqseq(void);
 extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
-struct xfrm_state * xfrm_find_acq(struct net *net, u8 mode, u32 reqid, u8 proto,
-                                  xfrm_address_t *daddr, xfrm_address_t *saddr,
-                                  int create, unsigned short family);
+struct xfrm_state *xfrm_find_acq(struct net *net, struct xfrm_mark *mark,
+                                 u8 mode, u32 reqid, u8 proto,
+                                 xfrm_address_t *daddr,
+                                 xfrm_address_t *saddr, int create,
+                                 unsigned short family);
 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
 extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
                           struct flowi *fl, int family, int strict);
@@ -1500,7 +1512,7 @@ static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
         switch (family) {
         default:
         case AF_INET:
-                return (__force __u32)a->a4 - (__force __u32)b->a4;
+                return (__force u32)a->a4 - (__force u32)b->a4;
         case AF_INET6:
                 return ipv6_addr_cmp((struct in6_addr *)a,
                                      (struct in6_addr *)b);
@@ -1570,4 +1582,24 @@ static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
 }
 #endif
 
+static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
+{
+        if (attrs[XFRMA_MARK])
+                memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(m));
+        else
+                m->v = m->m = 0;
+
+        return m->v & m->m;
+}
+
+static inline int xfrm_mark_put(struct sk_buff *skb, struct xfrm_mark *m)
+{
+        if (m->m | m->v)
+                NLA_PUT(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
+        return 0;
+
+nla_put_failure:
+        return -1;
+}
+
 #endif  /* _NET_XFRM_H */
diff --git a/include/pcmcia/device_id.h b/include/pcmcia/device_id.h
index c33ea08352b8..63e5b8f6b7dd 100644
--- a/include/pcmcia/device_id.h
+++ b/include/pcmcia/device_id.h
@@ -34,6 +34,11 @@
         .prod_id = { NULL, (v2), NULL, NULL },  \
         .prod_id_hash = { 0, (vh2), 0, 0 }, }
 
+#define PCMCIA_DEVICE_PROD_ID3(v3, vh3) { \
+        .match_flags = PCMCIA_DEV_ID_MATCH_PROD_ID3, \
+        .prod_id = { NULL, NULL, (v3), NULL },  \
+        .prod_id_hash = { 0, 0, (vh3), 0 }, }
+
 #define PCMCIA_DEVICE_PROD_ID12(v1, v2, vh1, vh2) { \
         .match_flags = PCMCIA_DEV_ID_MATCH_PROD_ID1| \
                         PCMCIA_DEV_ID_MATCH_PROD_ID2, \