29 files changed, 442 insertions, 140 deletions

diff --git a/include/net/act_api.h b/include/net/act_api.h
index 565eed8fe496..c05fd717c588 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -16,7 +16,7 @@ struct tcf_common {
         u32                             tcfc_capab;
         int                             tcfc_action;
         struct tcf_t                    tcfc_tm;
-        struct gnet_stats_basic         tcfc_bstats;
+        struct gnet_stats_basic_packed  tcfc_bstats;
         struct gnet_stats_queue         tcfc_qstats;
         struct gnet_stats_rate_est      tcfc_rate_est;
         spinlock_t                      tcfc_lock;
diff --git a/include/net/af_ieee802154.h b/include/net/af_ieee802154.h
index 0d78605fb1a6..75e64c7a2960 100644
--- a/include/net/af_ieee802154.h
+++ b/include/net/af_ieee802154.h
@@ -54,7 +54,9 @@ struct sockaddr_ieee802154 {
         struct ieee802154_addr addr;
 };
 
-/* master device */
-#define IEEE802154_SIOC_ADD_SLAVE               (SIOCDEVPRIVATE + 0)
+/* get/setsockopt */
+#define SOL_IEEE802154  0
+
+#define WPAN_WANTACK    0
 
 #endif
diff --git a/include/net/arp.h b/include/net/arp.h
index c236270ec95e..716f43c5c98e 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -26,6 +26,6 @@ extern struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
                                   const unsigned char *target_hw);
 extern void arp_xmit(struct sk_buff *skb);
 
-extern struct neigh_ops arp_broken_ops;
+extern const struct neigh_ops arp_broken_ops;
 
 #endif  /* _ARP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 968166a45f86..718394e2c01e 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -138,8 +138,11 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
 struct bt_skb_cb {
         __u8 pkt_type;
         __u8 incoming;
+        __u8 tx_seq;
+        __u8 retries;
+        __u8 sar;
 };
-#define bt_cb(skb) ((struct bt_skb_cb *)(skb->cb)) 
+#define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
 
 static inline struct sk_buff *bt_skb_alloc(unsigned int len, gfp_t how)
 {
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index c4ca4228b083..7b640aeddb64 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -117,7 +117,7 @@ struct hci_dev {
         struct sk_buff          *sent_cmd;
         struct sk_buff          *reassembly[3];
 
-        struct semaphore        req_lock;
+        struct mutex            req_lock;
         wait_queue_head_t       req_wait_q;
         __u32                   req_status;
         __u32                   req_result;
@@ -187,6 +187,7 @@ struct hci_conn {
         struct work_struct work_del;
 
         struct device   dev;
+        atomic_t        devref;
 
         struct hci_dev  *hdev;
         void            *l2cap_data;
@@ -339,6 +340,9 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 void hci_conn_enter_active_mode(struct hci_conn *conn);
 void hci_conn_enter_sniff_mode(struct hci_conn *conn);
 
+void hci_conn_hold_device(struct hci_conn *conn);
+void hci_conn_put_device(struct hci_conn *conn);
+
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
         atomic_inc(&conn->refcnt);
@@ -700,8 +704,8 @@ struct hci_sec_filter {
 #define HCI_REQ_PEND      1
 #define HCI_REQ_CANCELED  2
 
-#define hci_req_lock(d)         down(&d->req_lock)
-#define hci_req_unlock(d)       up(&d->req_lock)
+#define hci_req_lock(d)         mutex_lock(&d->req_lock)
+#define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
 
 void hci_req_complete(struct hci_dev *hdev, int result);
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index e919fca1072a..9516f4b4a3c2 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -27,12 +27,14 @@
 
 /* L2CAP defaults */
 #define L2CAP_DEFAULT_MTU               672
+#define L2CAP_DEFAULT_MIN_MTU           48
 #define L2CAP_DEFAULT_FLUSH_TO          0xffff
-#define L2CAP_DEFAULT_RX_WINDOW         1
-#define L2CAP_DEFAULT_MAX_RECEIVE       1
-#define L2CAP_DEFAULT_RETRANS_TO        300    /* 300 milliseconds */
-#define L2CAP_DEFAULT_MONITOR_TO        1000   /* 1 second */
-#define L2CAP_DEFAULT_MAX_RX_APDU       0xfff7
+#define L2CAP_DEFAULT_TX_WINDOW         63
+#define L2CAP_DEFAULT_NUM_TO_ACK        (L2CAP_DEFAULT_TX_WINDOW/5)
+#define L2CAP_DEFAULT_MAX_TX            3
+#define L2CAP_DEFAULT_RETRANS_TO        1000    /* 1 second */
+#define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
+#define L2CAP_DEFAULT_MAX_PDU_SIZE      672
 
 #define L2CAP_CONN_TIMEOUT      (40000) /* 40 seconds */
 #define L2CAP_INFO_TIMEOUT      (4000)  /*  4 seconds */
@@ -52,6 +54,7 @@ struct l2cap_options {
         __u16 imtu;
         __u16 flush_to;
         __u8  mode;
+        __u8  fcs;
 };
 
 #define L2CAP_CONNINFO  0x02
@@ -93,6 +96,32 @@ struct l2cap_conninfo {
 #define L2CAP_FCS_NONE          0x00
 #define L2CAP_FCS_CRC16         0x01
 
+/* L2CAP Control Field bit masks */
+#define L2CAP_CTRL_SAR               0xC000
+#define L2CAP_CTRL_REQSEQ            0x3F00
+#define L2CAP_CTRL_TXSEQ             0x007E
+#define L2CAP_CTRL_RETRANS           0x0080
+#define L2CAP_CTRL_FINAL             0x0080
+#define L2CAP_CTRL_POLL              0x0010
+#define L2CAP_CTRL_SUPERVISE         0x000C
+#define L2CAP_CTRL_FRAME_TYPE        0x0001 /* I- or S-Frame */
+
+#define L2CAP_CTRL_TXSEQ_SHIFT      1
+#define L2CAP_CTRL_REQSEQ_SHIFT     8
+#define L2CAP_CTRL_SAR_SHIFT       14
+
+/* L2CAP Supervisory Function */
+#define L2CAP_SUPER_RCV_READY           0x0000
+#define L2CAP_SUPER_REJECT              0x0004
+#define L2CAP_SUPER_RCV_NOT_READY       0x0008
+#define L2CAP_SUPER_SELECT_REJECT       0x000C
+
+/* L2CAP Segmentation and Reassembly */
+#define L2CAP_SDU_UNSEGMENTED       0x0000
+#define L2CAP_SDU_START             0x4000
+#define L2CAP_SDU_END               0x8000
+#define L2CAP_SDU_CONTINUE          0xC000
+
 /* L2CAP structures */
 struct l2cap_hdr {
         __le16     len;
@@ -190,7 +219,7 @@ struct l2cap_conf_rfc {
 #define L2CAP_MODE_RETRANS      0x01
 #define L2CAP_MODE_FLOWCTL      0x02
 #define L2CAP_MODE_ERTM         0x03
-#define L2CAP_MODE_STREAM       0x04
+#define L2CAP_MODE_STREAMING    0x04
 
 struct l2cap_disconn_req {
         __le16     dcid;
@@ -261,6 +290,14 @@ struct l2cap_conn {
 
 /* ----- L2CAP channel and socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
+#define TX_QUEUE(sk) (&l2cap_pi(sk)->tx_queue)
+#define SREJ_QUEUE(sk) (&l2cap_pi(sk)->srej_queue)
+#define SREJ_LIST(sk) (&l2cap_pi(sk)->srej_l.list)
+
+struct srej_list {
+        __u8    tx_seq;
+        struct list_head list;
+};
 
 struct l2cap_pinfo {
         struct bt_sock  bt;
@@ -271,30 +308,97 @@ struct l2cap_pinfo {
         __u16           imtu;
         __u16           omtu;
         __u16           flush_to;
-        __u8            sec_level;
+        __u8            mode;
+        __u8            num_conf_req;
+        __u8            num_conf_rsp;
+
+        __u8            fcs;
+        __u8            sec_level;
         __u8            role_switch;
-        __u8            force_reliable;
+        __u8            force_reliable;
 
         __u8            conf_req[64];
         __u8            conf_len;
         __u8            conf_state;
-        __u8            conf_retry;
+        __u8            conn_state;
+
+        __u8            next_tx_seq;
+        __u8            expected_ack_seq;
+        __u8            req_seq;
+        __u8            expected_tx_seq;
+        __u8            buffer_seq;
+        __u8            buffer_seq_srej;
+        __u8            srej_save_reqseq;
+        __u8            unacked_frames;
+        __u8            retry_count;
+        __u8            num_to_ack;
+        __u16           sdu_len;
+        __u16           partial_sdu_len;
+        struct sk_buff  *sdu;
 
         __u8            ident;
 
+        __u8            remote_tx_win;
+        __u8            remote_max_tx;
+        __u16           retrans_timeout;
+        __u16           monitor_timeout;
+        __u16           max_pdu_size;
+
         __le16          sport;
 
+        struct timer_list       retrans_timer;
+        struct timer_list       monitor_timer;
+        struct sk_buff_head     tx_queue;
+        struct sk_buff_head     srej_queue;
+        struct srej_list        srej_l;
         struct l2cap_conn       *conn;
         struct sock             *next_c;
         struct sock             *prev_c;
 };
 
-#define L2CAP_CONF_REQ_SENT     0x01
-#define L2CAP_CONF_INPUT_DONE   0x02
-#define L2CAP_CONF_OUTPUT_DONE  0x04
-#define L2CAP_CONF_CONNECT_PEND 0x80
-
-#define L2CAP_CONF_MAX_RETRIES  2
+#define L2CAP_CONF_REQ_SENT       0x01
+#define L2CAP_CONF_INPUT_DONE     0x02
+#define L2CAP_CONF_OUTPUT_DONE    0x04
+#define L2CAP_CONF_MTU_DONE       0x08
+#define L2CAP_CONF_MODE_DONE      0x10
+#define L2CAP_CONF_CONNECT_PEND   0x20
+#define L2CAP_CONF_NO_FCS_RECV    0x40
+#define L2CAP_CONF_STATE2_DEVICE  0x80
+
+#define L2CAP_CONF_MAX_CONF_REQ 2
+#define L2CAP_CONF_MAX_CONF_RSP 2
+
+#define L2CAP_CONN_SAR_SDU         0x01
+#define L2CAP_CONN_SREJ_SENT       0x02
+#define L2CAP_CONN_WAIT_F          0x04
+#define L2CAP_CONN_SREJ_ACT        0x08
+#define L2CAP_CONN_SEND_PBIT       0x10
+#define L2CAP_CONN_REMOTE_BUSY     0x20
+#define L2CAP_CONN_LOCAL_BUSY      0x40
+
+#define __mod_retrans_timer() mod_timer(&l2cap_pi(sk)->retrans_timer, \
+                jiffies +  msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
+#define __mod_monitor_timer() mod_timer(&l2cap_pi(sk)->monitor_timer, \
+                jiffies + msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
+
+static inline int l2cap_tx_window_full(struct sock *sk)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        int sub;
+
+        sub = (pi->next_tx_seq - pi->expected_ack_seq) % 64;
+
+        if (sub < 0)
+                sub += 64;
+
+        return (sub == pi->remote_tx_win);
+}
+
+#define __get_txseq(ctrl) ((ctrl) & L2CAP_CTRL_TXSEQ) >> 1
+#define __get_reqseq(ctrl) ((ctrl) & L2CAP_CTRL_REQSEQ) >> 8
+#define __is_iframe(ctrl) !((ctrl) & L2CAP_CTRL_FRAME_TYPE)
+#define __is_sframe(ctrl) (ctrl) & L2CAP_CTRL_FRAME_TYPE
+#define __is_sar_start(ctrl) ((ctrl) & L2CAP_CTRL_SAR) == L2CAP_SDU_START
 
 void l2cap_load(void);
 
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 80072611d26a..921d7b3c7f8d 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -29,6 +29,7 @@
 #define RFCOMM_CONN_TIMEOUT (HZ * 30)
 #define RFCOMM_DISC_TIMEOUT (HZ * 20)
 #define RFCOMM_AUTH_TIMEOUT (HZ * 25)
+#define RFCOMM_IDLE_TIMEOUT (HZ * 2)
 
 #define RFCOMM_DEFAULT_MTU      127
 #define RFCOMM_DEFAULT_CREDITS  7
@@ -154,6 +155,7 @@ struct rfcomm_msc {
 struct rfcomm_session {
         struct list_head list;
         struct socket   *sock;
+        struct timer_list timer;
         unsigned long    state;
         unsigned long    flags;
         atomic_t         refcnt;
@@ -355,7 +357,17 @@ struct rfcomm_dev_list_req {
 };
 
 int  rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
+
+#ifdef CONFIG_BT_RFCOMM_TTY
 int  rfcomm_init_ttys(void);
 void rfcomm_cleanup_ttys(void);
-
+#else
+static inline int rfcomm_init_ttys(void)
+{
+        return 0;
+}
+static inline void rfcomm_cleanup_ttys(void)
+{
+}
+#endif
 #endif /* __RFCOMM_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index fa729979de88..3d874c620219 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -80,7 +80,6 @@ enum ieee80211_channel_flags {
  * with cfg80211.
  *
  * @center_freq: center frequency in MHz
- * @max_bandwidth: maximum allowed bandwidth for this channel, in MHz
  * @hw_value: hardware-specific value for the channel
  * @flags: channel flags from &enum ieee80211_channel_flags.
  * @orig_flags: channel flags at registration time, used by regulatory
@@ -97,7 +96,6 @@ enum ieee80211_channel_flags {
 struct ieee80211_channel {
         enum ieee80211_band band;
         u16 center_freq;
-        u8 max_bandwidth;
         u16 hw_value;
         u32 flags;
         int max_antenna_gain;
@@ -372,6 +370,10 @@ struct rate_info {
  * @txrate: current unicast bitrate to this station
  * @rx_packets: packets received from this station
  * @tx_packets: packets transmitted to this station
+ * @generation: generation number for nl80211 dumps.
+ *      This number should increase every time the list of stations
+ *      changes, i.e. when a station is added or removed, so that
+ *      userspace can tell whether it got a consistent snapshot.
  */
 struct station_info {
         u32 filled;
@@ -385,6 +387,8 @@ struct station_info {
         struct rate_info txrate;
         u32 rx_packets;
         u32 tx_packets;
+
+        int generation;
 };
 
 /**
@@ -444,6 +448,10 @@ enum mpath_info_flags {
  * @flags: mesh path flags
  * @discovery_timeout: total mesh path discovery timeout, in msecs
  * @discovery_retries: mesh path discovery retries
+ * @generation: generation number for nl80211 dumps.
+ *      This number should increase every time the list of mesh paths
+ *      changes, i.e. when a station is added or removed, so that
+ *      userspace can tell whether it got a consistent snapshot.
  */
 struct mpath_info {
         u32 filled;
@@ -454,6 +462,8 @@ struct mpath_info {
         u32 discovery_timeout;
         u8 discovery_retries;
         u8 flags;
+
+        int generation;
 };
 
 /**
@@ -547,7 +557,6 @@ struct cfg80211_ssid {
 struct cfg80211_scan_request {
         struct cfg80211_ssid *ssids;
         int n_ssids;
-        struct ieee80211_channel **channels;
         u32 n_channels;
         const u8 *ie;
         size_t ie_len;
@@ -556,6 +565,9 @@ struct cfg80211_scan_request {
         struct wiphy *wiphy;
         struct net_device *dev;
         bool aborted;
+
+        /* keep last */
+        struct ieee80211_channel *channels[0];
 };
 
 /**
@@ -1076,6 +1088,10 @@ struct cfg80211_ops {
  *      channels at a later time. This can be used for devices which do not
  *      have calibration information gauranteed for frequencies or settings
  *      outside of its regulatory domain.
+ * @disable_beacon_hints: enable this if your driver needs to ensure that
+ *      passive scan flags and beaconing flags may not be lifted by cfg80211
+ *      due to regulatory beacon hints. For more information on beacon
+ *      hints read the documenation for regulatory_hint_found_beacon()
  * @reg_notifier: the driver's regulatory notification callback
  * @regd: the driver's regulatory domain, if one was requested via
  *      the regulatory_hint() API. This can be used by the driver
@@ -1092,6 +1108,9 @@ struct cfg80211_ops {
  * @net: the network namespace this wiphy currently lives in
  * @netnsok: if set to false, do not allow changing the netns of this
  *      wiphy at all
+ * @ps_default: default for powersave, will be set depending on the
+ *      kernel's default on wiphy_new(), but can be changed by the
+ *      driver if it has a good reason to override the default
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -1104,8 +1123,10 @@ struct wiphy {
 
         bool custom_regulatory;
         bool strict_regulatory;
+        bool disable_beacon_hints;
 
         bool netnsok;
+        bool ps_default;
 
         enum cfg80211_signal_type signal_type;
 
@@ -1304,6 +1325,8 @@ struct wireless_dev {
 
         struct mutex mtx;
 
+        struct work_struct cleanup_work;
+
         /* currently used for IBSS and SME - might be rearranged later */
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         u8 ssid_len;
@@ -1330,10 +1353,10 @@ struct wireless_dev {
                 struct cfg80211_cached_keys *keys;
                 u8 *ie;
                 size_t ie_len;
-                u8 bssid[ETH_ALEN];
+                u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
                 u8 ssid[IEEE80211_MAX_SSID_LEN];
                 s8 default_key, default_mgmt_key;
-                bool ps;
+                bool ps, prev_bssid_valid;
                 int ps_timeout;
         } wext;
 #endif
diff --git a/include/net/dcbnl.h b/include/net/dcbnl.h
index 775cfc8055be..b36ac7e0914d 100644
--- a/include/net/dcbnl.h
+++ b/include/net/dcbnl.h
@@ -48,6 +48,8 @@ struct dcbnl_rtnl_ops {
         void (*setbcncfg)(struct net_device *, int, u32);
         void (*getbcnrp)(struct net_device *, int, u8 *);
         void (*setbcnrp)(struct net_device *, int, u8);
+        u8   (*setapp)(struct net_device *, u8, u16, u8);
+        u8   (*getapp)(struct net_device *, u8, u16);
 };
 
 #endif /* __NET_DCBNL_H__ */
diff --git a/include/net/dst.h b/include/net/dst.h
index 7fc409c19b37..5a900ddcf10d 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -8,6 +8,7 @@
 #ifndef _NET_DST_H
 #define _NET_DST_H
 
+#include <net/dst_ops.h>
 #include <linux/netdevice.h>
 #include <linux/rtnetlink.h>
 #include <linux/rcupdate.h>
@@ -102,28 +103,6 @@ struct dst_entry
         };
 };
 
-
-struct dst_ops
-{
-        unsigned short          family;
-        __be16                  protocol;
-        unsigned                gc_thresh;
-
-        int                     (*gc)(struct dst_ops *ops);
-        struct dst_entry *      (*check)(struct dst_entry *, __u32 cookie);
-        void                    (*destroy)(struct dst_entry *);
-        void                    (*ifdown)(struct dst_entry *,
-                                          struct net_device *dev, int how);
-        struct dst_entry *      (*negative_advice)(struct dst_entry *);
-        void                    (*link_failure)(struct sk_buff *);
-        void                    (*update_pmtu)(struct dst_entry *dst, u32 mtu);
-        int                     (*local_out)(struct sk_buff *skb);
-
-        atomic_t                entries;
-        struct kmem_cache               *kmem_cachep;
-        struct net              *dst_net;
-};
-
 #ifdef __KERNEL__
 
 static inline u32
diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
new file mode 100644
index 000000000000..d1ff9b7e99b8
--- /dev/null
+++ b/include/net/dst_ops.h
@@ -0,0 +1,28 @@
+#ifndef _NET_DST_OPS_H
+#define _NET_DST_OPS_H
+#include <linux/types.h>
+
+struct dst_entry;
+struct kmem_cachep;
+struct net_device;
+struct sk_buff;
+
+struct dst_ops {
+        unsigned short          family;
+        __be16                  protocol;
+        unsigned                gc_thresh;
+
+        int                     (*gc)(struct dst_ops *ops);
+        struct dst_entry *      (*check)(struct dst_entry *, __u32 cookie);
+        void                    (*destroy)(struct dst_entry *);
+        void                    (*ifdown)(struct dst_entry *,
+                                          struct net_device *dev, int how);
+        struct dst_entry *      (*negative_advice)(struct dst_entry *);
+        void                    (*link_failure)(struct sk_buff *);
+        void                    (*update_pmtu)(struct dst_entry *dst, u32 mtu);
+        int                     (*local_out)(struct sk_buff *skb);
+
+        atomic_t                entries;
+        struct kmem_cache       *kmem_cachep;
+};
+#endif
diff --git a/include/net/gen_stats.h b/include/net/gen_stats.h
index d136b5240ef2..c1488553e349 100644
--- a/include/net/gen_stats.h
+++ b/include/net/gen_stats.h
@@ -28,7 +28,7 @@ extern int gnet_stats_start_copy_compat(struct sk_buff *skb, int type,
                                         spinlock_t *lock, struct gnet_dump *d);
 
 extern int gnet_stats_copy_basic(struct gnet_dump *d,
-                                 struct gnet_stats_basic *b);
+                                 struct gnet_stats_basic_packed *b);
 extern int gnet_stats_copy_rate_est(struct gnet_dump *d,
                                     struct gnet_stats_rate_est *r);
 extern int gnet_stats_copy_queue(struct gnet_dump *d,
@@ -37,14 +37,14 @@ extern int gnet_stats_copy_app(struct gnet_dump *d, void *st, int len);
 
 extern int gnet_stats_finish_copy(struct gnet_dump *d);
 
-extern int gen_new_estimator(struct gnet_stats_basic *bstats,
+extern int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                              struct gnet_stats_rate_est *rate_est,
                              spinlock_t *stats_lock, struct nlattr *opt);
-extern void gen_kill_estimator(struct gnet_stats_basic *bstats,
+extern void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                                struct gnet_stats_rate_est *rate_est);
-extern int gen_replace_estimator(struct gnet_stats_basic *bstats,
+extern int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
                                  struct gnet_stats_rate_est *rate_est,
                                  spinlock_t *stats_lock, struct nlattr *opt);
-extern bool gen_estimator_active(const struct gnet_stats_basic *bstats,
+extern bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                                  const struct gnet_stats_rate_est *rate_est);
 #endif
diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
index e2506af3e7c8..5dc6a61952de 100644
--- a/include/net/ieee802154_netdev.h
+++ b/include/net/ieee802154_netdev.h
@@ -80,7 +80,7 @@ static inline int mac_cb_type(struct sk_buff *skb)
 struct ieee802154_mlme_ops {
         int (*assoc_req)(struct net_device *dev,
                         struct ieee802154_addr *addr,
-                        u8 channel, u8 cap);
+                        u8 channel, u8 page, u8 cap);
         int (*assoc_resp)(struct net_device *dev,
                         struct ieee802154_addr *addr,
                         u16 short_addr, u8 status);
@@ -89,10 +89,10 @@ struct ieee802154_mlme_ops {
                         u8 reason);
         int (*start_req)(struct net_device *dev,
                         struct ieee802154_addr *addr,
-                        u8 channel, u8 bcn_ord, u8 sf_ord,
+                        u8 channel, u8 page, u8 bcn_ord, u8 sf_ord,
                         u8 pan_coord, u8 blx, u8 coord_realign);
         int (*scan_req)(struct net_device *dev,
-                        u8 type, u32 channels, u8 duration);
+                        u8 type, u32 channels, u8 page, u8 duration);
 
         /*
          * FIXME: these should become the part of PIB/MIB interface.
diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index 2b3fbbb8669e..e9054a283fde 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -416,13 +416,13 @@ struct iw_spy_data
  * data (i.e. valid as long as struct net_device exist, same locking rules).
  */
 /* Forward declaration */
-struct ieee80211_device;
+struct libipw_device;
 /* The struct */
 struct iw_public_data {
         /* Driver enhanced spy support */
         struct iw_spy_data *            spy_data;
-        /* Structure managed by the in-kernel IEEE 802.11 layer */
-        struct ieee80211_device *       ieee80211;
+        /* Legacy structure managed by the ipw2x00-specific IEEE 802.11 layer */
+        struct libipw_device *          libipw;
 };
 
 /**************************** PROTOTYPES ****************************/
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index e2fb5767e1fa..466859b285e1 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -239,7 +239,14 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_AMPDU: this frame should be sent as part of an A-MPDU
  * @IEEE80211_TX_CTL_INJECTED: Frame was injected, internal to mac80211.
  * @IEEE80211_TX_STAT_TX_FILTERED: The frame was not transmitted
- *      because the destination STA was in powersave mode.
+ *      because the destination STA was in powersave mode. Note that to
+ *      avoid race conditions, the filter must be set by the hardware or
+ *      firmware upon receiving a frame that indicates that the station
+ *      went to sleep (must be done on device to filter frames already on
+ *      the queue) and may only be unset after mac80211 gives the OK for
+ *      that by setting the IEEE80211_TX_CTL_CLEAR_PS_FILT (see above),
+ *      since only then is it guaranteed that no more frames are in the
+ *      hardware queue.
  * @IEEE80211_TX_STAT_ACK: Frame was acknowledged
  * @IEEE80211_TX_STAT_AMPDU: The frame was aggregated, so status
  *      is for the whole aggregation.
@@ -261,6 +268,10 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_PSPOLL_RESPONSE: (internal?)
  *      This frame is a response to a PS-poll frame and should be sent
  *      although the station is in powersave mode.
+ * @IEEE80211_TX_CTL_MORE_FRAMES: More frames will be passed to the
+ *      transmit function after the current frame, this can be used
+ *      by drivers to kick the DMA queue only if unset or when the
+ *      queue gets full.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -281,6 +292,7 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_INTFL_RETRIED              = BIT(15),
         IEEE80211_TX_INTFL_DONT_ENCRYPT         = BIT(16),
         IEEE80211_TX_CTL_PSPOLL_RESPONSE        = BIT(17),
+        IEEE80211_TX_CTL_MORE_FRAMES            = BIT(18),
 };
 
 /**
@@ -338,6 +350,21 @@ enum mac80211_rate_control_flags {
  *
  * When used for transmit status reporting, the driver should
  * always report the rate along with the flags it used.
+ *
+ * &struct ieee80211_tx_info contains an array of these structs
+ * in the control information, and it will be filled by the rate
+ * control algorithm according to what should be sent. For example,
+ * if this array contains, in the format { <idx>, <count> } the
+ * information
+ *    { 3, 2 }, { 2, 2 }, { 1, 4 }, { -1, 0 }, { -1, 0 }
+ * then this means that the frame should be transmitted
+ * up to twice at rate 3, up to twice at rate 2, and up to four
+ * times at rate 1 if it doesn't get acknowledged. Say it gets
+ * acknowledged by the peer after the fifth attempt, the status
+ * information should then contain
+ *   { 3, 2 }, { 2, 2 }, { 1, 1 }, { -1, 0 } ...
+ * since it was transmitted twice at rate 3, twice at rate 2
+ * and once at rate 1 after which we received an acknowledgement.
  */
 struct ieee80211_tx_rate {
         s8 idx;
@@ -556,7 +583,6 @@ enum ieee80211_conf_flags {
 /**
  * enum ieee80211_conf_changed - denotes which configuration changed
  *
- * @_IEEE80211_CONF_CHANGE_RADIO_ENABLED: DEPRECATED
  * @IEEE80211_CONF_CHANGE_LISTEN_INTERVAL: the listen interval changed
  * @IEEE80211_CONF_CHANGE_RADIOTAP: the radiotap flag changed
  * @IEEE80211_CONF_CHANGE_PS: the PS flag or dynamic PS timeout changed
@@ -566,7 +592,6 @@ enum ieee80211_conf_flags {
  * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
  */
 enum ieee80211_conf_changed {
-        _IEEE80211_CONF_CHANGE_RADIO_ENABLED    = BIT(0),
         IEEE80211_CONF_CHANGE_LISTEN_INTERVAL   = BIT(2),
         IEEE80211_CONF_CHANGE_RADIOTAP          = BIT(3),
         IEEE80211_CONF_CHANGE_PS                = BIT(4),
@@ -576,14 +601,6 @@ enum ieee80211_conf_changed {
         IEEE80211_CONF_CHANGE_IDLE              = BIT(8),
 };
 
-static inline __deprecated enum ieee80211_conf_changed
-__IEEE80211_CONF_CHANGE_RADIO_ENABLED(void)
-{
-        return _IEEE80211_CONF_CHANGE_RADIO_ENABLED;
-}
-#define IEEE80211_CONF_CHANGE_RADIO_ENABLED \
-        __IEEE80211_CONF_CHANGE_RADIO_ENABLED()
-
 /**
  * struct ieee80211_conf - configuration of the device
  *
@@ -591,9 +608,6 @@ __IEEE80211_CONF_CHANGE_RADIO_ENABLED(void)
  *
  * @flags: configuration flags defined above
  *
- * @radio_enabled: when zero, driver is required to switch off the radio.
- * @beacon_int: DEPRECATED, DO NOT USE
- *
  * @listen_interval: listen interval in units of beacon interval
  * @max_sleep_period: the maximum number of beacon intervals to sleep for
  *      before checking the beacon for a TIM bit (managed mode only); this
@@ -617,13 +631,11 @@ __IEEE80211_CONF_CHANGE_RADIO_ENABLED(void)
  *    number of transmissions not the number of retries
  */
 struct ieee80211_conf {
-        int __deprecated beacon_int;
         u32 flags;
         int power_level, dynamic_ps_timeout;
         int max_sleep_period;
 
         u16 listen_interval;
-        bool __deprecated radio_enabled;
 
         u8 long_frame_max_tx_count, short_frame_max_tx_count;
 
@@ -1192,10 +1204,13 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * the driver's configure_filter() function which frames should be
  * passed to mac80211 and which should be filtered out.
  *
- * The configure_filter() callback is invoked with the parameters
- * @mc_count and @mc_list for the combined multicast address list
- * of all virtual interfaces, @changed_flags telling which flags
- * were changed and @total_flags with the new flag states.
+ * Before configure_filter() is invoked, the prepare_multicast()
+ * callback is invoked with the parameters @mc_count and @mc_list
+ * for the combined multicast address list of all virtual interfaces.
+ * It's use is optional, and it returns a u64 that is passed to
+ * configure_filter(). Additionally, configure_filter() has the
+ * arguments @changed_flags telling which flags were changed and
+ * @total_flags with the new flag states.
  *
  * If your device has no multicast address filters your driver will
  * need to check both the %FIF_ALLMULTI flag and the @mc_count
@@ -1348,9 +1363,13 @@ enum ieee80211_ampdu_mlme_action {
  *      for association indication. The @changed parameter indicates which
  *      of the bss parameters has changed when a call is made.
  *
+ * @prepare_multicast: Prepare for multicast filter configuration.
+ *      This callback is optional, and its return value is passed
+ *      to configure_filter(). This callback must be atomic.
+ *
  * @configure_filter: Configure the device's RX filter.
  *      See the section "Frame filtering" for more information.
- *      This callback must be implemented and atomic.
+ *      This callback must be implemented.
  *
  * @set_tim: Set TIM bit. mac80211 calls this function when a TIM bit
  *      must be set or cleared for a given STA. Must be atomic.
@@ -1452,10 +1471,12 @@ struct ieee80211_ops {
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_bss_conf *info,
                                  u32 changed);
+        u64 (*prepare_multicast)(struct ieee80211_hw *hw,
+                                 int mc_count, struct dev_addr_list *mc_list);
         void (*configure_filter)(struct ieee80211_hw *hw,
                                  unsigned int changed_flags,
                                  unsigned int *total_flags,
-                                 int mc_count, struct dev_addr_list *mc_list);
+                                 u64 multicast);
         int (*set_tim)(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
                        bool set);
         int (*set_key)(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -1636,12 +1657,6 @@ void ieee80211_free_hw(struct ieee80211_hw *hw);
  */
 void ieee80211_restart_hw(struct ieee80211_hw *hw);
 
-/*
- * trick to avoid symbol clashes with the ieee80211 subsystem,
- * use the inline below instead
- */
-void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb);
-
 /**
  * ieee80211_rx - receive frame
  *
@@ -1657,10 +1672,7 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb);
  * @hw: the hardware this frame came in on
  * @skb: the buffer to receive, owned by mac80211 after this call
  */
-static inline void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
-{
-        __ieee80211_rx(hw, skb);
-}
+void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb);
 
 /**
  * ieee80211_rx_irqsafe - receive frame
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 18b69b6cecaf..3817fda82a80 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -118,7 +118,7 @@ struct neighbour
         int                     (*output)(struct sk_buff *skb);
         struct sk_buff_head     arp_queue;
         struct timer_list       timer;
-        struct neigh_ops        *ops;
+        const struct neigh_ops  *ops;
         u8                      primary_key[0];
 };
 
diff --git a/include/net/netfilter/xt_rateest.h b/include/net/netfilter/xt_rateest.h
index 65d594dffbff..ddbf37e19616 100644
--- a/include/net/netfilter/xt_rateest.h
+++ b/include/net/netfilter/xt_rateest.h
@@ -8,7 +8,7 @@ struct xt_rateest {
         spinlock_t                      lock;
         struct gnet_estimator           params;
         struct gnet_stats_rate_est      rstats;
-        struct gnet_stats_basic         bstats;
+        struct gnet_stats_basic_packed  bstats;
 };
 
 extern struct xt_rateest *xt_rateest_lookup(const char *name);
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index afab4e4cbac7..dfeb2d7c425b 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -6,6 +6,7 @@
 
 #ifndef __NETNS_IPV6_H__
 #define __NETNS_IPV6_H__
+#include <net/dst_ops.h>
 
 struct ctl_table_header;
 
@@ -42,7 +43,7 @@ struct netns_ipv6 {
         struct timer_list       ip6_fib_timer;
         struct hlist_head       *fib_table_hash;
         struct fib6_table       *fib6_main_tbl;
-        struct dst_ops          *ip6_dst_ops;
+        struct dst_ops          ip6_dst_ops;
         unsigned int             ip6_rt_gc_expire;
         unsigned long            ip6_rt_last_gc;
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
diff --git a/include/net/nl802154.h b/include/net/nl802154.h
index 6096096f6d7d..99d2ba1c7e03 100644
--- a/include/net/nl802154.h
+++ b/include/net/nl802154.h
@@ -95,7 +95,7 @@ int ieee802154_nl_disassoc_confirm(struct net_device *dev,
  * Note: This API does not permit the return of an active scan result.
  */
 int ieee802154_nl_scan_confirm(struct net_device *dev,
-                u8 status, u8 scan_type, u32 unscanned,
+                u8 status, u8 scan_type, u32 unscanned, u8 page,
                 u8 *edl/*, struct list_head *pan_desc_list */);
 
 /**
@@ -114,4 +114,13 @@ int ieee802154_nl_scan_confirm(struct net_device *dev,
 int ieee802154_nl_beacon_indic(struct net_device *dev, u16 panid,
                 u16 coord_addr);
 
+/**
+ * ieee802154_nl_start_confirm - Notify userland of completion of start.
+ * @dev: The device which was instructed to scan.
+ * @status: The status of the scan operation.
+ *
+ * Note: This is in section 7.1.14 of the IEEE 802.15.4 document.
+ */
+int ieee802154_nl_start_confirm(struct net_device *dev, u8 status);
+
 #endif
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 85ba560332ed..c3aa044d3fc3 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -70,6 +70,9 @@ struct rtnl_link_ops {
         size_t                  (*get_xstats_size)(const struct net_device *dev);
         int                     (*fill_xstats)(struct sk_buff *skb,
                                                const struct net_device *dev);
+        int                     (*get_tx_queues)(struct net *net, struct nlattr *tb[],
+                                                 unsigned int *tx_queues,
+                                                 unsigned int *real_tx_queues);
 };
 
 extern int      __rtnl_link_register(struct rtnl_link_ops *ops);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 84b3fc2aef0f..88eb9de095de 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -46,6 +46,7 @@ struct Qdisc
 #define TCQ_F_THROTTLED         2
 #define TCQ_F_INGRESS           4
 #define TCQ_F_CAN_BYPASS        8
+#define TCQ_F_MQROOT            16
 #define TCQ_F_WARN_NONWC        (1 << 16)
         int                     padded;
         struct Qdisc_ops        *ops;
@@ -73,13 +74,14 @@ struct Qdisc
          */
         unsigned long           state;
         struct sk_buff_head     q;
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
 };
 
 struct Qdisc_class_ops
 {
         /* Child qdisc manipulation */
+        unsigned int            (*select_queue)(struct Qdisc *, struct tcmsg *);
         int                     (*graft)(struct Qdisc *, unsigned long cl,
                                         struct Qdisc *, struct Qdisc **);
         struct Qdisc *          (*leaf)(struct Qdisc *, unsigned long cl);
@@ -122,6 +124,7 @@ struct Qdisc_ops
         void                    (*reset)(struct Qdisc *);
         void                    (*destroy)(struct Qdisc *);
         int                     (*change)(struct Qdisc *, struct nlattr *arg);
+        void                    (*attach)(struct Qdisc *);
 
         int                     (*dump)(struct Qdisc *, struct sk_buff *);
         int                     (*dump_stats)(struct Qdisc *, struct gnet_dump *);
@@ -255,6 +258,8 @@ static inline void sch_tree_unlock(struct Qdisc *q)
 
 extern struct Qdisc noop_qdisc;
 extern struct Qdisc_ops noop_qdisc_ops;
+extern struct Qdisc_ops pfifo_fast_ops;
+extern struct Qdisc_ops mq_qdisc_ops;
 
 struct Qdisc_class_common
 {
@@ -302,6 +307,8 @@ extern void dev_init_scheduler(struct net_device *dev);
 extern void dev_shutdown(struct net_device *dev);
 extern void dev_activate(struct net_device *dev);
 extern void dev_deactivate(struct net_device *dev);
+extern struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
+                                     struct Qdisc *qdisc);
 extern void qdisc_reset(struct Qdisc *qdisc);
 extern void qdisc_destroy(struct Qdisc *qdisc);
 extern void qdisc_tree_decrease_qlen(struct Qdisc *qdisc, unsigned int n);
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 3b966802e05d..8be5135ff7aa 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -106,6 +106,7 @@ typedef enum {
         SCTP_CMD_ASSOC_SHKEY,    /* generate the association shared keys */
         SCTP_CMD_T1_RETRAN,      /* Mark for retransmission after T1 timeout  */
         SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
+        SCTP_CMD_SEND_MSG,       /* Send the whole use message */
         SCTP_CMD_LAST
 } sctp_verb_t;
 
@@ -139,6 +140,7 @@ typedef union {
         struct sctp_ulpevent *ulpevent;
         struct sctp_packet *packet;
         sctp_sackhdr_t *sackh;
+        struct sctp_datamsg *msg;
 } sctp_arg_t;
 
 /* We are simulating ML type constructors here.
@@ -188,6 +190,7 @@ SCTP_ARG_CONSTRUCTOR(PEER_INIT,	sctp_init_chunk_t *, init)
 SCTP_ARG_CONSTRUCTOR(ULPEVENT,  struct sctp_ulpevent *, ulpevent)
 SCTP_ARG_CONSTRUCTOR(PACKET,    struct sctp_packet *, packet)
 SCTP_ARG_CONSTRUCTOR(SACKH,     sctp_sackhdr_t *, sackh)
+SCTP_ARG_CONSTRUCTOR(DATAMSG,   struct sctp_datamsg *, msg)
 
 typedef struct {
         sctp_arg_t obj;
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index 8bc25f7b04ce..58f714a3b670 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -231,7 +231,7 @@ typedef enum {
         SCTP_SS_LISTENING      = TCP_LISTEN,
         SCTP_SS_ESTABLISHING   = TCP_SYN_SENT,
         SCTP_SS_ESTABLISHED    = TCP_ESTABLISHED,
-        SCTP_SS_DISCONNECTING  = TCP_CLOSING,
+        SCTP_SS_CLOSING        = TCP_CLOSING,
 } sctp_sock_state_t;
 
 /* These functions map various type to printable names.  */
@@ -363,6 +363,13 @@ typedef enum {
         SCTP_SCOPE_UNUSABLE,            /* IPv4 unusable addresses */
 } sctp_scope_t;
 
+typedef enum {
+        SCTP_SCOPE_POLICY_DISABLE,      /* Disable IPv4 address scoping */
+        SCTP_SCOPE_POLICY_ENABLE,       /* Enable IPv4 address scoping */
+        SCTP_SCOPE_POLICY_PRIVATE,      /* Follow draft but allow IPv4 private addresses */
+        SCTP_SCOPE_POLICY_LINK,         /* Follow draft but allow IPv4 link local addresses */
+} sctp_scope_policy_t;
+
 /* Based on IPv4 scoping <draft-stewart-tsvwg-sctp-ipv4-00.txt>,
  * SCTP IPv4 unusable addresses: 0.0.0.0/8, 224.0.0.0/4, 198.18.0.0/24,
  * 192.88.99.0/24.
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index d16a304cbed4..8a6d5297de16 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -486,15 +486,16 @@ static inline __s32 sctp_jitter(__u32 rto)
 }
 
 /* Break down data chunks at this point.  */
-static inline int sctp_frag_point(const struct sctp_sock *sp, int pmtu)
+static inline int sctp_frag_point(const struct sctp_association *asoc, int pmtu)
 {
+        struct sctp_sock *sp = sctp_sk(asoc->base.sk);
         int frag = pmtu;
 
         frag -= sp->pf->af->net_header_len;
         frag -= sizeof(struct sctphdr) + sizeof(struct sctp_data_chunk);
 
-        if (sp->user_frag)
-                frag = min_t(int, frag, sp->user_frag);
+        if (asoc->user_frag)
+                frag = min_t(int, frag, asoc->user_frag);
 
         frag = min_t(int, frag, SCTP_MAX_CHUNK_LEN);
 
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index edfcacf3250e..42d00ced5eb8 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -219,6 +219,15 @@ extern struct sctp_globals {
         /* Flag to idicate if SCTP-AUTH is enabled */
         int auth_enable;
 
+        /*
+         * Policy to control SCTP IPv4 address scoping
+         * 0   - Disable IPv4 address scoping
+         * 1   - Enable IPv4 address scoping
+         * 2   - Selectively allow only IPv4 private addresses
+         * 3   - Selectively allow only IPv4 link local address
+         */
+        int ipv4_scope_policy;
+
         /* Flag to indicate whether computing and verifying checksum
          * is disabled. */
         int checksum_disable;
@@ -252,6 +261,7 @@ extern struct sctp_globals {
 #define sctp_port_hashtable             (sctp_globals.port_hashtable)
 #define sctp_local_addr_list            (sctp_globals.local_addr_list)
 #define sctp_local_addr_lock            (sctp_globals.addr_list_lock)
+#define sctp_scope_policy               (sctp_globals.ipv4_scope_policy)
 #define sctp_addip_enable               (sctp_globals.addip_enable)
 #define sctp_addip_noauth               (sctp_globals.addip_noauth_enable)
 #define sctp_prsctp_enable              (sctp_globals.prsctp_enable)
@@ -628,7 +638,7 @@ struct sctp_datamsg {
         /* Chunks waiting to be submitted to lower layer. */
         struct list_head chunks;
         /* Chunks that have been transmitted. */
-        struct list_head track;
+        size_t msg_size;
         /* Reference counting. */
         atomic_t refcnt;
         /* When is this message no longer interesting to the peer? */
@@ -643,6 +653,7 @@ struct sctp_datamsg {
 struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *,
                                             struct sctp_sndrcvinfo *,
                                             struct msghdr *, int len);
+void sctp_datamsg_free(struct sctp_datamsg *);
 void sctp_datamsg_put(struct sctp_datamsg *);
 void sctp_chunk_fail(struct sctp_chunk *, int error);
 int sctp_chunk_abandoned(struct sctp_chunk *);
@@ -811,22 +822,12 @@ struct sctp_packet {
         /* pointer to the auth chunk for this packet */
         struct sctp_chunk *auth;
 
-        /* This packet contains a COOKIE-ECHO chunk. */
-        __u8 has_cookie_echo;
-
-        /* This packet contains a SACK chunk. */
-        __u8 has_sack;
-
-        /* This packet contains an AUTH chunk */
-        __u8 has_auth;
-
-        /* This packet contains at least 1 DATA chunk */
-        __u8 has_data;
-
-        /* SCTP cannot fragment this packet. So let ip fragment it. */
-        __u8 ipfragok;
-
-        __u8 malloced;
+        u8  has_cookie_echo:1,  /* This packet contains a COOKIE-ECHO chunk. */
+            has_sack:1,         /* This packet contains a SACK chunk. */
+            has_auth:1,         /* This packet contains an AUTH chunk */
+            has_data:1,         /* This packet contains at least 1 DATA chunk */
+            ipfragok:1,         /* So let ip fragment this packet */
+            malloced:1;         /* Is it malloced? */
 };
 
 struct sctp_packet *sctp_packet_init(struct sctp_packet *,
@@ -1567,13 +1568,13 @@ struct sctp_association {
                 __u32   sack_cnt;
 
                 /* These are capabilities which our peer advertised.  */
-                __u8    ecn_capable;     /* Can peer do ECN? */
-                __u8    ipv4_address;    /* Peer understands IPv4 addresses? */
-                __u8    ipv6_address;    /* Peer understands IPv6 addresses? */
-                __u8    hostname_address;/* Peer understands DNS addresses? */
-                __u8    asconf_capable;  /* Does peer support ADDIP? */
-                __u8    prsctp_capable;  /* Can peer do PR-SCTP? */
-                __u8    auth_capable;    /* Is peer doing SCTP-AUTH? */
+                __u8    ecn_capable:1,      /* Can peer do ECN? */
+                        ipv4_address:1,     /* Peer understands IPv4 addresses? */
+                        ipv6_address:1,     /* Peer understands IPv6 addresses? */
+                        hostname_address:1, /* Peer understands DNS addresses? */
+                        asconf_capable:1,   /* Does peer support ADDIP? */
+                        prsctp_capable:1,   /* Can peer do PR-SCTP? */
+                        auth_capable:1;     /* Is peer doing SCTP-AUTH? */
 
                 __u32   adaptation_ind;  /* Adaptation Code point. */
 
@@ -1738,6 +1739,12 @@ struct sctp_association {
          */
         __u32 rwnd_over;
 
+        /* Keeps treack of rwnd pressure.  This happens when we have
+         * a window, but not recevie buffer (i.e small packets).  This one
+         * is releases slowly (1 PMTU at a time ).
+         */
+        __u32 rwnd_press;
+
         /* This is the sndbuf size in use for the association.
          * This corresponds to the sndbuf size for the association,
          * as specified in the sk->sndbuf.
@@ -1756,6 +1763,7 @@ struct sctp_association {
 
         /* The message size at which SCTP fragmentation will occur. */
         __u32 frag_point;
+        __u32 user_frag;
 
         /* Counter used to count INIT errors. */
         int init_err_counter;
@@ -1905,11 +1913,8 @@ struct sctp_association {
 
         __u16 active_key_id;
 
-        /* Need to send an ECNE Chunk? */
-        char need_ecne;
-
-        /* Is it a temporary association? */
-        char temp;
+        __u8 need_ecne:1,       /* Need to send an ECNE Chunk? */
+             temp:1;            /* Is it a temporary association? */
 };
 
 
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 1580c04f68bc..be2334aaf52e 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -210,12 +210,6 @@ enum sctp_sinfo_flags {
 };
 
 
-typedef union {
-        __u8                    raw;
-        struct sctp_initmsg     init;
-        struct sctp_sndrcvinfo  sndrcv;
-} sctp_cmsg_data_t;
-
 /* These are cmsg_types.  */
 typedef enum sctp_cmsg_type {
         SCTP_INIT,              /* 5.2.1 SCTP Initiation Structure */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 88af84306471..b71a446d58f6 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -469,6 +469,7 @@ extern void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
                                       int nonagle);
 extern int tcp_may_send_now(struct sock *sk);
 extern int tcp_retransmit_skb(struct sock *, struct sk_buff *);
+extern void tcp_retransmit_timer(struct sock *sk);
 extern void tcp_xmit_retransmit_queue(struct sock *);
 extern void tcp_simple_retransmit(struct sock *);
 extern int tcp_trim_head(struct sock *, struct sk_buff *, u32);
@@ -521,6 +522,17 @@ extern int tcp_mtu_to_mss(struct sock *sk, int pmtu);
 extern int tcp_mss_to_mtu(struct sock *sk, int mss);
 extern void tcp_mtup_init(struct sock *sk);
 
+static inline void tcp_bound_rto(const struct sock *sk)
+{
+        if (inet_csk(sk)->icsk_rto > TCP_RTO_MAX)
+                inet_csk(sk)->icsk_rto = TCP_RTO_MAX;
+}
+
+static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
+{
+        return (tp->srtt >> 3) + tp->rttvar;
+}
+
 static inline void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)
 {
         tp->pred_flags = htonl((tp->tcp_header_len << 26) |
@@ -1007,6 +1019,11 @@ static inline int keepalive_time_when(const struct tcp_sock *tp)
         return tp->keepalive_time ? : sysctl_tcp_keepalive_time;
 }
 
+static inline int keepalive_probes(const struct tcp_sock *tp)
+{
+        return tp->keepalive_probes ? : sysctl_tcp_keepalive_probes;
+}
+
 static inline int tcp_fin_time(const struct sock *sk)
 {
         int fin_timeout = tcp_sk(sk)->linger2 ? : sysctl_tcp_fin_timeout;
@@ -1169,7 +1186,7 @@ extern int			tcp_v4_md5_do_del(struct sock *sk,
 #define tcp_twsk_md5_key(twsk)  NULL
 #endif
 
-extern struct tcp_md5sig_pool   **tcp_alloc_md5sig_pool(void);
+extern struct tcp_md5sig_pool   **tcp_alloc_md5sig_pool(struct sock *);
 extern void                     tcp_free_md5sig_pool(void);
 
 extern struct tcp_md5sig_pool   *__tcp_get_md5sig_pool(int cpu);
@@ -1235,6 +1252,29 @@ static inline struct sk_buff *tcp_write_queue_prev(struct sock *sk, struct sk_bu
 #define tcp_for_write_queue_from_safe(skb, tmp, sk)                     \
         skb_queue_walk_from_safe(&(sk)->sk_write_queue, skb, tmp)
 
+/* This function calculates a "timeout" which is equivalent to the timeout of a
+ * TCP connection after "boundary" unsucessful, exponentially backed-off
+ * retransmissions with an initial RTO of TCP_RTO_MIN.
+ */
+static inline bool retransmits_timed_out(const struct sock *sk,
+                                         unsigned int boundary)
+{
+        unsigned int timeout, linear_backoff_thresh;
+
+        if (!inet_csk(sk)->icsk_retransmits)
+                return false;
+
+        linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
+
+        if (boundary <= linear_backoff_thresh)
+                timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
+        else
+                timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+                          (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
+
+        return (tcp_time_stamp - tcp_sk(sk)->retrans_stamp) >= timeout;
+}
+
 static inline struct sk_buff *tcp_send_head(struct sock *sk)
 {
         return sk->sk_send_head;
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index bfb240c6cf79..d65381cad0fc 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -51,7 +51,7 @@ extern int			datagram_send_ctl(struct net *net,
 /*
  *      address family specific functions
  */
-extern struct inet_connection_sock_af_ops ipv4_specific;
+extern const struct inet_connection_sock_af_ops ipv4_specific;
 
 extern void inet6_destroy_sock(struct sock *sk);
 
diff --git a/include/net/wpan-phy.h b/include/net/wpan-phy.h
new file mode 100644
index 000000000000..547b1e271ac9
--- /dev/null
+++ b/include/net/wpan-phy.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ */
+
+#ifndef WPAN_PHY_H
+#define WPAN_PHY_H
+
+#include <linux/netdevice.h>
+#include <linux/mutex.h>
+
+struct wpan_phy {
+        struct mutex pib_lock;
+
+        /*
+         * This is a PIB acording to 802.15.4-2006.
+         * We do not provide timing-related variables, as they
+         * aren't used outside of driver
+         */
+        u8 current_channel;
+        u8 current_page;
+        u32 channels_supported;
+        u8 transmit_power;
+        u8 cca_mode;
+
+        struct device dev;
+        int idx;
+
+        char priv[0] __attribute__((__aligned__(NETDEV_ALIGN)));
+};
+
+struct wpan_phy *wpan_phy_alloc(size_t priv_size);
+int wpan_phy_register(struct device *parent, struct wpan_phy *phy);
+void wpan_phy_unregister(struct wpan_phy *phy);
+void wpan_phy_free(struct wpan_phy *phy);
+
+static inline void *wpan_phy_priv(struct wpan_phy *phy)
+{
+        BUG_ON(!phy);
+        return &phy->priv;
+}
+
+struct wpan_phy *wpan_phy_find(const char *str);
+static inline const char *wpan_phy_name(struct wpan_phy *phy)
+{
+        return dev_name(&phy->dev);
+}
+#endif