Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1446 commits)
  macvlan: fix panic if lowerdev in a bond
  tg3: Add braces around 5906 workaround.
  tg3: Fix NETIF_F_LOOPBACK error
  macvlan: remove one synchronize_rcu() call
  networking: NET_CLS_ROUTE4 depends on INET
  irda: Fix error propagation in ircomm_lmp_connect_response()
  irda: Kill set but unused variable 'bytes' in irlan_check_command_param()
  irda: Kill set but unused variable 'clen' in ircomm_connect_indication()
  rxrpc: Fix set but unused variable 'usage' in rxrpc_get_transport()
  be2net: Kill set but unused variable 'req' in lancer_fw_download()
  irda: Kill set but unused vars 'saddr' and 'daddr' in irlan_provider_connect_indication()
  atl1c: atl1c_resume() is only used when CONFIG_PM_SLEEP is defined.
  rxrpc: Fix set but unused variable 'usage' in rxrpc_get_peer().
  rxrpc: Kill set but unused variable 'local' in rxrpc_UDP_error_handler()
  rxrpc: Kill set but unused variable 'sp' in rxrpc_process_connection()
  rxrpc: Kill set but unused variable 'sp' in rxrpc_rotate_tx_window()
  pkt_sched: Kill set but unused variable 'protocol' in tc_classify()
  isdn: capi: Use pr_debug() instead of ifdefs.
  tg3: Update version to 3.119
  tg3: Apply rx_discards fix to 5719/5720
  ...

Fix up trivial conflicts in arch/x86/Kconfig and net/mac80211/agg-tx.c
as per Davem.

87 files changed, 2675 insertions, 739 deletions

diff --git a/include/linux/ath9k_platform.h b/include/linux/ath9k_platform.h
index b847fc7b93f9..60a7c49dcb49 100644
--- a/include/linux/ath9k_platform.h
+++ b/include/linux/ath9k_platform.h
@@ -23,6 +23,13 @@
 
 struct ath9k_platform_data {
         u16 eeprom_data[ATH9K_PLAT_EEP_MAX_WORDS];
+        u8 *macaddr;
+
+        int led_pin;
+        u32 gpio_mask;
+        u32 gpio_val;
+
+        bool is_clk_25mhz;
 };
 
 #endif /* _LINUX_ATH9K_PLATFORM_H */
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
new file mode 100644
index 000000000000..08763e4e848f
--- /dev/null
+++ b/include/linux/bcma/bcma.h
@@ -0,0 +1,224 @@
+#ifndef LINUX_BCMA_H_
+#define LINUX_BCMA_H_
+
+#include <linux/pci.h>
+#include <linux/mod_devicetable.h>
+
+#include <linux/bcma/bcma_driver_chipcommon.h>
+#include <linux/bcma/bcma_driver_pci.h>
+
+#include "bcma_regs.h"
+
+struct bcma_device;
+struct bcma_bus;
+
+enum bcma_hosttype {
+        BCMA_HOSTTYPE_NONE,
+        BCMA_HOSTTYPE_PCI,
+        BCMA_HOSTTYPE_SDIO,
+};
+
+struct bcma_chipinfo {
+        u16 id;
+        u8 rev;
+        u8 pkg;
+};
+
+struct bcma_host_ops {
+        u8 (*read8)(struct bcma_device *core, u16 offset);
+        u16 (*read16)(struct bcma_device *core, u16 offset);
+        u32 (*read32)(struct bcma_device *core, u16 offset);
+        void (*write8)(struct bcma_device *core, u16 offset, u8 value);
+        void (*write16)(struct bcma_device *core, u16 offset, u16 value);
+        void (*write32)(struct bcma_device *core, u16 offset, u32 value);
+        /* Agent ops */
+        u32 (*aread32)(struct bcma_device *core, u16 offset);
+        void (*awrite32)(struct bcma_device *core, u16 offset, u32 value);
+};
+
+/* Core manufacturers */
+#define BCMA_MANUF_ARM                  0x43B
+#define BCMA_MANUF_MIPS                 0x4A7
+#define BCMA_MANUF_BCM                  0x4BF
+
+/* Core class values. */
+#define BCMA_CL_SIM                     0x0
+#define BCMA_CL_EROM                    0x1
+#define BCMA_CL_CORESIGHT               0x9
+#define BCMA_CL_VERIF                   0xB
+#define BCMA_CL_OPTIMO                  0xD
+#define BCMA_CL_GEN                     0xE
+#define BCMA_CL_PRIMECELL               0xF
+
+/* Core-ID values. */
+#define BCMA_CORE_OOB_ROUTER            0x367   /* Out of band */
+#define BCMA_CORE_INVALID               0x700
+#define BCMA_CORE_CHIPCOMMON            0x800
+#define BCMA_CORE_ILINE20               0x801
+#define BCMA_CORE_SRAM                  0x802
+#define BCMA_CORE_SDRAM                 0x803
+#define BCMA_CORE_PCI                   0x804
+#define BCMA_CORE_MIPS                  0x805
+#define BCMA_CORE_ETHERNET              0x806
+#define BCMA_CORE_V90                   0x807
+#define BCMA_CORE_USB11_HOSTDEV         0x808
+#define BCMA_CORE_ADSL                  0x809
+#define BCMA_CORE_ILINE100              0x80A
+#define BCMA_CORE_IPSEC                 0x80B
+#define BCMA_CORE_UTOPIA                0x80C
+#define BCMA_CORE_PCMCIA                0x80D
+#define BCMA_CORE_INTERNAL_MEM          0x80E
+#define BCMA_CORE_MEMC_SDRAM            0x80F
+#define BCMA_CORE_OFDM                  0x810
+#define BCMA_CORE_EXTIF                 0x811
+#define BCMA_CORE_80211                 0x812
+#define BCMA_CORE_PHY_A                 0x813
+#define BCMA_CORE_PHY_B                 0x814
+#define BCMA_CORE_PHY_G                 0x815
+#define BCMA_CORE_MIPS_3302             0x816
+#define BCMA_CORE_USB11_HOST            0x817
+#define BCMA_CORE_USB11_DEV             0x818
+#define BCMA_CORE_USB20_HOST            0x819
+#define BCMA_CORE_USB20_DEV             0x81A
+#define BCMA_CORE_SDIO_HOST             0x81B
+#define BCMA_CORE_ROBOSWITCH            0x81C
+#define BCMA_CORE_PARA_ATA              0x81D
+#define BCMA_CORE_SATA_XORDMA           0x81E
+#define BCMA_CORE_ETHERNET_GBIT         0x81F
+#define BCMA_CORE_PCIE                  0x820
+#define BCMA_CORE_PHY_N                 0x821
+#define BCMA_CORE_SRAM_CTL              0x822
+#define BCMA_CORE_MINI_MACPHY           0x823
+#define BCMA_CORE_ARM_1176              0x824
+#define BCMA_CORE_ARM_7TDMI             0x825
+#define BCMA_CORE_PHY_LP                0x826
+#define BCMA_CORE_PMU                   0x827
+#define BCMA_CORE_PHY_SSN               0x828
+#define BCMA_CORE_SDIO_DEV              0x829
+#define BCMA_CORE_ARM_CM3               0x82A
+#define BCMA_CORE_PHY_HT                0x82B
+#define BCMA_CORE_MIPS_74K              0x82C
+#define BCMA_CORE_MAC_GBIT              0x82D
+#define BCMA_CORE_DDR12_MEM_CTL         0x82E
+#define BCMA_CORE_PCIE_RC               0x82F   /* PCIe Root Complex */
+#define BCMA_CORE_OCP_OCP_BRIDGE        0x830
+#define BCMA_CORE_SHARED_COMMON         0x831
+#define BCMA_CORE_OCP_AHB_BRIDGE        0x832
+#define BCMA_CORE_SPI_HOST              0x833
+#define BCMA_CORE_I2S                   0x834
+#define BCMA_CORE_SDR_DDR1_MEM_CTL      0x835   /* SDR/DDR1 memory controller core */
+#define BCMA_CORE_SHIM                  0x837   /* SHIM component in ubus/6362 */
+#define BCMA_CORE_DEFAULT               0xFFF
+
+#define BCMA_MAX_NR_CORES               16
+
+struct bcma_device {
+        struct bcma_bus *bus;
+        struct bcma_device_id id;
+
+        struct device dev;
+        bool dev_registered;
+
+        u8 core_index;
+
+        u32 addr;
+        u32 wrap;
+
+        void *drvdata;
+        struct list_head list;
+};
+
+static inline void *bcma_get_drvdata(struct bcma_device *core)
+{
+        return core->drvdata;
+}
+static inline void bcma_set_drvdata(struct bcma_device *core, void *drvdata)
+{
+        core->drvdata = drvdata;
+}
+
+struct bcma_driver {
+        const char *name;
+        const struct bcma_device_id *id_table;
+
+        int (*probe)(struct bcma_device *dev);
+        void (*remove)(struct bcma_device *dev);
+        int (*suspend)(struct bcma_device *dev, pm_message_t state);
+        int (*resume)(struct bcma_device *dev);
+        void (*shutdown)(struct bcma_device *dev);
+
+        struct device_driver drv;
+};
+extern
+int __bcma_driver_register(struct bcma_driver *drv, struct module *owner);
+static inline int bcma_driver_register(struct bcma_driver *drv)
+{
+        return __bcma_driver_register(drv, THIS_MODULE);
+}
+extern void bcma_driver_unregister(struct bcma_driver *drv);
+
+struct bcma_bus {
+        /* The MMIO area. */
+        void __iomem *mmio;
+
+        const struct bcma_host_ops *ops;
+
+        enum bcma_hosttype hosttype;
+        union {
+                /* Pointer to the PCI bus (only for BCMA_HOSTTYPE_PCI) */
+                struct pci_dev *host_pci;
+                /* Pointer to the SDIO device (only for BCMA_HOSTTYPE_SDIO) */
+                struct sdio_func *host_sdio;
+        };
+
+        struct bcma_chipinfo chipinfo;
+
+        struct bcma_device *mapped_core;
+        struct list_head cores;
+        u8 nr_cores;
+
+        struct bcma_drv_cc drv_cc;
+        struct bcma_drv_pci drv_pci;
+};
+
+extern inline u32 bcma_read8(struct bcma_device *core, u16 offset)
+{
+        return core->bus->ops->read8(core, offset);
+}
+extern inline u32 bcma_read16(struct bcma_device *core, u16 offset)
+{
+        return core->bus->ops->read16(core, offset);
+}
+extern inline u32 bcma_read32(struct bcma_device *core, u16 offset)
+{
+        return core->bus->ops->read32(core, offset);
+}
+extern inline
+void bcma_write8(struct bcma_device *core, u16 offset, u32 value)
+{
+        core->bus->ops->write8(core, offset, value);
+}
+extern inline
+void bcma_write16(struct bcma_device *core, u16 offset, u32 value)
+{
+        core->bus->ops->write16(core, offset, value);
+}
+extern inline
+void bcma_write32(struct bcma_device *core, u16 offset, u32 value)
+{
+        core->bus->ops->write32(core, offset, value);
+}
+extern inline u32 bcma_aread32(struct bcma_device *core, u16 offset)
+{
+        return core->bus->ops->aread32(core, offset);
+}
+extern inline
+void bcma_awrite32(struct bcma_device *core, u16 offset, u32 value)
+{
+        core->bus->ops->awrite32(core, offset, value);
+}
+
+extern bool bcma_core_is_enabled(struct bcma_device *core);
+extern int bcma_core_enable(struct bcma_device *core, u32 flags);
+
+#endif /* LINUX_BCMA_H_ */
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
new file mode 100644
index 000000000000..083c3b6cd5ce
--- /dev/null
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -0,0 +1,302 @@
+#ifndef LINUX_BCMA_DRIVER_CC_H_
+#define LINUX_BCMA_DRIVER_CC_H_
+
+/** ChipCommon core registers. **/
+#define BCMA_CC_ID                      0x0000
+#define  BCMA_CC_ID_ID                  0x0000FFFF
+#define  BCMA_CC_ID_ID_SHIFT            0
+#define  BCMA_CC_ID_REV                 0x000F0000
+#define  BCMA_CC_ID_REV_SHIFT           16
+#define  BCMA_CC_ID_PKG                 0x00F00000
+#define  BCMA_CC_ID_PKG_SHIFT           20
+#define  BCMA_CC_ID_NRCORES             0x0F000000
+#define  BCMA_CC_ID_NRCORES_SHIFT       24
+#define  BCMA_CC_ID_TYPE                0xF0000000
+#define  BCMA_CC_ID_TYPE_SHIFT          28
+#define BCMA_CC_CAP                     0x0004          /* Capabilities */
+#define  BCMA_CC_CAP_NRUART             0x00000003      /* # of UARTs */
+#define  BCMA_CC_CAP_MIPSEB             0x00000004      /* MIPS in BigEndian Mode */
+#define  BCMA_CC_CAP_UARTCLK            0x00000018      /* UART clock select */
+#define   BCMA_CC_CAP_UARTCLK_INT       0x00000008      /* UARTs are driven by internal divided clock */
+#define  BCMA_CC_CAP_UARTGPIO           0x00000020      /* UARTs on GPIO 15-12 */
+#define  BCMA_CC_CAP_EXTBUS             0x000000C0      /* External buses present */
+#define  BCMA_CC_CAP_FLASHT             0x00000700      /* Flash Type */
+#define   BCMA_CC_FLASHT_NONE           0x00000000      /* No flash */
+#define   BCMA_CC_FLASHT_STSER          0x00000100      /* ST serial flash */
+#define   BCMA_CC_FLASHT_ATSER          0x00000200      /* Atmel serial flash */
+#define   BCMA_CC_FLASHT_PARA           0x00000700      /* Parallel flash */
+#define  BCMA_CC_CAP_PLLT               0x00038000      /* PLL Type */
+#define   BCMA_PLLTYPE_NONE             0x00000000
+#define   BCMA_PLLTYPE_1                0x00010000      /* 48Mhz base, 3 dividers */
+#define   BCMA_PLLTYPE_2                0x00020000      /* 48Mhz, 4 dividers */
+#define   BCMA_PLLTYPE_3                0x00030000      /* 25Mhz, 2 dividers */
+#define   BCMA_PLLTYPE_4                0x00008000      /* 48Mhz, 4 dividers */
+#define   BCMA_PLLTYPE_5                0x00018000      /* 25Mhz, 4 dividers */
+#define   BCMA_PLLTYPE_6                0x00028000      /* 100/200 or 120/240 only */
+#define   BCMA_PLLTYPE_7                0x00038000      /* 25Mhz, 4 dividers */
+#define  BCMA_CC_CAP_PCTL               0x00040000      /* Power Control */
+#define  BCMA_CC_CAP_OTPS               0x00380000      /* OTP size */
+#define  BCMA_CC_CAP_OTPS_SHIFT         19
+#define  BCMA_CC_CAP_OTPS_BASE          5
+#define  BCMA_CC_CAP_JTAGM              0x00400000      /* JTAG master present */
+#define  BCMA_CC_CAP_BROM               0x00800000      /* Internal boot ROM active */
+#define  BCMA_CC_CAP_64BIT              0x08000000      /* 64-bit Backplane */
+#define  BCMA_CC_CAP_PMU                0x10000000      /* PMU available (rev >= 20) */
+#define  BCMA_CC_CAP_ECI                0x20000000      /* ECI available (rev >= 20) */
+#define  BCMA_CC_CAP_SPROM              0x40000000      /* SPROM present */
+#define BCMA_CC_CORECTL                 0x0008
+#define  BCMA_CC_CORECTL_UARTCLK0       0x00000001      /* Drive UART with internal clock */
+#define  BCMA_CC_CORECTL_SE             0x00000002      /* sync clk out enable (corerev >= 3) */
+#define  BCMA_CC_CORECTL_UARTCLKEN      0x00000008      /* UART clock enable (rev >= 21) */
+#define BCMA_CC_BIST                    0x000C
+#define BCMA_CC_OTPS                    0x0010          /* OTP status */
+#define  BCMA_CC_OTPS_PROGFAIL          0x80000000
+#define  BCMA_CC_OTPS_PROTECT           0x00000007
+#define  BCMA_CC_OTPS_HW_PROTECT        0x00000001
+#define  BCMA_CC_OTPS_SW_PROTECT        0x00000002
+#define  BCMA_CC_OTPS_CID_PROTECT       0x00000004
+#define BCMA_CC_OTPC                    0x0014          /* OTP control */
+#define  BCMA_CC_OTPC_RECWAIT           0xFF000000
+#define  BCMA_CC_OTPC_PROGWAIT          0x00FFFF00
+#define  BCMA_CC_OTPC_PRW_SHIFT         8
+#define  BCMA_CC_OTPC_MAXFAIL           0x00000038
+#define  BCMA_CC_OTPC_VSEL              0x00000006
+#define  BCMA_CC_OTPC_SELVL             0x00000001
+#define BCMA_CC_OTPP                    0x0018          /* OTP prog */
+#define  BCMA_CC_OTPP_COL               0x000000FF
+#define  BCMA_CC_OTPP_ROW               0x0000FF00
+#define  BCMA_CC_OTPP_ROW_SHIFT         8
+#define  BCMA_CC_OTPP_READERR           0x10000000
+#define  BCMA_CC_OTPP_VALUE             0x20000000
+#define  BCMA_CC_OTPP_READ              0x40000000
+#define  BCMA_CC_OTPP_START             0x80000000
+#define  BCMA_CC_OTPP_BUSY              0x80000000
+#define BCMA_CC_IRQSTAT                 0x0020
+#define BCMA_CC_IRQMASK                 0x0024
+#define  BCMA_CC_IRQ_GPIO               0x00000001      /* gpio intr */
+#define  BCMA_CC_IRQ_EXT                0x00000002      /* ro: ext intr pin (corerev >= 3) */
+#define  BCMA_CC_IRQ_WDRESET            0x80000000      /* watchdog reset occurred */
+#define BCMA_CC_CHIPCTL                 0x0028          /* Rev >= 11 only */
+#define BCMA_CC_CHIPSTAT                0x002C          /* Rev >= 11 only */
+#define BCMA_CC_JCMD                    0x0030          /* Rev >= 10 only */
+#define  BCMA_CC_JCMD_START             0x80000000
+#define  BCMA_CC_JCMD_BUSY              0x80000000
+#define  BCMA_CC_JCMD_PAUSE             0x40000000
+#define  BCMA_CC_JCMD0_ACC_MASK         0x0000F000
+#define  BCMA_CC_JCMD0_ACC_IRDR         0x00000000
+#define  BCMA_CC_JCMD0_ACC_DR           0x00001000
+#define  BCMA_CC_JCMD0_ACC_IR           0x00002000
+#define  BCMA_CC_JCMD0_ACC_RESET        0x00003000
+#define  BCMA_CC_JCMD0_ACC_IRPDR        0x00004000
+#define  BCMA_CC_JCMD0_ACC_PDR          0x00005000
+#define  BCMA_CC_JCMD0_IRW_MASK         0x00000F00
+#define  BCMA_CC_JCMD_ACC_MASK          0x000F0000      /* Changes for corerev 11 */
+#define  BCMA_CC_JCMD_ACC_IRDR          0x00000000
+#define  BCMA_CC_JCMD_ACC_DR            0x00010000
+#define  BCMA_CC_JCMD_ACC_IR            0x00020000
+#define  BCMA_CC_JCMD_ACC_RESET         0x00030000
+#define  BCMA_CC_JCMD_ACC_IRPDR         0x00040000
+#define  BCMA_CC_JCMD_ACC_PDR           0x00050000
+#define  BCMA_CC_JCMD_IRW_MASK          0x00001F00
+#define  BCMA_CC_JCMD_IRW_SHIFT         8
+#define  BCMA_CC_JCMD_DRW_MASK          0x0000003F
+#define BCMA_CC_JIR                     0x0034          /* Rev >= 10 only */
+#define BCMA_CC_JDR                     0x0038          /* Rev >= 10 only */
+#define BCMA_CC_JCTL                    0x003C          /* Rev >= 10 only */
+#define  BCMA_CC_JCTL_FORCE_CLK         4               /* Force clock */
+#define  BCMA_CC_JCTL_EXT_EN            2               /* Enable external targets */
+#define  BCMA_CC_JCTL_EN                1               /* Enable Jtag master */
+#define BCMA_CC_FLASHCTL                0x0040
+#define  BCMA_CC_FLASHCTL_START         0x80000000
+#define  BCMA_CC_FLASHCTL_BUSY          BCMA_CC_FLASHCTL_START
+#define BCMA_CC_FLASHADDR               0x0044
+#define BCMA_CC_FLASHDATA               0x0048
+#define BCMA_CC_BCAST_ADDR              0x0050
+#define BCMA_CC_BCAST_DATA              0x0054
+#define BCMA_CC_GPIOPULLUP              0x0058          /* Rev >= 20 only */
+#define BCMA_CC_GPIOPULLDOWN            0x005C          /* Rev >= 20 only */
+#define BCMA_CC_GPIOIN                  0x0060
+#define BCMA_CC_GPIOOUT                 0x0064
+#define BCMA_CC_GPIOOUTEN               0x0068
+#define BCMA_CC_GPIOCTL                 0x006C
+#define BCMA_CC_GPIOPOL                 0x0070
+#define BCMA_CC_GPIOIRQ                 0x0074
+#define BCMA_CC_WATCHDOG                0x0080
+#define BCMA_CC_GPIOTIMER               0x0088          /* LED powersave (corerev >= 16) */
+#define  BCMA_CC_GPIOTIMER_OFFTIME      0x0000FFFF
+#define  BCMA_CC_GPIOTIMER_OFFTIME_SHIFT        0
+#define  BCMA_CC_GPIOTIMER_ONTIME       0xFFFF0000
+#define  BCMA_CC_GPIOTIMER_ONTIME_SHIFT 16
+#define BCMA_CC_GPIOTOUTM               0x008C          /* LED powersave (corerev >= 16) */
+#define BCMA_CC_CLOCK_N                 0x0090
+#define BCMA_CC_CLOCK_SB                0x0094
+#define BCMA_CC_CLOCK_PCI               0x0098
+#define BCMA_CC_CLOCK_M2                0x009C
+#define BCMA_CC_CLOCK_MIPS              0x00A0
+#define BCMA_CC_CLKDIV                  0x00A4          /* Rev >= 3 only */
+#define  BCMA_CC_CLKDIV_SFLASH          0x0F000000
+#define  BCMA_CC_CLKDIV_SFLASH_SHIFT    24
+#define  BCMA_CC_CLKDIV_OTP             0x000F0000
+#define  BCMA_CC_CLKDIV_OTP_SHIFT       16
+#define  BCMA_CC_CLKDIV_JTAG            0x00000F00
+#define  BCMA_CC_CLKDIV_JTAG_SHIFT      8
+#define  BCMA_CC_CLKDIV_UART            0x000000FF
+#define BCMA_CC_CAP_EXT                 0x00AC          /* Capabilities */
+#define BCMA_CC_PLLONDELAY              0x00B0          /* Rev >= 4 only */
+#define BCMA_CC_FREFSELDELAY            0x00B4          /* Rev >= 4 only */
+#define BCMA_CC_SLOWCLKCTL              0x00B8          /* 6 <= Rev <= 9 only */
+#define  BCMA_CC_SLOWCLKCTL_SRC         0x00000007      /* slow clock source mask */
+#define   BCMA_CC_SLOWCLKCTL_SRC_LPO    0x00000000      /* source of slow clock is LPO */
+#define   BCMA_CC_SLOWCLKCTL_SRC_XTAL   0x00000001      /* source of slow clock is crystal */
+#define   BCMA_CC_SLOECLKCTL_SRC_PCI    0x00000002      /* source of slow clock is PCI */
+#define  BCMA_CC_SLOWCLKCTL_LPOFREQ     0x00000200      /* LPOFreqSel, 1: 160Khz, 0: 32KHz */
+#define  BCMA_CC_SLOWCLKCTL_LPOPD       0x00000400      /* LPOPowerDown, 1: LPO is disabled, 0: LPO is enabled */
+#define  BCMA_CC_SLOWCLKCTL_FSLOW       0x00000800      /* ForceSlowClk, 1: sb/cores running on slow clock, 0: power logic control */
+#define  BCMA_CC_SLOWCLKCTL_IPLL        0x00001000      /* IgnorePllOffReq, 1/0: power logic ignores/honors PLL clock disable requests from core */
+#define  BCMA_CC_SLOWCLKCTL_ENXTAL      0x00002000      /* XtalControlEn, 1/0: power logic does/doesn't disable crystal when appropriate */
+#define  BCMA_CC_SLOWCLKCTL_XTALPU      0x00004000      /* XtalPU (RO), 1/0: crystal running/disabled */
+#define  BCMA_CC_SLOWCLKCTL_CLKDIV      0xFFFF0000      /* ClockDivider (SlowClk = 1/(4+divisor)) */
+#define  BCMA_CC_SLOWCLKCTL_CLKDIV_SHIFT        16
+#define BCMA_CC_SYSCLKCTL               0x00C0          /* Rev >= 3 only */
+#define  BCMA_CC_SYSCLKCTL_IDLPEN       0x00000001      /* ILPen: Enable Idle Low Power */
+#define  BCMA_CC_SYSCLKCTL_ALPEN        0x00000002      /* ALPen: Enable Active Low Power */
+#define  BCMA_CC_SYSCLKCTL_PLLEN        0x00000004      /* ForcePLLOn */
+#define  BCMA_CC_SYSCLKCTL_FORCEALP     0x00000008      /* Force ALP (or HT if ALPen is not set */
+#define  BCMA_CC_SYSCLKCTL_FORCEHT      0x00000010      /* Force HT */
+#define  BCMA_CC_SYSCLKCTL_CLKDIV       0xFFFF0000      /* ClkDiv  (ILP = 1/(4+divisor)) */
+#define  BCMA_CC_SYSCLKCTL_CLKDIV_SHIFT 16
+#define BCMA_CC_CLKSTSTR                0x00C4          /* Rev >= 3 only */
+#define BCMA_CC_EROM                    0x00FC
+#define BCMA_CC_PCMCIA_CFG              0x0100
+#define BCMA_CC_PCMCIA_MEMWAIT          0x0104
+#define BCMA_CC_PCMCIA_ATTRWAIT         0x0108
+#define BCMA_CC_PCMCIA_IOWAIT           0x010C
+#define BCMA_CC_IDE_CFG                 0x0110
+#define BCMA_CC_IDE_MEMWAIT             0x0114
+#define BCMA_CC_IDE_ATTRWAIT            0x0118
+#define BCMA_CC_IDE_IOWAIT              0x011C
+#define BCMA_CC_PROG_CFG                0x0120
+#define BCMA_CC_PROG_WAITCNT            0x0124
+#define BCMA_CC_FLASH_CFG               0x0128
+#define BCMA_CC_FLASH_WAITCNT           0x012C
+#define BCMA_CC_CLKCTLST                0x01E0 /* Clock control and status (rev >= 20) */
+#define  BCMA_CC_CLKCTLST_FORCEALP      0x00000001 /* Force ALP request */
+#define  BCMA_CC_CLKCTLST_FORCEHT       0x00000002 /* Force HT request */
+#define  BCMA_CC_CLKCTLST_FORCEILP      0x00000004 /* Force ILP request */
+#define  BCMA_CC_CLKCTLST_HAVEALPREQ    0x00000008 /* ALP available request */
+#define  BCMA_CC_CLKCTLST_HAVEHTREQ     0x00000010 /* HT available request */
+#define  BCMA_CC_CLKCTLST_HWCROFF       0x00000020 /* Force HW clock request off */
+#define  BCMA_CC_CLKCTLST_HAVEHT        0x00010000 /* HT available */
+#define  BCMA_CC_CLKCTLST_HAVEALP       0x00020000 /* APL available */
+#define BCMA_CC_HW_WORKAROUND           0x01E4 /* Hardware workaround (rev >= 20) */
+#define BCMA_CC_UART0_DATA              0x0300
+#define BCMA_CC_UART0_IMR               0x0304
+#define BCMA_CC_UART0_FCR               0x0308
+#define BCMA_CC_UART0_LCR               0x030C
+#define BCMA_CC_UART0_MCR               0x0310
+#define BCMA_CC_UART0_LSR               0x0314
+#define BCMA_CC_UART0_MSR               0x0318
+#define BCMA_CC_UART0_SCRATCH           0x031C
+#define BCMA_CC_UART1_DATA              0x0400
+#define BCMA_CC_UART1_IMR               0x0404
+#define BCMA_CC_UART1_FCR               0x0408
+#define BCMA_CC_UART1_LCR               0x040C
+#define BCMA_CC_UART1_MCR               0x0410
+#define BCMA_CC_UART1_LSR               0x0414
+#define BCMA_CC_UART1_MSR               0x0418
+#define BCMA_CC_UART1_SCRATCH           0x041C
+/* PMU registers (rev >= 20) */
+#define BCMA_CC_PMU_CTL                 0x0600 /* PMU control */
+#define  BCMA_CC_PMU_CTL_ILP_DIV        0xFFFF0000 /* ILP div mask */
+#define  BCMA_CC_PMU_CTL_ILP_DIV_SHIFT  16
+#define  BCMA_CC_PMU_CTL_NOILPONW       0x00000200 /* No ILP on wait */
+#define  BCMA_CC_PMU_CTL_HTREQEN        0x00000100 /* HT req enable */
+#define  BCMA_CC_PMU_CTL_ALPREQEN       0x00000080 /* ALP req enable */
+#define  BCMA_CC_PMU_CTL_XTALFREQ       0x0000007C /* Crystal freq */
+#define  BCMA_CC_PMU_CTL_XTALFREQ_SHIFT 2
+#define  BCMA_CC_PMU_CTL_ILPDIVEN       0x00000002 /* ILP div enable */
+#define  BCMA_CC_PMU_CTL_LPOSEL         0x00000001 /* LPO sel */
+#define BCMA_CC_PMU_CAP                 0x0604 /* PMU capabilities */
+#define  BCMA_CC_PMU_CAP_REVISION       0x000000FF /* Revision mask */
+#define BCMA_CC_PMU_STAT                0x0608 /* PMU status */
+#define  BCMA_CC_PMU_STAT_INTPEND       0x00000040 /* Interrupt pending */
+#define  BCMA_CC_PMU_STAT_SBCLKST       0x00000030 /* Backplane clock status? */
+#define  BCMA_CC_PMU_STAT_HAVEALP       0x00000008 /* ALP available */
+#define  BCMA_CC_PMU_STAT_HAVEHT        0x00000004 /* HT available */
+#define  BCMA_CC_PMU_STAT_RESINIT       0x00000003 /* Res init */
+#define BCMA_CC_PMU_RES_STAT            0x060C /* PMU res status */
+#define BCMA_CC_PMU_RES_PEND            0x0610 /* PMU res pending */
+#define BCMA_CC_PMU_TIMER               0x0614 /* PMU timer */
+#define BCMA_CC_PMU_MINRES_MSK          0x0618 /* PMU min res mask */
+#define BCMA_CC_PMU_MAXRES_MSK          0x061C /* PMU max res mask */
+#define BCMA_CC_PMU_RES_TABSEL          0x0620 /* PMU res table sel */
+#define BCMA_CC_PMU_RES_DEPMSK          0x0624 /* PMU res dep mask */
+#define BCMA_CC_PMU_RES_UPDNTM          0x0628 /* PMU res updown timer */
+#define BCMA_CC_PMU_RES_TIMER           0x062C /* PMU res timer */
+#define BCMA_CC_PMU_CLKSTRETCH          0x0630 /* PMU clockstretch */
+#define BCMA_CC_PMU_WATCHDOG            0x0634 /* PMU watchdog */
+#define BCMA_CC_PMU_RES_REQTS           0x0640 /* PMU res req timer sel */
+#define BCMA_CC_PMU_RES_REQT            0x0644 /* PMU res req timer */
+#define BCMA_CC_PMU_RES_REQM            0x0648 /* PMU res req mask */
+#define BCMA_CC_CHIPCTL_ADDR            0x0650
+#define BCMA_CC_CHIPCTL_DATA            0x0654
+#define BCMA_CC_REGCTL_ADDR             0x0658
+#define BCMA_CC_REGCTL_DATA             0x065C
+#define BCMA_CC_PLLCTL_ADDR             0x0660
+#define BCMA_CC_PLLCTL_DATA             0x0664
+
+/* Data for the PMU, if available.
+ * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
+ */
+struct bcma_chipcommon_pmu {
+        u8 rev;                 /* PMU revision */
+        u32 crystalfreq;        /* The active crystal frequency (in kHz) */
+};
+
+struct bcma_drv_cc {
+        struct bcma_device *core;
+        u32 status;
+        u32 capabilities;
+        u32 capabilities_ext;
+        /* Fast Powerup Delay constant */
+        u16 fast_pwrup_delay;
+        struct bcma_chipcommon_pmu pmu;
+};
+
+/* Register access */
+#define bcma_cc_read32(cc, offset) \
+        bcma_read32((cc)->core, offset)
+#define bcma_cc_write32(cc, offset, val) \
+        bcma_write32((cc)->core, offset, val)
+
+#define bcma_cc_mask32(cc, offset, mask) \
+        bcma_cc_write32(cc, offset, bcma_cc_read32(cc, offset) & (mask))
+#define bcma_cc_set32(cc, offset, set) \
+        bcma_cc_write32(cc, offset, bcma_cc_read32(cc, offset) | (set))
+#define bcma_cc_maskset32(cc, offset, mask, set) \
+        bcma_cc_write32(cc, offset, (bcma_cc_read32(cc, offset) & (mask)) | (set))
+
+extern void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
+
+extern void bcma_chipco_suspend(struct bcma_drv_cc *cc);
+extern void bcma_chipco_resume(struct bcma_drv_cc *cc);
+
+extern void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc,
+                                          u32 ticks);
+
+void bcma_chipco_irq_mask(struct bcma_drv_cc *cc, u32 mask, u32 value);
+
+u32 bcma_chipco_irq_status(struct bcma_drv_cc *cc, u32 mask);
+
+/* Chipcommon GPIO pin access. */
+u32 bcma_chipco_gpio_in(struct bcma_drv_cc *cc, u32 mask);
+u32 bcma_chipco_gpio_out(struct bcma_drv_cc *cc, u32 mask, u32 value);
+u32 bcma_chipco_gpio_outen(struct bcma_drv_cc *cc, u32 mask, u32 value);
+u32 bcma_chipco_gpio_control(struct bcma_drv_cc *cc, u32 mask, u32 value);
+u32 bcma_chipco_gpio_intmask(struct bcma_drv_cc *cc, u32 mask, u32 value);
+u32 bcma_chipco_gpio_polarity(struct bcma_drv_cc *cc, u32 mask, u32 value);
+
+/* PMU support */
+extern void bcma_pmu_init(struct bcma_drv_cc *cc);
+
+#endif /* LINUX_BCMA_DRIVER_CC_H_ */
diff --git a/include/linux/bcma/bcma_driver_pci.h b/include/linux/bcma/bcma_driver_pci.h
new file mode 100644
index 000000000000..b7e191cf00ec
--- /dev/null
+++ b/include/linux/bcma/bcma_driver_pci.h
@@ -0,0 +1,89 @@
+#ifndef LINUX_BCMA_DRIVER_PCI_H_
+#define LINUX_BCMA_DRIVER_PCI_H_
+
+#include <linux/types.h>
+
+struct pci_dev;
+
+/** PCI core registers. **/
+#define BCMA_CORE_PCI_CTL                       0x0000  /* PCI Control */
+#define  BCMA_CORE_PCI_CTL_RST_OE               0x00000001 /* PCI_RESET Output Enable */
+#define  BCMA_CORE_PCI_CTL_RST                  0x00000002 /* PCI_RESET driven out to pin */
+#define  BCMA_CORE_PCI_CTL_CLK_OE               0x00000004 /* Clock gate Output Enable */
+#define  BCMA_CORE_PCI_CTL_CLK                  0x00000008 /* Gate for clock driven out to pin */
+#define BCMA_CORE_PCI_ARBCTL                    0x0010  /* PCI Arbiter Control */
+#define  BCMA_CORE_PCI_ARBCTL_INTERN            0x00000001 /* Use internal arbiter */
+#define  BCMA_CORE_PCI_ARBCTL_EXTERN            0x00000002 /* Use external arbiter */
+#define  BCMA_CORE_PCI_ARBCTL_PARKID            0x00000006 /* Mask, selects which agent is parked on an idle bus */
+#define   BCMA_CORE_PCI_ARBCTL_PARKID_LAST      0x00000000 /* Last requestor */
+#define   BCMA_CORE_PCI_ARBCTL_PARKID_4710      0x00000002 /* 4710 */
+#define   BCMA_CORE_PCI_ARBCTL_PARKID_EXT0      0x00000004 /* External requestor 0 */
+#define   BCMA_CORE_PCI_ARBCTL_PARKID_EXT1      0x00000006 /* External requestor 1 */
+#define BCMA_CORE_PCI_ISTAT                     0x0020  /* Interrupt status */
+#define  BCMA_CORE_PCI_ISTAT_INTA               0x00000001 /* PCI INTA# */
+#define  BCMA_CORE_PCI_ISTAT_INTB               0x00000002 /* PCI INTB# */
+#define  BCMA_CORE_PCI_ISTAT_SERR               0x00000004 /* PCI SERR# (write to clear) */
+#define  BCMA_CORE_PCI_ISTAT_PERR               0x00000008 /* PCI PERR# (write to clear) */
+#define  BCMA_CORE_PCI_ISTAT_PME                0x00000010 /* PCI PME# */
+#define BCMA_CORE_PCI_IMASK                     0x0024  /* Interrupt mask */
+#define  BCMA_CORE_PCI_IMASK_INTA               0x00000001 /* PCI INTA# */
+#define  BCMA_CORE_PCI_IMASK_INTB               0x00000002 /* PCI INTB# */
+#define  BCMA_CORE_PCI_IMASK_SERR               0x00000004 /* PCI SERR# */
+#define  BCMA_CORE_PCI_IMASK_PERR               0x00000008 /* PCI PERR# */
+#define  BCMA_CORE_PCI_IMASK_PME                0x00000010 /* PCI PME# */
+#define BCMA_CORE_PCI_MBOX                      0x0028  /* Backplane to PCI Mailbox */
+#define  BCMA_CORE_PCI_MBOX_F0_0                0x00000100 /* PCI function 0, INT 0 */
+#define  BCMA_CORE_PCI_MBOX_F0_1                0x00000200 /* PCI function 0, INT 1 */
+#define  BCMA_CORE_PCI_MBOX_F1_0                0x00000400 /* PCI function 1, INT 0 */
+#define  BCMA_CORE_PCI_MBOX_F1_1                0x00000800 /* PCI function 1, INT 1 */
+#define  BCMA_CORE_PCI_MBOX_F2_0                0x00001000 /* PCI function 2, INT 0 */
+#define  BCMA_CORE_PCI_MBOX_F2_1                0x00002000 /* PCI function 2, INT 1 */
+#define  BCMA_CORE_PCI_MBOX_F3_0                0x00004000 /* PCI function 3, INT 0 */
+#define  BCMA_CORE_PCI_MBOX_F3_1                0x00008000 /* PCI function 3, INT 1 */
+#define BCMA_CORE_PCI_BCAST_ADDR                0x0050  /* Backplane Broadcast Address */
+#define  BCMA_CORE_PCI_BCAST_ADDR_MASK          0x000000FF
+#define BCMA_CORE_PCI_BCAST_DATA                0x0054  /* Backplane Broadcast Data */
+#define BCMA_CORE_PCI_GPIO_IN                   0x0060  /* rev >= 2 only */
+#define BCMA_CORE_PCI_GPIO_OUT                  0x0064  /* rev >= 2 only */
+#define BCMA_CORE_PCI_GPIO_ENABLE               0x0068  /* rev >= 2 only */
+#define BCMA_CORE_PCI_GPIO_CTL                  0x006C  /* rev >= 2 only */
+#define BCMA_CORE_PCI_SBTOPCI0                  0x0100  /* Backplane to PCI translation 0 (sbtopci0) */
+#define  BCMA_CORE_PCI_SBTOPCI0_MASK            0xFC000000
+#define BCMA_CORE_PCI_SBTOPCI1                  0x0104  /* Backplane to PCI translation 1 (sbtopci1) */
+#define  BCMA_CORE_PCI_SBTOPCI1_MASK            0xFC000000
+#define BCMA_CORE_PCI_SBTOPCI2                  0x0108  /* Backplane to PCI translation 2 (sbtopci2) */
+#define  BCMA_CORE_PCI_SBTOPCI2_MASK            0xC0000000
+#define BCMA_CORE_PCI_PCICFG0                   0x0400  /* PCI config space 0 (rev >= 8) */
+#define BCMA_CORE_PCI_PCICFG1                   0x0500  /* PCI config space 1 (rev >= 8) */
+#define BCMA_CORE_PCI_PCICFG2                   0x0600  /* PCI config space 2 (rev >= 8) */
+#define BCMA_CORE_PCI_PCICFG3                   0x0700  /* PCI config space 3 (rev >= 8) */
+#define BCMA_CORE_PCI_SPROM(wordoffset)         (0x0800 + ((wordoffset) * 2)) /* SPROM shadow area (72 bytes) */
+
+/* SBtoPCIx */
+#define BCMA_CORE_PCI_SBTOPCI_MEM               0x00000000
+#define BCMA_CORE_PCI_SBTOPCI_IO                0x00000001
+#define BCMA_CORE_PCI_SBTOPCI_CFG0              0x00000002
+#define BCMA_CORE_PCI_SBTOPCI_CFG1              0x00000003
+#define BCMA_CORE_PCI_SBTOPCI_PREF              0x00000004 /* Prefetch enable */
+#define BCMA_CORE_PCI_SBTOPCI_BURST             0x00000008 /* Burst enable */
+#define BCMA_CORE_PCI_SBTOPCI_MRM               0x00000020 /* Memory Read Multiple */
+#define BCMA_CORE_PCI_SBTOPCI_RC                0x00000030 /* Read Command mask (rev >= 11) */
+#define  BCMA_CORE_PCI_SBTOPCI_RC_READ          0x00000000 /* Memory read */
+#define  BCMA_CORE_PCI_SBTOPCI_RC_READL         0x00000010 /* Memory read line */
+#define  BCMA_CORE_PCI_SBTOPCI_RC_READM         0x00000020 /* Memory read multiple */
+
+/* PCIcore specific boardflags */
+#define BCMA_CORE_PCI_BFL_NOPCI                 0x00000400 /* Board leaves PCI floating */
+
+struct bcma_drv_pci {
+        struct bcma_device *core;
+        u8 setup_done:1;
+};
+
+/* Register access */
+#define pcicore_read32(pc, offset)              bcma_read32((pc)->core, offset)
+#define pcicore_write32(pc, offset, val)        bcma_write32((pc)->core, offset, val)
+
+extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
+
+#endif /* LINUX_BCMA_DRIVER_PCI_H_ */
diff --git a/include/linux/bcma/bcma_regs.h b/include/linux/bcma/bcma_regs.h
new file mode 100644
index 000000000000..f82d88a960ce
--- /dev/null
+++ b/include/linux/bcma/bcma_regs.h
@@ -0,0 +1,34 @@
+#ifndef LINUX_BCMA_REGS_H_
+#define LINUX_BCMA_REGS_H_
+
+/* Agent registers (common for every core) */
+#define BCMA_IOCTL                      0x0408
+#define  BCMA_IOCTL_CLK                 0x0001
+#define  BCMA_IOCTL_FGC                 0x0002
+#define  BCMA_IOCTL_CORE_BITS           0x3FFC
+#define  BCMA_IOCTL_PME_EN              0x4000
+#define  BCMA_IOCTL_BIST_EN             0x8000
+#define BCMA_RESET_CTL                  0x0800
+#define  BCMA_RESET_CTL_RESET           0x0001
+
+/* BCMA PCI config space registers. */
+#define BCMA_PCI_PMCSR                  0x44
+#define  BCMA_PCI_PE                    0x100
+#define BCMA_PCI_BAR0_WIN               0x80    /* Backplane address space 0 */
+#define BCMA_PCI_BAR1_WIN               0x84    /* Backplane address space 1 */
+#define BCMA_PCI_SPROMCTL               0x88    /* SPROM control */
+#define  BCMA_PCI_SPROMCTL_WE           0x10    /* SPROM write enable */
+#define BCMA_PCI_BAR1_CONTROL           0x8c    /* Address space 1 burst control */
+#define BCMA_PCI_IRQS                   0x90    /* PCI interrupts */
+#define BCMA_PCI_IRQMASK                0x94    /* PCI IRQ control and mask (pcirev >= 6 only) */
+#define BCMA_PCI_BACKPLANE_IRQS         0x98    /* Backplane Interrupts */
+#define BCMA_PCI_BAR0_WIN2              0xAC
+#define BCMA_PCI_GPIO_IN                0xB0    /* GPIO Input (pcirev >= 3 only) */
+#define BCMA_PCI_GPIO_OUT               0xB4    /* GPIO Output (pcirev >= 3 only) */
+#define BCMA_PCI_GPIO_OUT_ENABLE        0xB8    /* GPIO Output Enable/Disable (pcirev >= 3 only) */
+#define  BCMA_PCI_GPIO_SCS              0x10    /* PCI config space bit 4 for 4306c0 slow clock source */
+#define  BCMA_PCI_GPIO_HWRAD            0x20    /* PCI config space GPIO 13 for hw radio disable */
+#define  BCMA_PCI_GPIO_XTAL             0x40    /* PCI config space GPIO 14 for Xtal powerup */
+#define  BCMA_PCI_GPIO_PLL              0x80    /* PCI config space GPIO 15 for PLL powerdown */
+
+#endif /* LINUX_BCMA_REGS_H_ */
diff --git a/include/linux/can/core.h b/include/linux/can/core.h
index 6f70a6d3a16e..5ce6b5d62ecc 100644
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -44,8 +44,8 @@ struct can_proto {
 
 /* function prototypes for the CAN networklayer core (af_can.c) */
 
-extern int  can_proto_register(struct can_proto *cp);
-extern void can_proto_unregister(struct can_proto *cp);
+extern int  can_proto_register(const struct can_proto *cp);
+extern void can_proto_unregister(const struct can_proto *cp);
 
 extern int  can_rx_register(struct net_device *dev, canid_t can_id,
                             canid_t mask,
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index dc80d8294247..c6a850ab2ec5 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -24,7 +24,10 @@ struct ethtool_cmd {
         __u32   cmd;
         __u32   supported;      /* Features this interface supports */
         __u32   advertising;    /* Features this interface advertises */
-        __u16   speed;          /* The forced speed, 10Mb, 100Mb, gigabit */
+        __u16   speed;          /* The forced speed (lower bits) in
+                                 * Mbps. Please use
+                                 * ethtool_cmd_speed()/_set() to
+                                 * access it */
         __u8    duplex;         /* Duplex, half or full */
         __u8    port;           /* Which connector port */
         __u8    phy_address;
@@ -33,7 +36,10 @@ struct ethtool_cmd {
         __u8    mdio_support;
         __u32   maxtxpkt;       /* Tx pkts before generating tx int */
         __u32   maxrxpkt;       /* Rx pkts before generating rx int */
-        __u16   speed_hi;
+        __u16   speed_hi;       /* The forced speed (upper
+                                 * bits) in Mbps. Please use
+                                 * ethtool_cmd_speed()/_set() to
+                                 * access it */
         __u8    eth_tp_mdix;
         __u8    reserved2;
         __u32   lp_advertising; /* Features the link partner advertises */
@@ -41,14 +47,14 @@ struct ethtool_cmd {
 };
 
 static inline void ethtool_cmd_speed_set(struct ethtool_cmd *ep,
-                                                __u32 speed)
+                                         __u32 speed)
 {
 
         ep->speed = (__u16)speed;
         ep->speed_hi = (__u16)(speed >> 16);
 }
 
-static inline __u32 ethtool_cmd_speed(struct ethtool_cmd *ep)
+static inline __u32 ethtool_cmd_speed(const struct ethtool_cmd *ep)
 {
         return (ep->speed_hi << 16) | ep->speed;
 }
@@ -229,6 +235,34 @@ struct ethtool_ringparam {
         __u32   tx_pending;
 };
 
+/**
+ * struct ethtool_channels - configuring number of network channel
+ * @cmd: ETHTOOL_{G,S}CHANNELS
+ * @max_rx: Read only. Maximum number of receive channel the driver support.
+ * @max_tx: Read only. Maximum number of transmit channel the driver support.
+ * @max_other: Read only. Maximum number of other channel the driver support.
+ * @max_combined: Read only. Maximum number of combined channel the driver
+ *      support. Set of queues RX, TX or other.
+ * @rx_count: Valid values are in the range 1 to the max_rx.
+ * @tx_count: Valid values are in the range 1 to the max_tx.
+ * @other_count: Valid values are in the range 1 to the max_other.
+ * @combined_count: Valid values are in the range 1 to the max_combined.
+ *
+ * This can be used to configure RX, TX and other channels.
+ */
+
+struct ethtool_channels {
+        __u32   cmd;
+        __u32   max_rx;
+        __u32   max_tx;
+        __u32   max_other;
+        __u32   max_combined;
+        __u32   rx_count;
+        __u32   tx_count;
+        __u32   other_count;
+        __u32   combined_count;
+};
+
 /* for configuring link flow control parameters */
 struct ethtool_pauseparam {
         __u32   cmd;    /* ETHTOOL_{G,S}PAUSEPARAM */
@@ -380,27 +414,42 @@ struct ethtool_usrip4_spec {
         __u8    proto;
 };
 
+union ethtool_flow_union {
+        struct ethtool_tcpip4_spec              tcp_ip4_spec;
+        struct ethtool_tcpip4_spec              udp_ip4_spec;
+        struct ethtool_tcpip4_spec              sctp_ip4_spec;
+        struct ethtool_ah_espip4_spec           ah_ip4_spec;
+        struct ethtool_ah_espip4_spec           esp_ip4_spec;
+        struct ethtool_usrip4_spec              usr_ip4_spec;
+        struct ethhdr                           ether_spec;
+        __u8                                    hdata[60];
+};
+
+struct ethtool_flow_ext {
+        __be16  vlan_etype;
+        __be16  vlan_tci;
+        __be32  data[2];
+};
+
 /**
  * struct ethtool_rx_flow_spec - specification for RX flow filter
  * @flow_type: Type of match to perform, e.g. %TCP_V4_FLOW
  * @h_u: Flow fields to match (dependent on @flow_type)
- * @m_u: Masks for flow field bits to be ignored
+ * @h_ext: Additional fields to match
+ * @m_u: Masks for flow field bits to be matched
+ * @m_ext: Masks for additional field bits to be matched
+ *      Note, all additional fields must be ignored unless @flow_type
+ *      includes the %FLOW_EXT flag.
  * @ring_cookie: RX ring/queue index to deliver to, or %RX_CLS_FLOW_DISC
  *      if packets should be discarded
  * @location: Index of filter in hardware table
  */
 struct ethtool_rx_flow_spec {
         __u32           flow_type;
-        union {
-                struct ethtool_tcpip4_spec              tcp_ip4_spec;
-                struct ethtool_tcpip4_spec              udp_ip4_spec;
-                struct ethtool_tcpip4_spec              sctp_ip4_spec;
-                struct ethtool_ah_espip4_spec           ah_ip4_spec;
-                struct ethtool_ah_espip4_spec           esp_ip4_spec;
-                struct ethtool_usrip4_spec              usr_ip4_spec;
-                struct ethhdr                           ether_spec;
-                __u8                                    hdata[72];
-        } h_u, m_u;
+        union ethtool_flow_union h_u;
+        struct ethtool_flow_ext h_ext;
+        union ethtool_flow_union m_u;
+        struct ethtool_flow_ext m_ext;
         __u64           ring_cookie;
         __u32           location;
 };
@@ -458,16 +507,10 @@ struct ethtool_rxnfc {
 
 struct compat_ethtool_rx_flow_spec {
         u32             flow_type;
-        union {
-                struct ethtool_tcpip4_spec              tcp_ip4_spec;
-                struct ethtool_tcpip4_spec              udp_ip4_spec;
-                struct ethtool_tcpip4_spec              sctp_ip4_spec;
-                struct ethtool_ah_espip4_spec           ah_ip4_spec;
-                struct ethtool_ah_espip4_spec           esp_ip4_spec;
-                struct ethtool_usrip4_spec              usr_ip4_spec;
-                struct ethhdr                           ether_spec;
-                u8                                      hdata[72];
-        } h_u, m_u;
+        union ethtool_flow_union h_u;
+        struct ethtool_flow_ext h_ext;
+        union ethtool_flow_union m_u;
+        struct ethtool_flow_ext m_ext;
         compat_u64      ring_cookie;
         u32             location;
 };
@@ -558,6 +601,26 @@ struct ethtool_flash {
         char    data[ETHTOOL_FLASH_MAX_FILENAME];
 };
 
+/**
+ * struct ethtool_dump - used for retrieving, setting device dump
+ * @cmd: Command number - %ETHTOOL_GET_DUMP_FLAG, %ETHTOOL_GET_DUMP_DATA, or
+ *      %ETHTOOL_SET_DUMP
+ * @version: FW version of the dump, filled in by driver
+ * @flag: driver dependent flag for dump setting, filled in by driver during
+ *        get and filled in by ethtool for set operation
+ * @len: length of dump data, used as the length of the user buffer on entry to
+ *       %ETHTOOL_GET_DUMP_DATA and this is returned as dump length by driver
+ *       for %ETHTOOL_GET_DUMP_FLAG command
+ * @data: data collected for get dump data operation
+ */
+struct ethtool_dump {
+        __u32   cmd;
+        __u32   version;
+        __u32   flag;
+        __u32   len;
+        __u8    data[0];
+};
+
 /* for returning and changing feature sets */
 
 /**
@@ -663,6 +726,22 @@ struct ethtool_rx_ntuple_list {
         unsigned int            count;
 };
 
+/**
+ * enum ethtool_phys_id_state - indicator state for physical identification
+ * @ETHTOOL_ID_INACTIVE: Physical ID indicator should be deactivated
+ * @ETHTOOL_ID_ACTIVE: Physical ID indicator should be activated
+ * @ETHTOOL_ID_ON: LED should be turned on (used iff %ETHTOOL_ID_ACTIVE
+ *      is not supported)
+ * @ETHTOOL_ID_OFF: LED should be turned off (used iff %ETHTOOL_ID_ACTIVE
+ *      is not supported)
+ */
+enum ethtool_phys_id_state {
+        ETHTOOL_ID_INACTIVE,
+        ETHTOOL_ID_ACTIVE,
+        ETHTOOL_ID_ON,
+        ETHTOOL_ID_OFF
+};
+
 struct net_device;
 
 /* Some generic methods drivers may use in their ethtool_ops */
@@ -683,63 +762,131 @@ void ethtool_ntuple_flush(struct net_device *dev);
 bool ethtool_invalid_flags(struct net_device *dev, u32 data, u32 supported);
 
 /**
- * &ethtool_ops - Alter and report network device settings
- * get_settings: Get device-specific settings
- * set_settings: Set device-specific settings
- * get_drvinfo: Report driver information
- * get_regs: Get device registers
- * get_wol: Report whether Wake-on-Lan is enabled
- * set_wol: Turn Wake-on-Lan on or off
- * get_msglevel: Report driver message level
- * set_msglevel: Set driver message level
- * nway_reset: Restart autonegotiation
- * get_link: Get link status
- * get_eeprom: Read data from the device EEPROM
- * set_eeprom: Write data to the device EEPROM
- * get_coalesce: Get interrupt coalescing parameters
- * set_coalesce: Set interrupt coalescing parameters
- * get_ringparam: Report ring sizes
- * set_ringparam: Set ring sizes
- * get_pauseparam: Report pause parameters
- * set_pauseparam: Set pause parameters
- * get_rx_csum: Report whether receive checksums are turned on or off
- * set_rx_csum: Turn receive checksum on or off
- * get_tx_csum: Report whether transmit checksums are turned on or off
- * set_tx_csum: Turn transmit checksums on or off
- * get_sg: Report whether scatter-gather is enabled
- * set_sg: Turn scatter-gather on or off
- * get_tso: Report whether TCP segmentation offload is enabled
- * set_tso: Turn TCP segmentation offload on or off
- * get_ufo: Report whether UDP fragmentation offload is enabled
- * set_ufo: Turn UDP fragmentation offload on or off
- * self_test: Run specified self-tests
- * get_strings: Return a set of strings that describe the requested objects
- * phys_id: Identify the device
- * get_stats: Return statistics about the device
- * get_flags: get 32-bit flags bitmap
- * set_flags: set 32-bit flags bitmap
- *
- * Description:
- *
- * get_settings:
- *      @get_settings is passed an &ethtool_cmd to fill in.  It returns
- *      an negative errno or zero.
- *
- * set_settings:
- *      @set_settings is passed an &ethtool_cmd and should attempt to set
- *      all the settings this device supports.  It may return an error value
- *      if something goes wrong (otherwise 0).
- *
- * get_eeprom:
+ * struct ethtool_ops - optional netdev operations
+ * @get_settings: Get various device settings including Ethernet link
+ *      settings. The @cmd parameter is expected to have been cleared
+ *      before get_settings is called. Returns a negative error code or
+ *      zero.
+ * @set_settings: Set various device settings including Ethernet link
+ *      settings.  Returns a negative error code or zero.
+ * @get_drvinfo: Report driver/device information.  Should only set the
+ *      @driver, @version, @fw_version and @bus_info fields.  If not
+ *      implemented, the @driver and @bus_info fields will be filled in
+ *      according to the netdev's parent device.
+ * @get_regs_len: Get buffer length required for @get_regs
+ * @get_regs: Get device registers
+ * @get_wol: Report whether Wake-on-Lan is enabled
+ * @set_wol: Turn Wake-on-Lan on or off.  Returns a negative error code
+ *      or zero.
+ * @get_msglevel: Report driver message level.  This should be the value
+ *      of the @msg_enable field used by netif logging functions.
+ * @set_msglevel: Set driver message level
+ * @nway_reset: Restart autonegotiation.  Returns a negative error code
+ *      or zero.
+ * @get_link: Report whether physical link is up.  Will only be called if
+ *      the netdev is up.  Should usually be set to ethtool_op_get_link(),
+ *      which uses netif_carrier_ok().
+ * @get_eeprom: Read data from the device EEPROM.
  *      Should fill in the magic field.  Don't need to check len for zero
  *      or wraparound.  Fill in the data argument with the eeprom values
  *      from offset to offset + len.  Update len to the amount read.
  *      Returns an error or zero.
- *
- * set_eeprom:
+ * @set_eeprom: Write data to the device EEPROM.
  *      Should validate the magic field.  Don't need to check len for zero
  *      or wraparound.  Update len to the amount written.  Returns an error
  *      or zero.
+ * @get_coalesce: Get interrupt coalescing parameters.  Returns a negative
+ *      error code or zero.
+ * @set_coalesce: Set interrupt coalescing parameters.  Returns a negative
+ *      error code or zero.
+ * @get_ringparam: Report ring sizes
+ * @set_ringparam: Set ring sizes.  Returns a negative error code or zero.
+ * @get_pauseparam: Report pause parameters
+ * @set_pauseparam: Set pause parameters.  Returns a negative error code
+ *      or zero.
+ * @get_rx_csum: Deprecated in favour of the netdev feature %NETIF_F_RXCSUM.
+ *      Report whether receive checksums are turned on or off.
+ * @set_rx_csum: Deprecated in favour of generic netdev features.  Turn
+ *      receive checksum on or off.  Returns a negative error code or zero.
+ * @get_tx_csum: Deprecated as redundant. Report whether transmit checksums
+ *      are turned on or off.
+ * @set_tx_csum: Deprecated in favour of generic netdev features.  Turn
+ *      transmit checksums on or off.  Returns a egative error code or zero.
+ * @get_sg: Deprecated as redundant.  Report whether scatter-gather is
+ *      enabled.  
+ * @set_sg: Deprecated in favour of generic netdev features.  Turn
+ *      scatter-gather on or off. Returns a negative error code or zero.
+ * @get_tso: Deprecated as redundant.  Report whether TCP segmentation
+ *      offload is enabled.
+ * @set_tso: Deprecated in favour of generic netdev features.  Turn TCP
+ *      segmentation offload on or off.  Returns a negative error code or zero.
+ * @self_test: Run specified self-tests
+ * @get_strings: Return a set of strings that describe the requested objects
+ * @set_phys_id: Identify the physical devices, e.g. by flashing an LED
+ *      attached to it.  The implementation may update the indicator
+ *      asynchronously or synchronously, but in either case it must return
+ *      quickly.  It is initially called with the argument %ETHTOOL_ID_ACTIVE,
+ *      and must either activate asynchronous updates and return zero, return
+ *      a negative error or return a positive frequency for synchronous
+ *      indication (e.g. 1 for one on/off cycle per second).  If it returns
+ *      a frequency then it will be called again at intervals with the
+ *      argument %ETHTOOL_ID_ON or %ETHTOOL_ID_OFF and should set the state of
+ *      the indicator accordingly.  Finally, it is called with the argument
+ *      %ETHTOOL_ID_INACTIVE and must deactivate the indicator.  Returns a
+ *      negative error code or zero.
+ * @get_ethtool_stats: Return extended statistics about the device.
+ *      This is only useful if the device maintains statistics not
+ *      included in &struct rtnl_link_stats64.
+ * @begin: Function to be called before any other operation.  Returns a
+ *      negative error code or zero.
+ * @complete: Function to be called after any other operation except
+ *      @begin.  Will be called even if the other operation failed.
+ * @get_ufo: Deprecated as redundant.  Report whether UDP fragmentation
+ *      offload is enabled.
+ * @set_ufo: Deprecated in favour of generic netdev features.  Turn UDP
+ *      fragmentation offload on or off.  Returns a negative error code or zero.
+ * @get_flags: Deprecated as redundant.  Report features included in
+ *      &enum ethtool_flags that are enabled.  
+ * @set_flags: Deprecated in favour of generic netdev features.  Turn
+ *      features included in &enum ethtool_flags on or off.  Returns a
+ *      negative error code or zero.
+ * @get_priv_flags: Report driver-specific feature flags.
+ * @set_priv_flags: Set driver-specific feature flags.  Returns a negative
+ *      error code or zero.
+ * @get_sset_count: Get number of strings that @get_strings will write.
+ * @get_rxnfc: Get RX flow classification rules.  Returns a negative
+ *      error code or zero.
+ * @set_rxnfc: Set RX flow classification rules.  Returns a negative
+ *      error code or zero.
+ * @flash_device: Write a firmware image to device's flash memory.
+ *      Returns a negative error code or zero.
+ * @reset: Reset (part of) the device, as specified by a bitmask of
+ *      flags from &enum ethtool_reset_flags.  Returns a negative
+ *      error code or zero.
+ * @set_rx_ntuple: Set an RX n-tuple rule.  Returns a negative error code
+ *      or zero.
+ * @get_rx_ntuple: Deprecated.
+ * @get_rxfh_indir: Get the contents of the RX flow hash indirection table.
+ *      Returns a negative error code or zero.
+ * @set_rxfh_indir: Set the contents of the RX flow hash indirection table.
+ *      Returns a negative error code or zero.
+ * @get_channels: Get number of channels.
+ * @set_channels: Set number of channels.  Returns a negative error code or
+ *      zero.
+ * @get_dump_flag: Get dump flag indicating current dump length, version,
+ *                 and flag of the device.
+ * @get_dump_data: Get dump data.
+ * @set_dump: Set dump specific flags to the device.
+ *
+ * All operations are optional (i.e. the function pointer may be set
+ * to %NULL) and callers must take this into account.  Callers must
+ * hold the RTNL, except that for @get_drvinfo the caller may or may
+ * not hold the RTNL.
+ *
+ * See the structures used by these operations for further documentation.
+ *
+ * See &struct net_device and &struct net_device_ops for documentation
+ * of the generic netdev features interface.
  */
 struct ethtool_ops {
         int     (*get_settings)(struct net_device *, struct ethtool_cmd *);
@@ -778,7 +925,7 @@ struct ethtool_ops {
         int     (*set_tso)(struct net_device *, u32);
         void    (*self_test)(struct net_device *, struct ethtool_test *, u64 *);
         void    (*get_strings)(struct net_device *, u32 stringset, u8 *);
-        int     (*phys_id)(struct net_device *, u32);
+        int     (*set_phys_id)(struct net_device *, enum ethtool_phys_id_state);
         void    (*get_ethtool_stats)(struct net_device *,
                                      struct ethtool_stats *, u64 *);
         int     (*begin)(struct net_device *);
@@ -802,6 +949,13 @@ struct ethtool_ops {
                                   struct ethtool_rxfh_indir *);
         int     (*set_rxfh_indir)(struct net_device *,
                                   const struct ethtool_rxfh_indir *);
+        void    (*get_channels)(struct net_device *, struct ethtool_channels *);
+        int     (*set_channels)(struct net_device *, struct ethtool_channels *);
+        int     (*get_dump_flag)(struct net_device *, struct ethtool_dump *);
+        int     (*get_dump_data)(struct net_device *,
+                                 struct ethtool_dump *, void *);
+        int     (*set_dump)(struct net_device *, struct ethtool_dump *);
+
 };
 #endif /* __KERNEL__ */
 
@@ -870,6 +1024,11 @@ struct ethtool_ops {
 
 #define ETHTOOL_GFEATURES       0x0000003a /* Get device offload settings */
 #define ETHTOOL_SFEATURES       0x0000003b /* Change device offload settings */
+#define ETHTOOL_GCHANNELS       0x0000003c /* Get no of channels */
+#define ETHTOOL_SCHANNELS       0x0000003d /* Set no of channels */
+#define ETHTOOL_SET_DUMP        0x0000003e /* Set dump settings */
+#define ETHTOOL_GET_DUMP_FLAG   0x0000003f /* Get dump settings */
+#define ETHTOOL_GET_DUMP_DATA   0x00000040 /* Get dump data */
 
 /* compatibility with older code */
 #define SPARC_ETH_GSET          ETHTOOL_GSET
@@ -897,6 +1056,8 @@ struct ethtool_ops {
 #define SUPPORTED_10000baseKX4_Full     (1 << 18)
 #define SUPPORTED_10000baseKR_Full      (1 << 19)
 #define SUPPORTED_10000baseR_FEC        (1 << 20)
+#define SUPPORTED_20000baseMLD2_Full    (1 << 21)
+#define SUPPORTED_20000baseKR2_Full     (1 << 22)
 
 /* Indicates what features are advertised by the interface. */
 #define ADVERTISED_10baseT_Half         (1 << 0)
@@ -920,6 +1081,8 @@ struct ethtool_ops {
 #define ADVERTISED_10000baseKX4_Full    (1 << 18)
 #define ADVERTISED_10000baseKR_Full     (1 << 19)
 #define ADVERTISED_10000baseR_FEC       (1 << 20)
+#define ADVERTISED_20000baseMLD2_Full   (1 << 21)
+#define ADVERTISED_20000baseKR2_Full    (1 << 22)
 
 /* The following are all involved in forcing a particular link
  * mode for the device for setting things.  When getting the
@@ -992,6 +1155,8 @@ struct ethtool_ops {
 #define IPV4_FLOW       0x10    /* hash only */
 #define IPV6_FLOW       0x11    /* hash only */
 #define ETHER_FLOW      0x12    /* spec only (ether_spec) */
+/* Flag to enable additional fields in struct ethtool_rx_flow_spec */
+#define FLOW_EXT        0x80000000
 
 /* L3-L4 network traffic flow hash options */
 #define RXH_L2DA        (1 << 1)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 45266b75409a..4609b85e559d 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -135,6 +135,8 @@ struct sk_filter
 {
         atomic_t                refcnt;
         unsigned int            len;    /* Number of filter blocks */
+        unsigned int            (*bpf_func)(const struct sk_buff *skb,
+                                            const struct sock_filter *filter);
         struct rcu_head         rcu;
         struct sock_filter      insns[0];
 };
@@ -153,6 +155,80 @@ extern unsigned int sk_run_filter(const struct sk_buff *skb,
 extern int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk);
 extern int sk_detach_filter(struct sock *sk);
 extern int sk_chk_filter(struct sock_filter *filter, int flen);
+
+#ifdef CONFIG_BPF_JIT
+extern void bpf_jit_compile(struct sk_filter *fp);
+extern void bpf_jit_free(struct sk_filter *fp);
+#define SK_RUN_FILTER(FILTER, SKB) (*FILTER->bpf_func)(SKB, FILTER->insns)
+#else
+static inline void bpf_jit_compile(struct sk_filter *fp)
+{
+}
+static inline void bpf_jit_free(struct sk_filter *fp)
+{
+}
+#define SK_RUN_FILTER(FILTER, SKB) sk_run_filter(SKB, FILTER->insns)
+#endif
+
+enum {
+        BPF_S_RET_K = 1,
+        BPF_S_RET_A,
+        BPF_S_ALU_ADD_K,
+        BPF_S_ALU_ADD_X,
+        BPF_S_ALU_SUB_K,
+        BPF_S_ALU_SUB_X,
+        BPF_S_ALU_MUL_K,
+        BPF_S_ALU_MUL_X,
+        BPF_S_ALU_DIV_X,
+        BPF_S_ALU_AND_K,
+        BPF_S_ALU_AND_X,
+        BPF_S_ALU_OR_K,
+        BPF_S_ALU_OR_X,
+        BPF_S_ALU_LSH_K,
+        BPF_S_ALU_LSH_X,
+        BPF_S_ALU_RSH_K,
+        BPF_S_ALU_RSH_X,
+        BPF_S_ALU_NEG,
+        BPF_S_LD_W_ABS,
+        BPF_S_LD_H_ABS,
+        BPF_S_LD_B_ABS,
+        BPF_S_LD_W_LEN,
+        BPF_S_LD_W_IND,
+        BPF_S_LD_H_IND,
+        BPF_S_LD_B_IND,
+        BPF_S_LD_IMM,
+        BPF_S_LDX_W_LEN,
+        BPF_S_LDX_B_MSH,
+        BPF_S_LDX_IMM,
+        BPF_S_MISC_TAX,
+        BPF_S_MISC_TXA,
+        BPF_S_ALU_DIV_K,
+        BPF_S_LD_MEM,
+        BPF_S_LDX_MEM,
+        BPF_S_ST,
+        BPF_S_STX,
+        BPF_S_JMP_JA,
+        BPF_S_JMP_JEQ_K,
+        BPF_S_JMP_JEQ_X,
+        BPF_S_JMP_JGE_K,
+        BPF_S_JMP_JGE_X,
+        BPF_S_JMP_JGT_K,
+        BPF_S_JMP_JGT_X,
+        BPF_S_JMP_JSET_K,
+        BPF_S_JMP_JSET_X,
+        /* Ancillary data */
+        BPF_S_ANC_PROTOCOL,
+        BPF_S_ANC_PKTTYPE,
+        BPF_S_ANC_IFINDEX,
+        BPF_S_ANC_NLATTR,
+        BPF_S_ANC_NLATTR_NEST,
+        BPF_S_ANC_MARK,
+        BPF_S_ANC_QUEUE,
+        BPF_S_ANC_HATYPE,
+        BPF_S_ANC_RXHASH,
+        BPF_S_ANC_CPU,
+};
+
 #endif /* __KERNEL__ */
 
 #endif /* __LINUX_FILTER_H__ */
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 2d1c6117d92c..b2eee5879883 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -884,6 +884,15 @@ struct ieee80211_ht_cap {
 #define IEEE80211_HT_CAP_40MHZ_INTOLERANT       0x4000
 #define IEEE80211_HT_CAP_LSIG_TXOP_PROT         0x8000
 
+/* 802.11n HT extended capabilities masks (for extended_ht_cap_info) */
+#define IEEE80211_HT_EXT_CAP_PCO                0x0001
+#define IEEE80211_HT_EXT_CAP_PCO_TIME           0x0006
+#define         IEEE80211_HT_EXT_CAP_PCO_TIME_SHIFT     1
+#define IEEE80211_HT_EXT_CAP_MCS_FB             0x0300
+#define         IEEE80211_HT_EXT_CAP_MCS_FB_SHIFT       8
+#define IEEE80211_HT_EXT_CAP_HTC_SUP            0x0400
+#define IEEE80211_HT_EXT_CAP_RD_RESPONDER       0x0800
+
 /* 802.11n HT capability AMPDU settings (for ampdu_params_info) */
 #define IEEE80211_HT_AMPDU_PARM_FACTOR          0x03
 #define IEEE80211_HT_AMPDU_PARM_DENSITY         0x1C
@@ -993,6 +1002,11 @@ struct ieee80211_ht_info {
 
 #define WLAN_CAPABILITY_ESS             (1<<0)
 #define WLAN_CAPABILITY_IBSS            (1<<1)
+
+/* A mesh STA sets the ESS and IBSS capability bits to zero */
+#define WLAN_CAPABILITY_IS_MBSS(cap)    \
+        (!((cap) & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)))
+
 #define WLAN_CAPABILITY_CF_POLLABLE     (1<<2)
 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
 #define WLAN_CAPABILITY_PRIVACY         (1<<4)
@@ -1252,9 +1266,8 @@ enum ieee80211_category {
         WLAN_CATEGORY_MULTIHOP_ACTION = 14,
         WLAN_CATEGORY_SELF_PROTECTED = 15,
         WLAN_CATEGORY_WMM = 17,
-        /* TODO: remove MESH_PLINK and MESH_PATH_SEL after */
-        /*       mesh is updated to current 802.11s draft  */
-        WLAN_CATEGORY_MESH_PLINK = 30,
+        /* TODO: remove MESH_PATH_SEL after mesh is updated
+         * to current 802.11s draft  */
         WLAN_CATEGORY_MESH_PATH_SEL = 32,
         WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
         WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
@@ -1507,6 +1520,7 @@ static inline bool ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
                 category = ((u8 *) hdr) + 24;
                 return *category != WLAN_CATEGORY_PUBLIC &&
                         *category != WLAN_CATEGORY_HT &&
+                        *category != WLAN_CATEGORY_SELF_PROTECTED &&
                         *category != WLAN_CATEGORY_VENDOR_SPECIFIC;
         }
 
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index be69043d2896..0f1325d98295 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -136,6 +136,7 @@ int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr);
 extern struct ctl_table ether_table[];
 #endif
 
+int mac_pton(const char *s, u8 *mac);
 extern ssize_t sysfs_format_mac(char *buf, const unsigned char *addr, int len);
 
 #endif
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 635e1faec412..290bd8ac94cf 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -86,7 +86,6 @@ struct vlan_group {
                                             * the vlan is attached to.
                                             */
         unsigned int            nr_vlans;
-        int                     killall;
         struct hlist_node       hlist;  /* linked list */
         struct net_device **vlan_devices_arrays[VLAN_GROUP_ARRAY_SPLIT_PARTS];
         struct rcu_head         rcu;
@@ -132,7 +131,8 @@ extern u16 vlan_dev_vlan_id(const struct net_device *dev);
 
 extern int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
                              u16 vlan_tci, int polling);
-extern bool vlan_hwaccel_do_receive(struct sk_buff **skb);
+extern bool vlan_do_receive(struct sk_buff **skb);
+extern struct sk_buff *vlan_untag(struct sk_buff *skb);
 extern gro_result_t
 vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
                  unsigned int vlan_tci, struct sk_buff *skb);
@@ -166,13 +166,18 @@ static inline int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
         return NET_XMIT_SUCCESS;
 }
 
-static inline bool vlan_hwaccel_do_receive(struct sk_buff **skb)
+static inline bool vlan_do_receive(struct sk_buff **skb)
 {
         if ((*skb)->vlan_tci & VLAN_VID_MASK)
                 (*skb)->pkt_type = PACKET_OTHERHOST;
         return false;
 }
 
+static inline struct sk_buff *vlan_untag(struct sk_buff *skb)
+{
+        return skb;
+}
+
 static inline gro_result_t
 vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
                  unsigned int vlan_tci, struct sk_buff *skb)
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index 48c007dae476..ae28e93fd072 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -382,6 +382,23 @@ struct ssb_device_id {
 #define SSB_ANY_ID              0xFFFF
 #define SSB_ANY_REV             0xFF
 
+/* Broadcom's specific AMBA core, see drivers/bcma/ */
+struct bcma_device_id {
+        __u16   manuf;
+        __u16   id;
+        __u8    rev;
+        __u8    class;
+};
+#define BCMA_CORE(_manuf, _id, _rev, _class)  \
+        { .manuf = _manuf, .id = _id, .rev = _rev, .class = _class, }
+#define BCMA_CORETABLE_END  \
+        { 0, },
+
+#define BCMA_ANY_MANUF          0xFFFF
+#define BCMA_ANY_ID             0xFFFF
+#define BCMA_ANY_REV            0xFF
+#define BCMA_ANY_CLASS          0xFF
+
 struct virtio_device_id {
         __u32 device;
         __u32 vendor;
diff --git a/include/linux/mroute.h b/include/linux/mroute.h
index b21d567692b2..46caaf44339d 100644
--- a/include/linux/mroute.h
+++ b/include/linux/mroute.h
@@ -244,6 +244,7 @@ struct mfc_cache {
 #ifdef __KERNEL__
 struct rtmsg;
 extern int ipmr_get_route(struct net *net, struct sk_buff *skb,
+                          __be32 saddr, __be32 daddr,
                           struct rtmsg *rtm, int nowait);
 #endif
 
diff --git a/include/linux/net.h b/include/linux/net.h
index 94de83c0f877..1da55e9b6f01 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -42,6 +42,7 @@
 #define SYS_RECVMSG     17              /* sys_recvmsg(2)               */
 #define SYS_ACCEPT4     18              /* sys_accept4(2)               */
 #define SYS_RECVMMSG    19              /* sys_recvmmsg(2)              */
+#define SYS_SENDMMSG    20              /* sys_sendmmsg(2)              */
 
 typedef enum {
         SS_FREE = 0,                    /* not allocated                */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 0249fe7e3872..ca333e79e10f 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1020,9 +1020,6 @@ struct net_device {
          *      part of the usual set specified in Space.c.
          */
 
-        unsigned char           if_port;        /* Selectable AUI, TP,..*/
-        unsigned char           dma;            /* DMA channel          */
-
         unsigned long           state;
 
         struct list_head        dev_list;
@@ -1035,7 +1032,7 @@ struct net_device {
         u32                     hw_features;
         /* user-requested features */
         u32                     wanted_features;
-        /* VLAN feature mask */
+        /* mask of features inheritable by VLAN devices */
         u32                     vlan_features;
 
         /* Net device feature bits; if you change something,
@@ -1066,6 +1063,8 @@ struct net_device {
 #define NETIF_F_NTUPLE          (1 << 27) /* N-tuple filters supported */
 #define NETIF_F_RXHASH          (1 << 28) /* Receive hashing offload */
 #define NETIF_F_RXCSUM          (1 << 29) /* Receive checksumming offload */
+#define NETIF_F_NOCACHE_COPY    (1 << 30) /* Use no-cache copyfromuser */
+#define NETIF_F_LOOPBACK        (1 << 31) /* Enable loopback */
 
         /* Segmentation offload features */
 #define NETIF_F_GSO_SHIFT       16
@@ -1079,9 +1078,9 @@ struct net_device {
 
         /* Features valid for ethtool to change */
         /* = all defined minus driver/device-class-related */
-#define NETIF_F_NEVER_CHANGE    (NETIF_F_HIGHDMA | NETIF_F_VLAN_CHALLENGED | \
+#define NETIF_F_NEVER_CHANGE    (NETIF_F_VLAN_CHALLENGED | \
                                   NETIF_F_LLTX | NETIF_F_NETNS_LOCAL)
-#define NETIF_F_ETHTOOL_BITS    (0x3f3fffff & ~NETIF_F_NEVER_CHANGE)
+#define NETIF_F_ETHTOOL_BITS    (0xff3fffff & ~NETIF_F_NEVER_CHANGE)
 
         /* List of features with software fallbacks. */
 #define NETIF_F_GSO_SOFTWARE    (NETIF_F_TSO | NETIF_F_TSO_ECN | \
@@ -1095,9 +1094,14 @@ struct net_device {
 
 #define NETIF_F_ALL_TSO         (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_TSO_ECN)
 
+#define NETIF_F_ALL_FCOE        (NETIF_F_FCOE_CRC | NETIF_F_FCOE_MTU | \
+                                 NETIF_F_FSO)
+
 #define NETIF_F_ALL_TX_OFFLOADS (NETIF_F_ALL_CSUM | NETIF_F_SG | \
                                  NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
-                                 NETIF_F_SCTP_CSUM | NETIF_F_FCOE_CRC)
+                                 NETIF_F_HIGHDMA | \
+                                 NETIF_F_SCTP_CSUM | \
+                                 NETIF_F_ALL_FCOE)
 
         /*
          * If one device supports one of these features, then enable them
@@ -1105,7 +1109,12 @@ struct net_device {
          */
 #define NETIF_F_ONE_FOR_ALL     (NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ROBUST | \
                                  NETIF_F_SG | NETIF_F_HIGHDMA |         \
-                                 NETIF_F_FRAGLIST)
+                                 NETIF_F_FRAGLIST | NETIF_F_VLAN_CHALLENGED)
+        /*
+         * If one device doesn't support one of these features, then disable it
+         * for all in netdev_increment_features.
+         */
+#define NETIF_F_ALL_FOR_ALL     (NETIF_F_NOCACHE_COPY | NETIF_F_FSO)
 
         /* changeable features with no special hardware requirements */
 #define NETIF_F_SOFT_FEATURES   (NETIF_F_GSO | NETIF_F_GRO)
@@ -1134,13 +1143,16 @@ struct net_device {
         const struct header_ops *header_ops;
 
         unsigned int            flags;  /* interface flags (a la BSD)   */
+        unsigned int            priv_flags; /* Like 'flags' but invisible to userspace. */
         unsigned short          gflags;
-        unsigned int            priv_flags; /* Like 'flags' but invisible to userspace. */
         unsigned short          padded; /* How much padding added by alloc_netdev() */
 
         unsigned char           operstate; /* RFC2863 operstate */
         unsigned char           link_mode; /* mapping policy to operstate */
 
+        unsigned char           if_port;        /* Selectable AUI, TP,..*/
+        unsigned char           dma;            /* DMA channel          */
+
         unsigned int            mtu;    /* interface MTU value          */
         unsigned short          type;   /* interface hardware type      */
         unsigned short          hard_header_len;        /* hardware hdr length  */
@@ -1281,7 +1293,9 @@ struct net_device {
                NETREG_UNREGISTERED,     /* completed unregister todo */
                NETREG_RELEASED,         /* called free_netdev */
                NETREG_DUMMY,            /* dummy device for NAPI poll */
-        } reg_state:16;
+        } reg_state:8;
+
+        bool dismantle; /* device is going do be freed */
 
         enum {
                 RTNL_LINK_INITIALIZED,
@@ -2513,6 +2527,7 @@ extern struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
 extern int              netdev_max_backlog;
 extern int              netdev_tstamp_prequeue;
 extern int              weight_p;
+extern int              bpf_jit_enable;
 extern int              netdev_set_master(struct net_device *dev, struct net_device *master);
 extern int netdev_set_bond_master(struct net_device *dev,
                                   struct net_device *master);
@@ -2550,7 +2565,9 @@ static inline u32 netdev_get_wanted_features(struct net_device *dev)
 }
 u32 netdev_increment_features(u32 all, u32 one, u32 mask);
 u32 netdev_fix_features(struct net_device *dev, u32 features);
+int __netdev_update_features(struct net_device *dev);
 void netdev_update_features(struct net_device *dev);
+void netdev_change_features(struct net_device *dev);
 
 void netif_stacked_transfer_operstate(const struct net_device *rootdev,
                                         struct net_device *dev);
@@ -2588,13 +2605,8 @@ static inline int netif_is_bond_slave(struct net_device *dev)
 
 extern struct pernet_operations __net_initdata loopback_net_ops;
 
-static inline int dev_ethtool_get_settings(struct net_device *dev,
-                                           struct ethtool_cmd *cmd)
-{
-        if (!dev->ethtool_ops || !dev->ethtool_ops->get_settings)
-                return -EOPNOTSUPP;
-        return dev->ethtool_ops->get_settings(dev, cmd);
-}
+int dev_ethtool_get_settings(struct net_device *dev,
+                             struct ethtool_cmd *cmd);
 
 static inline u32 dev_ethtool_get_rx_csum(struct net_device *dev)
 {
diff --git a/include/linux/netfilter/ipset/ip_set_getport.h b/include/linux/netfilter/ipset/ip_set_getport.h
index 5aebd170f899..90d09300e954 100644
--- a/include/linux/netfilter/ipset/ip_set_getport.h
+++ b/include/linux/netfilter/ipset/ip_set_getport.h
@@ -22,7 +22,9 @@ static inline bool ip_set_proto_with_ports(u8 proto)
 {
         switch (proto) {
         case IPPROTO_TCP:
+        case IPPROTO_SCTP:
         case IPPROTO_UDP:
+        case IPPROTO_UDPLITE:
                 return true;
         }
         return false;
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 37219525ff6f..32cddf78b13e 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -456,72 +456,60 @@ extern void xt_proto_fini(struct net *net, u_int8_t af);
 extern struct xt_table_info *xt_alloc_table_info(unsigned int size);
 extern void xt_free_table_info(struct xt_table_info *info);
 
-/*
- * Per-CPU spinlock associated with per-cpu table entries, and
- * with a counter for the "reading" side that allows a recursive
- * reader to avoid taking the lock and deadlocking.
- *
- * "reading" is used by ip/arp/ip6 tables rule processing which runs per-cpu.
- * It needs to ensure that the rules are not being changed while the packet
- * is being processed. In some cases, the read lock will be acquired
- * twice on the same CPU; this is okay because of the count.
- *
- * "writing" is used when reading counters.
- *  During replace any readers that are using the old tables have to complete
- *  before freeing the old table. This is handled by the write locking
- *  necessary for reading the counters.
+/**
+ * xt_recseq - recursive seqcount for netfilter use
+ * 
+ * Packet processing changes the seqcount only if no recursion happened
+ * get_counters() can use read_seqcount_begin()/read_seqcount_retry(),
+ * because we use the normal seqcount convention :
+ * Low order bit set to 1 if a writer is active.
  */
-struct xt_info_lock {
-        seqlock_t lock;
-        unsigned char readers;
-};
-DECLARE_PER_CPU(struct xt_info_lock, xt_info_locks);
+DECLARE_PER_CPU(seqcount_t, xt_recseq);
 
-/*
- * Note: we need to ensure that preemption is disabled before acquiring
- * the per-cpu-variable, so we do it as a two step process rather than
- * using "spin_lock_bh()".
- *
- * We _also_ need to disable bottom half processing before updating our
- * nesting count, to make sure that the only kind of re-entrancy is this
- * code being called by itself: since the count+lock is not an atomic
- * operation, we can allow no races.
+/**
+ * xt_write_recseq_begin - start of a write section
  *
- * _Only_ that special combination of being per-cpu and never getting
- * re-entered asynchronously means that the count is safe.
+ * Begin packet processing : all readers must wait the end
+ * 1) Must be called with preemption disabled
+ * 2) softirqs must be disabled too (or we should use irqsafe_cpu_add())
+ * Returns :
+ *  1 if no recursion on this cpu
+ *  0 if recursion detected
  */
-static inline void xt_info_rdlock_bh(void)
+static inline unsigned int xt_write_recseq_begin(void)
 {
-        struct xt_info_lock *lock;
+        unsigned int addend;
 
-        local_bh_disable();
-        lock = &__get_cpu_var(xt_info_locks);
-        if (likely(!lock->readers++))
-                write_seqlock(&lock->lock);
-}
+        /*
+         * Low order bit of sequence is set if we already
+         * called xt_write_recseq_begin().
+         */
+        addend = (__this_cpu_read(xt_recseq.sequence) + 1) & 1;
 
-static inline void xt_info_rdunlock_bh(void)
-{
-        struct xt_info_lock *lock = &__get_cpu_var(xt_info_locks);
+        /*
+         * This is kind of a write_seqcount_begin(), but addend is 0 or 1
+         * We dont check addend value to avoid a test and conditional jump,
+         * since addend is most likely 1
+         */
+        __this_cpu_add(xt_recseq.sequence, addend);
+        smp_wmb();
 
-        if (likely(!--lock->readers))
-                write_sequnlock(&lock->lock);
-        local_bh_enable();
+        return addend;
 }
 
-/*
- * The "writer" side needs to get exclusive access to the lock,
- * regardless of readers.  This must be called with bottom half
- * processing (and thus also preemption) disabled.
+/**
+ * xt_write_recseq_end - end of a write section
+ * @addend: return value from previous xt_write_recseq_begin()
+ *
+ * End packet processing : all readers can proceed
+ * 1) Must be called with preemption disabled
+ * 2) softirqs must be disabled too (or we should use irqsafe_cpu_add())
  */
-static inline void xt_info_wrlock(unsigned int cpu)
-{
-        write_seqlock(&per_cpu(xt_info_locks, cpu).lock);
-}
-
-static inline void xt_info_wrunlock(unsigned int cpu)
+static inline void xt_write_recseq_end(unsigned int addend)
 {
-        write_sequnlock(&per_cpu(xt_info_locks, cpu).lock);
+        /* this is kind of a write_seqcount_end(), but addend is 0 or 1 */
+        smp_wmb();
+        __this_cpu_add(xt_recseq.sequence, addend);
 }
 
 /*
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index bbfa1093f606..c7ccaae15af6 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -77,6 +77,39 @@
  */
 
 /**
+ * DOC: Virtual interface / concurrency capabilities
+ *
+ * Some devices are able to operate with virtual MACs, they can have
+ * more than one virtual interface. The capability handling for this
+ * is a bit complex though, as there may be a number of restrictions
+ * on the types of concurrency that are supported.
+ *
+ * To start with, each device supports the interface types listed in
+ * the %NL80211_ATTR_SUPPORTED_IFTYPES attribute, but by listing the
+ * types there no concurrency is implied.
+ *
+ * Once concurrency is desired, more attributes must be observed:
+ * To start with, since some interface types are purely managed in
+ * software, like the AP-VLAN type in mac80211 for example, there's
+ * an additional list of these, they can be added at any time and
+ * are only restricted by some semantic restrictions (e.g. AP-VLAN
+ * cannot be added without a corresponding AP interface). This list
+ * is exported in the %NL80211_ATTR_SOFTWARE_IFTYPES attribute.
+ *
+ * Further, the list of supported combinations is exported. This is
+ * in the %NL80211_ATTR_INTERFACE_COMBINATIONS attribute. Basically,
+ * it exports a list of "groups", and at any point in time the
+ * interfaces that are currently active must fall into any one of
+ * the advertised groups. Within each group, there are restrictions
+ * on the number of interfaces of different types that are supported
+ * and also the number of different channels, along with potentially
+ * some other restrictions. See &enum nl80211_if_combination_attrs.
+ *
+ * All together, these attributes define the concurrency of virtual
+ * interfaces that a given device supports.
+ */
+
+/**
  * enum nl80211_commands - supported nl80211 commands
  *
  * @NL80211_CMD_UNSPEC: unspecified command to catch errors
@@ -203,6 +236,28 @@
  * @NL80211_CMD_SCAN_ABORTED: scan was aborted, for unspecified reasons,
  *      partial scan results may be available
  *
+ * @NL80211_CMD_START_SCHED_SCAN: start a scheduled scan at certain
+ *      intervals, as specified by %NL80211_ATTR_SCHED_SCAN_INTERVAL.
+ *      Like with normal scans, if SSIDs (%NL80211_ATTR_SCAN_SSIDS)
+ *      are passed, they are used in the probe requests.  For
+ *      broadcast, a broadcast SSID must be passed (ie. an empty
+ *      string).  If no SSID is passed, no probe requests are sent and
+ *      a passive scan is performed.  %NL80211_ATTR_SCAN_FREQUENCIES,
+ *      if passed, define which channels should be scanned; if not
+ *      passed, all channels allowed for the current regulatory domain
+ *      are used.  Extra IEs can also be passed from the userspace by
+ *      using the %NL80211_ATTR_IE attribute.
+ * @NL80211_CMD_STOP_SCHED_SCAN: stop a scheduled scan
+ * @NL80211_CMD_SCHED_SCAN_RESULTS: indicates that there are scheduled scan
+ *      results available.
+ * @NL80211_CMD_SCHED_SCAN_STOPPED: indicates that the scheduled scan has
+ *      stopped.  The driver may issue this event at any time during a
+ *      scheduled scan.  One reason for stopping the scan is if the hardware
+ *      does not support starting an association or a normal scan while running
+ *      a scheduled scan.  This event is also sent when the
+ *      %NL80211_CMD_STOP_SCHED_SCAN command is received or when the interface
+ *      is brought down while a scheduled scan was running.
+ *
  * @NL80211_CMD_GET_SURVEY: get survey resuls, e.g. channel occupation
  *      or noise level
  * @NL80211_CMD_NEW_SURVEY_RESULTS: survey data notification (as a reply to
@@ -410,6 +465,24 @@
  *      notification. This event is used to indicate that an unprotected
  *      disassociation frame was dropped when MFP is in use.
  *
+ * @NL80211_CMD_NEW_PEER_CANDIDATE: Notification on the reception of a
+ *      beacon or probe response from a compatible mesh peer.  This is only
+ *      sent while no station information (sta_info) exists for the new peer
+ *      candidate and when @NL80211_MESH_SETUP_USERSPACE_AUTH is set.  On
+ *      reception of this notification, userspace may decide to create a new
+ *      station (@NL80211_CMD_NEW_STATION).  To stop this notification from
+ *      reoccurring, the userspace authentication daemon may want to create the
+ *      new station with the AUTHENTICATED flag unset and maybe change it later
+ *      depending on the authentication result.
+ *
+ * @NL80211_CMD_GET_WOWLAN: get Wake-on-Wireless-LAN (WoWLAN) settings.
+ * @NL80211_CMD_SET_WOWLAN: set Wake-on-Wireless-LAN (WoWLAN) settings.
+ *      Since wireless is more complex than wired ethernet, it supports
+ *      various triggers. These triggers can be configured through this
+ *      command with the %NL80211_ATTR_WOWLAN_TRIGGERS attribute. For
+ *      more background information, see
+ *      http://wireless.kernel.org/en/users/Documentation/WoWLAN.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -522,6 +595,16 @@ enum nl80211_commands {
         NL80211_CMD_UNPROT_DEAUTHENTICATE,
         NL80211_CMD_UNPROT_DISASSOCIATE,
 
+        NL80211_CMD_NEW_PEER_CANDIDATE,
+
+        NL80211_CMD_GET_WOWLAN,
+        NL80211_CMD_SET_WOWLAN,
+
+        NL80211_CMD_START_SCHED_SCAN,
+        NL80211_CMD_STOP_SCHED_SCAN,
+        NL80211_CMD_SCHED_SCAN_RESULTS,
+        NL80211_CMD_SCHED_SCAN_STOPPED,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -545,6 +628,7 @@ enum nl80211_commands {
 /* source-level API compatibility */
 #define NL80211_CMD_GET_MESH_PARAMS NL80211_CMD_GET_MESH_CONFIG
 #define NL80211_CMD_SET_MESH_PARAMS NL80211_CMD_SET_MESH_CONFIG
+#define NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE NL80211_MESH_SETUP_IE
 
 /**
  * enum nl80211_attrs - nl80211 netlink attributes
@@ -886,6 +970,31 @@ enum nl80211_commands {
  *      changed once the mesh is active.
  * @NL80211_ATTR_MESH_CONFIG: Mesh configuration parameters, a nested attribute
  *      containing attributes from &enum nl80211_meshconf_params.
+ * @NL80211_ATTR_SUPPORT_MESH_AUTH: Currently, this means the underlying driver
+ *      allows auth frames in a mesh to be passed to userspace for processing via
+ *      the @NL80211_MESH_SETUP_USERSPACE_AUTH flag.
+ * @NL80211_ATTR_STA_PLINK_STATE: The state of a mesh peer link as
+ *      defined in &enum nl80211_plink_state. Used when userspace is
+ *      driving the peer link management state machine.
+ *      @NL80211_MESH_SETUP_USERSPACE_AMPE must be enabled.
+ *
+ * @NL80211_ATTR_WOWLAN_SUPPORTED: indicates, as part of the wiphy capabilities,
+ *      the supported WoWLAN triggers
+ * @NL80211_ATTR_WOWLAN_TRIGGERS: used by %NL80211_CMD_SET_WOWLAN to
+ *      indicate which WoW triggers should be enabled. This is also
+ *      used by %NL80211_CMD_GET_WOWLAN to get the currently enabled WoWLAN
+ *      triggers.
+
+ * @NL80211_ATTR_SCHED_SCAN_INTERVAL: Interval between scheduled scan
+ *      cycles, in msecs.
+ *
+ * @NL80211_ATTR_INTERFACE_COMBINATIONS: Nested attribute listing the supported
+ *      interface combinations. In each nested item, it contains attributes
+ *      defined in &enum nl80211_if_combination_attrs.
+ * @NL80211_ATTR_SOFTWARE_IFTYPES: Nested attribute (just like
+ *      %NL80211_ATTR_SUPPORTED_IFTYPES) containing the interface types that
+ *      are managed in software: interfaces of these types aren't subject to
+ *      any restrictions in their number or combinations.
  *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
@@ -1074,6 +1183,17 @@ enum nl80211_attrs {
         NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
         NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 
+        NL80211_ATTR_SUPPORT_MESH_AUTH,
+        NL80211_ATTR_STA_PLINK_STATE,
+
+        NL80211_ATTR_WOWLAN_TRIGGERS,
+        NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED,
+
+        NL80211_ATTR_SCHED_SCAN_INTERVAL,
+
+        NL80211_ATTR_INTERFACE_COMBINATIONS,
+        NL80211_ATTR_SOFTWARE_IFTYPES,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1126,7 +1246,9 @@ enum nl80211_attrs {
  * @NL80211_IFTYPE_ADHOC: independent BSS member
  * @NL80211_IFTYPE_STATION: managed BSS member
  * @NL80211_IFTYPE_AP: access point
- * @NL80211_IFTYPE_AP_VLAN: VLAN interface for access points
+ * @NL80211_IFTYPE_AP_VLAN: VLAN interface for access points; VLAN interfaces
+ *      are a bit special in that they must always be tied to a pre-existing
+ *      AP type interface.
  * @NL80211_IFTYPE_WDS: wireless distribution interface
  * @NL80211_IFTYPE_MONITOR: monitor interface receiving all frames
  * @NL80211_IFTYPE_MESH_POINT: mesh point
@@ -1168,6 +1290,7 @@ enum nl80211_iftype {
  *      with short barker preamble
  * @NL80211_STA_FLAG_WME: station is WME/QoS capable
  * @NL80211_STA_FLAG_MFP: station uses management frame protection
+ * @NL80211_STA_FLAG_AUTHENTICATED: station is authenticated
  * @NL80211_STA_FLAG_MAX: highest station flag number currently defined
  * @__NL80211_STA_FLAG_AFTER_LAST: internal use
  */
@@ -1177,6 +1300,7 @@ enum nl80211_sta_flags {
         NL80211_STA_FLAG_SHORT_PREAMBLE,
         NL80211_STA_FLAG_WME,
         NL80211_STA_FLAG_MFP,
+        NL80211_STA_FLAG_AUTHENTICATED,
 
         /* keep last */
         __NL80211_STA_FLAG_AFTER_LAST,
@@ -1222,6 +1346,36 @@ enum nl80211_rate_info {
 };
 
 /**
+ * enum nl80211_sta_bss_param - BSS information collected by STA
+ *
+ * These attribute types are used with %NL80211_STA_INFO_BSS_PARAM
+ * when getting information about the bitrate of a station.
+ *
+ * @__NL80211_STA_BSS_PARAM_INVALID: attribute number 0 is reserved
+ * @NL80211_STA_BSS_PARAM_CTS_PROT: whether CTS protection is enabled (flag)
+ * @NL80211_STA_BSS_PARAM_SHORT_PREAMBLE:  whether short preamble is enabled
+ *      (flag)
+ * @NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME:  whether short slot time is enabled
+ *      (flag)
+ * @NL80211_STA_BSS_PARAM_DTIM_PERIOD: DTIM period for beaconing (u8)
+ * @NL80211_STA_BSS_PARAM_BEACON_INTERVAL: Beacon interval (u16)
+ * @NL80211_STA_BSS_PARAM_MAX: highest sta_bss_param number currently defined
+ * @__NL80211_STA_BSS_PARAM_AFTER_LAST: internal use
+ */
+enum nl80211_sta_bss_param {
+        __NL80211_STA_BSS_PARAM_INVALID,
+        NL80211_STA_BSS_PARAM_CTS_PROT,
+        NL80211_STA_BSS_PARAM_SHORT_PREAMBLE,
+        NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME,
+        NL80211_STA_BSS_PARAM_DTIM_PERIOD,
+        NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
+
+        /* keep last */
+        __NL80211_STA_BSS_PARAM_AFTER_LAST,
+        NL80211_STA_BSS_PARAM_MAX = __NL80211_STA_BSS_PARAM_AFTER_LAST - 1
+};
+
+/**
  * enum nl80211_sta_info - station information
  *
  * These attribute types are used with %NL80211_ATTR_STA_INFO
@@ -1233,7 +1387,7 @@ enum nl80211_rate_info {
  * @NL80211_STA_INFO_TX_BYTES: total transmitted bytes (u32, to this station)
  * @NL80211_STA_INFO_SIGNAL: signal strength of last received PPDU (u8, dBm)
  * @NL80211_STA_INFO_TX_BITRATE: current unicast tx rate, nested attribute
- *      containing info as possible, see &enum nl80211_sta_info_txrate.
+ *      containing info as possible, see &enum nl80211_rate_info
  * @NL80211_STA_INFO_RX_PACKETS: total received packet (u32, from this station)
  * @NL80211_STA_INFO_TX_PACKETS: total transmitted packets (u32, to this
  *      station)
@@ -1243,8 +1397,12 @@ enum nl80211_rate_info {
  * @NL80211_STA_INFO_LLID: the station's mesh LLID
  * @NL80211_STA_INFO_PLID: the station's mesh PLID
  * @NL80211_STA_INFO_PLINK_STATE: peer link state for the station
+ *      (see %enum nl80211_plink_state)
  * @NL80211_STA_INFO_RX_BITRATE: last unicast data frame rx rate, nested
  *      attribute, like NL80211_STA_INFO_TX_BITRATE.
+ * @NL80211_STA_INFO_BSS_PARAM: current station's view of BSS, nested attribute
+ *     containing info as possible, see &enum nl80211_sta_bss_param
+ * @NL80211_STA_INFO_CONNECTED_TIME: time since the station is last connected
  * @__NL80211_STA_INFO_AFTER_LAST: internal
  * @NL80211_STA_INFO_MAX: highest possible station info attribute
  */
@@ -1264,6 +1422,8 @@ enum nl80211_sta_info {
         NL80211_STA_INFO_TX_FAILED,
         NL80211_STA_INFO_SIGNAL_AVG,
         NL80211_STA_INFO_RX_BITRATE,
+        NL80211_STA_INFO_BSS_PARAM,
+        NL80211_STA_INFO_CONNECTED_TIME,
 
         /* keep last */
         __NL80211_STA_INFO_AFTER_LAST,
@@ -1686,9 +1846,21 @@ enum nl80211_meshconf_params {
  * vendor specific path metric or disable it to use the default Airtime
  * metric.
  *
- * @NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE: A vendor specific information
- * element that vendors will use to identify the path selection methods and
- * metrics in use.
+ * @NL80211_MESH_SETUP_IE: Information elements for this mesh, for instance, a
+ * robust security network ie, or a vendor specific information element that
+ * vendors will use to identify the path selection methods and metrics in use.
+ *
+ * @NL80211_MESH_SETUP_USERSPACE_AUTH: Enable this option if an authentication
+ * daemon will be authenticating mesh candidates.
+ *
+ * @NL80211_MESH_SETUP_USERSPACE_AMPE: Enable this option if an authentication
+ * daemon will be securing peer link frames.  AMPE is a secured version of Mesh
+ * Peering Management (MPM) and is implemented with the assistance of a
+ * userspace daemon.  When this flag is set, the kernel will send peer
+ * management frames to a userspace daemon that will implement AMPE
+ * functionality (security capabilities selection, key confirmation, and key
+ * management).  When the flag is unset (default), the kernel can autonomously
+ * complete (unsecured) mesh peering without the need of a userspace daemon.
  *
  * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
  * @__NL80211_MESH_SETUP_ATTR_AFTER_LAST: Internal use
@@ -1697,7 +1869,9 @@ enum nl80211_mesh_setup_params {
         __NL80211_MESH_SETUP_INVALID,
         NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL,
         NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC,
-        NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE,
+        NL80211_MESH_SETUP_IE,
+        NL80211_MESH_SETUP_USERSPACE_AUTH,
+        NL80211_MESH_SETUP_USERSPACE_AMPE,
 
         /* keep last */
         __NL80211_MESH_SETUP_ATTR_AFTER_LAST,
@@ -2002,4 +2176,189 @@ enum nl80211_tx_power_setting {
         NL80211_TX_POWER_FIXED,
 };
 
+/**
+ * enum nl80211_wowlan_packet_pattern_attr - WoWLAN packet pattern attribute
+ * @__NL80211_WOWLAN_PKTPAT_INVALID: invalid number for nested attribute
+ * @NL80211_WOWLAN_PKTPAT_PATTERN: the pattern, values where the mask has
+ *      a zero bit are ignored
+ * @NL80211_WOWLAN_PKTPAT_MASK: pattern mask, must be long enough to have
+ *      a bit for each byte in the pattern. The lowest-order bit corresponds
+ *      to the first byte of the pattern, but the bytes of the pattern are
+ *      in a little-endian-like format, i.e. the 9th byte of the pattern
+ *      corresponds to the lowest-order bit in the second byte of the mask.
+ *      For example: The match 00:xx:00:00:xx:00:00:00:00:xx:xx:xx (where
+ *      xx indicates "don't care") would be represented by a pattern of
+ *      twelve zero bytes, and a mask of "0xed,0x07".
+ *      Note that the pattern matching is done as though frames were not
+ *      802.11 frames but 802.3 frames, i.e. the frame is fully unpacked
+ *      first (including SNAP header unpacking) and then matched.
+ * @NUM_NL80211_WOWLAN_PKTPAT: number of attributes
+ * @MAX_NL80211_WOWLAN_PKTPAT: max attribute number
+ */
+enum nl80211_wowlan_packet_pattern_attr {
+        __NL80211_WOWLAN_PKTPAT_INVALID,
+        NL80211_WOWLAN_PKTPAT_MASK,
+        NL80211_WOWLAN_PKTPAT_PATTERN,
+
+        NUM_NL80211_WOWLAN_PKTPAT,
+        MAX_NL80211_WOWLAN_PKTPAT = NUM_NL80211_WOWLAN_PKTPAT - 1,
+};
+
+/**
+ * struct nl80211_wowlan_pattern_support - pattern support information
+ * @max_patterns: maximum number of patterns supported
+ * @min_pattern_len: minimum length of each pattern
+ * @max_pattern_len: maximum length of each pattern
+ *
+ * This struct is carried in %NL80211_WOWLAN_TRIG_PKT_PATTERN when
+ * that is part of %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED in the
+ * capability information given by the kernel to userspace.
+ */
+struct nl80211_wowlan_pattern_support {
+        __u32 max_patterns;
+        __u32 min_pattern_len;
+        __u32 max_pattern_len;
+} __attribute__((packed));
+
+/**
+ * enum nl80211_wowlan_triggers - WoWLAN trigger definitions
+ * @__NL80211_WOWLAN_TRIG_INVALID: invalid number for nested attributes
+ * @NL80211_WOWLAN_TRIG_ANY: wake up on any activity, do not really put
+ *      the chip into a special state -- works best with chips that have
+ *      support for low-power operation already (flag)
+ * @NL80211_WOWLAN_TRIG_DISCONNECT: wake up on disconnect, the way disconnect
+ *      is detected is implementation-specific (flag)
+ * @NL80211_WOWLAN_TRIG_MAGIC_PKT: wake up on magic packet (6x 0xff, followed
+ *      by 16 repetitions of MAC addr, anywhere in payload) (flag)
+ * @NL80211_WOWLAN_TRIG_PKT_PATTERN: wake up on the specified packet patterns
+ *      which are passed in an array of nested attributes, each nested attribute
+ *      defining a with attributes from &struct nl80211_wowlan_trig_pkt_pattern.
+ *      Each pattern defines a wakeup packet. The matching is done on the MSDU,
+ *      i.e. as though the packet was an 802.3 packet, so the pattern matching
+ *      is done after the packet is converted to the MSDU.
+ *
+ *      In %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED, it is a binary attribute
+ *      carrying a &struct nl80211_wowlan_pattern_support.
+ * @NUM_NL80211_WOWLAN_TRIG: number of wake on wireless triggers
+ * @MAX_NL80211_WOWLAN_TRIG: highest wowlan trigger attribute number
+ */
+enum nl80211_wowlan_triggers {
+        __NL80211_WOWLAN_TRIG_INVALID,
+        NL80211_WOWLAN_TRIG_ANY,
+        NL80211_WOWLAN_TRIG_DISCONNECT,
+        NL80211_WOWLAN_TRIG_MAGIC_PKT,
+        NL80211_WOWLAN_TRIG_PKT_PATTERN,
+
+        /* keep last */
+        NUM_NL80211_WOWLAN_TRIG,
+        MAX_NL80211_WOWLAN_TRIG = NUM_NL80211_WOWLAN_TRIG - 1
+};
+
+/**
+ * enum nl80211_iface_limit_attrs - limit attributes
+ * @NL80211_IFACE_LIMIT_UNSPEC: (reserved)
+ * @NL80211_IFACE_LIMIT_MAX: maximum number of interfaces that
+ *      can be chosen from this set of interface types (u32)
+ * @NL80211_IFACE_LIMIT_TYPES: nested attribute containing a
+ *      flag attribute for each interface type in this set
+ * @NUM_NL80211_IFACE_LIMIT: number of attributes
+ * @MAX_NL80211_IFACE_LIMIT: highest attribute number
+ */
+enum nl80211_iface_limit_attrs {
+        NL80211_IFACE_LIMIT_UNSPEC,
+        NL80211_IFACE_LIMIT_MAX,
+        NL80211_IFACE_LIMIT_TYPES,
+
+        /* keep last */
+        NUM_NL80211_IFACE_LIMIT,
+        MAX_NL80211_IFACE_LIMIT = NUM_NL80211_IFACE_LIMIT - 1
+};
+
+/**
+ * enum nl80211_if_combination_attrs -- interface combination attributes
+ *
+ * @NL80211_IFACE_COMB_UNSPEC: (reserved)
+ * @NL80211_IFACE_COMB_LIMITS: Nested attributes containing the limits
+ *      for given interface types, see &enum nl80211_iface_limit_attrs.
+ * @NL80211_IFACE_COMB_MAXNUM: u32 attribute giving the total number of
+ *      interfaces that can be created in this group. This number doesn't
+ *      apply to interfaces purely managed in software, which are listed
+ *      in a separate attribute %NL80211_ATTR_INTERFACES_SOFTWARE.
+ * @NL80211_IFACE_COMB_STA_AP_BI_MATCH: flag attribute specifying that
+ *      beacon intervals within this group must be all the same even for
+ *      infrastructure and AP/GO combinations, i.e. the GO(s) must adopt
+ *      the infrastructure network's beacon interval.
+ * @NL80211_IFACE_COMB_NUM_CHANNELS: u32 attribute specifying how many
+ *      different channels may be used within this group.
+ * @NUM_NL80211_IFACE_COMB: number of attributes
+ * @MAX_NL80211_IFACE_COMB: highest attribute number
+ *
+ * Examples:
+ *      limits = [ #{STA} <= 1, #{AP} <= 1 ], matching BI, channels = 1, max = 2
+ *      => allows an AP and a STA that must match BIs
+ *
+ *      numbers = [ #{AP, P2P-GO} <= 8 ], channels = 1, max = 8
+ *      => allows 8 of AP/GO
+ *
+ *      numbers = [ #{STA} <= 2 ], channels = 2, max = 2
+ *      => allows two STAs on different channels
+ *
+ *      numbers = [ #{STA} <= 1, #{P2P-client,P2P-GO} <= 3 ], max = 4
+ *      => allows a STA plus three P2P interfaces
+ *
+ * The list of these four possiblities could completely be contained
+ * within the %NL80211_ATTR_INTERFACE_COMBINATIONS attribute to indicate
+ * that any of these groups must match.
+ *
+ * "Combinations" of just a single interface will not be listed here,
+ * a single interface of any valid interface type is assumed to always
+ * be possible by itself. This means that implicitly, for each valid
+ * interface type, the following group always exists:
+ *      numbers = [ #{<type>} <= 1 ], channels = 1, max = 1
+ */
+enum nl80211_if_combination_attrs {
+        NL80211_IFACE_COMB_UNSPEC,
+        NL80211_IFACE_COMB_LIMITS,
+        NL80211_IFACE_COMB_MAXNUM,
+        NL80211_IFACE_COMB_STA_AP_BI_MATCH,
+        NL80211_IFACE_COMB_NUM_CHANNELS,
+
+        /* keep last */
+        NUM_NL80211_IFACE_COMB,
+        MAX_NL80211_IFACE_COMB = NUM_NL80211_IFACE_COMB - 1
+};
+
+
+/**
+ * enum nl80211_plink_state - state of a mesh peer link finite state machine
+ *
+ * @NL80211_PLINK_LISTEN: initial state, considered the implicit
+ *      state of non existant mesh peer links
+ * @NL80211_PLINK_OPN_SNT: mesh plink open frame has been sent to
+ *      this mesh peer
+ * @NL80211_PLINK_OPN_RCVD: mesh plink open frame has been received
+ *      from this mesh peer
+ * @NL80211_PLINK_CNF_RCVD: mesh plink confirm frame has been
+ *      received from this mesh peer
+ * @NL80211_PLINK_ESTAB: mesh peer link is established
+ * @NL80211_PLINK_HOLDING: mesh peer link is being closed or cancelled
+ * @NL80211_PLINK_BLOCKED: all frames transmitted from this mesh
+ *      plink are discarded
+ * @NUM_NL80211_PLINK_STATES: number of peer link states
+ * @MAX_NL80211_PLINK_STATES: highest numerical value of plink states
+ */
+enum nl80211_plink_state {
+        NL80211_PLINK_LISTEN,
+        NL80211_PLINK_OPN_SNT,
+        NL80211_PLINK_OPN_RCVD,
+        NL80211_PLINK_CNF_RCVD,
+        NL80211_PLINK_ESTAB,
+        NL80211_PLINK_HOLDING,
+        NL80211_PLINK_BLOCKED,
+
+        /* keep last */
+        NUM_NL80211_PLINK_STATES,
+        MAX_NL80211_PLINK_STATES = NUM_NL80211_PLINK_STATES - 1
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/include/linux/pkt_sched.h b/include/linux/pkt_sched.h
index 3a02e0208575..c5336705921f 100644
--- a/include/linux/pkt_sched.h
+++ b/include/linux/pkt_sched.h
@@ -588,4 +588,19 @@ struct tc_sfb_xstats {
 
 #define SFB_MAX_PROB 0xFFFF
 
+/* QFQ */
+enum {
+        TCA_QFQ_UNSPEC,
+        TCA_QFQ_WEIGHT,
+        TCA_QFQ_LMAX,
+        __TCA_QFQ_MAX
+};
+
+#define TCA_QFQ_MAX     (__TCA_QFQ_MAX - 1)
+
+struct tc_qfq_stats {
+        __u32 weight;
+        __u32 lmax;
+};
+
 #endif
diff --git a/include/linux/rfkill-regulator.h b/include/linux/rfkill-regulator.h
new file mode 100644
index 000000000000..aca36bc83315
--- /dev/null
+++ b/include/linux/rfkill-regulator.h
@@ -0,0 +1,48 @@
+/*
+ * rfkill-regulator.c - Regulator consumer driver for rfkill
+ *
+ * Copyright (C) 2009  Guiming Zhuo <gmzhuo@gmail.com>
+ * Copyright (C) 2011  Antonio Ospite <ospite@studenti.unina.it>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#ifndef __LINUX_RFKILL_REGULATOR_H
+#define __LINUX_RFKILL_REGULATOR_H
+
+/*
+ * Use "vrfkill" as supply id when declaring the regulator consumer:
+ *
+ * static struct regulator_consumer_supply pcap_regulator_V6_consumers [] = {
+ *      { .dev_name = "rfkill-regulator.0", .supply = "vrfkill" },
+ * };
+ *
+ * If you have several regulator driven rfkill, you can append a numerical id to
+ * .dev_name as done above, and use the same id when declaring the platform
+ * device:
+ *
+ * static struct rfkill_regulator_platform_data ezx_rfkill_bt_data = {
+ *      .name  = "ezx-bluetooth",
+ *      .type  = RFKILL_TYPE_BLUETOOTH,
+ * };
+ *
+ * static struct platform_device a910_rfkill = {
+ *      .name  = "rfkill-regulator",
+ *      .id    = 0,
+ *      .dev   = {
+ *              .platform_data = &ezx_rfkill_bt_data,
+ *      },
+ * };
+ */
+
+#include <linux/rfkill.h>
+
+struct rfkill_regulator_platform_data {
+        char *name;             /* the name for the rfkill switch */
+        enum rfkill_type type;  /* the type as specified in rfkill.h */
+};
+
+#endif /* __LINUX_RFKILL_REGULATOR_H */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index d0ae90af0b40..79aafbbf430a 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -391,8 +391,8 @@ struct sk_buff {
 
         __u32                   rxhash;
 
+        __u16                   queue_mapping;
         kmemcheck_bitfield_begin(flags2);
-        __u16                   queue_mapping:16;
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
         __u8                    ndisc_nodetype:2;
 #endif
diff --git a/include/linux/smsc911x.h b/include/linux/smsc911x.h
index 7144e8aa1e41..4dde70e74822 100644
--- a/include/linux/smsc911x.h
+++ b/include/linux/smsc911x.h
@@ -29,6 +29,7 @@ struct smsc911x_platform_config {
         unsigned int irq_polarity;
         unsigned int irq_type;
         unsigned int flags;
+        unsigned int shift;
         phy_interface_t phy_interface;
         unsigned char mac[6];
 };
diff --git a/include/linux/socket.h b/include/linux/socket.h
index d2b5e982f079..4ef98e422fde 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -333,5 +333,7 @@ struct timespec;
 
 extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
                           unsigned int flags, struct timespec *timeout);
+extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg,
+                          unsigned int vlen, unsigned int flags);
 #endif /* not kernel and not glibc */
 #endif /* _LINUX_SOCKET_H */
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 045f72ab5dfd..252e44821787 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -308,7 +308,7 @@ struct ssb_bus {
 
         /* ID information about the Chip. */
         u16 chip_id;
-        u16 chip_rev;
+        u8 chip_rev;
         u16 sprom_offset;
         u16 sprom_size;         /* number of words in sprom */
         u8 chip_package;
@@ -520,6 +520,7 @@ extern int ssb_bus_may_powerdown(struct ssb_bus *bus);
  * Otherwise static always-on powercontrol will be used. */
 extern int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl);
 
+extern void ssb_commit_settings(struct ssb_bus *bus);
 
 /* Various helper functions */
 extern u32 ssb_admatch_base(u32 adm);
diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
index 2cdf249b4e5f..a08d693d8324 100644
--- a/include/linux/ssb/ssb_driver_chipcommon.h
+++ b/include/linux/ssb/ssb_driver_chipcommon.h
@@ -123,6 +123,8 @@
 #define SSB_CHIPCO_FLASHDATA            0x0048
 #define SSB_CHIPCO_BCAST_ADDR           0x0050
 #define SSB_CHIPCO_BCAST_DATA           0x0054
+#define SSB_CHIPCO_GPIOPULLUP           0x0058          /* Rev >= 20 only */
+#define SSB_CHIPCO_GPIOPULLDOWN         0x005C          /* Rev >= 20 only */
 #define SSB_CHIPCO_GPIOIN               0x0060
 #define SSB_CHIPCO_GPIOOUT              0x0064
 #define SSB_CHIPCO_GPIOOUTEN            0x0068
@@ -131,6 +133,9 @@
 #define SSB_CHIPCO_GPIOIRQ              0x0074
 #define SSB_CHIPCO_WATCHDOG             0x0080
 #define SSB_CHIPCO_GPIOTIMER            0x0088          /* LED powersave (corerev >= 16) */
+#define  SSB_CHIPCO_GPIOTIMER_OFFTIME   0x0000FFFF
+#define  SSB_CHIPCO_GPIOTIMER_OFFTIME_SHIFT     0
+#define  SSB_CHIPCO_GPIOTIMER_ONTIME    0xFFFF0000
 #define  SSB_CHIPCO_GPIOTIMER_ONTIME_SHIFT      16
 #define SSB_CHIPCO_GPIOTOUTM            0x008C          /* LED powersave (corerev >= 16) */
 #define SSB_CHIPCO_CLOCK_N              0x0090
@@ -189,8 +194,10 @@
 #define  SSB_CHIPCO_CLKCTLST_HAVEALPREQ 0x00000008 /* ALP available request */
 #define  SSB_CHIPCO_CLKCTLST_HAVEHTREQ  0x00000010 /* HT available request */
 #define  SSB_CHIPCO_CLKCTLST_HWCROFF    0x00000020 /* Force HW clock request off */
-#define  SSB_CHIPCO_CLKCTLST_HAVEHT     0x00010000 /* HT available */
-#define  SSB_CHIPCO_CLKCTLST_HAVEALP    0x00020000 /* APL available */
+#define  SSB_CHIPCO_CLKCTLST_HAVEALP    0x00010000 /* ALP available */
+#define  SSB_CHIPCO_CLKCTLST_HAVEHT     0x00020000 /* HT available */
+#define  SSB_CHIPCO_CLKCTLST_4328A0_HAVEHT      0x00010000 /* 4328a0 has reversed bits */
+#define  SSB_CHIPCO_CLKCTLST_4328A0_HAVEALP     0x00020000 /* 4328a0 has reversed bits */
 #define SSB_CHIPCO_HW_WORKAROUND        0x01E4 /* Hardware workaround (rev >= 20) */
 #define SSB_CHIPCO_UART0_DATA           0x0300
 #define SSB_CHIPCO_UART0_IMR            0x0304
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index 402955ae48ce..efbf459d571c 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -97,7 +97,7 @@
 #define  SSB_INTVEC_ENET1       0x00000040 /* Enable interrupts for enet 1 */
 #define SSB_TMSLOW              0x0F98     /* SB Target State Low */
 #define  SSB_TMSLOW_RESET       0x00000001 /* Reset */
-#define  SSB_TMSLOW_REJECT_22   0x00000002 /* Reject (Backplane rev 2.2) */
+#define  SSB_TMSLOW_REJECT      0x00000002 /* Reject (Standard Backplane) */
 #define  SSB_TMSLOW_REJECT_23   0x00000004 /* Reject (Backplane rev 2.3) */
 #define  SSB_TMSLOW_CLOCK       0x00010000 /* Clock Enable */
 #define  SSB_TMSLOW_FGC         0x00020000 /* Force Gated Clocks On */
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index f29197a4b227..9529e49b0385 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -26,6 +26,8 @@
 #ifndef __STMMAC_PLATFORM_DATA
 #define __STMMAC_PLATFORM_DATA
 
+#include <linux/platform_device.h>
+
 /* platform data for platform device structure's platform_data field */
 
 /* Private data for the STM on-board ethernet driver */
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 83ecc1749ef6..ab71447d0c5a 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -610,6 +610,8 @@ asmlinkage long sys_send(int, void __user *, size_t, unsigned);
 asmlinkage long sys_sendto(int, void __user *, size_t, unsigned,
                                 struct sockaddr __user *, int);
 asmlinkage long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
+asmlinkage long sys_sendmmsg(int fd, struct mmsghdr __user *msg,
+                             unsigned int vlen, unsigned flags);
 asmlinkage long sys_recv(int, void __user *, size_t, unsigned);
 asmlinkage long sys_recvfrom(int, void __user *, size_t, unsigned,
                                 struct sockaddr __user *, int __user *);
diff --git a/include/linux/tipc.h b/include/linux/tipc.h
index a5b994a204d2..f2d90091cc20 100644
--- a/include/linux/tipc.h
+++ b/include/linux/tipc.h
@@ -101,7 +101,7 @@ static inline unsigned int tipc_node(__u32 addr)
  * Limiting values for messages
  */
 
-#define TIPC_MAX_USER_MSG_SIZE  66000
+#define TIPC_MAX_USER_MSG_SIZE  66000U
 
 /*
  * Message importance levels
diff --git a/include/linux/usb/rndis_host.h b/include/linux/usb/rndis_host.h
index 05ef52861988..88fceb718c77 100644
--- a/include/linux/usb/rndis_host.h
+++ b/include/linux/usb/rndis_host.h
@@ -256,6 +256,8 @@ struct rndis_keepalive_c {	/* IN (optionally OUT) */
 #define FLAG_RNDIS_PHYM_NOT_WIRELESS    0x0001
 #define FLAG_RNDIS_PHYM_WIRELESS        0x0002
 
+/* Flags for driver_info::data */
+#define RNDIS_DRIVER_DATA_POLL_STATUS   1       /* poll status before control */
 
 extern void rndis_status(struct usbnet *dev, struct urb *urb);
 extern int
diff --git a/include/linux/wl12xx.h b/include/linux/wl12xx.h
index bebb8efea0a6..4b697395326e 100644
--- a/include/linux/wl12xx.h
+++ b/include/linux/wl12xx.h
@@ -24,12 +24,26 @@
 #ifndef _LINUX_WL12XX_H
 #define _LINUX_WL12XX_H
 
-/* The board reference clock values */
+/* Reference clock values */
 enum {
-        WL12XX_REFCLOCK_19 = 0, /* 19.2 MHz */
-        WL12XX_REFCLOCK_26 = 1, /* 26 MHz */
-        WL12XX_REFCLOCK_38 = 2, /* 38.4 MHz */
-        WL12XX_REFCLOCK_54 = 3, /* 54 MHz */
+        WL12XX_REFCLOCK_19      = 0, /* 19.2 MHz */
+        WL12XX_REFCLOCK_26      = 1, /* 26 MHz */
+        WL12XX_REFCLOCK_38      = 2, /* 38.4 MHz */
+        WL12XX_REFCLOCK_52      = 3, /* 52 MHz */
+        WL12XX_REFCLOCK_38_XTAL = 4, /* 38.4 MHz, XTAL */
+        WL12XX_REFCLOCK_26_XTAL = 5, /* 26 MHz, XTAL */
+};
+
+/* TCXO clock values */
+enum {
+        WL12XX_TCXOCLOCK_19_2   = 0, /* 19.2MHz */
+        WL12XX_TCXOCLOCK_26     = 1, /* 26 MHz */
+        WL12XX_TCXOCLOCK_38_4   = 2, /* 38.4MHz */
+        WL12XX_TCXOCLOCK_52     = 3, /* 52 MHz */
+        WL12XX_TCXOCLOCK_16_368 = 4, /* 16.368 MHz */
+        WL12XX_TCXOCLOCK_32_736 = 5, /* 32.736 MHz */
+        WL12XX_TCXOCLOCK_16_8   = 6, /* 16.8 MHz */
+        WL12XX_TCXOCLOCK_33_6   = 7, /* 33.6 MHz */
 };
 
 struct wl12xx_platform_data {
@@ -38,8 +52,13 @@ struct wl12xx_platform_data {
         int irq;
         bool use_eeprom;
         int board_ref_clock;
+        int board_tcxo_clock;
+        unsigned long platform_quirks;
 };
 
+/* Platform does not support level trigger interrupts */
+#define WL12XX_PLATFORM_QUIRK_EDGE_IRQ  BIT(0)
+
 #ifdef CONFIG_WL12XX_PLATFORM_DATA
 
 int wl12xx_set_platform_data(const struct wl12xx_platform_data *data);
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 23710aa6a181..582e4ae70753 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -42,8 +42,6 @@ struct prefix_info {
 };
 
 
-#ifdef __KERNEL__
-
 #include <linux/netdevice.h>
 #include <net/if_inet6.h>
 #include <net/ipv6.h>
@@ -61,16 +59,16 @@ extern int			addrconf_set_dstaddr(struct net *net,
                                                      void __user *arg);
 
 extern int                      ipv6_chk_addr(struct net *net,
-                                              struct in6_addr *addr,
+                                              const struct in6_addr *addr,
                                               struct net_device *dev,
                                               int strict);
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 extern int                      ipv6_chk_home_addr(struct net *net,
-                                                   struct in6_addr *addr);
+                                                   const struct in6_addr *addr);
 #endif
 
-extern int                      ipv6_chk_prefix(struct in6_addr *addr,
+extern int                      ipv6_chk_prefix(const struct in6_addr *addr,
                                                 struct net_device *dev);
 
 extern struct inet6_ifaddr      *ipv6_get_ifaddr(struct net *net,
@@ -89,9 +87,9 @@ extern int			ipv6_get_lladdr(struct net_device *dev,
 extern int                      ipv6_rcv_saddr_equal(const struct sock *sk,
                                                     const struct sock *sk2);
 extern void                     addrconf_join_solict(struct net_device *dev,
-                                        struct in6_addr *addr);
+                                        const struct in6_addr *addr);
 extern void                     addrconf_leave_solict(struct inet6_dev *idev,
-                                        struct in6_addr *addr);
+                                        const struct in6_addr *addr);
 
 static inline unsigned long addrconf_timeout_fixup(u32 timeout,
                                                     unsigned unit)
@@ -158,15 +156,15 @@ extern void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len);
 /*
  *      anycast prototypes (anycast.c)
  */
-extern int ipv6_sock_ac_join(struct sock *sk,int ifindex,struct in6_addr *addr);
-extern int ipv6_sock_ac_drop(struct sock *sk,int ifindex,struct in6_addr *addr);
+extern int ipv6_sock_ac_join(struct sock *sk,int ifindex, const struct in6_addr *addr);
+extern int ipv6_sock_ac_drop(struct sock *sk,int ifindex, const struct in6_addr *addr);
 extern void ipv6_sock_ac_close(struct sock *sk);
-extern int inet6_ac_check(struct sock *sk, struct in6_addr *addr, int ifindex);
+extern int inet6_ac_check(struct sock *sk, const struct in6_addr *addr, int ifindex);
 
-extern int ipv6_dev_ac_inc(struct net_device *dev, struct in6_addr *addr);
-extern int __ipv6_dev_ac_dec(struct inet6_dev *idev, struct in6_addr *addr);
+extern int ipv6_dev_ac_inc(struct net_device *dev, const struct in6_addr *addr);
+extern int __ipv6_dev_ac_dec(struct inet6_dev *idev, const struct in6_addr *addr);
 extern int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
-                               struct in6_addr *addr);
+                               const struct in6_addr *addr);
 
 
 /* Device notifier */
@@ -285,4 +283,3 @@ extern void if6_proc_exit(void);
 #endif
 
 #endif
-#endif
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index 00c2eaa07c25..03e6e9453623 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -12,8 +12,6 @@
 #ifndef _NET_RXRPC_H
 #define _NET_RXRPC_H
 
-#ifdef __KERNEL__
-
 #include <linux/rxrpc.h>
 
 struct rxrpc_call;
@@ -53,5 +51,4 @@ extern struct rxrpc_call *rxrpc_kernel_accept_call(struct socket *,
                                                    unsigned long);
 extern int rxrpc_kernel_reject_call(struct socket *);
 
-#endif /* __KERNEL__ */
 #endif /* _NET_RXRPC_H */
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 18e5c3f67580..91ab5b01678a 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -41,7 +41,6 @@ struct unix_skb_parms {
                                 spin_lock_nested(&unix_sk(s)->lock, \
                                 SINGLE_DEPTH_NESTING)
 
-#ifdef __KERNEL__
 /* The AF_UNIX socket */
 struct unix_sock {
         /* WARNING: sk has to be the first member */
@@ -72,4 +71,3 @@ static inline int unix_sysctl_register(struct net *net) { return 0; }
 static inline void unix_sysctl_unregister(struct net *net) {}
 #endif
 #endif
-#endif
diff --git a/include/net/atmclip.h b/include/net/atmclip.h
index 467c531b8a7e..497ef6444a7a 100644
--- a/include/net/atmclip.h
+++ b/include/net/atmclip.h
@@ -54,8 +54,6 @@ struct clip_priv {
 };
 
 
-#ifdef __KERNEL__
 extern struct neigh_table *clip_tbl_hook;
-#endif
 
 #endif
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 2c0d309c7381..0c20227e57f6 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -246,6 +246,15 @@ enum {
 #define HCI_AT_GENERAL_BONDING          0x04
 #define HCI_AT_GENERAL_BONDING_MITM     0x05
 
+/* Link Key types */
+#define HCI_LK_COMBINATION              0x00
+#define HCI_LK_LOCAL_UNIT               0x01
+#define HCI_LK_REMOTE_UNIT              0x02
+#define HCI_LK_DEBUG_COMBINATION        0x03
+#define HCI_LK_UNAUTH_COMBINATION       0x04
+#define HCI_LK_AUTH_COMBINATION         0x05
+#define HCI_LK_CHANGED_COMBINATION      0x06
+
 /* -----  HCI Commands ---- */
 #define HCI_OP_NOP                      0x0000
 
@@ -428,6 +437,18 @@ struct hci_rp_user_confirm_reply {
 
 #define HCI_OP_USER_CONFIRM_NEG_REPLY   0x042d
 
+#define HCI_OP_REMOTE_OOB_DATA_REPLY    0x0430
+struct hci_cp_remote_oob_data_reply {
+        bdaddr_t bdaddr;
+        __u8     hash[16];
+        __u8     randomizer[16];
+} __packed;
+
+#define HCI_OP_REMOTE_OOB_DATA_NEG_REPLY        0x0433
+struct hci_cp_remote_oob_data_neg_reply {
+        bdaddr_t bdaddr;
+} __packed;
+
 #define HCI_OP_IO_CAPABILITY_NEG_REPLY  0x0434
 struct hci_cp_io_capability_neg_reply {
         bdaddr_t bdaddr;
@@ -537,15 +558,17 @@ struct hci_cp_delete_stored_link_key {
         __u8     delete_all;
 } __packed;
 
+#define HCI_MAX_NAME_LENGTH             248
+
 #define HCI_OP_WRITE_LOCAL_NAME         0x0c13
 struct hci_cp_write_local_name {
-        __u8     name[248];
+        __u8     name[HCI_MAX_NAME_LENGTH];
 } __packed;
 
 #define HCI_OP_READ_LOCAL_NAME          0x0c14
 struct hci_rp_read_local_name {
         __u8     status;
-        __u8     name[248];
+        __u8     name[HCI_MAX_NAME_LENGTH];
 } __packed;
 
 #define HCI_OP_WRITE_CA_TIMEOUT         0x0c16
@@ -602,6 +625,14 @@ struct hci_cp_host_buffer_size {
 
 #define HCI_OP_WRITE_INQUIRY_MODE       0x0c45
 
+#define HCI_MAX_EIR_LENGTH              240
+
+#define HCI_OP_WRITE_EIR                0x0c52
+struct hci_cp_write_eir {
+        uint8_t         fec;
+        uint8_t         data[HCI_MAX_EIR_LENGTH];
+} __packed;
+
 #define HCI_OP_READ_SSP_MODE            0x0c55
 struct hci_rp_read_ssp_mode {
         __u8     status;
@@ -613,6 +644,13 @@ struct hci_cp_write_ssp_mode {
         __u8     mode;
 } __packed;
 
+#define HCI_OP_READ_LOCAL_OOB_DATA              0x0c57
+struct hci_rp_read_local_oob_data {
+        __u8     status;
+        __u8     hash[16];
+        __u8     randomizer[16];
+} __packed;
+
 #define HCI_OP_READ_INQ_RSP_TX_POWER    0x0c58
 
 #define HCI_OP_READ_LOCAL_VERSION       0x1001
@@ -747,7 +785,7 @@ struct hci_ev_auth_complete {
 struct hci_ev_remote_name {
         __u8     status;
         bdaddr_t bdaddr;
-        __u8     name[248];
+        __u8     name[HCI_MAX_NAME_LENGTH];
 } __packed;
 
 #define HCI_EV_ENCRYPT_CHANGE           0x08
@@ -955,6 +993,11 @@ struct hci_ev_user_confirm_req {
         __le32          passkey;
 } __packed;
 
+#define HCI_EV_REMOTE_OOB_DATA_REQUEST  0x35
+struct hci_ev_remote_oob_data_request {
+        bdaddr_t bdaddr;
+} __packed;
+
 #define HCI_EV_SIMPLE_PAIR_COMPLETE     0x36
 struct hci_ev_simple_pair_complete {
         __u8     status;
@@ -1033,7 +1076,6 @@ struct hci_sco_hdr {
         __u8    dlen;
 } __packed;
 
-#ifdef __KERNEL__
 #include <linux/skbuff.h>
 static inline struct hci_event_hdr *hci_event_hdr(const struct sk_buff *skb)
 {
@@ -1049,7 +1091,6 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
 {
         return (struct hci_sco_hdr *) skb->data;
 }
-#endif
 
 /* Command opcode pack/unpack */
 #define hci_opcode_pack(ogf, ocf)       (__u16) ((ocf & 0x03ff)|(ogf << 10))
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 441dadbf6a89..6c994c004d15 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -82,6 +82,13 @@ struct link_key {
         u8 pin_len;
 };
 
+struct oob_data {
+        struct list_head list;
+        bdaddr_t bdaddr;
+        u8 hash[16];
+        u8 randomizer[16];
+};
+
 #define NUM_REASSEMBLY 4
 struct hci_dev {
         struct list_head list;
@@ -94,7 +101,8 @@ struct hci_dev {
         __u8            bus;
         __u8            dev_type;
         bdaddr_t        bdaddr;
-        __u8            dev_name[248];
+        __u8            dev_name[HCI_MAX_NAME_LENGTH];
+        __u8            eir[HCI_MAX_EIR_LENGTH];
         __u8            dev_class[3];
         __u8            major_class;
         __u8            minor_class;
@@ -118,6 +126,8 @@ struct hci_dev {
         __u16           sniff_min_interval;
         __u16           sniff_max_interval;
 
+        unsigned int    auto_accept_delay;
+
         unsigned long   quirks;
 
         atomic_t        cmd_cnt;
@@ -169,6 +179,8 @@ struct hci_dev {
 
         struct list_head        link_keys;
 
+        struct list_head        remote_oob_data;
+
         struct hci_dev_stats    stat;
 
         struct sk_buff_head     driver_init;
@@ -216,6 +228,7 @@ struct hci_conn {
         __u16           pkt_type;
         __u16           link_policy;
         __u32           link_mode;
+        __u8            key_type;
         __u8            auth_type;
         __u8            sec_level;
         __u8            pending_sec_level;
@@ -235,6 +248,7 @@ struct hci_conn {
 
         struct timer_list disc_timer;
         struct timer_list idle_timer;
+        struct timer_list auto_accept_timer;
 
         struct work_struct work_add;
         struct work_struct work_del;
@@ -408,6 +422,7 @@ void hci_conn_check_pending(struct hci_dev *hdev);
 
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type);
 int hci_conn_check_link_mode(struct hci_conn *conn);
+int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type);
 int hci_conn_change_link_key(struct hci_conn *conn);
 int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
@@ -501,10 +516,17 @@ int hci_uuids_clear(struct hci_dev *hdev);
 
 int hci_link_keys_clear(struct hci_dev *hdev);
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
-int hci_add_link_key(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
-                                                u8 *key, u8 type, u8 pin_len);
+int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
+                        bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
+int hci_remote_oob_data_clear(struct hci_dev *hdev);
+struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
+                                                        bdaddr_t *bdaddr);
+int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
+                                                                u8 *randomizer);
+int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
+
 void hci_del_off_timer(struct hci_dev *hdev);
 
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
@@ -754,19 +776,27 @@ int mgmt_index_removed(u16 index);
 int mgmt_powered(u16 index, u8 powered);
 int mgmt_discoverable(u16 index, u8 discoverable);
 int mgmt_connectable(u16 index, u8 connectable);
-int mgmt_new_key(u16 index, struct link_key *key, u8 old_key_type);
+int mgmt_new_key(u16 index, struct link_key *key, u8 persistent);
 int mgmt_connected(u16 index, bdaddr_t *bdaddr);
 int mgmt_disconnected(u16 index, bdaddr_t *bdaddr);
 int mgmt_disconnect_failed(u16 index);
 int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 status);
-int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr);
+int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr, u8 secure);
 int mgmt_pin_code_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status);
 int mgmt_pin_code_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status);
-int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value);
+int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value,
+                                                        u8 confirm_hint);
 int mgmt_user_confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status);
 int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr,
                                                                 u8 status);
 int mgmt_auth_failed(u16 index, bdaddr_t *bdaddr, u8 status);
+int mgmt_set_local_name_complete(u16 index, u8 *name, u8 status);
+int mgmt_read_local_oob_data_reply_complete(u16 index, u8 *hash, u8 *randomizer,
+                                                                u8 status);
+int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 *dev_class, s8 rssi,
+                                                                u8 *eir);
+int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name);
+int mgmt_discovering(u16 index, u8 discovering);
 
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 4f4bff1eaed6..d09c9b1118e3 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -276,63 +276,17 @@ struct l2cap_conn_param_update_rsp {
 #define L2CAP_CONN_PARAM_ACCEPTED       0x0000
 #define L2CAP_CONN_PARAM_REJECTED       0x0001
 
-/* ----- L2CAP connections ----- */
-struct l2cap_chan_list {
-        struct sock     *head;
-        rwlock_t        lock;
-        long            num;
-};
-
-struct l2cap_conn {
-        struct hci_conn *hcon;
-
-        bdaddr_t        *dst;
-        bdaddr_t        *src;
-
-        unsigned int    mtu;
-
-        __u32           feat_mask;
-
-        __u8            info_state;
-        __u8            info_ident;
-
-        struct timer_list info_timer;
-
-        spinlock_t      lock;
-
-        struct sk_buff *rx_skb;
-        __u32           rx_len;
-        __u8            rx_ident;
-        __u8            tx_ident;
-
-        __u8            disc_reason;
-
-        struct l2cap_chan_list chan_list;
-};
-
-struct sock_del_list {
-        struct sock *sk;
-        struct list_head list;
-};
-
-#define L2CAP_INFO_CL_MTU_REQ_SENT      0x01
-#define L2CAP_INFO_FEAT_MASK_REQ_SENT   0x04
-#define L2CAP_INFO_FEAT_MASK_REQ_DONE   0x08
-
-/* ----- L2CAP channel and socket info ----- */
-#define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
-#define TX_QUEUE(sk) (&l2cap_pi(sk)->tx_queue)
-#define SREJ_QUEUE(sk) (&l2cap_pi(sk)->srej_queue)
-#define BUSY_QUEUE(sk) (&l2cap_pi(sk)->busy_queue)
-#define SREJ_LIST(sk) (&l2cap_pi(sk)->srej_l.list)
-
+/* ----- L2CAP channels and connections ----- */
 struct srej_list {
         __u8    tx_seq;
         struct list_head list;
 };
 
-struct l2cap_pinfo {
-        struct bt_sock  bt;
+struct l2cap_chan {
+        struct sock *sk;
+
+        struct l2cap_conn       *conn;
+
         __le16          psm;
         __u16           dcid;
         __u16           scid;
@@ -341,17 +295,29 @@ struct l2cap_pinfo {
         __u16           omtu;
         __u16           flush_to;
         __u8            mode;
-        __u8            num_conf_req;
-        __u8            num_conf_rsp;
 
-        __u8            fcs;
+        __le16          sport;
+
         __u8            sec_level;
         __u8            role_switch;
         __u8            force_reliable;
         __u8            flushable;
 
+        __u8            ident;
+
         __u8            conf_req[64];
         __u8            conf_len;
+        __u8            num_conf_req;
+        __u8            num_conf_rsp;
+
+        __u8            fcs;
+
+        __u8            tx_win;
+        __u8            max_tx;
+        __u16           retrans_timeout;
+        __u16           monitor_timeout;
+        __u16           mps;
+
         __u8            conf_state;
         __u16           conn_state;
 
@@ -369,30 +335,61 @@ struct l2cap_pinfo {
         __u16           partial_sdu_len;
         struct sk_buff  *sdu;
 
-        __u8            ident;
-
-        __u8            tx_win;
-        __u8            max_tx;
         __u8            remote_tx_win;
         __u8            remote_max_tx;
-        __u16           retrans_timeout;
-        __u16           monitor_timeout;
         __u16           remote_mps;
-        __u16           mps;
-
-        __le16          sport;
 
         struct timer_list       retrans_timer;
         struct timer_list       monitor_timer;
         struct timer_list       ack_timer;
-        struct sk_buff_head     tx_queue;
-        struct sk_buff_head     srej_queue;
-        struct sk_buff_head     busy_queue;
+        struct sk_buff          *tx_send_head;
+        struct sk_buff_head     tx_q;
+        struct sk_buff_head     srej_q;
+        struct sk_buff_head     busy_q;
         struct work_struct      busy_work;
-        struct srej_list        srej_l;
-        struct l2cap_conn       *conn;
-        struct sock             *next_c;
-        struct sock             *prev_c;
+        struct list_head        srej_l;
+
+        struct list_head list;
+        struct list_head global_l;
+};
+
+struct l2cap_conn {
+        struct hci_conn *hcon;
+
+        bdaddr_t        *dst;
+        bdaddr_t        *src;
+
+        unsigned int    mtu;
+
+        __u32           feat_mask;
+
+        __u8            info_state;
+        __u8            info_ident;
+
+        struct timer_list info_timer;
+
+        spinlock_t      lock;
+
+        struct sk_buff *rx_skb;
+        __u32           rx_len;
+        __u8            tx_ident;
+
+        __u8            disc_reason;
+
+        struct list_head chan_l;
+        rwlock_t        chan_lock;
+};
+
+#define L2CAP_INFO_CL_MTU_REQ_SENT      0x01
+#define L2CAP_INFO_FEAT_MASK_REQ_SENT   0x04
+#define L2CAP_INFO_FEAT_MASK_REQ_DONE   0x08
+
+/* ----- L2CAP socket info ----- */
+#define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
+
+struct l2cap_pinfo {
+        struct bt_sock  bt;
+        struct l2cap_chan       *chan;
 };
 
 #define L2CAP_CONF_REQ_SENT       0x01
@@ -419,24 +416,23 @@ struct l2cap_pinfo {
 #define L2CAP_CONN_RNR_SENT        0x0200
 #define L2CAP_CONN_SAR_RETRY       0x0400
 
-#define __mod_retrans_timer() mod_timer(&l2cap_pi(sk)->retrans_timer, \
+#define __mod_retrans_timer() mod_timer(&chan->retrans_timer, \
                 jiffies +  msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
-#define __mod_monitor_timer() mod_timer(&l2cap_pi(sk)->monitor_timer, \
+#define __mod_monitor_timer() mod_timer(&chan->monitor_timer, \
                 jiffies + msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
-#define __mod_ack_timer() mod_timer(&l2cap_pi(sk)->ack_timer, \
+#define __mod_ack_timer() mod_timer(&chan->ack_timer, \
                 jiffies + msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
 
-static inline int l2cap_tx_window_full(struct sock *sk)
+static inline int l2cap_tx_window_full(struct l2cap_chan *ch)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         int sub;
 
-        sub = (pi->next_tx_seq - pi->expected_ack_seq) % 64;
+        sub = (ch->next_tx_seq - ch->expected_ack_seq) % 64;
 
         if (sub < 0)
                 sub += 64;
 
-        return sub == pi->remote_tx_win;
+        return sub == ch->remote_tx_win;
 }
 
 #define __get_txseq(ctrl)       (((ctrl) & L2CAP_CTRL_TXSEQ) >> 1)
@@ -446,24 +442,24 @@ static inline int l2cap_tx_window_full(struct sock *sk)
 #define __is_sar_start(ctrl)    (((ctrl) & L2CAP_CTRL_SAR) == L2CAP_SDU_START)
 
 extern int disable_ertm;
-extern const struct proto_ops l2cap_sock_ops;
-extern struct bt_sock_list l2cap_sk_list;
 
 int l2cap_init_sockets(void);
 void l2cap_cleanup_sockets(void);
 
-u8 l2cap_get_ident(struct l2cap_conn *conn);
 void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data);
-int l2cap_build_conf_req(struct sock *sk, void *data);
+void __l2cap_connect_rsp_defer(struct l2cap_chan *chan);
 int __l2cap_wait_ack(struct sock *sk);
 
-struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr *msg, size_t len);
-struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *msg, size_t len);
-struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *msg, size_t len, u16 control, u16 sdulen);
-int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, size_t len);
-void l2cap_do_send(struct sock *sk, struct sk_buff *skb);
-void l2cap_streaming_send(struct sock *sk);
-int l2cap_ertm_send(struct sock *sk);
+struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
+struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
+struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len, u16 control, u16 sdulen);
+int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
+void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb);
+void l2cap_streaming_send(struct l2cap_chan *chan);
+int l2cap_ertm_send(struct l2cap_chan *chan);
+
+int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm);
+int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
 
 void l2cap_sock_set_timer(struct sock *sk, long timeout);
 void l2cap_sock_clear_timer(struct sock *sk);
@@ -472,8 +468,10 @@ void l2cap_sock_kill(struct sock *sk);
 void l2cap_sock_init(struct sock *sk, struct sock *parent);
 struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
                                                         int proto, gfp_t prio);
-void l2cap_send_disconn_req(struct l2cap_conn *conn, struct sock *sk, int err);
-void l2cap_chan_del(struct sock *sk, int err);
-int l2cap_do_connect(struct sock *sk);
+void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err);
+struct l2cap_chan *l2cap_chan_create(struct sock *sk);
+void l2cap_chan_del(struct l2cap_chan *chan, int err);
+void l2cap_chan_destroy(struct l2cap_chan *chan);
+int l2cap_chan_connect(struct l2cap_chan *chan);
 
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 5fabfa886b3e..4899286ed4e4 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -41,6 +41,10 @@ struct mgmt_rp_read_index_list {
         __le16 index[0];
 } __packed;
 
+/* Reserve one extra byte for names in management messages so that they
+ * are always guaranteed to be nul-terminated */
+#define MGMT_MAX_NAME_LENGTH            (HCI_MAX_NAME_LENGTH + 1)
+
 #define MGMT_OP_READ_INFO               0x0004
 struct mgmt_rp_read_info {
         __u8 type;
@@ -55,6 +59,7 @@ struct mgmt_rp_read_info {
         __u16 manufacturer;
         __u8 hci_ver;
         __u16 hci_rev;
+        __u8 name[MGMT_MAX_NAME_LENGTH];
 } __packed;
 
 struct mgmt_mode {
@@ -167,6 +172,33 @@ struct mgmt_rp_user_confirm_reply {
 
 #define MGMT_OP_USER_CONFIRM_NEG_REPLY  0x0016
 
+#define MGMT_OP_SET_LOCAL_NAME          0x0017
+struct mgmt_cp_set_local_name {
+        __u8 name[MGMT_MAX_NAME_LENGTH];
+} __packed;
+
+#define MGMT_OP_READ_LOCAL_OOB_DATA     0x0018
+struct mgmt_rp_read_local_oob_data {
+        __u8 hash[16];
+        __u8 randomizer[16];
+} __packed;
+
+#define MGMT_OP_ADD_REMOTE_OOB_DATA     0x0019
+struct mgmt_cp_add_remote_oob_data {
+        bdaddr_t bdaddr;
+        __u8 hash[16];
+        __u8 randomizer[16];
+} __packed;
+
+#define MGMT_OP_REMOVE_REMOTE_OOB_DATA  0x001A
+struct mgmt_cp_remove_remote_oob_data {
+        bdaddr_t bdaddr;
+} __packed;
+
+#define MGMT_OP_START_DISCOVERY         0x001B
+
+#define MGMT_OP_STOP_DISCOVERY          0x001C
+
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
         __le16 opcode;
@@ -198,8 +230,8 @@ struct mgmt_ev_controller_error {
 
 #define MGMT_EV_NEW_KEY                 0x000A
 struct mgmt_ev_new_key {
+        __u8 store_hint;
         struct mgmt_key_info key;
-        __u8 old_key_type;
 } __packed;
 
 #define MGMT_EV_CONNECTED               0x000B
@@ -221,11 +253,13 @@ struct mgmt_ev_connect_failed {
 #define MGMT_EV_PIN_CODE_REQUEST        0x000E
 struct mgmt_ev_pin_code_request {
         bdaddr_t bdaddr;
+        __u8 secure;
 } __packed;
 
 #define MGMT_EV_USER_CONFIRM_REQUEST    0x000F
 struct mgmt_ev_user_confirm_request {
         bdaddr_t bdaddr;
+        __u8 confirm_hint;
         __le32 value;
 } __packed;
 
@@ -234,3 +268,24 @@ struct mgmt_ev_auth_failed {
         bdaddr_t bdaddr;
         __u8 status;
 } __packed;
+
+#define MGMT_EV_LOCAL_NAME_CHANGED      0x0011
+struct mgmt_ev_local_name_changed {
+        __u8 name[MGMT_MAX_NAME_LENGTH];
+} __packed;
+
+#define MGMT_EV_DEVICE_FOUND            0x0012
+struct mgmt_ev_device_found {
+        bdaddr_t bdaddr;
+        __u8 dev_class[3];
+        __s8 rssi;
+        __u8 eir[HCI_MAX_EIR_LENGTH];
+} __packed;
+
+#define MGMT_EV_REMOTE_NAME             0x0013
+struct mgmt_ev_remote_name {
+        bdaddr_t bdaddr;
+        __u8 name[MGMT_MAX_NAME_LENGTH];
+} __packed;
+
+#define MGMT_EV_DISCOVERING             0x0014
diff --git a/include/net/caif/caif_dev.h b/include/net/caif/caif_dev.h
index 8eff83b95366..c011281d92c0 100644
--- a/include/net/caif/caif_dev.h
+++ b/include/net/caif/caif_dev.h
@@ -11,6 +11,7 @@
 #include <net/caif/cfcnfg.h>
 #include <linux/caif/caif_socket.h>
 #include <linux/if.h>
+#include <linux/net.h>
 
 /**
  * struct caif_param - CAIF parameters.
@@ -62,46 +63,45 @@ struct caif_connect_request {
  * E.g. CAIF Socket will call this function for each socket it connects
  * and have one client_layer instance for each socket.
  */
-int caif_connect_client(struct caif_connect_request *conn_req,
+int caif_connect_client(struct net *net,
+                        struct caif_connect_request *conn_req,
                         struct cflayer *client_layer, int *ifindex,
                         int *headroom, int *tailroom);
 
 /**
  * caif_disconnect_client - Disconnects a client from the CAIF stack.
  *
- * @client_layer: Client layer to be removed.
+ * @client_layer: Client layer to be disconnected.
  */
-int caif_disconnect_client(struct cflayer *client_layer);
+int caif_disconnect_client(struct net *net, struct cflayer *client_layer);
+
 
 /**
- * caif_release_client - Release adaptation layer reference to client.
+ * caif_client_register_refcnt - register ref-count functions provided by client.
  *
- * @client_layer: Client layer.
+ * @adapt_layer: Client layer using CAIF Stack.
+ * @hold:       Function provided by client layer increasing ref-count
+ * @put:        Function provided by client layer decreasing ref-count
  *
- * Releases a client/adaptation layer use of the caif stack.
- * This function must be used after caif_disconnect_client to
- * decrease the reference count of the service layer.
- */
-void caif_release_client(struct cflayer *client_layer);
-
-/**
- * connect_req_to_link_param - Translate configuration parameters
- *                              from socket format to internal format.
- * @cnfg:       Pointer to configuration handler
- * @con_req:    Configuration parameters supplied in function
- *              caif_connect_client
- * @channel_setup_param: Parameters supplied to the CAIF Core stack for
- *                       setting up channels.
+ * Client of the CAIF Stack must register functions for reference counting.
+ * These functions are called by the CAIF Stack for every upstream packet,
+ * and must therefore be implemented efficiently.
  *
+ * Client should call caif_free_client when reference count degrease to zero.
  */
-int connect_req_to_link_param(struct cfcnfg *cnfg,
-                                struct caif_connect_request *con_req,
-                                struct cfctrl_link_param *channel_setup_param);
 
+void caif_client_register_refcnt(struct cflayer *adapt_layer,
+                                        void (*hold)(struct cflayer *lyr),
+                                        void (*put)(struct cflayer *lyr));
 /**
- * get_caif_conf() - Get the configuration handler.
+ * caif_free_client - Free memory used to manage the client in the CAIF Stack.
+ *
+ * @client_layer: Client layer to be removed.
+ *
+ * This function must be called from client layer in order to free memory.
+ * Caller must guarantee that no packets are in flight upstream when calling
+ * this function.
  */
-struct cfcnfg *get_caif_conf(void);
-
+void caif_free_client(struct cflayer *adap_layer);
 
 #endif /* CAIF_DEV_H_ */
diff --git a/include/net/caif/cfcnfg.h b/include/net/caif/cfcnfg.h
index f33d36341132..3e93a4a4b677 100644
--- a/include/net/caif/cfcnfg.h
+++ b/include/net/caif/cfcnfg.h
@@ -46,6 +46,12 @@ enum cfcnfg_phy_preference {
 };
 
 /**
+ * cfcnfg_create() - Get the CAIF configuration object given network.
+ * @net:        Network for the CAIF configuration object.
+ */
+struct cfcnfg *get_cfcnfg(struct net *net);
+
+/**
  * cfcnfg_create() - Create the CAIF configuration object.
  */
 struct cfcnfg *cfcnfg_create(void);
@@ -65,17 +71,15 @@ void cfcnfg_remove(struct cfcnfg *cfg);
  * @dev:        Pointer to link layer device
  * @phy_layer:  Specify the physical layer. The transmit function
  *              MUST be set in the structure.
- * @phyid:      The assigned physical ID for this layer, used in
- *              cfcnfg_add_adapt_layer to specify PHY for the link.
  * @pref:       The phy (link layer) preference.
  * @fcs:        Specify if checksum is used in CAIF Framing Layer.
- * @stx:        Specify if Start Of Frame extension is used.
+ * @stx:        Specify if Start Of Frame eXtention is used.
  */
 
 void
 cfcnfg_add_phy_layer(struct cfcnfg *cnfg, enum cfcnfg_phy_type phy_type,
                      struct net_device *dev, struct cflayer *phy_layer,
-                     u16 *phyid, enum cfcnfg_phy_preference pref,
+                     enum cfcnfg_phy_preference pref,
                      bool fcs, bool stx);
 
 /**
@@ -88,61 +92,12 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg, enum cfcnfg_phy_type phy_type,
 int cfcnfg_del_phy_layer(struct cfcnfg *cnfg, struct cflayer *phy_layer);
 
 /**
- * cfcnfg_disconn_adapt_layer - Disconnects an adaptation layer.
- *
- * @cnfg:       Pointer to a CAIF configuration object, created by
- *              cfcnfg_create().
- * @adap_layer: Adaptation layer to be removed.
- */
-int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg,
-                        struct cflayer *adap_layer);
-
-/**
- * cfcnfg_release_adap_layer - Used by client to release the adaptation layer.
- *
- * @adap_layer: Adaptation layer.
- */
-void cfcnfg_release_adap_layer(struct cflayer *adap_layer);
-
-/**
- * cfcnfg_add_adaptation_layer - Add an adaptation layer to the CAIF stack.
- *
- * The adaptation Layer is where the interface to application or higher-level
- * driver functionality is implemented.
- *
- * @cnfg:               Pointer to a CAIF configuration object, created by
- *                      cfcnfg_create().
- * @param:              Link setup parameters.
- * @adap_layer:         Specify the adaptation layer; the receive and
- *                      flow-control functions MUST be set in the structure.
- * @ifindex:            Link layer interface index used for this connection.
- * @proto_head:         Protocol head-space needed by CAIF protocol,
- *                      excluding link layer.
- * @proto_tail:         Protocol tail-space needed by CAIF protocol,
- *                      excluding link layer.
- */
-int cfcnfg_add_adaptation_layer(struct cfcnfg *cnfg,
-                            struct cfctrl_link_param *param,
-                            struct cflayer *adap_layer,
-                            int *ifindex,
-                            int *proto_head,
-                            int *proto_tail);
-
-/**
- * cfcnfg_get_phyid() - Get physical ID, given type.
- * Returns one of the physical interfaces matching the given type.
- * Zero if no match is found.
+ * cfcnfg_set_phy_state() - Set the state of the physical interface device.
  * @cnfg:       Configuration object
- * @phy_pref:   Caif Link Layer preference
+ * @phy_layer:  Physical Layer representation
+ * @up: State of device
  */
-struct dev_info *cfcnfg_get_phyid(struct cfcnfg *cnfg,
-                     enum cfcnfg_phy_preference phy_pref);
+int cfcnfg_set_phy_state(struct cfcnfg *cnfg, struct cflayer *phy_layer,
+                                bool up);
 
-/**
- * cfcnfg_get_id_from_ifi() - Get the Physical Identifier of ifindex,
- *                      it matches caif physical id with the kernel interface id.
- * @cnfg:       Configuration object
- * @ifi:        ifindex obtained from socket.c bindtodevice.
- */
-int cfcnfg_get_id_from_ifi(struct cfcnfg *cnfg, int ifi);
 #endif                          /* CFCNFG_H_ */
diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
index e54f6396fa4c..9e5425b4a1d7 100644
--- a/include/net/caif/cfctrl.h
+++ b/include/net/caif/cfctrl.h
@@ -121,19 +121,10 @@ int cfctrl_linkup_request(struct cflayer *cfctrl,
                            struct cflayer *user_layer);
 int  cfctrl_linkdown_req(struct cflayer *cfctrl, u8 linkid,
                          struct cflayer *client);
-void cfctrl_sleep_req(struct cflayer *cfctrl);
-void cfctrl_wake_req(struct cflayer *cfctrl);
-void cfctrl_getstartreason_req(struct cflayer *cfctrl);
+
 struct cflayer *cfctrl_create(void);
-void cfctrl_set_dnlayer(struct cflayer *this, struct cflayer *dn);
-void cfctrl_set_uplayer(struct cflayer *this, struct cflayer *up);
 struct cfctrl_rsp *cfctrl_get_respfuncs(struct cflayer *layer);
-bool cfctrl_req_eq(struct cfctrl_request_info *r1,
-                   struct cfctrl_request_info *r2);
-void cfctrl_insert_req(struct cfctrl *ctrl,
-                              struct cfctrl_request_info *req);
-struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
-                                              struct cfctrl_request_info *req);
-void cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer);
+int cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer);
+void cfctrl_remove(struct cflayer *layr);
 
 #endif                          /* CFCTRL_H_ */
diff --git a/include/net/caif/cffrml.h b/include/net/caif/cffrml.h
index 3f14d2e1ce61..afac1a48cce7 100644
--- a/include/net/caif/cffrml.h
+++ b/include/net/caif/cffrml.h
@@ -7,10 +7,15 @@
 #ifndef CFFRML_H_
 #define CFFRML_H_
 #include <net/caif/caif_layer.h>
+#include <linux/netdevice.h>
 
 struct cffrml;
-struct cflayer *cffrml_create(u16 phyid, bool DoFCS);
+struct cflayer *cffrml_create(u16 phyid, bool use_fcs);
+void cffrml_free(struct cflayer *layr);
 void cffrml_set_uplayer(struct cflayer *this, struct cflayer *up);
 void cffrml_set_dnlayer(struct cflayer *this, struct cflayer *dn);
+void cffrml_put(struct cflayer *layr);
+void cffrml_hold(struct cflayer *layr);
+int cffrml_refcnt_read(struct cflayer *layr);
 
 #endif /* CFFRML_H_ */
diff --git a/include/net/caif/cfmuxl.h b/include/net/caif/cfmuxl.h
index 4e1b4f33423e..5847a196b8ad 100644
--- a/include/net/caif/cfmuxl.h
+++ b/include/net/caif/cfmuxl.h
@@ -16,7 +16,5 @@ int cfmuxl_set_uplayer(struct cflayer *layr, struct cflayer *up, u8 linkid);
 struct cflayer *cfmuxl_remove_dnlayer(struct cflayer *layr, u8 phyid);
 int cfmuxl_set_dnlayer(struct cflayer *layr, struct cflayer *up, u8 phyid);
 struct cflayer *cfmuxl_remove_uplayer(struct cflayer *layr, u8 linkid);
-bool cfmuxl_is_phy_inuse(struct cflayer *layr, u8 phyid);
-u8 cfmuxl_get_phyid(struct cflayer *layr, u8 channel_id);
 
 #endif                          /* CFMUXL_H_ */
diff --git a/include/net/caif/cfpkt.h b/include/net/caif/cfpkt.h
index fbc681beff52..6bd200a4754a 100644
--- a/include/net/caif/cfpkt.h
+++ b/include/net/caif/cfpkt.h
@@ -16,12 +16,6 @@ struct cfpkt;
  */
 struct cfpkt *cfpkt_create(u16 len);
 
-/* Create a CAIF packet.
- * data Data to copy.
- * len Length of packet to be created
- * @return New packet.
- */
-struct cfpkt *cfpkt_create_uplink(const unsigned char *data, unsigned int len);
 /*
  * Destroy a CAIF Packet.
  * pkt Packet to be destoyed.
@@ -181,22 +175,6 @@ u16 cfpkt_iterate(struct cfpkt *pkt,
                 u16 (*iter_func)(u16 chks, void *buf, u16 len),
                 u16 data);
 
-/* Append by giving user access to packet buffer
- * cfpkt Packet to append to
- * buf Buffer inside pkt that user shall copy data into
- * buflen Length of buffer and number of bytes added to packet
- * @return 0 on error, 1 on success
- */
-int cfpkt_raw_append(struct cfpkt *cfpkt, void **buf, unsigned int buflen);
-
-/* Extract by giving user access to packet buffer
- * cfpkt Packet to extract from
- * buf Buffer inside pkt that user shall copy data from
- * buflen Length of buffer and number of bytes removed from packet
- * @return 0 on error, 1 on success
- */
-int cfpkt_raw_extract(struct cfpkt *cfpkt, void **buf, unsigned int buflen);
-
 /* Map from a "native" packet (e.g. Linux Socket Buffer) to a CAIF packet.
  *  dir - Direction indicating whether this packet is to be sent or received.
  *  nativepkt  - The native packet to be transformed to a CAIF packet
@@ -210,59 +188,6 @@ struct cfpkt *cfpkt_fromnative(enum caif_direction dir, void *nativepkt);
  */
 void *cfpkt_tonative(struct cfpkt *pkt);
 
-/*
- * Insert a packet in the packet queue.
- * pktq Packet queue to insert into
- * pkt Packet to be inserted in queue
- * prio Priority of packet
- */
-void cfpkt_queue(struct cfpktq *pktq, struct cfpkt *pkt,
-                 unsigned short prio);
-
-/*
- * Remove a packet from the packet queue.
- * pktq Packet queue to fetch packets from.
- * @return Dequeued packet.
- */
-struct cfpkt *cfpkt_dequeue(struct cfpktq *pktq);
-
-/*
- * Peek into a packet from the packet queue.
- * pktq Packet queue to fetch packets from.
- * @return Peeked packet.
- */
-struct cfpkt *cfpkt_qpeek(struct cfpktq *pktq);
-
-/*
- * Initiates the packet queue.
- * @return Pointer to new packet queue.
- */
-struct cfpktq *cfpktq_create(void);
-
-/*
- * Get the number of packets in the queue.
- * pktq Packet queue to fetch count from.
- * @return Number of packets in queue.
- */
-int cfpkt_qcount(struct cfpktq *pktq);
-
-/*
- * Put content of packet into buffer for debuging purposes.
- * pkt Packet to copy data from
- * buf Buffer to copy data into
- * buflen Length of data to copy
- * @return Pointer to copied data
- */
-char *cfpkt_log_pkt(struct cfpkt *pkt, char *buf, int buflen);
-
-/*
- * Clones a packet and releases the original packet.
- * This is used for taking ownership of a packet e.g queueing.
- * pkt Packet to clone and release.
- * @return Cloned packet.
- */
-struct cfpkt *cfpkt_clone_release(struct cfpkt *pkt);
-
 
 /*
  * Returns packet information for a packet.
@@ -270,5 +195,4 @@ struct cfpkt *cfpkt_clone_release(struct cfpkt *pkt);
  * @return Packet information
  */
 struct caif_payload_info *cfpkt_info(struct cfpkt *pkt);
-/*! @} */
 #endif                          /* CFPKT_H_ */
diff --git a/include/net/caif/cfsrvl.h b/include/net/caif/cfsrvl.h
index b1fa87ee0992..0f5905241843 100644
--- a/include/net/caif/cfsrvl.h
+++ b/include/net/caif/cfsrvl.h
@@ -10,6 +10,7 @@
 #include <linux/stddef.h>
 #include <linux/types.h>
 #include <linux/kref.h>
+#include <linux/rculist.h>
 
 struct cfsrvl {
         struct cflayer layer;
@@ -17,12 +18,13 @@ struct cfsrvl {
         bool phy_flow_on;
         bool modem_flow_on;
         bool supports_flowctrl;
-        void (*release)(struct kref *);
+        void (*release)(struct cflayer *layer);
         struct dev_info dev_info;
-        struct kref ref;
+        void (*hold)(struct cflayer *lyr);
+        void (*put)(struct cflayer *lyr);
+        struct rcu_head rcu;
 };
 
-void cfsrvl_release(struct kref *kref);
 struct cflayer *cfvei_create(u8 linkid, struct dev_info *dev_info);
 struct cflayer *cfdgml_create(u8 linkid, struct dev_info *dev_info);
 struct cflayer *cfutill_create(u8 linkid, struct dev_info *dev_info);
@@ -30,8 +32,12 @@ struct cflayer *cfvidl_create(u8 linkid, struct dev_info *dev_info);
 struct cflayer *cfrfml_create(u8 linkid, struct dev_info *dev_info,
                                 int mtu_size);
 struct cflayer *cfdbgl_create(u8 linkid, struct dev_info *dev_info);
+
+void cfsrvl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
+                     int phyid);
+
 bool cfsrvl_phyid_match(struct cflayer *layer, int phyid);
-void cfservl_destroy(struct cflayer *layer);
+
 void cfsrvl_init(struct cfsrvl *service,
                         u8 channel_id,
                         struct dev_info *dev_info,
@@ -41,23 +47,19 @@ u8 cfsrvl_getphyid(struct cflayer *layer);
 
 static inline void cfsrvl_get(struct cflayer *layr)
 {
-        struct cfsrvl *s;
-        if (layr == NULL)
+        struct cfsrvl *s = container_of(layr, struct cfsrvl, layer);
+        if (layr == NULL || layr->up == NULL || s->hold == NULL)
                 return;
-        s = container_of(layr, struct cfsrvl, layer);
-        kref_get(&s->ref);
+
+        s->hold(layr->up);
 }
 
 static inline void cfsrvl_put(struct cflayer *layr)
 {
-        struct cfsrvl *s;
-        if (layr == NULL)
+        struct cfsrvl *s = container_of(layr, struct cfsrvl, layer);
+        if (layr == NULL || layr->up == NULL || s->hold == NULL)
                 return;
-        s = container_of(layr, struct cfsrvl, layer);
 
-        WARN_ON(!s->release);
-        if (s->release)
-                kref_put(&s->ref, s->release);
+        s->put(layr->up);
 }
-
 #endif                          /* CFSRVL_H_ */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index b2b9d28cb4ab..bfd6557946be 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -387,6 +387,7 @@ enum plink_actions {
  * @listen_interval: listen interval or -1 for no change
  * @aid: AID or zero for no change
  * @plink_action: plink action to take
+ * @plink_state: set the peer link state for a station
  * @ht_capa: HT capabilities of station
  */
 struct station_parameters {
@@ -397,6 +398,7 @@ struct station_parameters {
         u16 aid;
         u8 supported_rates_len;
         u8 plink_action;
+        u8 plink_state;
         struct ieee80211_ht_cap *ht_capa;
 };
 
@@ -422,6 +424,8 @@ struct station_parameters {
  * @STATION_INFO_RX_DROP_MISC: @rx_dropped_misc filled
  * @STATION_INFO_SIGNAL_AVG: @signal_avg filled
  * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
+ * @STATION_INFO_BSS_PARAM: @bss_param filled
+ * @STATION_INFO_CONNECTED_TIME: @connected_time filled
  */
 enum station_info_flags {
         STATION_INFO_INACTIVE_TIME      = 1<<0,
@@ -439,6 +443,8 @@ enum station_info_flags {
         STATION_INFO_RX_DROP_MISC       = 1<<12,
         STATION_INFO_SIGNAL_AVG         = 1<<13,
         STATION_INFO_RX_BITRATE         = 1<<14,
+        STATION_INFO_BSS_PARAM          = 1<<15,
+        STATION_INFO_CONNECTED_TIME     = 1<<16
 };
 
 /**
@@ -473,11 +479,43 @@ struct rate_info {
 };
 
 /**
+ * enum station_info_rate_flags - bitrate info flags
+ *
+ * Used by the driver to indicate the specific rate transmission
+ * type for 802.11n transmissions.
+ *
+ * @BSS_PARAM_FLAGS_CTS_PROT: whether CTS protection is enabled
+ * @BSS_PARAM_FLAGS_SHORT_PREAMBLE: whether short preamble is enabled
+ * @BSS_PARAM_FLAGS_SHORT_SLOT_TIME: whether short slot time is enabled
+ */
+enum bss_param_flags {
+        BSS_PARAM_FLAGS_CTS_PROT        = 1<<0,
+        BSS_PARAM_FLAGS_SHORT_PREAMBLE  = 1<<1,
+        BSS_PARAM_FLAGS_SHORT_SLOT_TIME = 1<<2,
+};
+
+/**
+ * struct sta_bss_parameters - BSS parameters for the attached station
+ *
+ * Information about the currently associated BSS
+ *
+ * @flags: bitflag of flags from &enum bss_param_flags
+ * @dtim_period: DTIM period for the BSS
+ * @beacon_interval: beacon interval
+ */
+struct sta_bss_parameters {
+        u8 flags;
+        u8 dtim_period;
+        u16 beacon_interval;
+};
+
+/**
  * struct station_info - station information
  *
  * Station information filled by driver for get_station() and dump_station.
  *
  * @filled: bitflag of flags from &enum station_info_flags
+ * @connected_time: time(in secs) since a station is last connected
  * @inactive_time: time since last station activity (tx/rx) in milliseconds
  * @rx_bytes: bytes received from this station
  * @tx_bytes: bytes transmitted to this station
@@ -500,6 +538,7 @@ struct rate_info {
  */
 struct station_info {
         u32 filled;
+        u32 connected_time;
         u32 inactive_time;
         u32 rx_bytes;
         u32 tx_bytes;
@@ -515,6 +554,7 @@ struct station_info {
         u32 tx_retries;
         u32 tx_failed;
         u32 rx_dropped_misc;
+        struct sta_bss_parameters bss_param;
 
         int generation;
 };
@@ -655,8 +695,10 @@ struct mesh_config {
  * @mesh_id_len: length of the mesh ID, at least 1 and at most 32 bytes
  * @path_sel_proto: which path selection protocol to use
  * @path_metric: which metric to use
- * @vendor_ie: vendor information elements (optional)
- * @vendor_ie_len: length of vendor information elements
+ * @ie: vendor information elements (optional)
+ * @ie_len: length of vendor information elements
+ * @is_authenticated: this mesh requires authentication
+ * @is_secure: this mesh uses security
  *
  * These parameters are fixed when the mesh is created.
  */
@@ -665,8 +707,10 @@ struct mesh_setup {
         u8 mesh_id_len;
         u8  path_sel_proto;
         u8  path_metric;
-        const u8 *vendor_ie;
-        u8 vendor_ie_len;
+        const u8 *ie;
+        u8 ie_len;
+        bool is_authenticated;
+        bool is_secure;
 };
 
 /**
@@ -753,6 +797,35 @@ struct cfg80211_scan_request {
 };
 
 /**
+ * struct cfg80211_sched_scan_request - scheduled scan request description
+ *
+ * @ssids: SSIDs to scan for (passed in the probe_reqs in active scans)
+ * @n_ssids: number of SSIDs
+ * @n_channels: total number of channels to scan
+ * @interval: interval between each scheduled scan cycle
+ * @ie: optional information element(s) to add into Probe Request or %NULL
+ * @ie_len: length of ie in octets
+ * @wiphy: the wiphy this was for
+ * @dev: the interface
+ * @channels: channels to scan
+ */
+struct cfg80211_sched_scan_request {
+        struct cfg80211_ssid *ssids;
+        int n_ssids;
+        u32 n_channels;
+        u32 interval;
+        const u8 *ie;
+        size_t ie_len;
+
+        /* internal */
+        struct wiphy *wiphy;
+        struct net_device *dev;
+
+        /* keep last */
+        struct ieee80211_channel *channels[0];
+};
+
+/**
  * enum cfg80211_signal_type - signal type
  *
  * @CFG80211_SIGNAL_TYPE_NONE: no signal strength information available
@@ -1048,6 +1121,38 @@ struct cfg80211_pmksa {
 };
 
 /**
+ * struct cfg80211_wowlan_trig_pkt_pattern - packet pattern
+ * @mask: bitmask where to match pattern and where to ignore bytes,
+ *      one bit per byte, in same format as nl80211
+ * @pattern: bytes to match where bitmask is 1
+ * @pattern_len: length of pattern (in bytes)
+ *
+ * Internal note: @mask and @pattern are allocated in one chunk of
+ * memory, free @mask only!
+ */
+struct cfg80211_wowlan_trig_pkt_pattern {
+        u8 *mask, *pattern;
+        int pattern_len;
+};
+
+/**
+ * struct cfg80211_wowlan - Wake on Wireless-LAN support info
+ *
+ * This structure defines the enabled WoWLAN triggers for the device.
+ * @any: wake up on any activity -- special trigger if device continues
+ *      operating as normal during suspend
+ * @disconnect: wake up if getting disconnected
+ * @magic_pkt: wake up on receiving magic packet
+ * @patterns: wake up on receiving packet matching a pattern
+ * @n_patterns: number of patterns
+ */
+struct cfg80211_wowlan {
+        bool any, disconnect, magic_pkt;
+        struct cfg80211_wowlan_trig_pkt_pattern *patterns;
+        int n_patterns;
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -1060,7 +1165,9 @@ struct cfg80211_pmksa {
  * wireless extensions but this is subject to reevaluation as soon as this
  * code is used more widely and we have a first user without wext.
  *
- * @suspend: wiphy device needs to be suspended
+ * @suspend: wiphy device needs to be suspended. The variable @wow will
+ *      be %NULL or contain the enabled Wake-on-Wireless triggers that are
+ *      configured for the device.
  * @resume: wiphy device needs to be resumed
  *
  * @add_virtual_intf: create a new virtual interface with the given name,
@@ -1187,6 +1294,10 @@ struct cfg80211_pmksa {
  * @set_power_mgmt: Configure WLAN power management. A timeout value of -1
  *      allows the driver to adjust the dynamic ps timeout value.
  * @set_cqm_rssi_config: Configure connection quality monitor RSSI threshold.
+ * @sched_scan_start: Tell the driver to start a scheduled scan.
+ * @sched_scan_stop: Tell the driver to stop an ongoing scheduled
+ *      scan.  The driver_initiated flag specifies whether the driver
+ *      itself has informed that the scan has stopped.
  *
  * @mgmt_frame_register: Notify driver that a management frame type was
  *      registered. Note that this callback may not sleep, and cannot run
@@ -1204,7 +1315,7 @@ struct cfg80211_pmksa {
  * @get_ringparam: Get tx and rx ring current and maximum sizes.
  */
 struct cfg80211_ops {
-        int     (*suspend)(struct wiphy *wiphy);
+        int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
         int     (*resume)(struct wiphy *wiphy);
 
         struct net_device * (*add_virtual_intf)(struct wiphy *wiphy,
@@ -1373,6 +1484,11 @@ struct cfg80211_ops {
         int     (*set_ringparam)(struct wiphy *wiphy, u32 tx, u32 rx);
         void    (*get_ringparam)(struct wiphy *wiphy,
                                  u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max);
+
+        int     (*sched_scan_start)(struct wiphy *wiphy,
+                                struct net_device *dev,
+                                struct cfg80211_sched_scan_request *request);
+        int     (*sched_scan_stop)(struct wiphy *wiphy, struct net_device *dev);
 };
 
 /*
@@ -1404,6 +1520,10 @@ struct cfg80211_ops {
  *      hints read the documenation for regulatory_hint_found_beacon()
  * @WIPHY_FLAG_NETNS_OK: if not set, do not allow changing the netns of this
  *      wiphy at all
+ * @WIPHY_FLAG_ENFORCE_COMBINATIONS: Set this flag to enforce interface
+ *      combinations for this device. This flag is used for backward
+ *      compatibility only until all drivers advertise combinations and
+ *      they will always be enforced.
  * @WIPHY_FLAG_PS_ON_BY_DEFAULT: if set to true, powersave will be enabled
  *      by default -- this flag will be set depending on the kernel's default
  *      on wiphy_new(), but can be changed by the driver if it has a good
@@ -1415,8 +1535,9 @@ struct cfg80211_ops {
  *      control port protocol ethertype. The device also honours the
  *      control_port_no_encrypt flag.
  * @WIPHY_FLAG_IBSS_RSN: The device supports IBSS RSN.
- * @WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS: The device supports separate
- *      unicast and multicast TX keys.
+ * @WIPHY_FLAG_MESH_AUTH: The device supports mesh authentication by routing
+ *      auth frames to userspace. See @NL80211_MESH_SETUP_USERSPACE_AUTH.
+ * @WIPHY_FLAG_SCHED_SCAN: The device supports scheduled scans.
  */
 enum wiphy_flags {
         WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
@@ -1428,7 +1549,83 @@ enum wiphy_flags {
         WIPHY_FLAG_4ADDR_STATION                = BIT(6),
         WIPHY_FLAG_CONTROL_PORT_PROTOCOL        = BIT(7),
         WIPHY_FLAG_IBSS_RSN                     = BIT(8),
-        WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS= BIT(9),
+        WIPHY_FLAG_MESH_AUTH                    = BIT(10),
+        WIPHY_FLAG_SUPPORTS_SCHED_SCAN          = BIT(11),
+        WIPHY_FLAG_ENFORCE_COMBINATIONS         = BIT(12),
+};
+
+/**
+ * struct ieee80211_iface_limit - limit on certain interface types
+ * @max: maximum number of interfaces of these types
+ * @types: interface types (bits)
+ */
+struct ieee80211_iface_limit {
+        u16 max;
+        u16 types;
+};
+
+/**
+ * struct ieee80211_iface_combination - possible interface combination
+ * @limits: limits for the given interface types
+ * @n_limits: number of limitations
+ * @num_different_channels: can use up to this many different channels
+ * @max_interfaces: maximum number of interfaces in total allowed in this
+ *      group
+ * @beacon_int_infra_match: In this combination, the beacon intervals
+ *      between infrastructure and AP types must match. This is required
+ *      only in special cases.
+ *
+ * These examples can be expressed as follows:
+ *
+ * Allow #STA <= 1, #AP <= 1, matching BI, channels = 1, 2 total:
+ *
+ *  struct ieee80211_iface_limit limits1[] = {
+ *      { .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
+ *      { .max = 1, .types = BIT(NL80211_IFTYPE_AP}, },
+ *  };
+ *  struct ieee80211_iface_combination combination1 = {
+ *      .limits = limits1,
+ *      .n_limits = ARRAY_SIZE(limits1),
+ *      .max_interfaces = 2,
+ *      .beacon_int_infra_match = true,
+ *  };
+ *
+ *
+ * Allow #{AP, P2P-GO} <= 8, channels = 1, 8 total:
+ *
+ *  struct ieee80211_iface_limit limits2[] = {
+ *      { .max = 8, .types = BIT(NL80211_IFTYPE_AP) |
+ *                           BIT(NL80211_IFTYPE_P2P_GO), },
+ *  };
+ *  struct ieee80211_iface_combination combination2 = {
+ *      .limits = limits2,
+ *      .n_limits = ARRAY_SIZE(limits2),
+ *      .max_interfaces = 8,
+ *      .num_different_channels = 1,
+ *  };
+ *
+ *
+ * Allow #STA <= 1, #{P2P-client,P2P-GO} <= 3 on two channels, 4 total.
+ * This allows for an infrastructure connection and three P2P connections.
+ *
+ *  struct ieee80211_iface_limit limits3[] = {
+ *      { .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
+ *      { .max = 3, .types = BIT(NL80211_IFTYPE_P2P_GO) |
+ *                           BIT(NL80211_IFTYPE_P2P_CLIENT), },
+ *  };
+ *  struct ieee80211_iface_combination combination3 = {
+ *      .limits = limits3,
+ *      .n_limits = ARRAY_SIZE(limits3),
+ *      .max_interfaces = 4,
+ *      .num_different_channels = 2,
+ *  };
+ */
+struct ieee80211_iface_combination {
+        const struct ieee80211_iface_limit *limits;
+        u32 num_different_channels;
+        u16 max_interfaces;
+        u8 n_limits;
+        bool beacon_int_infra_match;
 };
 
 struct mac_address {
@@ -1440,6 +1637,38 @@ struct ieee80211_txrx_stypes {
 };
 
 /**
+ * enum wiphy_wowlan_support_flags - WoWLAN support flags
+ * @WIPHY_WOWLAN_ANY: supports wakeup for the special "any"
+ *      trigger that keeps the device operating as-is and
+ *      wakes up the host on any activity, for example a
+ *      received packet that passed filtering; note that the
+ *      packet should be preserved in that case
+ * @WIPHY_WOWLAN_MAGIC_PKT: supports wakeup on magic packet
+ *      (see nl80211.h)
+ * @WIPHY_WOWLAN_DISCONNECT: supports wakeup on disconnect
+ */
+enum wiphy_wowlan_support_flags {
+        WIPHY_WOWLAN_ANY        = BIT(0),
+        WIPHY_WOWLAN_MAGIC_PKT  = BIT(1),
+        WIPHY_WOWLAN_DISCONNECT = BIT(2),
+};
+
+/**
+ * struct wiphy_wowlan_support - WoWLAN support data
+ * @flags: see &enum wiphy_wowlan_support_flags
+ * @n_patterns: number of supported wakeup patterns
+ *      (see nl80211.h for the pattern definition)
+ * @pattern_max_len: maximum length of each pattern
+ * @pattern_min_len: minimum length of each pattern
+ */
+struct wiphy_wowlan_support {
+        u32 flags;
+        int n_patterns;
+        int pattern_max_len;
+        int pattern_min_len;
+};
+
+/**
  * struct wiphy - wireless hardware description
  * @reg_notifier: the driver's regulatory notification callback,
  *      note that if your driver uses wiphy_apply_custom_regulatory()
@@ -1476,6 +1705,11 @@ struct ieee80211_txrx_stypes {
  * @priv: driver private data (sized according to wiphy_new() parameter)
  * @interface_modes: bitmask of interfaces types valid for this wiphy,
  *      must be set by driver
+ * @iface_combinations: Valid interface combinations array, should not
+ *      list single interface types.
+ * @n_iface_combinations: number of entries in @iface_combinations array.
+ * @software_iftypes: bitmask of software interface types, these are not
+ *      subject to any restrictions since they are purely managed in SW.
  * @flags: wiphy flags, see &enum wiphy_flags
  * @bss_priv_size: each BSS struct has private data allocated with it,
  *      this variable determines its size
@@ -1506,6 +1740,8 @@ struct ieee80211_txrx_stypes {
  *
  * @max_remain_on_channel_duration: Maximum time a remain-on-channel operation
  *      may request, if implemented.
+ *
+ * @wowlan: WoWLAN support information
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -1518,6 +1754,10 @@ struct wiphy {
 
         const struct ieee80211_txrx_stypes *mgmt_stypes;
 
+        const struct ieee80211_iface_combination *iface_combinations;
+        int n_iface_combinations;
+        u16 software_iftypes;
+
         u16 n_addresses;
 
         /* Supported interface modes, OR together BIT(NL80211_IFTYPE_...) */
@@ -1543,6 +1783,8 @@ struct wiphy {
         char fw_version[ETHTOOL_BUSINFO_LEN];
         u32 hw_version;
 
+        struct wiphy_wowlan_support wowlan;
+
         u16 max_remain_on_channel_duration;
 
         u8 max_num_pmkids;
@@ -1726,6 +1968,8 @@ struct cfg80211_cached_keys;
  * @mgmt_registrations_lock: lock for the list
  * @mtx: mutex used to lock data in this struct
  * @cleanup_work: work struct used for cleanup that can't be done directly
+ * @beacon_interval: beacon interval used on this device for transmitting
+ *      beacons, 0 when not valid
  */
 struct wireless_dev {
         struct wiphy *wiphy;
@@ -1766,6 +2010,8 @@ struct wireless_dev {
         bool ps;
         int ps_timeout;
 
+        int beacon_interval;
+
 #ifdef CONFIG_CFG80211_WEXT
         /* wext data */
         struct {
@@ -1991,10 +2237,12 @@ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
  * @addr: The device MAC address.
  * @iftype: The device interface type.
  * @extra_headroom: The hardware extra headroom for SKBs in the @list.
+ * @has_80211_header: Set it true if SKB is with IEEE 802.11 header.
  */
 void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
                               const u8 *addr, enum nl80211_iftype iftype,
-                              const unsigned int extra_headroom);
+                              const unsigned int extra_headroom,
+                              bool has_80211_header);
 
 /**
  * cfg80211_classify8021d - determine the 802.1p/1d tag for a data frame
@@ -2214,6 +2462,24 @@ int cfg80211_wext_siwpmksa(struct net_device *dev,
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted);
 
 /**
+ * cfg80211_sched_scan_results - notify that new scan results are available
+ *
+ * @wiphy: the wiphy which got scheduled scan results
+ */
+void cfg80211_sched_scan_results(struct wiphy *wiphy);
+
+/**
+ * cfg80211_sched_scan_stopped - notify that the scheduled scan has stopped
+ *
+ * @wiphy: the wiphy on which the scheduled scan stopped
+ *
+ * The driver can call this function to inform cfg80211 that the
+ * scheduled scan had to be stopped, for whatever reason.  The driver
+ * is then called back via the sched_scan_stop operation when done.
+ */
+void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
+
+/**
  * cfg80211_inform_bss_frame - inform cfg80211 of a received BSS frame
  *
  * @wiphy: the wiphy reporting the BSS
@@ -2450,6 +2716,22 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
 
 /**
+ * cfg80211_notify_new_candidate - notify cfg80211 of a new mesh peer candidate
+ *
+ * @dev: network device
+ * @macaddr: the MAC address of the new candidate
+ * @ie: information elements advertised by the peer candidate
+ * @ie_len: lenght of the information elements buffer
+ * @gfp: allocation flags
+ *
+ * This function notifies cfg80211 that the mesh peer candidate has been
+ * detected, most likely via a beacon or, less likely, via a probe response.
+ * cfg80211 then sends a notification to userspace.
+ */
+void cfg80211_notify_new_peer_candidate(struct net_device *dev,
+                const u8 *macaddr, const u8 *ie, u8 ie_len, gfp_t gfp);
+
+/**
  * DOC: RFkill integration
  *
  * RFkill integration in cfg80211 is almost invisible to drivers,
@@ -2667,6 +2949,15 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
                       struct station_info *sinfo, gfp_t gfp);
 
 /**
+ * cfg80211_del_sta - notify userspace about deletion of a station
+ *
+ * @dev: the netdev
+ * @mac_addr: the station's address
+ * @gfp: allocation flags
+ */
+void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
+
+/**
  * cfg80211_rx_mgmt - notification of received, unprocessed management frame
  * @dev: network device
  * @freq: Frequency on which the frame was received in MHz
diff --git a/include/net/compat.h b/include/net/compat.h
index 28d5428ec6a2..9ee75edcc295 100644
--- a/include/net/compat.h
+++ b/include/net/compat.h
@@ -43,6 +43,8 @@ extern int compat_sock_get_timestampns(struct sock *, struct timespec __user *);
 extern int get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *);
 extern int verify_compat_iovec(struct msghdr *, struct iovec *, struct sockaddr *, int);
 extern asmlinkage long compat_sys_sendmsg(int,struct compat_msghdr __user *,unsigned);
+extern asmlinkage long compat_sys_sendmmsg(int, struct compat_mmsghdr __user *,
+                                           unsigned, unsigned);
 extern asmlinkage long compat_sys_recvmsg(int,struct compat_msghdr __user *,unsigned);
 extern asmlinkage long compat_sys_recvmmsg(int, struct compat_mmsghdr __user *,
                                            unsigned, unsigned,
diff --git a/include/net/dst.h b/include/net/dst.h
index 75b95df4afe7..07a0402c52e6 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -16,13 +16,6 @@
 #include <net/neighbour.h>
 #include <asm/processor.h>
 
-/*
- * 0 - no debugging messages
- * 1 - rare events and bugs (default)
- * 2 - trace mode.
- */
-#define RT_CACHE_DEBUG          0
-
 #define DST_GC_MIN      (HZ/10)
 #define DST_GC_INC      (HZ/2)
 #define DST_GC_MAX      (120*HZ)
@@ -92,8 +85,6 @@ struct dst_entry {
         };
 };
 
-#ifdef __KERNEL__
-
 extern u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
 extern const u32 dst_default_metrics[RTAX_MAX];
 
@@ -352,7 +343,8 @@ static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
 }
 
 extern int dst_discard(struct sk_buff *skb);
-extern void *dst_alloc(struct dst_ops * ops, int initial_ref);
+extern void *dst_alloc(struct dst_ops * ops, struct net_device *dev,
+                       int initial_ref, int initial_obsolete, int flags);
 extern void __dst_free(struct dst_entry * dst);
 extern struct dst_entry *dst_destroy(struct dst_entry * dst);
 
@@ -438,6 +430,5 @@ extern struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig
                                      const struct flowi *fl, struct sock *sk,
                                      int flags);
 #endif
-#endif
 
 #endif /* _NET_DST_H */
diff --git a/include/net/flow.h b/include/net/flow.h
index 7fe5a0f9483a..c6d5fe5ec1bf 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -26,8 +26,8 @@ struct flowi_common {
 
 union flowi_uli {
         struct {
-                __be16  sport;
                 __be16  dport;
+                __be16  sport;
         } ports;
 
         struct {
@@ -36,8 +36,8 @@ union flowi_uli {
         } icmpt;
 
         struct {
-                __le16  sport;
                 __le16  dport;
+                __le16  sport;
         } dnports;
 
         __be32          spi;
@@ -70,6 +70,27 @@ struct flowi4 {
 #define fl4_gre_key             uli.gre_key
 };
 
+static inline void flowi4_init_output(struct flowi4 *fl4, int oif,
+                                      __u32 mark, __u8 tos, __u8 scope,
+                                      __u8 proto, __u8 flags,
+                                      __be32 daddr, __be32 saddr,
+                                      __be16 dport, __be32 sport)
+{
+        fl4->flowi4_oif = oif;
+        fl4->flowi4_iif = 0;
+        fl4->flowi4_mark = mark;
+        fl4->flowi4_tos = tos;
+        fl4->flowi4_scope = scope;
+        fl4->flowi4_proto = proto;
+        fl4->flowi4_flags = flags;
+        fl4->flowi4_secid = 0;
+        fl4->daddr = daddr;
+        fl4->saddr = saddr;
+        fl4->fl4_dport = dport;
+        fl4->fl4_sport = sport;
+}
+                                      
+
 struct flowi6 {
         struct flowi_common     __fl_common;
 #define flowi6_oif              __fl_common.flowic_oif
diff --git a/include/net/garp.h b/include/net/garp.h
index f4c295984c45..834d8add9e5f 100644
--- a/include/net/garp.h
+++ b/include/net/garp.h
@@ -104,10 +104,12 @@ struct garp_applicant {
         struct sk_buff_head     queue;
         struct sk_buff          *pdu;
         struct rb_root          gid;
+        struct rcu_head         rcu;
 };
 
 struct garp_port {
         struct garp_applicant __rcu     *applicants[GARP_APPLICATION_MAX + 1];
+        struct rcu_head                 rcu;
 };
 
 extern int      garp_register_application(struct garp_application *app);
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index fccc2180c61b..11cf373970a9 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -30,8 +30,6 @@
 #define IF_PREFIX_ONLINK        0x01
 #define IF_PREFIX_AUTOCONF      0x02
 
-#ifdef __KERNEL__
-
 enum {
         INET6_IFADDR_STATE_DAD,
         INET6_IFADDR_STATE_POSTDAD,
@@ -156,8 +154,8 @@ struct ifacaddr6 {
 struct ipv6_devstat {
         struct proc_dir_entry   *proc_dir_entry;
         DEFINE_SNMP_STAT(struct ipstats_mib, ipv6);
-        DEFINE_SNMP_STAT(struct icmpv6_mib, icmpv6);
-        DEFINE_SNMP_STAT(struct icmpv6msg_mib, icmpv6msg);
+        DEFINE_SNMP_STAT_ATOMIC(struct icmpv6_mib_device, icmpv6dev);
+        DEFINE_SNMP_STAT_ATOMIC(struct icmpv6msg_mib_device, icmpv6msgdev);
 };
 
 struct inet6_dev {
@@ -196,7 +194,7 @@ struct inet6_dev {
         struct rcu_head         rcu;
 };
 
-static inline void ipv6_eth_mc_map(struct in6_addr *addr, char *buf)
+static inline void ipv6_eth_mc_map(const struct in6_addr *addr, char *buf)
 {
         /*
          *      +-------+-------+-------+-------+-------+-------+
@@ -210,7 +208,7 @@ static inline void ipv6_eth_mc_map(struct in6_addr *addr, char *buf)
         memcpy(buf + 2, &addr->s6_addr32[3], sizeof(__u32));
 }
 
-static inline void ipv6_tr_mc_map(struct in6_addr *addr, char *buf)
+static inline void ipv6_tr_mc_map(const struct in6_addr *addr, char *buf)
 {
         /* All nodes FF01::1, FF02::1, FF02::1:FFxx:xxxx */
 
@@ -303,4 +301,3 @@ static inline int ipv6_ipgre_mc_map(const struct in6_addr *addr,
 }
 
 #endif
-#endif
diff --git a/include/net/inet6_connection_sock.h b/include/net/inet6_connection_sock.h
index ff013505236b..3207e58ee019 100644
--- a/include/net/inet6_connection_sock.h
+++ b/include/net/inet6_connection_sock.h
@@ -41,5 +41,5 @@ extern void inet6_csk_reqsk_queue_hash_add(struct sock *sk,
 
 extern void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr);
 
-extern int inet6_csk_xmit(struct sk_buff *skb);
+extern int inet6_csk_xmit(struct sk_buff *skb, struct flowi *fl);
 #endif /* _INET6_CONNECTION_SOCK_H */
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 6ac4e3b5007f..e6db62e756dc 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -36,7 +36,7 @@ struct tcp_congestion_ops;
  * (i.e. things that depend on the address family)
  */
 struct inet_connection_sock_af_ops {
-        int         (*queue_xmit)(struct sk_buff *skb);
+        int         (*queue_xmit)(struct sk_buff *skb, struct flowi *fl);
         void        (*send_check)(struct sock *sk, struct sk_buff *skb);
         int         (*rebuild_header)(struct sock *sk);
         int         (*conn_request)(struct sock *sk, struct sk_buff *skb);
@@ -249,7 +249,11 @@ extern int inet_csk_bind_conflict(const struct sock *sk,
 extern int inet_csk_get_port(struct sock *sk, unsigned short snum);
 
 extern struct dst_entry* inet_csk_route_req(struct sock *sk,
+                                            struct flowi4 *fl4,
                                             const struct request_sock *req);
+extern struct dst_entry* inet_csk_route_child_sock(struct sock *sk,
+                                                   struct sock *newsk,
+                                                   const struct request_sock *req);
 
 static inline void inet_csk_reqsk_queue_add(struct sock *sk,
                                             struct request_sock *req,
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 7a37369f8ea3..caaff5f5f39f 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -57,7 +57,15 @@ struct ip_options {
         unsigned char   __data[0];
 };
 
-#define optlength(opt) (sizeof(struct ip_options) + opt->optlen)
+struct ip_options_rcu {
+        struct rcu_head rcu;
+        struct ip_options opt;
+};
+
+struct ip_options_data {
+        struct ip_options_rcu   opt;
+        char                    data[40];
+};
 
 struct inet_request_sock {
         struct request_sock     req;
@@ -78,7 +86,7 @@ struct inet_request_sock {
                                 acked      : 1,
                                 no_srccheck: 1;
         kmemcheck_bitfield_end(flags);
-        struct ip_options       *opt;
+        struct ip_options_rcu   *opt;
 };
 
 static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk)
@@ -88,17 +96,21 @@ static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk)
 
 struct inet_cork {
         unsigned int            flags;
-        unsigned int            fragsize;
+        __be32                  addr;
         struct ip_options       *opt;
+        unsigned int            fragsize;
         struct dst_entry        *dst;
         int                     length; /* Total length of all frames */
-        __be32                  addr;
-        struct flowi            fl;
         struct page             *page;
         u32                     off;
         u8                      tx_flags;
 };
 
+struct inet_cork_full {
+        struct inet_cork        base;
+        struct flowi            fl;
+};
+
 struct ip_mc_socklist;
 struct ipv6_pinfo;
 struct rtable;
@@ -140,7 +152,7 @@ struct inet_sock {
         __be16                  inet_sport;
         __u16                   inet_id;
 
-        struct ip_options       *opt;
+        struct ip_options_rcu __rcu     *inet_opt;
         __u8                    tos;
         __u8                    min_ttl;
         __u8                    mc_ttl;
@@ -156,7 +168,7 @@ struct inet_sock {
         int                     mc_index;
         __be32                  mc_addr;
         struct ip_mc_socklist __rcu     *mc_list;
-        struct inet_cork        cork;
+        struct inet_cork_full   cork;
 };
 
 #define IPCORK_OPT      1       /* ip-options has been held in ipcork.opt */
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index e6dd8da6b2ad..8a159cc3d68b 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -80,7 +80,7 @@ static inline struct inet_peer *inet_getpeer_v4(__be32 v4daddr, int create)
         return inet_getpeer(&daddr, create);
 }
 
-static inline struct inet_peer *inet_getpeer_v6(struct in6_addr *v6daddr, int create)
+static inline struct inet_peer *inet_getpeer_v6(const struct in6_addr *v6daddr, int create)
 {
         struct inetpeer_addr daddr;
 
diff --git a/include/net/ip.h b/include/net/ip.h
index 7c416583b710..66dd49149208 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -52,7 +52,7 @@ static inline unsigned int ip_hdrlen(const struct sk_buff *skb)
 struct ipcm_cookie {
         __be32                  addr;
         int                     oif;
-        struct ip_options       *opt;
+        struct ip_options_rcu   *opt;
         __u8                    tx_flags;
 };
 
@@ -92,7 +92,7 @@ extern int		igmp_mc_proc_init(void);
 
 extern int              ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
                                               __be32 saddr, __be32 daddr,
-                                              struct ip_options *opt);
+                                              struct ip_options_rcu *opt);
 extern int              ip_rcv(struct sk_buff *skb, struct net_device *dev,
                                struct packet_type *pt, struct net_device *orig_dev);
 extern int              ip_local_deliver(struct sk_buff *skb);
@@ -104,9 +104,9 @@ extern int		ip_do_nat(struct sk_buff *skb);
 extern void             ip_send_check(struct iphdr *ip);
 extern int              __ip_local_out(struct sk_buff *skb);
 extern int              ip_local_out(struct sk_buff *skb);
-extern int              ip_queue_xmit(struct sk_buff *skb);
+extern int              ip_queue_xmit(struct sk_buff *skb, struct flowi *fl);
 extern void             ip_init(void);
-extern int              ip_append_data(struct sock *sk,
+extern int              ip_append_data(struct sock *sk, struct flowi4 *fl4,
                                        int getfrag(void *from, char *to, int offset, int len,
                                                    int odd, struct sk_buff *skb),
                                 void *from, int len, int protolen,
@@ -114,15 +114,17 @@ extern int		ip_append_data(struct sock *sk,
                                 struct rtable **rt,
                                 unsigned int flags);
 extern int              ip_generic_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb);
-extern ssize_t          ip_append_page(struct sock *sk, struct page *page,
+extern ssize_t          ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                                 int offset, size_t size, int flags);
 extern struct sk_buff  *__ip_make_skb(struct sock *sk,
+                                      struct flowi4 *fl4,
                                       struct sk_buff_head *queue,
                                       struct inet_cork *cork);
 extern int              ip_send_skb(struct sk_buff *skb);
-extern int              ip_push_pending_frames(struct sock *sk);
+extern int              ip_push_pending_frames(struct sock *sk, struct flowi4 *fl4);
 extern void             ip_flush_pending_frames(struct sock *sk);
 extern struct sk_buff  *ip_make_skb(struct sock *sk,
+                                    struct flowi4 *fl4,
                                     int getfrag(void *from, char *to, int offset, int len,
                                                 int odd, struct sk_buff *skb),
                                     void *from, int length, int transhdrlen,
@@ -130,9 +132,9 @@ extern struct sk_buff  *ip_make_skb(struct sock *sk,
                                     struct rtable **rtp,
                                     unsigned int flags);
 
-static inline struct sk_buff *ip_finish_skb(struct sock *sk)
+static inline struct sk_buff *ip_finish_skb(struct sock *sk, struct flowi4 *fl4)
 {
-        return __ip_make_skb(sk, &sk->sk_write_queue, &inet_sk(sk)->cork);
+        return __ip_make_skb(sk, fl4, &sk->sk_write_queue, &inet_sk(sk)->cork.base);
 }
 
 /* datagram.c */
@@ -172,8 +174,8 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
         return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
 }
 
-void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *arg,
-                   unsigned int len); 
+void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
+                   struct ip_reply_arg *arg, unsigned int len);
 
 struct ipv4_config {
         int     log_martians;
@@ -416,14 +418,15 @@ extern int ip_forward(struct sk_buff *skb);
  *      Functions provided by ip_options.c
  */
  
-extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt, __be32 daddr, struct rtable *rt, int is_frag);
+extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
+                             __be32 daddr, struct rtable *rt, int is_frag);
 extern int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb);
 extern void ip_options_fragment(struct sk_buff *skb);
 extern int ip_options_compile(struct net *net,
                               struct ip_options *opt, struct sk_buff *skb);
-extern int ip_options_get(struct net *net, struct ip_options **optp,
+extern int ip_options_get(struct net *net, struct ip_options_rcu **optp,
                           unsigned char *data, int optlen);
-extern int ip_options_get_from_user(struct net *net, struct ip_options **optp,
+extern int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
                                     unsigned char __user *data, int optlen);
 extern void ip_options_undo(struct ip_options * opt);
 extern void ip_forward_options(struct sk_buff *skb);
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index bc3cde0a810c..477ef75f3873 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -13,8 +13,6 @@
 #ifndef _IP6_FIB_H
 #define _IP6_FIB_H
 
-#ifdef __KERNEL__
-
 #include <linux/ipv6_route.h>
 #include <linux/rtnetlink.h>
 #include <linux/spinlock.h>
@@ -42,6 +40,7 @@ struct fib6_config {
 
         struct in6_addr fc_dst;
         struct in6_addr fc_src;
+        struct in6_addr fc_prefsrc;
         struct in6_addr fc_gateway;
 
         unsigned long   fc_expires;
@@ -107,6 +106,7 @@ struct rt6_info {
         struct rt6key                   rt6i_dst ____cacheline_aligned_in_smp;
         u32                             rt6i_flags;
         struct rt6key                   rt6i_src;
+        struct rt6key                   rt6i_prefsrc;
         u32                             rt6i_metric;
         u32                             rt6i_peer_genid;
 
@@ -196,12 +196,12 @@ extern struct dst_entry         *fib6_rule_lookup(struct net *net,
                                                   pol_lookup_t lookup);
 
 extern struct fib6_node         *fib6_lookup(struct fib6_node *root,
-                                             struct in6_addr *daddr,
-                                             struct in6_addr *saddr);
+                                             const struct in6_addr *daddr,
+                                             const struct in6_addr *saddr);
 
 struct fib6_node                *fib6_locate(struct fib6_node *root,
-                                             struct in6_addr *daddr, int dst_len,
-                                             struct in6_addr *saddr, int src_len);
+                                             const struct in6_addr *daddr, int dst_len,
+                                             const struct in6_addr *saddr, int src_len);
 
 extern void                     fib6_clean_all(struct net *net,
                                                int (*func)(struct rt6_info *, void *arg),
@@ -238,4 +238,3 @@ static inline void              fib6_rules_cleanup(void)
 }
 #endif
 #endif
-#endif
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index c850e5fb967c..5e91b72fc718 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -21,8 +21,6 @@ struct route_info {
         __u8                    prefix[0];      /* 0,8 or 16 */
 };
 
-#ifdef __KERNEL__
-
 #include <net/flow.h>
 #include <net/ip6_fib.h>
 #include <net/sock.h>
@@ -84,6 +82,12 @@ extern int			ip6_route_add(struct fib6_config *cfg);
 extern int                      ip6_ins_rt(struct rt6_info *);
 extern int                      ip6_del_rt(struct rt6_info *);
 
+extern int                      ip6_route_get_saddr(struct net *net,
+                                                    struct rt6_info *rt,
+                                                    const struct in6_addr *daddr,
+                                                    unsigned int prefs,
+                                                    struct in6_addr *saddr);
+
 extern struct rt6_info          *rt6_lookup(struct net *net,
                                             const struct in6_addr *daddr,
                                             const struct in6_addr *saddr,
@@ -106,9 +110,9 @@ extern int			ip6_dst_hoplimit(struct dst_entry *dst);
  *      support functions for ND
  *
  */
-extern struct rt6_info *        rt6_get_dflt_router(struct in6_addr *addr,
+extern struct rt6_info *        rt6_get_dflt_router(const struct in6_addr *addr,
                                                     struct net_device *dev);
-extern struct rt6_info *        rt6_add_dflt_router(struct in6_addr *gwaddr,
+extern struct rt6_info *        rt6_add_dflt_router(const struct in6_addr *gwaddr,
                                                     struct net_device *dev,
                                                     unsigned int pref);
 
@@ -116,17 +120,17 @@ extern void			rt6_purge_dflt_routers(struct net *net);
 
 extern int                      rt6_route_rcv(struct net_device *dev,
                                               u8 *opt, int len,
-                                              struct in6_addr *gwaddr);
+                                              const struct in6_addr *gwaddr);
 
-extern void                     rt6_redirect(struct in6_addr *dest,
-                                             struct in6_addr *src,
-                                             struct in6_addr *saddr,
+extern void                     rt6_redirect(const struct in6_addr *dest,
+                                             const struct in6_addr *src,
+                                             const struct in6_addr *saddr,
                                              struct neighbour *neigh,
                                              u8 *lladdr,
                                              int on_link);
 
-extern void                     rt6_pmtu_discovery(struct in6_addr *daddr,
-                                                   struct in6_addr *saddr,
+extern void                     rt6_pmtu_discovery(const struct in6_addr *daddr,
+                                                   const struct in6_addr *saddr,
                                                    struct net_device *dev,
                                                    u32 pmtu);
 
@@ -141,6 +145,7 @@ struct rt6_rtnl_dump_arg {
 extern int rt6_dump_route(struct rt6_info *rt, void *p_arg);
 extern void rt6_ifdown(struct net *net, struct net_device *dev);
 extern void rt6_mtu_change(struct net_device *dev, unsigned mtu);
+extern void rt6_remove_prefsrc(struct inet6_ifaddr *ifp);
 
 
 /*
@@ -186,4 +191,3 @@ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
 }
 
 #endif
-#endif
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index e5d66ec88cf6..10422ef14e28 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -160,7 +160,8 @@ struct fib_table {
         struct hlist_node tb_hlist;
         u32             tb_id;
         int             tb_default;
-        unsigned char   tb_data[0];
+        int             tb_num_default;
+        unsigned long   tb_data[0];
 };
 
 extern int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp,
@@ -227,9 +228,9 @@ extern struct fib_table *fib_get_table(struct net *net, u32 id);
 /* Exported by fib_frontend.c */
 extern const struct nla_policy rtm_ipv4_policy[];
 extern void             ip_fib_init(void);
-extern int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
-                               struct net_device *dev, __be32 *spec_dst,
-                               u32 *itag, u32 mark);
+extern int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
+                               u8 tos, int oif, struct net_device *dev,
+                               __be32 *spec_dst, u32 *itag);
 extern void fib_select_default(struct fib_result *res);
 
 /* Exported by fib_semantics.c */
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 86aefed6140b..4fff432aeade 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -8,9 +8,6 @@
 
 #include <linux/ip_vs.h>                /* definitions shared with userland */
 
-/* old ipvsadm versions still include this file directly */
-#ifdef __KERNEL__
-
 #include <asm/types.h>                  /* for __uXX types */
 
 #include <linux/sysctl.h>               /* for ctl_path */
@@ -668,9 +665,7 @@ struct ip_vs_dest {
         struct dst_entry        *dst_cache;     /* destination cache entry */
         u32                     dst_rtos;       /* RT_TOS(tos) for dst */
         u32                     dst_cookie;
-#ifdef CONFIG_IP_VS_IPV6
-        struct in6_addr         dst_saddr;
-#endif
+        union nf_inet_addr      dst_saddr;
 
         /* for virtual service */
         struct ip_vs_service    *svc;           /* service it belongs to */
@@ -1256,7 +1251,8 @@ extern int ip_vs_tunnel_xmit
 extern int ip_vs_dr_xmit
 (struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
 extern int ip_vs_icmp_xmit
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp, int offset);
+(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,
+ int offset, unsigned int hooknum);
 extern void ip_vs_dst_reset(struct ip_vs_dest *dest);
 
 #ifdef CONFIG_IP_VS_IPV6
@@ -1270,7 +1266,7 @@ extern int ip_vs_dr_xmit_v6
 (struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
 extern int ip_vs_icmp_xmit_v6
 (struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,
- int offset);
+ int offset, unsigned int hooknum);
 #endif
 
 #ifdef CONFIG_SYSCTL
@@ -1432,6 +1428,4 @@ ip_vs_dest_conn_overhead(struct ip_vs_dest *dest)
                 atomic_read(&dest->inactconns);
 }
 
-#endif /* __KERNEL__ */
-
 #endif  /* _NET_IP_VS_H */
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 34200f9e6805..c033ed00df7d 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -77,11 +77,9 @@
 /*
  *      Addr scopes
  */
-#ifdef __KERNEL__
 #define IPV6_ADDR_MC_SCOPE(a)   \
         ((a)->s6_addr[1] & 0x0f)        /* nonstandard */
 #define __IPV6_ADDR_SCOPE_INVALID       -1
-#endif
 #define IPV6_ADDR_SCOPE_NODELOCAL       0x01
 #define IPV6_ADDR_SCOPE_LINKLOCAL       0x02
 #define IPV6_ADDR_SCOPE_SITELOCAL       0x05
@@ -91,14 +89,12 @@
 /*
  *      Addr flags
  */
-#ifdef __KERNEL__
 #define IPV6_ADDR_MC_FLAG_TRANSIENT(a)  \
         ((a)->s6_addr[1] & 0x10)
 #define IPV6_ADDR_MC_FLAG_PREFIX(a)     \
         ((a)->s6_addr[1] & 0x20)
 #define IPV6_ADDR_MC_FLAG_RENDEZVOUS(a) \
         ((a)->s6_addr[1] & 0x40)
-#endif
 
 /*
  *      fragmentation header
@@ -113,8 +109,6 @@ struct frag_hdr {
 
 #define IP6_MF  0x0001
 
-#ifdef __KERNEL__
-
 #include <net/sock.h>
 
 /* sysctls */
@@ -129,6 +123,15 @@ extern struct ctl_path net_ipv6_ctl_path[];
         SNMP_INC_STATS##modifier((net)->mib.statname##_statistics, (field));\
 })
 
+/* per device counters are atomic_long_t */
+#define _DEVINCATOMIC(net, statname, modifier, idev, field)             \
+({                                                                      \
+        struct inet6_dev *_idev = (idev);                               \
+        if (likely(_idev != NULL))                                      \
+                SNMP_INC_STATS_ATOMIC_LONG((_idev)->stats.statname##dev, (field)); \
+        SNMP_INC_STATS##modifier((net)->mib.statname##_statistics, (field));\
+})
+
 #define _DEVADD(net, statname, modifier, idev, field, val)              \
 ({                                                                      \
         struct inet6_dev *_idev = (idev);                               \
@@ -160,16 +163,16 @@ extern struct ctl_path net_ipv6_ctl_path[];
 #define IP6_UPD_PO_STATS_BH(net, idev,field,val)   \
                 _DEVUPD(net, ipv6, 64_BH, idev, field, val)
 #define ICMP6_INC_STATS(net, idev, field)       \
-                _DEVINC(net, icmpv6, , idev, field)
+                _DEVINCATOMIC(net, icmpv6, , idev, field)
 #define ICMP6_INC_STATS_BH(net, idev, field)    \
-                _DEVINC(net, icmpv6, _BH, idev, field)
+                _DEVINCATOMIC(net, icmpv6, _BH, idev, field)
 
 #define ICMP6MSGOUT_INC_STATS(net, idev, field)         \
-        _DEVINC(net, icmpv6msg, , idev, field +256)
+        _DEVINCATOMIC(net, icmpv6msg, , idev, field +256)
 #define ICMP6MSGOUT_INC_STATS_BH(net, idev, field)      \
-        _DEVINC(net, icmpv6msg, _BH, idev, field +256)
+        _DEVINCATOMIC(net, icmpv6msg, _BH, idev, field +256)
 #define ICMP6MSGIN_INC_STATS_BH(net, idev, field)       \
-        _DEVINC(net, icmpv6msg, _BH, idev, field)
+        _DEVINCATOMIC(net, icmpv6msg, _BH, idev, field)
 
 struct ip6_ra_chain {
         struct ip6_ra_chain     *next;
@@ -376,8 +379,8 @@ enum ip6_defrag_users {
 struct ip6_create_arg {
         __be32 id;
         u32 user;
-        struct in6_addr *src;
-        struct in6_addr *dst;
+        const struct in6_addr *src;
+        const struct in6_addr *dst;
 };
 
 void ip6_frag_init(struct inet_frag_queue *q, void *a);
@@ -667,5 +670,4 @@ extern int ipv6_static_sysctl_register(void);
 extern void ipv6_static_sysctl_unregister(void);
 #endif
 
-#endif /* __KERNEL__ */
 #endif /* _NET_IPV6_H */
diff --git a/include/net/ipx.h b/include/net/ipx.h
index 05d7e4a88b49..c1fec6b464cc 100644
--- a/include/net/ipx.h
+++ b/include/net/ipx.h
@@ -80,7 +80,6 @@ struct ipx_route {
         atomic_t                refcnt;
 };
 
-#ifdef __KERNEL__
 struct ipx_cb {
         u8      ipx_tctrl;
         __be32  ipx_dest_net;
@@ -116,7 +115,6 @@ static inline struct ipx_sock *ipx_sk(struct sock *sk)
 }
 
 #define IPX_SKB_CB(__skb) ((struct ipx_cb *)&((__skb)->cb[0]))
-#endif
 
 #define IPX_MIN_EPHEMERAL_SOCKET        0x4000
 #define IPX_MAX_EPHEMERAL_SOCKET        0x7fff
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 025d4cc7bbf8..8c7189c3f6ed 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -537,6 +537,21 @@ struct ieee80211_tx_info {
         };
 };
 
+/**
+ * ieee80211_sched_scan_ies - scheduled scan IEs
+ *
+ * This structure is used to pass the appropriate IEs to be used in scheduled
+ * scans for all bands.  It contains both the IEs passed from the userspace
+ * and the ones generated by mac80211.
+ *
+ * @ie: array with the IEs for each supported band
+ * @len: array with the total length of the IEs for each band
+ */
+struct ieee80211_sched_scan_ies {
+        u8 *ie[IEEE80211_NUM_BANDS];
+        size_t len[IEEE80211_NUM_BANDS];
+};
+
 static inline struct ieee80211_tx_info *IEEE80211_SKB_CB(struct sk_buff *skb)
 {
         return (struct ieee80211_tx_info *)skb->cb;
@@ -1606,6 +1621,18 @@ enum ieee80211_ampdu_mlme_action {
  *      you should ensure to cancel it on this callback.
  *      Must be implemented and can sleep.
  *
+ * @suspend: Suspend the device; mac80211 itself will quiesce before and
+ *      stop transmitting and doing any other configuration, and then
+ *      ask the device to suspend. This is only invoked when WoWLAN is
+ *      configured, otherwise the device is deconfigured completely and
+ *      reconfigured at resume time.
+ *
+ * @resume: If WoWLAN was configured, this indicates that mac80211 is
+ *      now resuming its operation, after this the device must be fully
+ *      functional again. If this returns an error, the only way out is
+ *      to also unregister the device. If it returns 1, then mac80211
+ *      will also go through the regular complete restart on resume.
+ *
  * @add_interface: Called when a netdevice attached to the hardware is
  *      enabled. Because it is not called for monitor mode devices, @start
  *      and @stop must be implemented.
@@ -1681,6 +1708,13 @@ enum ieee80211_ampdu_mlme_action {
  *      any error unless this callback returned a negative error code.
  *      The callback can sleep.
  *
+ * @sched_scan_start: Ask the hardware to start scanning repeatedly at
+ *      specific intervals.  The driver must call the
+ *      ieee80211_sched_scan_results() function whenever it finds results.
+ *      This process will continue until sched_scan_stop is called.
+ *
+ * @sched_scan_stop: Tell the hardware to stop an ongoing scheduled scan.
+ *
  * @sw_scan_start: Notifier function that is called just before a software scan
  *      is started. Can be NULL, if the driver doesn't need this notification.
  *      The callback can sleep.
@@ -1819,11 +1853,22 @@ enum ieee80211_ampdu_mlme_action {
  * @set_ringparam: Set tx and rx ring sizes.
  *
  * @get_ringparam: Get tx and rx ring current and maximum sizes.
+ *
+ * @tx_frames_pending: Check if there is any pending frame in the hardware
+ *      queues before entering power save.
+ *
+ * @set_bitrate_mask: Set a mask of rates to be used for rate control selection
+ *      when transmitting a frame. Currently only legacy rates are handled.
+ *      The callback can sleep.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
         int (*start)(struct ieee80211_hw *hw);
         void (*stop)(struct ieee80211_hw *hw);
+#ifdef CONFIG_PM
+        int (*suspend)(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan);
+        int (*resume)(struct ieee80211_hw *hw);
+#endif
         int (*add_interface)(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif);
         int (*change_interface)(struct ieee80211_hw *hw,
@@ -1854,6 +1899,12 @@ struct ieee80211_ops {
                                 u32 iv32, u16 *phase1key);
         int (*hw_scan)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct cfg80211_scan_request *req);
+        int (*sched_scan_start)(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct cfg80211_sched_scan_request *req,
+                                struct ieee80211_sched_scan_ies *ies);
+        void (*sched_scan_stop)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif);
         void (*sw_scan_start)(struct ieee80211_hw *hw);
         void (*sw_scan_complete)(struct ieee80211_hw *hw);
         int (*get_stats)(struct ieee80211_hw *hw,
@@ -1906,6 +1957,9 @@ struct ieee80211_ops {
         int (*set_ringparam)(struct ieee80211_hw *hw, u32 tx, u32 rx);
         void (*get_ringparam)(struct ieee80211_hw *hw,
                               u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max);
+        bool (*tx_frames_pending)(struct ieee80211_hw *hw);
+        int (*set_bitrate_mask)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                                const struct cfg80211_bitrate_mask *mask);
 };
 
 /**
@@ -2223,6 +2277,18 @@ static inline int ieee80211_sta_ps_transition_ni(struct ieee80211_sta *sta,
 #define IEEE80211_TX_STATUS_HEADROOM    13
 
 /**
+ * ieee80211_sta_set_tim - set the TIM bit for a sleeping station
+ *
+ * If a driver buffers frames for a powersave station instead of passing
+ * them back to mac80211 for retransmission, the station needs to be told
+ * to wake up using the TIM bitmap in the beacon.
+ *
+ * This function sets the station's TIM bit - it will be cleared when the
+ * station wakes up.
+ */
+void ieee80211_sta_set_tim(struct ieee80211_sta *sta);
+
+/**
  * ieee80211_tx_status - transmit status callback
  *
  * Call this function for all transmitted frames after they have been
@@ -2276,6 +2342,17 @@ void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
                                  struct sk_buff *skb);
 
 /**
+ * ieee80211_report_low_ack - report non-responding station
+ *
+ * When operating in AP-mode, call this function to report a non-responding
+ * connected STA.
+ *
+ * @sta: the non-responding connected sta
+ * @num_packets: number of packets sent to @sta without a response
+ */
+void ieee80211_report_low_ack(struct ieee80211_sta *sta, u32 num_packets);
+
+/**
  * ieee80211_beacon_get_tim - beacon generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
@@ -2545,6 +2622,28 @@ void ieee80211_wake_queues(struct ieee80211_hw *hw);
 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted);
 
 /**
+ * ieee80211_sched_scan_results - got results from scheduled scan
+ *
+ * When a scheduled scan is running, this function needs to be called by the
+ * driver whenever there are new scan results available.
+ *
+ * @hw: the hardware that is performing scheduled scans
+ */
+void ieee80211_sched_scan_results(struct ieee80211_hw *hw);
+
+/**
+ * ieee80211_sched_scan_stopped - inform that the scheduled scan has stopped
+ *
+ * When a scheduled scan is running, this function can be called by
+ * the driver if it needs to stop the scan to perform another task.
+ * Usual scenarios are drivers that cannot continue the scheduled scan
+ * while associating, for instance.
+ *
+ * @hw: the hardware that is performing scheduled scans
+ */
+void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw);
+
+/**
  * ieee80211_iterate_active_interfaces - iterate active interfaces
  *
  * This function iterates over the interfaces associated with a given
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index e0e594f8e9d9..62beeb97c4b1 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -42,8 +42,6 @@ enum {
 #define ND_REACHABLE_TIME               (30*HZ)
 #define ND_RETRANS_TIMER                HZ
 
-#ifdef __KERNEL__
-
 #include <linux/compiler.h>
 #include <linux/icmpv6.h>
 #include <linux/in6.h>
@@ -102,7 +100,8 @@ extern void			ndisc_send_redirect(struct sk_buff *skb,
                                                     struct neighbour *neigh,
                                                     const struct in6_addr *target);
 
-extern int                      ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int dir);
+extern int                      ndisc_mc_map(const struct in6_addr *addr, char *buf,
+                                             struct net_device *dev, int dir);
 
 extern struct sk_buff           *ndisc_build_skb(struct net_device *dev,
                                                  const struct in6_addr *daddr,
@@ -155,8 +154,4 @@ static inline struct neighbour * ndisc_get_neigh(struct net_device *dev, const s
         return ERR_PTR(-ENODEV);
 }
 
-
-#endif /* __KERNEL__ */
-
-
 #endif
diff --git a/include/net/netevent.h b/include/net/netevent.h
index 22b239c17eaa..086f8a5b59dc 100644
--- a/include/net/netevent.h
+++ b/include/net/netevent.h
@@ -10,7 +10,6 @@
  *
  *      Changes:
  */
-#ifdef __KERNEL__
 
 struct dst_entry;
 
@@ -29,4 +28,3 @@ extern int unregister_netevent_notifier(struct notifier_block *nb);
 extern int call_netevent_notifiers(unsigned long val, void *v);
 
 #endif
-#endif
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index d0d13378991e..c7c42e7acc31 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -14,7 +14,6 @@
 
 #include <linux/netfilter/nf_conntrack_common.h>
 
-#ifdef __KERNEL__
 #include <linux/bitops.h>
 #include <linux/compiler.h>
 #include <asm/atomic.h>
@@ -326,5 +325,4 @@ do {							\
 #define MODULE_ALIAS_NFCT_HELPER(helper) \
         MODULE_ALIAS("nfct-helper-" helper)
 
-#endif /* __KERNEL__ */
 #endif /* _NF_CONNTRACK_H */
diff --git a/include/net/netfilter/nf_conntrack_tuple.h b/include/net/netfilter/nf_conntrack_tuple.h
index 4ee44c84a304..7ca6bdd5bae6 100644
--- a/include/net/netfilter/nf_conntrack_tuple.h
+++ b/include/net/netfilter/nf_conntrack_tuple.h
@@ -104,8 +104,6 @@ struct nf_conntrack_tuple_mask {
         } src;
 };
 
-#ifdef __KERNEL__
-
 static inline void nf_ct_dump_tuple_ip(const struct nf_conntrack_tuple *t)
 {
 #ifdef DEBUG
@@ -148,8 +146,6 @@ struct nf_conntrack_tuple_hash {
         struct nf_conntrack_tuple tuple;
 };
 
-#endif /* __KERNEL__ */
-
 static inline bool __nf_ct_tuple_src_equal(const struct nf_conntrack_tuple *t1,
                                            const struct nf_conntrack_tuple *t2)
 { 
diff --git a/include/net/netfilter/nf_nat.h b/include/net/netfilter/nf_nat.h
index aff80b190c12..0346b0070864 100644
--- a/include/net/netfilter/nf_nat.h
+++ b/include/net/netfilter/nf_nat.h
@@ -48,7 +48,6 @@ struct nf_nat_multi_range_compat {
         struct nf_nat_range range[1];
 };
 
-#ifdef __KERNEL__
 #include <linux/list.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 #include <net/netfilter/nf_conntrack_extend.h>
@@ -93,7 +92,4 @@ static inline struct nf_conn_nat *nfct_nat(const struct nf_conn *ct)
 #endif
 }
 
-#else  /* !__KERNEL__: iptables wants this to compile. */
-#define nf_nat_multi_range nf_nat_multi_range_compat
-#endif /*__KERNEL__*/
 #endif
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 542195d9469e..d786b4fc02a4 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -54,6 +54,8 @@ struct netns_ipv4 {
         int sysctl_rt_cache_rebuild_count;
         int current_rt_cache_rebuild_count;
 
+        unsigned int sysctl_ping_group_range[2];
+
         atomic_t rt_genid;
         atomic_t dev_addr_genid;
 
diff --git a/include/net/phonet/pn_dev.h b/include/net/phonet/pn_dev.h
index 13649eb57413..8639de5750f6 100644
--- a/include/net/phonet/pn_dev.h
+++ b/include/net/phonet/pn_dev.h
@@ -51,7 +51,7 @@ void phonet_address_notify(int event, struct net_device *dev, u8 addr);
 int phonet_route_add(struct net_device *dev, u8 daddr);
 int phonet_route_del(struct net_device *dev, u8 daddr);
 void rtm_phonet_notify(int event, struct net_device *dev, u8 dst);
-struct net_device *phonet_route_get(struct net *net, u8 daddr);
+struct net_device *phonet_route_get_rcu(struct net *net, u8 daddr);
 struct net_device *phonet_route_output(struct net *net, u8 daddr);
 
 #define PN_NO_ADDR      0xff
diff --git a/include/net/ping.h b/include/net/ping.h
new file mode 100644
index 000000000000..682b5ae9af51
--- /dev/null
+++ b/include/net/ping.h
@@ -0,0 +1,55 @@
+/*
+ * INET         An implementation of the TCP/IP protocol suite for the LINUX
+ *              operating system.  INET is implemented using the  BSD Socket
+ *              interface as the means of communication with the user level.
+ *
+ *              Definitions for the "ping" module.
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ */
+#ifndef _PING_H
+#define _PING_H
+
+#include <net/netns/hash.h>
+
+/* PING_HTABLE_SIZE must be power of 2 */
+#define PING_HTABLE_SIZE        64
+#define PING_HTABLE_MASK        (PING_HTABLE_SIZE-1)
+
+#define ping_portaddr_for_each_entry(__sk, node, list) \
+        hlist_nulls_for_each_entry(__sk, node, list, sk_nulls_node)
+
+/*
+ * gid_t is either uint or ushort.  We want to pass it to
+ * proc_dointvec_minmax(), so it must not be larger than MAX_INT
+ */
+#define GID_T_MAX (((gid_t)~0U) >> 1)
+
+struct ping_table {
+        struct hlist_nulls_head hash[PING_HTABLE_SIZE];
+        rwlock_t                lock;
+};
+
+struct ping_iter_state {
+        struct seq_net_private  p;
+        int                     bucket;
+};
+
+extern struct proto ping_prot;
+
+
+extern void ping_rcv(struct sk_buff *);
+extern void ping_err(struct sk_buff *, u32 info);
+
+#ifdef CONFIG_PROC_FS
+extern int __init ping_proc_init(void);
+extern void ping_proc_exit(void);
+#endif
+
+void __init ping_init(void);
+
+
+#endif /* _PING_H */
diff --git a/include/net/rawv6.h b/include/net/rawv6.h
index f6b9b830df8c..cf7577234457 100644
--- a/include/net/rawv6.h
+++ b/include/net/rawv6.h
@@ -1,8 +1,6 @@
 #ifndef _NET_RAWV6_H
 #define _NET_RAWV6_H
 
-#ifdef __KERNEL__
-
 #include <net/protocol.h>
 
 void raw6_icmp_error(struct sk_buff *, int nexthdr,
@@ -20,5 +18,3 @@ int rawv6_mh_filter_unregister(int (*filter)(struct sock *sock,
 #endif
 
 #endif
-
-#endif
diff --git a/include/net/route.h b/include/net/route.h
index 8fce0621cad1..db7b3432f07c 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -35,16 +35,8 @@
 #include <linux/cache.h>
 #include <linux/security.h>
 
-#ifndef __KERNEL__
-#warning This file is not supposed to be used outside of kernel.
-#endif
-
 #define RTO_ONLINK      0x01
 
-#define RTO_CONN        0
-/* RTO_CONN is not used (being alias for 0), but preserved not to break
- * some modules referring to it. */
-
 #define RT_CONN_FLAGS(sk)   (RT_TOS(inet_sk(sk)->tos) | sock_flag(sk, SOCK_LOCALROUTE))
 
 struct fib_nh;
@@ -60,7 +52,7 @@ struct rtable {
         int                     rt_genid;
         unsigned                rt_flags;
         __u16                   rt_type;
-        __u8                    rt_tos;
+        __u8                    rt_key_tos;
 
         __be32                  rt_dst; /* Path destination     */
         __be32                  rt_src; /* Path source          */
@@ -123,7 +115,7 @@ extern void		ip_rt_redirect(__be32 old_gw, __be32 dst, __be32 new_gw,
                                        __be32 src, struct net_device *dev);
 extern void             rt_cache_flush(struct net *net, int how);
 extern void             rt_cache_flush_batch(struct net *net);
-extern struct rtable *__ip_route_output_key(struct net *, const struct flowi4 *flp);
+extern struct rtable *__ip_route_output_key(struct net *, struct flowi4 *flp);
 extern struct rtable *ip_route_output_flow(struct net *, struct flowi4 *flp,
                                            struct sock *sk);
 extern struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig);
@@ -145,40 +137,33 @@ static inline struct rtable *ip_route_output(struct net *net, __be32 daddr,
         return ip_route_output_key(net, &fl4);
 }
 
-static inline struct rtable *ip_route_output_ports(struct net *net, struct sock *sk,
+static inline struct rtable *ip_route_output_ports(struct net *net, struct flowi4 *fl4,
+                                                   struct sock *sk,
                                                    __be32 daddr, __be32 saddr,
                                                    __be16 dport, __be16 sport,
                                                    __u8 proto, __u8 tos, int oif)
 {
-        struct flowi4 fl4 = {
-                .flowi4_oif = oif,
-                .flowi4_flags = sk ? inet_sk_flowi_flags(sk) : 0,
-                .flowi4_mark = sk ? sk->sk_mark : 0,
-                .daddr = daddr,
-                .saddr = saddr,
-                .flowi4_tos = tos,
-                .flowi4_proto = proto,
-                .fl4_dport = dport,
-                .fl4_sport = sport,
-        };
+        flowi4_init_output(fl4, oif, sk ? sk->sk_mark : 0, tos,
+                           RT_SCOPE_UNIVERSE, proto,
+                           sk ? inet_sk_flowi_flags(sk) : 0,
+                           daddr, saddr, dport, sport);
         if (sk)
-                security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
-        return ip_route_output_flow(net, &fl4, sk);
+                security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+        return ip_route_output_flow(net, fl4, sk);
 }
 
-static inline struct rtable *ip_route_output_gre(struct net *net,
+static inline struct rtable *ip_route_output_gre(struct net *net, struct flowi4 *fl4,
                                                  __be32 daddr, __be32 saddr,
                                                  __be32 gre_key, __u8 tos, int oif)
 {
-        struct flowi4 fl4 = {
-                .flowi4_oif = oif,
-                .daddr = daddr,
-                .saddr = saddr,
-                .flowi4_tos = tos,
-                .flowi4_proto = IPPROTO_GRE,
-                .fl4_gre_key = gre_key,
-        };
-        return ip_route_output_key(net, &fl4);
+        memset(fl4, 0, sizeof(*fl4));
+        fl4->flowi4_oif = oif;
+        fl4->daddr = daddr;
+        fl4->saddr = saddr;
+        fl4->flowi4_tos = tos;
+        fl4->flowi4_proto = IPPROTO_GRE;
+        fl4->fl4_gre_key = gre_key;
+        return ip_route_output_key(net, fl4);
 }
 
 extern int ip_route_input_common(struct sk_buff *skb, __be32 dst, __be32 src,
@@ -196,14 +181,15 @@ static inline int ip_route_input_noref(struct sk_buff *skb, __be32 dst, __be32 s
         return ip_route_input_common(skb, dst, src, tos, devin, true);
 }
 
-extern unsigned short   ip_rt_frag_needed(struct net *net, struct iphdr *iph, unsigned short new_mtu, struct net_device *dev);
+extern unsigned short   ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
+                                          unsigned short new_mtu, struct net_device *dev);
 extern void             ip_rt_send_redirect(struct sk_buff *skb);
 
 extern unsigned         inet_addr_type(struct net *net, __be32 addr);
 extern unsigned         inet_dev_addr_type(struct net *net, const struct net_device *dev, __be32 addr);
 extern void             ip_rt_multicast_event(struct in_device *);
 extern int              ip_rt_ioctl(struct net *, unsigned int cmd, void __user *arg);
-extern void             ip_rt_get_source(u8 *src, struct rtable *rt);
+extern void             ip_rt_get_source(u8 *src, struct sk_buff *skb, struct rtable *rt);
 extern int              ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb);
 
 struct in_ifaddr;
@@ -225,78 +211,93 @@ static inline char rt_tos2priority(u8 tos)
         return ip_tos2prio[IPTOS_TOS(tos)>>1];
 }
 
-static inline struct rtable *ip_route_connect(__be32 dst, __be32 src, u32 tos,
+/* ip_route_connect() and ip_route_newports() work in tandem whilst
+ * binding a socket for a new outgoing connection.
+ *
+ * In order to use IPSEC properly, we must, in the end, have a
+ * route that was looked up using all available keys including source
+ * and destination ports.
+ *
+ * However, if a source port needs to be allocated (the user specified
+ * a wildcard source port) we need to obtain addressing information
+ * in order to perform that allocation.
+ *
+ * So ip_route_connect() looks up a route using wildcarded source and
+ * destination ports in the key, simply so that we can get a pair of
+ * addresses to use for port allocation.
+ *
+ * Later, once the ports are allocated, ip_route_newports() will make
+ * another route lookup if needed to make sure we catch any IPSEC
+ * rules keyed on the port information.
+ *
+ * The callers allocate the flow key on their stack, and must pass in
+ * the same flowi4 object to both the ip_route_connect() and the
+ * ip_route_newports() calls.
+ */
+
+static inline void ip_route_connect_init(struct flowi4 *fl4, __be32 dst, __be32 src,
+                                         u32 tos, int oif, u8 protocol,
+                                         __be16 sport, __be16 dport,
+                                         struct sock *sk, bool can_sleep)
+{
+        __u8 flow_flags = 0;
+
+        if (inet_sk(sk)->transparent)
+                flow_flags |= FLOWI_FLAG_ANYSRC;
+        if (protocol == IPPROTO_TCP)
+                flow_flags |= FLOWI_FLAG_PRECOW_METRICS;
+        if (can_sleep)
+                flow_flags |= FLOWI_FLAG_CAN_SLEEP;
+
+        flowi4_init_output(fl4, oif, sk->sk_mark, tos, RT_SCOPE_UNIVERSE,
+                           protocol, flow_flags, dst, src, dport, sport);
+}
+
+static inline struct rtable *ip_route_connect(struct flowi4 *fl4,
+                                              __be32 dst, __be32 src, u32 tos,
                                               int oif, u8 protocol,
                                               __be16 sport, __be16 dport,
                                               struct sock *sk, bool can_sleep)
 {
-        struct flowi4 fl4 = {
-                .flowi4_oif = oif,
-                .flowi4_mark = sk->sk_mark,
-                .daddr = dst,
-                .saddr = src,
-                .flowi4_tos = tos,
-                .flowi4_proto = protocol,
-                .fl4_sport = sport,
-                .fl4_dport = dport,
-        };
         struct net *net = sock_net(sk);
         struct rtable *rt;
 
-        if (inet_sk(sk)->transparent)
-                fl4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
-        if (protocol == IPPROTO_TCP)
-                fl4.flowi4_flags |= FLOWI_FLAG_PRECOW_METRICS;
-        if (can_sleep)
-                fl4.flowi4_flags |= FLOWI_FLAG_CAN_SLEEP;
+        ip_route_connect_init(fl4, dst, src, tos, oif, protocol,
+                              sport, dport, sk, can_sleep);
 
         if (!dst || !src) {
-                rt = __ip_route_output_key(net, &fl4);
+                rt = __ip_route_output_key(net, fl4);
                 if (IS_ERR(rt))
                         return rt;
-                fl4.daddr = rt->rt_dst;
-                fl4.saddr = rt->rt_src;
                 ip_rt_put(rt);
         }
-        security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
-        return ip_route_output_flow(net, &fl4, sk);
+        security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+        return ip_route_output_flow(net, fl4, sk);
 }
 
-static inline struct rtable *ip_route_newports(struct rtable *rt,
-                                               u8 protocol, __be16 orig_sport,
-                                               __be16 orig_dport, __be16 sport,
-                                               __be16 dport, struct sock *sk)
+static inline struct rtable *ip_route_newports(struct flowi4 *fl4, struct rtable *rt,
+                                               __be16 orig_sport, __be16 orig_dport,
+                                               __be16 sport, __be16 dport,
+                                               struct sock *sk)
 {
         if (sport != orig_sport || dport != orig_dport) {
-                struct flowi4 fl4 = {
-                        .flowi4_oif = rt->rt_oif,
-                        .flowi4_mark = rt->rt_mark,
-                        .daddr = rt->rt_dst,
-                        .saddr = rt->rt_src,
-                        .flowi4_tos = rt->rt_tos,
-                        .flowi4_proto = protocol,
-                        .fl4_sport = sport,
-                        .fl4_dport = dport
-                };
-                if (inet_sk(sk)->transparent)
-                        fl4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
-                if (protocol == IPPROTO_TCP)
-                        fl4.flowi4_flags |= FLOWI_FLAG_PRECOW_METRICS;
+                fl4->fl4_dport = dport;
+                fl4->fl4_sport = sport;
                 ip_rt_put(rt);
-                security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
-                return ip_route_output_flow(sock_net(sk), &fl4, sk);
+                security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+                return ip_route_output_flow(sock_net(sk), fl4, sk);
         }
         return rt;
 }
 
-extern void rt_bind_peer(struct rtable *rt, int create);
+extern void rt_bind_peer(struct rtable *rt, __be32 daddr, int create);
 
-static inline struct inet_peer *rt_get_peer(struct rtable *rt)
+static inline struct inet_peer *rt_get_peer(struct rtable *rt, __be32 daddr)
 {
         if (rt->peer)
                 return rt->peer;
 
-        rt_bind_peer(rt, 0);
+        rt_bind_peer(rt, daddr, 0);
         return rt->peer;
 }
 
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index c01dc99def07..2b447646ce4b 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -73,7 +73,6 @@ typedef enum {
         SCTP_CMD_INIT_FAILED,   /* High level, do init failure work. */
         SCTP_CMD_REPORT_DUP,    /* Report a duplicate TSN.  */
         SCTP_CMD_STRIKE,        /* Mark a strike against a transport.  */
-        SCTP_CMD_TRANSMIT,      /* Transmit the outqueue. */
         SCTP_CMD_HB_TIMERS_START,    /* Start the heartbeat timers. */
         SCTP_CMD_HB_TIMER_UPDATE,    /* Update a heartbeat timers.  */
         SCTP_CMD_HB_TIMERS_STOP,     /* Stop the heartbeat timers.  */
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index c70d8ccc55cb..942b864f6135 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -150,7 +150,6 @@ SCTP_SUBTYPE_CONSTRUCTOR(OTHER,		sctp_event_other_t,	other)
 SCTP_SUBTYPE_CONSTRUCTOR(PRIMITIVE,     sctp_event_primitive_t, primitive)
 
 
-#define sctp_chunk_is_control(a) (a->chunk_hdr->type != SCTP_CID_DATA)
 #define sctp_chunk_is_data(a) (a->chunk_hdr->type == SCTP_CID_DATA)
 
 /* Calculate the actual data size in a data chunk */
@@ -188,15 +187,14 @@ typedef enum {
 /* SCTP state defines for internal state machine */
 typedef enum {
 
-        SCTP_STATE_EMPTY                = 0,
-        SCTP_STATE_CLOSED               = 1,
-        SCTP_STATE_COOKIE_WAIT          = 2,
-        SCTP_STATE_COOKIE_ECHOED        = 3,
-        SCTP_STATE_ESTABLISHED          = 4,
-        SCTP_STATE_SHUTDOWN_PENDING     = 5,
-        SCTP_STATE_SHUTDOWN_SENT        = 6,
-        SCTP_STATE_SHUTDOWN_RECEIVED    = 7,
-        SCTP_STATE_SHUTDOWN_ACK_SENT    = 8,
+        SCTP_STATE_CLOSED               = 0,
+        SCTP_STATE_COOKIE_WAIT          = 1,
+        SCTP_STATE_COOKIE_ECHOED        = 2,
+        SCTP_STATE_ESTABLISHED          = 3,
+        SCTP_STATE_SHUTDOWN_PENDING     = 4,
+        SCTP_STATE_SHUTDOWN_SENT        = 5,
+        SCTP_STATE_SHUTDOWN_RECEIVED    = 6,
+        SCTP_STATE_SHUTDOWN_ACK_SENT    = 7,
 
 } sctp_state_t;
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 01e094c6d0ae..b2c2366676a7 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -530,7 +530,6 @@ _sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)
 
 #define _sctp_walk_params(pos, chunk, end, member)\
 for (pos.v = chunk->member;\
-     pos.v <= (void *)chunk + end - sizeof(sctp_paramhdr_t) &&\
      pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
      ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
      pos.v += WORD_ROUND(ntohs(pos.p->length)))
@@ -541,7 +540,6 @@ _sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length))
 #define _sctp_walk_errors(err, chunk_hdr, end)\
 for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
             sizeof(sctp_chunkhdr_t));\
-     (void *)err <= (void *)chunk_hdr + end - sizeof(sctp_errhdr_t) &&\
      (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
      ntohs(err->length) >= sizeof(sctp_errhdr_t); \
      err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length))))
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 9352d12f02de..9148632b8204 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -165,6 +165,7 @@ sctp_state_fn_t sctp_sf_do_prm_requestheartbeat;
 sctp_state_fn_t sctp_sf_do_prm_asconf;
 
 /* Prototypes for other event state functions.  */
+sctp_state_fn_t sctp_sf_do_no_pending_tsn;
 sctp_state_fn_t sctp_sf_do_9_2_start_shutdown;
 sctp_state_fn_t sctp_sf_do_9_2_shutdown_ack;
 sctp_state_fn_t sctp_sf_ignore_other;
@@ -232,9 +233,7 @@ struct sctp_chunk *sctp_make_violation_paramlen(const struct sctp_association *,
                                    const struct sctp_chunk *,
                                    struct sctp_paramhdr *);
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *,
-                                  const struct sctp_transport *,
-                                  const void *payload,
-                                  const size_t paylen);
+                                  const struct sctp_transport *);
 struct sctp_chunk *sctp_make_heartbeat_ack(const struct sctp_association *,
                                       const struct sctp_chunk *,
                                       const void *payload,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 0f6e60a9c308..795f4886e111 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -564,19 +564,15 @@ struct sctp_af {
                                          int optname,
                                          char __user *optval,
                                          int __user *optlen);
-        struct dst_entry *(*get_dst)    (struct sctp_association *asoc,
-                                         union sctp_addr *daddr,
-                                         union sctp_addr *saddr);
+        void            (*get_dst)      (struct sctp_transport *t,
+                                         union sctp_addr *saddr,
+                                         struct flowi *fl,
+                                         struct sock *sk);
         void            (*get_saddr)    (struct sctp_sock *sk,
-                                         struct sctp_association *asoc,
-                                         struct dst_entry *dst,
-                                         union sctp_addr *daddr,
-                                         union sctp_addr *saddr);
+                                         struct sctp_transport *t,
+                                         struct flowi *fl);
         void            (*copy_addrlist) (struct list_head *,
                                           struct net_device *);
-        void            (*dst_saddr)    (union sctp_addr *saddr,
-                                         struct dst_entry *dst,
-                                         __be16 port);
         int             (*cmp_addr)     (const union sctp_addr *addr1,
                                          const union sctp_addr *addr2);
         void            (*addr_copy)    (union sctp_addr *dst,
@@ -898,6 +894,7 @@ struct sctp_transport {
                 /* Is this structure kfree()able? */
                 malloced:1;
 
+        struct flowi fl;
 
         /* This is the peer's IP address and port. */
         union sctp_addr ipaddr;
@@ -1061,7 +1058,7 @@ void sctp_transport_set_owner(struct sctp_transport *,
                               struct sctp_association *);
 void sctp_transport_route(struct sctp_transport *, union sctp_addr *,
                           struct sctp_sock *);
-void sctp_transport_pmtu(struct sctp_transport *);
+void sctp_transport_pmtu(struct sctp_transport *, struct sock *sk);
 void sctp_transport_free(struct sctp_transport *);
 void sctp_transport_reset_timers(struct sctp_transport *);
 void sctp_transport_hold(struct sctp_transport *);
@@ -1400,7 +1397,7 @@ int sctp_has_association(const union sctp_addr *laddr,
 int sctp_verify_init(const struct sctp_association *asoc, sctp_cid_t,
                      sctp_init_chunk_t *peer_init, struct sctp_chunk *chunk,
                      struct sctp_chunk **err_chunk);
-int sctp_process_init(struct sctp_association *, sctp_cid_t cid,
+int sctp_process_init(struct sctp_association *, struct sctp_chunk *chunk,
                       const union sctp_addr *peer,
                       sctp_init_chunk_t *init, gfp_t gfp);
 __u32 sctp_generate_tag(const struct sctp_endpoint *);
diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h
index 7ea12e8e6676..99b027b2adce 100644
--- a/include/net/sctp/ulpevent.h
+++ b/include/net/sctp/ulpevent.h
@@ -132,6 +132,9 @@ struct sctp_ulpevent *sctp_ulpevent_make_authkey(
         const struct sctp_association *asoc, __u16 key_id,
         __u32 indication, gfp_t gfp);
 
+struct sctp_ulpevent *sctp_ulpevent_make_sender_dry_event(
+        const struct sctp_association *asoc, gfp_t gfp);
+
 void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event,
         struct msghdr *);
 __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event);
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index e73ebdae323d..32fd51274037 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -91,6 +91,7 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_PEER_AUTH_CHUNKS   26      /* Read only */
 #define SCTP_LOCAL_AUTH_CHUNKS  27      /* Read only */
 #define SCTP_GET_ASSOC_NUMBER   28      /* Read only */
+#define SCTP_GET_ASSOC_ID_LIST  29      /* Read only */
 
 /* Internal Socket Options. Some of the sctp library functions are
  * implemented using these socket options.
@@ -353,6 +354,20 @@ struct sctp_authkey_event {
 
 enum { SCTP_AUTH_NEWKEY = 0, };
 
+/*
+ * 6.1.9. SCTP_SENDER_DRY_EVENT
+ *
+ * When the SCTP stack has no more user data to send or retransmit, this
+ * notification is given to the user. Also, at the time when a user app
+ * subscribes to this event, if there is no data to be sent or
+ * retransmit, the stack will immediately send up this notification.
+ */
+struct sctp_sender_dry_event {
+        __u16 sender_dry_type;
+        __u16 sender_dry_flags;
+        __u32 sender_dry_length;
+        sctp_assoc_t sender_dry_assoc_id;
+};
 
 /*
  * Described in Section 7.3
@@ -368,6 +383,7 @@ struct sctp_event_subscribe {
         __u8 sctp_partial_delivery_event;
         __u8 sctp_adaptation_layer_event;
         __u8 sctp_authentication_event;
+        __u8 sctp_sender_dry_event;
 };
 
 /*
@@ -391,6 +407,7 @@ union sctp_notification {
         struct sctp_adaptation_event sn_adaptation_event;
         struct sctp_pdapi_event sn_pdapi_event;
         struct sctp_authkey_event sn_authkey_event;
+        struct sctp_sender_dry_event sn_sender_dry_event;
 };
 
 /* Section 5.3.1
@@ -407,7 +424,9 @@ enum sctp_sn_type {
         SCTP_SHUTDOWN_EVENT,
         SCTP_PARTIAL_DELIVERY_EVENT,
         SCTP_ADAPTATION_INDICATION,
-        SCTP_AUTHENTICATION_INDICATION,
+        SCTP_AUTHENTICATION_EVENT,
+#define SCTP_AUTHENTICATION_INDICATION  SCTP_AUTHENTICATION_EVENT
+        SCTP_SENDER_DRY_EVENT,
 };
 
 /* Notification error codes used to fill up the error fields in some
@@ -669,6 +688,18 @@ struct sctp_authchunks {
 };
 
 /*
+ * 8.2.6. Get the Current Identifiers of Associations
+ *        (SCTP_GET_ASSOC_ID_LIST)
+ *
+ * This option gets the current list of SCTP association identifiers of
+ * the SCTP associations handled by a one-to-many style socket.
+ */
+struct sctp_assoc_ids {
+        __u32           gaids_number_of_ids;
+        sctp_assoc_t    gaids_assoc_id[];
+};
+
+/*
  * 8.3, 8.5 get all peer/local addresses in an association.
  * This parameter struct is used by SCTP_GET_PEER_ADDRS and 
  * SCTP_GET_LOCAL_ADDRS socket options used internally to implement
diff --git a/include/net/snmp.h b/include/net/snmp.h
index 27461d6dd46f..479083a78b0c 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -72,14 +72,24 @@ struct icmpmsg_mib {
 
 /* ICMP6 (IPv6-ICMP) */
 #define ICMP6_MIB_MAX   __ICMP6_MIB_MAX
+/* per network ns counters */
 struct icmpv6_mib {
         unsigned long   mibs[ICMP6_MIB_MAX];
 };
+/* per device counters, (shared on all cpus) */
+struct icmpv6_mib_device {
+        atomic_long_t   mibs[ICMP6_MIB_MAX];
+};
 
 #define ICMP6MSG_MIB_MAX  __ICMP6MSG_MIB_MAX
+/* per network ns counters */
 struct icmpv6msg_mib {
         unsigned long   mibs[ICMP6MSG_MIB_MAX];
 };
+/* per device counters, (shared on all cpus) */
+struct icmpv6msg_mib_device {
+        atomic_long_t   mibs[ICMP6MSG_MIB_MAX];
+};
 
 
 /* TCP */
@@ -114,6 +124,8 @@ struct linux_xfrm_mib {
  */ 
 #define DEFINE_SNMP_STAT(type, name)    \
         __typeof__(type) __percpu *name[2]
+#define DEFINE_SNMP_STAT_ATOMIC(type, name)     \
+        __typeof__(type) *name
 #define DECLARE_SNMP_STAT(type, name)   \
         extern __typeof__(type) __percpu *name[2]
 
@@ -124,6 +136,8 @@ struct linux_xfrm_mib {
                         __this_cpu_inc(mib[0]->mibs[field])
 #define SNMP_INC_STATS_USER(mib, field) \
                         this_cpu_inc(mib[1]->mibs[field])
+#define SNMP_INC_STATS_ATOMIC_LONG(mib, field)  \
+                        atomic_long_inc(&mib->mibs[field])
 #define SNMP_INC_STATS(mib, field)      \
                         this_cpu_inc(mib[!in_softirq()]->mibs[field])
 #define SNMP_DEC_STATS(mib, field)      \
diff --git a/include/net/sock.h b/include/net/sock.h
index 01810a3f19df..f2046e404a61 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -52,6 +52,7 @@
 #include <linux/mm.h>
 #include <linux/security.h>
 #include <linux/slab.h>
+#include <linux/uaccess.h>
 
 #include <linux/filter.h>
 #include <linux/rculist_nulls.h>
@@ -1389,6 +1390,59 @@ static inline void sk_nocaps_add(struct sock *sk, int flags)
         sk->sk_route_caps &= ~flags;
 }
 
+static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
+                                           char __user *from, char *to,
+                                           int copy, int offset)
+{
+        if (skb->ip_summed == CHECKSUM_NONE) {
+                int err = 0;
+                __wsum csum = csum_and_copy_from_user(from, to, copy, 0, &err);
+                if (err)
+                        return err;
+                skb->csum = csum_block_add(skb->csum, csum, offset);
+        } else if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY) {
+                if (!access_ok(VERIFY_READ, from, copy) ||
+                    __copy_from_user_nocache(to, from, copy))
+                        return -EFAULT;
+        } else if (copy_from_user(to, from, copy))
+                return -EFAULT;
+
+        return 0;
+}
+
+static inline int skb_add_data_nocache(struct sock *sk, struct sk_buff *skb,
+                                       char __user *from, int copy)
+{
+        int err, offset = skb->len;
+
+        err = skb_do_copy_data_nocache(sk, skb, from, skb_put(skb, copy),
+                                       copy, offset);
+        if (err)
+                __skb_trim(skb, offset);
+
+        return err;
+}
+
+static inline int skb_copy_to_page_nocache(struct sock *sk, char __user *from,
+                                           struct sk_buff *skb,
+                                           struct page *page,
+                                           int off, int copy)
+{
+        int err;
+
+        err = skb_do_copy_data_nocache(sk, skb, from, page_address(page) + off,
+                                       copy, skb->len);
+        if (err)
+                return err;
+
+        skb->len             += copy;
+        skb->data_len        += copy;
+        skb->truesize        += copy;
+        sk->sk_wmem_queued   += copy;
+        sk_mem_charge(sk, copy);
+        return 0;
+}
+
 static inline int skb_copy_to_page(struct sock *sk, char __user *from,
                                    struct sk_buff *skb, struct page *page,
                                    int off, int copy)
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index a8122dc56410..5271a741c3a3 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -7,8 +7,6 @@
  *      IPv6 transport protocols
  */
 
-#ifdef __KERNEL__
-
 extern struct proto rawv6_prot;
 extern struct proto udpv6_prot;
 extern struct proto udplitev6_prot;
@@ -57,5 +55,3 @@ extern const struct inet_connection_sock_af_ops ipv4_specific;
 extern void inet6_destroy_sock(struct sock *sk);
 
 #endif
-
-#endif
diff --git a/include/net/wimax.h b/include/net/wimax.h
index c799ba7b708b..7328d5019d88 100644
--- a/include/net/wimax.h
+++ b/include/net/wimax.h
@@ -250,7 +250,6 @@
 
 #ifndef __NET__WIMAX_H__
 #define __NET__WIMAX_H__
-#ifdef __KERNEL__
 
 #include <linux/wimax.h>
 #include <net/genetlink.h>
@@ -518,8 +517,4 @@ extern ssize_t wimax_msg_len(struct sk_buff *);
 extern int wimax_rfkill(struct wimax_dev *, enum wimax_rf_state);
 extern int wimax_reset(struct wimax_dev *);
 
-#else
-/* You might be looking for linux/wimax.h */
-#error This file should not be included from user space.
-#endif /* #ifdef __KERNEL__ */
 #endif /* #ifndef __NET__WIMAX_H__ */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 20afeaa39395..b203e14d26b7 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -958,6 +958,15 @@ struct sec_path {
         struct xfrm_state       *xvec[XFRM_MAX_DEPTH];
 };
 
+static inline int secpath_exists(struct sk_buff *skb)
+{
+#ifdef CONFIG_XFRM
+        return skb->sp != NULL;
+#else
+        return 0;
+#endif
+}
+
 static inline struct sec_path *
 secpath_get(struct sec_path *sp)
 {
@@ -1468,7 +1477,7 @@ extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
 extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
-extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr);
+extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
 extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_output(struct sk_buff *skb);
@@ -1563,8 +1572,8 @@ static inline int xfrm_addr_cmp(const xfrm_address_t *a,
         case AF_INET:
                 return (__force u32)a->a4 - (__force u32)b->a4;
         case AF_INET6:
-                return ipv6_addr_cmp((struct in6_addr *)a,
-                                     (struct in6_addr *)b);
+                return ipv6_addr_cmp((const struct in6_addr *)a,
+                                     (const struct in6_addr *)b);
         }
 }
 
diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
index b5fc9f39122b..ae8c68f30f1b 100644
--- a/include/rdma/ib_addr.h
+++ b/include/rdma/ib_addr.h
@@ -217,18 +217,19 @@ static inline enum ib_mtu iboe_get_mtu(int mtu)
 static inline int iboe_get_rate(struct net_device *dev)
 {
         struct ethtool_cmd cmd;
+        u32 speed;
 
-        if (!dev->ethtool_ops || !dev->ethtool_ops->get_settings ||
-            dev->ethtool_ops->get_settings(dev, &cmd))
+        if (dev_ethtool_get_settings(dev, &cmd))
                 return IB_RATE_PORT_CURRENT;
 
-        if (cmd.speed >= 40000)
+        speed = ethtool_cmd_speed(&cmd);
+        if (speed >= 40000)
                 return IB_RATE_40_GBPS;
-        else if (cmd.speed >= 30000)
+        else if (speed >= 30000)
                 return IB_RATE_30_GBPS;
-        else if (cmd.speed >= 20000)
+        else if (speed >= 20000)
                 return IB_RATE_20_GBPS;
-        else if (cmd.speed >= 10000)
+        else if (speed >= 10000)
                 return IB_RATE_10_GBPS;
         else
                 return IB_RATE_PORT_CURRENT;