58 files changed, 891 insertions, 903 deletions
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index a9441249306c..23710aa6a181 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -1,8 +1,6 @@
 #ifndef _ADDRCONF_H
 #define _ADDRCONF_H
-#define RETRANS_TIMER   HZ
 #define MAX_RTR_SOLICITATIONS           3
 #define RTR_SOLICITATION_INTERVAL       (4*HZ)
diff --git a/include/net/ah.h b/include/net/ah.h
index f0129f79a31a..ca95b98969dd 100644
--- a/include/net/ah.h
+++ b/include/net/ah.h
@@ -4,7 +4,7 @@
 #include <linux/skbuff.h>
 /* This is the maximum truncated ICV length that we know of. */
-#define MAX_AH_AUTH_LEN 12
+#define MAX_AH_AUTH_LEN 64
 struct crypto_ahash;
diff --git a/include/net/arp.h b/include/net/arp.h
index f4cf6ce66586..91f0568a04ef 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -25,5 +25,6 @@ extern struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
                                  const unsigned char *src_hw,
                                  const unsigned char *target_hw);
 extern void arp_xmit(struct sk_buff *skb);
+int arp_invalidate(struct net_device *dev, __be32 ip);
 #endif  /* _ARP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index d81ea7997701..0c5e72503b77 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -144,6 +144,7 @@ struct bt_skb_cb {
        __u8 tx_seq;
        __u8 retries;
        __u8 sar;
+        unsigned short channel;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index e30e00834340..29a7a8ca0438 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -1,4 +1,4 @@
-/* 
+/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated
@@ -12,13 +12,13 @@
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
 */
@@ -489,7 +489,7 @@ struct hci_rp_read_local_name {
 #define HCI_OP_WRITE_PG_TIMEOUT         0x0c18
-#define HCI_OP_WRITE_SCAN_ENABLE        0x0c1a
+#define HCI_OP_WRITE_SCAN_ENABLE        0x0c1a
        #define SCAN_DISABLED           0x00
        #define SCAN_INQUIRY            0x01
        #define SCAN_PAGE               0x02
@@ -874,7 +874,7 @@ struct hci_ev_si_security {
 struct hci_command_hdr {
        __le16  opcode;         /* OCF & OGF */
-        __u8    plen;
+        __u8    plen;
 } __packed;
 struct hci_event_hdr {
@@ -934,9 +934,13 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
 struct sockaddr_hci {
        sa_family_t    hci_family;
        unsigned short hci_dev;
+        unsigned short hci_channel;
 };
 #define HCI_DEV_NONE    0xffff
+#define HCI_CHANNEL_RAW         0
+#define HCI_CHANNEL_CONTROL     1
 struct hci_filter {
        unsigned long type_mask;
        unsigned long event_mask[2];
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ebec8c9a929d..a29feb01854e 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -44,15 +44,15 @@ struct inquiry_data {
 };
 struct inquiry_entry {
-        struct inquiry_entry    *next;
+        struct inquiry_entry    *next;
        __u32                   timestamp;
        struct inquiry_data     data;
 };
 struct inquiry_cache {
-        spinlock_t              lock;
+        spinlock_t              lock;
        __u32                   timestamp;
-        struct inquiry_entry    *list;
+        struct inquiry_entry    *list;
 };
 struct hci_conn_hash {
@@ -129,6 +129,7 @@ struct hci_dev {
        wait_queue_head_t       req_wait_q;
        __u32                   req_status;
        __u32                   req_result;
+        __u16                   req_last_cmd;
        struct inquiry_cache    inq_cache;
        struct hci_conn_hash    conn_hash;
@@ -141,7 +142,7 @@ struct hci_dev {
        void                    *driver_data;
        void                    *core_data;
-        atomic_t                promisc;
+        atomic_t                promisc;
        struct dentry           *debugfs;
@@ -150,7 +151,7 @@ struct hci_dev {
        struct rfkill           *rfkill;
-        struct module           *owner;
+        struct module           *owner;
        int (*open)(struct hci_dev *hdev);
        int (*close)(struct hci_dev *hdev);
@@ -215,8 +216,8 @@ extern rwlock_t hci_dev_list_lock;
 extern rwlock_t hci_cb_list_lock;
 /* ----- Inquiry cache ----- */
-#define INQUIRY_CACHE_AGE_MAX   (HZ*30)   // 30 seconds
+#define INQUIRY_CACHE_AGE_MAX   (HZ*30)   /* 30 seconds */
-#define INQUIRY_ENTRY_AGE_MAX   (HZ*60)   // 60 seconds
+#define INQUIRY_ENTRY_AGE_MAX   (HZ*60)   /* 60 seconds */
 #define inquiry_cache_lock(c)           spin_lock(&c->lock)
 #define inquiry_cache_unlock(c)         spin_unlock(&c->lock)
@@ -660,6 +661,11 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data);
 /* ----- HCI Sockets ----- */
 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb);
+/* Management interface */
+int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
+int mgmt_index_added(u16 index);
+int mgmt_index_removed(u16 index);
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
@@ -668,6 +674,7 @@ struct hci_pinfo {
        struct hci_dev    *hdev;
        struct hci_filter filter;
        __u32             cmsg_mask;
+        unsigned short   channel;
 };
 /* HCI security filter */
@@ -687,6 +694,6 @@ struct hci_sec_filter {
 #define hci_req_lock(d)         mutex_lock(&d->req_lock)
 #define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
-void hci_req_complete(struct hci_dev *hdev, int result);
+void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result);
 #endif /* __HCI_CORE_H */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index c819c8bf9b68..7ad25ca60ec0 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -1,4 +1,4 @@
-/* 
+/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated
   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
@@ -14,13 +14,13 @@
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
 */
@@ -417,11 +417,11 @@ static inline int l2cap_tx_window_full(struct sock *sk)
        return sub == pi->remote_tx_win;
 }
-#define __get_txseq(ctrl) ((ctrl) & L2CAP_CTRL_TXSEQ) >> 1
+#define __get_txseq(ctrl)       (((ctrl) & L2CAP_CTRL_TXSEQ) >> 1)
-#define __get_reqseq(ctrl) ((ctrl) & L2CAP_CTRL_REQSEQ) >> 8
+#define __get_reqseq(ctrl)      (((ctrl) & L2CAP_CTRL_REQSEQ) >> 8)
-#define __is_iframe(ctrl) !((ctrl) & L2CAP_CTRL_FRAME_TYPE)
+#define __is_iframe(ctrl)       (!((ctrl) & L2CAP_CTRL_FRAME_TYPE))
-#define __is_sframe(ctrl) (ctrl) & L2CAP_CTRL_FRAME_TYPE
+#define __is_sframe(ctrl)       ((ctrl) & L2CAP_CTRL_FRAME_TYPE)
-#define __is_sar_start(ctrl) ((ctrl) & L2CAP_CTRL_SAR) == L2CAP_SDU_START
+#define __is_sar_start(ctrl)    (((ctrl) & L2CAP_CTRL_SAR) == L2CAP_SDU_START)
 void l2cap_load(void);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
new file mode 100644
index 000000000000..ca29c1367ffd
--- /dev/null
+++ b/include/net/bluetooth/mgmt.h
@@ -0,0 +1,87 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2010  Nokia Corporation
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+struct mgmt_hdr {
+        __le16 opcode;
+        __le16 len;
+} __packed;
+#define MGMT_HDR_SIZE                   4
+#define MGMT_OP_READ_VERSION            0x0001
+struct mgmt_rp_read_version {
+        __u8 version;
+        __le16 revision;
+} __packed;
+#define MGMT_OP_READ_INDEX_LIST         0x0003
+struct mgmt_rp_read_index_list {
+        __le16 num_controllers;
+        __le16 index[0];
+} __packed;
+#define MGMT_OP_READ_INFO               0x0004
+struct mgmt_cp_read_info {
+        __le16 index;
+} __packed;
+struct mgmt_rp_read_info {
+        __le16 index;
+        __u8 type;
+        __u8 powered;
+        __u8 discoverable;
+        __u8 pairable;
+        __u8 sec_mode;
+        bdaddr_t bdaddr;
+        __u8 dev_class[3];
+        __u8 features[8];
+        __u16 manufacturer;
+        __u8 hci_ver;
+        __u16 hci_rev;
+} __packed;
+#define MGMT_EV_CMD_COMPLETE            0x0001
+struct mgmt_ev_cmd_complete {
+        __le16 opcode;
+        __u8 data[0];
+} __packed;
+#define MGMT_EV_CMD_STATUS              0x0002
+struct mgmt_ev_cmd_status {
+        __u8 status;
+        __le16 opcode;
+} __packed;
+#define MGMT_EV_CONTROLLER_ERROR        0x0003
+struct mgmt_ev_controller_error {
+        __le16 index;
+        __u8 error_code;
+} __packed;
+#define MGMT_EV_INDEX_ADDED             0x0004
+struct mgmt_ev_index_added {
+        __le16 index;
+} __packed;
+#define MGMT_EV_INDEX_REMOVED           0x0005
+struct mgmt_ev_index_removed {
+        __le16 index;
+} __packed;
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 71047bc0af84..6eac4a760c3b 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -1,5 +1,5 @@
-/* 
+/*
-   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
+   RFCOMM implementation for Linux Bluetooth stack (BlueZ)
   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
@@ -11,13 +11,13 @@
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
 */
@@ -105,7 +105,7 @@
 struct rfcomm_hdr {
        u8 addr;
        u8 ctrl;
-        u8 len;    // Actual size can be 2 bytes
+        u8 len;    /* Actual size can be 2 bytes */
 } __packed;
 struct rfcomm_cmd {
@@ -228,7 +228,7 @@ struct rfcomm_dlc {
 /* ---- RFCOMM SEND RPN ---- */
 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
                        u8 bit_rate, u8 data_bits, u8 stop_bits,
-                        u8 parity, u8 flow_ctrl_settings, 
+                        u8 parity, u8 flow_ctrl_settings,
                        u8 xon_char, u8 xoff_char, u16 param_mask);
 /* ---- RFCOMM DLCs (channels) ---- */
diff --git a/include/net/bluetooth/sco.h b/include/net/bluetooth/sco.h
index e28a2a771471..1e35c43657c8 100644
--- a/include/net/bluetooth/sco.h
+++ b/include/net/bluetooth/sco.h
@@ -1,4 +1,4 @@
-/* 
+/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated
@@ -12,13 +12,13 @@
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
 */
@@ -55,11 +55,11 @@ struct sco_conninfo {
 struct sco_conn {
        struct hci_conn *hcon;
-        bdaddr_t        *dst;
+        bdaddr_t        *dst;
-        bdaddr_t        *src;
+        bdaddr_t        *src;
-        
        spinlock_t      lock;
-        struct sock     *sk;
+        struct sock     *sk;
        unsigned int    mtu;
 };
diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
index 9402543fc20d..e54f6396fa4c 100644
--- a/include/net/caif/cfctrl.h
+++ b/include/net/caif/cfctrl.h
@@ -51,7 +51,7 @@ struct cfctrl_rsp {
        void (*restart_rsp)(void);
        void (*radioset_rsp)(void);
        void (*reject_rsp)(struct cflayer *layer, u8 linkid,
-                                struct cflayer *client_layer);;
+                                struct cflayer *client_layer);
 };
 /* Link Setup Parameters for CAIF-Links. */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 97b8b7c9b63c..1322695beb52 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -258,13 +258,9 @@ struct ieee80211_supported_band {
 /**
 * struct vif_params - describes virtual interface parameters
- * @mesh_id: mesh ID to use
- * @mesh_id_len: length of the mesh ID
 * @use_4addr: use 4-address frames
 */
 struct vif_params {
-       u8 *mesh_id;
-       int mesh_id_len;
       int use_4addr;
 };
@@ -424,6 +420,7 @@ struct station_parameters {
 * @STATION_INFO_TX_RETRIES: @tx_retries filled
 * @STATION_INFO_TX_FAILED: @tx_failed filled
 * @STATION_INFO_RX_DROP_MISC: @rx_dropped_misc filled
+ * @STATION_INFO_SIGNAL_AVG: @signal_avg filled
 */
 enum station_info_flags {
        STATION_INFO_INACTIVE_TIME      = 1<<0,
@@ -439,6 +436,7 @@ enum station_info_flags {
        STATION_INFO_TX_RETRIES         = 1<<10,
        STATION_INFO_TX_FAILED          = 1<<11,
        STATION_INFO_RX_DROP_MISC       = 1<<12,
+        STATION_INFO_SIGNAL_AVG         = 1<<13,
 };
 /**
@@ -485,6 +483,7 @@ struct rate_info {
 * @plid: mesh peer link id
 * @plink_state: mesh peer link state
 * @signal: signal strength of last received packet in dBm
+ * @signal_avg: signal strength average in dBm
 * @txrate: current unicast bitrate to this station
 * @rx_packets: packets received from this station
 * @tx_packets: packets transmitted to this station
@@ -505,6 +504,7 @@ struct station_info {
        u16 plid;
        u8 plink_state;
        s8 signal;
+        s8 signal_avg;
        struct rate_info txrate;
        u32 rx_packets;
        u32 tx_packets;
@@ -605,6 +605,8 @@ struct mpath_info {
 *      (or NULL for no change)
 * @basic_rates_len: number of basic rates
 * @ap_isolate: do not forward packets between connected stations
+ * @ht_opmode: HT Operation mode
+ *      (u16 = opmode, -1 = do not change)
 */
 struct bss_parameters {
        int use_cts_prot;
@@ -613,8 +615,14 @@ struct bss_parameters {
        u8 *basic_rates;
        u8 basic_rates_len;
        int ap_isolate;
+        int ht_opmode;
 };
+/*
+ * struct mesh_config - 802.11s mesh configuration
+ *
+ * These parameters can be changed while the mesh is active.
+ */
 struct mesh_config {
        /* Timeouts in ms */
        /* Mesh plink management parameters */
@@ -624,6 +632,8 @@ struct mesh_config {
        u16 dot11MeshMaxPeerLinks;
        u8  dot11MeshMaxRetries;
        u8  dot11MeshTTL;
+        /* ttl used in path selection information elements */
+        u8  element_ttl;
        bool auto_open_plinks;
        /* HWMP parameters */
        u8  dot11MeshHWMPmaxPREQretries;
@@ -636,6 +646,26 @@ struct mesh_config {
 };
 /**
+ * struct mesh_setup - 802.11s mesh setup configuration
+ * @mesh_id: the mesh ID
+ * @mesh_id_len: length of the mesh ID, at least 1 and at most 32 bytes
+ * @path_sel_proto: which path selection protocol to use
+ * @path_metric: which metric to use
+ * @vendor_ie: vendor information elements (optional)
+ * @vendor_ie_len: length of vendor information elements
+ *
+ * These parameters are fixed when the mesh is created.
+ */
+struct mesh_setup {
+        const u8 *mesh_id;
+        u8 mesh_id_len;
+        u8  path_sel_proto;
+        u8  path_metric;
+        const u8 *vendor_ie;
+        u8 vendor_ie_len;
+};
+/**
 * struct ieee80211_txq_params - TX queue parameters
 * @queue: TX queue identifier (NL80211_TXQ_Q_*)
 * @txop: Maximum burst time in units of 32 usecs, 0 meaning disabled
@@ -923,6 +953,7 @@ struct cfg80211_disassoc_request {
 * @privacy: this is a protected network, keys will be configured
 *      after joining
 * @basic_rates: bitmap of basic rates to use when creating the IBSS
+ * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
 */
 struct cfg80211_ibss_params {
        u8 *ssid;
@@ -934,6 +965,7 @@ struct cfg80211_ibss_params {
        u32 basic_rates;
        bool channel_fixed;
        bool privacy;
+        int mcast_rate[IEEE80211_NUM_BANDS];
 };
 /**
@@ -1029,7 +1061,8 @@ struct cfg80211_pmksa {
 *
 * @add_virtual_intf: create a new virtual interface with the given name,
 *      must set the struct wireless_dev's iftype. Beware: You must create
- *      the new netdev in the wiphy's network namespace!
+ *      the new netdev in the wiphy's network namespace! Returns the netdev,
+ *      or an ERR_PTR.
 *
 * @del_virtual_intf: remove the virtual interface determined by ifindex.
 *
@@ -1070,10 +1103,12 @@ struct cfg80211_pmksa {
 * @change_mpath: change a given mesh path
 * @get_mpath: get a mesh path for the given parameters
 * @dump_mpath: dump mesh path callback -- resume dump at index @idx
+ * @join_mesh: join the mesh network with the specified parameters
+ * @leave_mesh: leave the current mesh network
 *
- * @get_mesh_params: Put the current mesh parameters into *params
+ * @get_mesh_config: Get the current mesh configuration
 *
- * @set_mesh_params: Set mesh parameters.
+ * @update_mesh_config: Update mesh parameters on a running mesh.
 *      The mask is a bitfield which tells us which parameters to
 *      set, and which to leave alone.
 *
@@ -1132,7 +1167,9 @@ struct cfg80211_pmksa {
 * @cancel_remain_on_channel: Cancel an on-going remain-on-channel operation.
 *      This allows the operation to be terminated prior to timeout based on
 *      the duration value.
- * @mgmt_tx: Transmit a management frame
+ * @mgmt_tx: Transmit a management frame.
+ * @mgmt_tx_cancel_wait: Cancel the wait time from transmitting a management
+ *      frame on another channel
 *
 * @testmode_cmd: run a test mode command
 *
@@ -1150,14 +1187,23 @@ struct cfg80211_pmksa {
 * @mgmt_frame_register: Notify driver that a management frame type was
 *      registered. Note that this callback may not sleep, and cannot run
 *      concurrently with itself.
+ *
+ * @set_antenna: Set antenna configuration (tx_ant, rx_ant) on the device.
+ *      Parameters are bitmaps of allowed antennas to use for TX/RX. Drivers may
+ *      reject TX/RX mask combinations they cannot support by returning -EINVAL
+ *      (also see nl80211.h @NL80211_ATTR_WIPHY_ANTENNA_TX).
+ *
+ * @get_antenna: Get current antenna configuration from device (tx_ant, rx_ant).
 */
 struct cfg80211_ops {
        int     (*suspend)(struct wiphy *wiphy);
        int     (*resume)(struct wiphy *wiphy);
-        int     (*add_virtual_intf)(struct wiphy *wiphy, char *name,
+        struct net_device * (*add_virtual_intf)(struct wiphy *wiphy,
-                                    enum nl80211_iftype type, u32 *flags,
+                                                char *name,
-                                    struct vif_params *params);
+                                                enum nl80211_iftype type,
+                                                u32 *flags,
+                                                struct vif_params *params);
        int     (*del_virtual_intf)(struct wiphy *wiphy, struct net_device *dev);
        int     (*change_virtual_intf)(struct wiphy *wiphy,
                                       struct net_device *dev,
@@ -1175,7 +1221,7 @@ struct cfg80211_ops {
                           u8 key_index, bool pairwise, const u8 *mac_addr);
        int     (*set_default_key)(struct wiphy *wiphy,
                                   struct net_device *netdev,
-                                   u8 key_index);
+                                   u8 key_index, bool unicast, bool multicast);
        int     (*set_default_mgmt_key)(struct wiphy *wiphy,
                                        struct net_device *netdev,
                                        u8 key_index);
@@ -1210,12 +1256,17 @@ struct cfg80211_ops {
        int     (*dump_mpath)(struct wiphy *wiphy, struct net_device *dev,
                               int idx, u8 *dst, u8 *next_hop,
                               struct mpath_info *pinfo);
-        int     (*get_mesh_params)(struct wiphy *wiphy,
+        int     (*get_mesh_config)(struct wiphy *wiphy,
                                struct net_device *dev,
                                struct mesh_config *conf);
-        int     (*set_mesh_params)(struct wiphy *wiphy,
+        int     (*update_mesh_config)(struct wiphy *wiphy,
-                                struct net_device *dev,
+                                      struct net_device *dev, u32 mask,
-                                const struct mesh_config *nconf, u32 mask);
+                                      const struct mesh_config *nconf);
+        int     (*join_mesh)(struct wiphy *wiphy, struct net_device *dev,
+                             const struct mesh_config *conf,
+                             const struct mesh_setup *setup);
+        int     (*leave_mesh)(struct wiphy *wiphy, struct net_device *dev);
        int     (*change_bss)(struct wiphy *wiphy, struct net_device *dev,
                              struct bss_parameters *params);
@@ -1289,10 +1340,13 @@ struct cfg80211_ops {
                                            u64 cookie);
        int     (*mgmt_tx)(struct wiphy *wiphy, struct net_device *dev,
-                          struct ieee80211_channel *chan,
+                          struct ieee80211_channel *chan, bool offchan,
                          enum nl80211_channel_type channel_type,
-                          bool channel_type_valid,
+                          bool channel_type_valid, unsigned int wait,
                          const u8 *buf, size_t len, u64 *cookie);
+        int     (*mgmt_tx_cancel_wait)(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       u64 cookie);
        int     (*set_power_mgmt)(struct wiphy *wiphy, struct net_device *dev,
                                  bool enabled, int timeout);
@@ -1304,6 +1358,9 @@ struct cfg80211_ops {
        void    (*mgmt_frame_register)(struct wiphy *wiphy,
                                       struct net_device *dev,
                                       u16 frame_type, bool reg);
+        int     (*set_antenna)(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant);
+        int     (*get_antenna)(struct wiphy *wiphy, u32 *tx_ant, u32 *rx_ant);
 };
 /*
@@ -1321,13 +1378,14 @@ struct cfg80211_ops {
 *      initiator is %REGDOM_SET_BY_CORE).
 * @WIPHY_FLAG_STRICT_REGULATORY: tells us the driver for this device will
 *      ignore regulatory domain settings until it gets its own regulatory
- *      domain via its regulatory_hint(). After its gets its own regulatory
+ *      domain via its regulatory_hint() unless the regulatory hint is
- *      domain it will only allow further regulatory domain settings to
+ *      from a country IE. After its gets its own regulatory domain it will
- *      further enhance compliance. For example if channel 13 and 14 are
+ *      only allow further regulatory domain settings to further enhance
- *      disabled by this regulatory domain no user regulatory domain can
+ *      compliance. For example if channel 13 and 14 are disabled by this
- *      enable these channels at a later time. This can be used for devices
+ *      regulatory domain no user regulatory domain can enable these channels
- *      which do not have calibration information gauranteed for frequencies
+ *      at a later time. This can be used for devices which do not have
- *      or settings outside of its regulatory domain.
+ *      calibration information guaranteed for frequencies or settings
+ *      outside of its regulatory domain.
 * @WIPHY_FLAG_DISABLE_BEACON_HINTS: enable this if your driver needs to ensure
 *      that passive scan flags and beaconing flags may not be lifted by
 *      cfg80211 due to regulatory beacon hints. For more information on beacon
@@ -1345,6 +1403,8 @@ struct cfg80211_ops {
 *      control port protocol ethertype. The device also honours the
 *      control_port_no_encrypt flag.
 * @WIPHY_FLAG_IBSS_RSN: The device supports IBSS RSN.
+ * @WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS: The device supports separate
+ *      unicast and multicast TX keys.
 */
 enum wiphy_flags {
        WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
@@ -1356,6 +1416,7 @@ enum wiphy_flags {
        WIPHY_FLAG_4ADDR_STATION                = BIT(6),
        WIPHY_FLAG_CONTROL_PORT_PROTOCOL        = BIT(7),
        WIPHY_FLAG_IBSS_RSN                     = BIT(8),
+        WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS= BIT(9),
 };
 struct mac_address {
@@ -1368,7 +1429,9 @@ struct ieee80211_txrx_stypes {
 /**
 * struct wiphy - wireless hardware description
- * @reg_notifier: the driver's regulatory notification callback
+ * @reg_notifier: the driver's regulatory notification callback,
+ *      note that if your driver uses wiphy_apply_custom_regulatory()
+ *      the reg_notifier's request can be passed as NULL
 * @regd: the driver's regulatory domain, if one was requested via
 *      the regulatory_hint() API. This can be used by the driver
 *      on the reg_notifier() if it chooses to ignore future
@@ -1420,6 +1483,17 @@ struct ieee80211_txrx_stypes {
 * @mgmt_stypes: bitmasks of frame subtypes that can be subscribed to or
 *      transmitted through nl80211, points to an array indexed by interface
 *      type
+ *
+ * @available_antennas_tx: bitmap of antennas which are available to be
+ *      configured as TX antennas. Antenna configuration commands will be
+ *      rejected unless this or @available_antennas_rx is set.
+ *
+ * @available_antennas_rx: bitmap of antennas which are available to be
+ *      configured as RX antennas. Antenna configuration commands will be
+ *      rejected unless this or @available_antennas_tx is set.
+ *
+ * @max_remain_on_channel_duration: Maximum time a remain-on-channel operation
+ *      may request, if implemented.
 */
 struct wiphy {
        /* assign these fields before you register the wiphy */
@@ -1457,8 +1531,13 @@ struct wiphy {
        char fw_version[ETHTOOL_BUSINFO_LEN];
        u32 hw_version;
+        u16 max_remain_on_channel_duration;
        u8 max_num_pmkids;
+        u32 available_antennas_tx;
+        u32 available_antennas_rx;
        /* If multiple wiphys are registered and you're handed e.g.
         * a regular netdev with assigned ieee80211_ptr, you won't
         * know whether it points to a wiphy your driver has registered
@@ -1624,6 +1703,8 @@ struct cfg80211_cached_keys;
 * @bssid: (private) Used by the internal configuration code
 * @ssid: (private) Used by the internal configuration code
 * @ssid_len: (private) Used by the internal configuration code
+ * @mesh_id_len: (private) Used by the internal configuration code
+ * @mesh_id_up_len: (private) Used by the internal configuration code
 * @wext: (private) Used by the internal wireless extensions compat code
 * @use_4addr: indicates 4addr mode is used on this interface, must be
 *      set by driver (if supported) on add_interface BEFORE registering the
@@ -1653,7 +1734,7 @@ struct wireless_dev {
        /* currently used for IBSS and SME - might be rearranged later */
        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        u8 ssid_len;
+        u8 ssid_len, mesh_id_len, mesh_id_up_len;
        enum {
                CFG80211_SME_IDLE,
                CFG80211_SME_CONNECTING,
@@ -2297,6 +2378,32 @@ void __cfg80211_send_disassoc(struct net_device *dev, const u8 *buf,
        size_t len);
 /**
+ * cfg80211_send_unprot_deauth - notification of unprotected deauthentication
+ * @dev: network device
+ * @buf: deauthentication frame (header + body)
+ * @len: length of the frame data
+ *
+ * This function is called whenever a received Deauthentication frame has been
+ * dropped in station mode because of MFP being used but the Deauthentication
+ * frame was not protected. This function may sleep.
+ */
+void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
+                                 size_t len);
+/**
+ * cfg80211_send_unprot_disassoc - notification of unprotected disassociation
+ * @dev: network device
+ * @buf: disassociation frame (header + body)
+ * @len: length of the frame data
+ *
+ * This function is called whenever a received Disassociation frame has been
+ * dropped in station mode because of MFP being used but the Disassociation
+ * frame was not protected. This function may sleep.
+ */
+void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
+                                   size_t len);
+/**
 * cfg80211_michael_mic_failure - notification of Michael MIC failure (TKIP)
 * @dev: network device
 * @addr: The source MAC address of the frame
@@ -2595,6 +2702,18 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
                              enum nl80211_cqm_rssi_threshold_event rssi_event,
                              gfp_t gfp);
+/**
+ * cfg80211_cqm_pktloss_notify - notify userspace about packetloss to peer
+ * @dev: network device
+ * @peer: peer's MAC address
+ * @num_packets: how many packets were lost -- should be a fixed threshold
+ *      but probably no less than maybe 50, or maybe a throughput dependent
+ *      threshold (to account for temporary interference)
+ * @gfp: context flags
+ */
+void cfg80211_cqm_pktloss_notify(struct net_device *dev,
+                                 const u8 *peer, u32 num_packets, gfp_t gfp);
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/dcbevent.h b/include/net/dcbevent.h
new file mode 100644
index 000000000000..bc1e7ef40171
--- /dev/null
+++ b/include/net/dcbevent.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2010, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * Author: John Fastabend <john.r.fastabend@intel.com>
+ */
+#ifndef _DCB_EVENT_H
+#define _DCB_EVENT_H
+enum dcbevent_notif_type {
+        DCB_APP_EVENT = 1,
+};
+extern int register_dcbevent_notifier(struct notifier_block *nb);
+extern int unregister_dcbevent_notifier(struct notifier_block *nb);
+extern int call_dcbevent_notifiers(unsigned long val, void *v);
+#endif
diff --git a/include/net/dcbnl.h b/include/net/dcbnl.h
index b36ac7e0914d..a8e7852b10ab 100644
--- a/include/net/dcbnl.h
+++ b/include/net/dcbnl.h
@@ -20,11 +20,31 @@
 #ifndef __NET_DCBNL_H__
 #define __NET_DCBNL_H__
+#include <linux/dcbnl.h>
+struct dcb_app_type {
+        char              name[IFNAMSIZ];
+        struct dcb_app    app;
+        struct list_head  list;
+};
+u8 dcb_setapp(struct net_device *, struct dcb_app *);
+u8 dcb_getapp(struct net_device *, struct dcb_app *);
 /*
 * Ops struct for the netlink callbacks.  Used by DCB-enabled drivers through
 * the netdevice struct.
 */
 struct dcbnl_rtnl_ops {
+        /* IEEE 802.1Qaz std */
+        int (*ieee_getets) (struct net_device *, struct ieee_ets *);
+        int (*ieee_setets) (struct net_device *, struct ieee_ets *);
+        int (*ieee_getpfc) (struct net_device *, struct ieee_pfc *);
+        int (*ieee_setpfc) (struct net_device *, struct ieee_pfc *);
+        int (*ieee_getapp) (struct net_device *, struct dcb_app *);
+        int (*ieee_setapp) (struct net_device *, struct dcb_app *);
+        /* CEE std */
        u8   (*getstate)(struct net_device *);
        u8   (*setstate)(struct net_device *, u8);
        void (*getpermhwaddr)(struct net_device *, u8 *);
@@ -50,6 +70,14 @@ struct dcbnl_rtnl_ops {
        void (*setbcnrp)(struct net_device *, int, u8);
        u8   (*setapp)(struct net_device *, u8, u16, u8);
        u8   (*getapp)(struct net_device *, u8, u16);
+        u8   (*getfeatcfg)(struct net_device *, int, u8 *);
+        u8   (*setfeatcfg)(struct net_device *, int, u8);
+        /* DCBX configuration */
+        u8   (*getdcbx)(struct net_device *);
+        u8   (*setdcbx)(struct net_device *, u8);
 };
 #endif /* __NET_DCBNL_H__ */
diff --git a/include/net/dn_dev.h b/include/net/dn_dev.h
index 0916bbf3bdff..b9e32db03f20 100644
--- a/include/net/dn_dev.h
+++ b/include/net/dn_dev.h
@@ -5,13 +5,14 @@
 struct dn_dev;
 struct dn_ifaddr {
-        struct dn_ifaddr *ifa_next;
+        struct dn_ifaddr __rcu *ifa_next;
        struct dn_dev    *ifa_dev;
        __le16            ifa_local;
        __le16            ifa_address;
        __u8              ifa_flags;
        __u8              ifa_scope;
        char              ifa_label[IFNAMSIZ];
+        struct rcu_head   rcu;
 };
 #define DN_DEV_S_RU  0 /* Run - working normally   */
@@ -83,7 +84,7 @@ struct dn_dev_parms {
 struct dn_dev {
-        struct dn_ifaddr *ifa_list;
+        struct dn_ifaddr __rcu *ifa_list;
        struct net_device *dev;
        struct dn_dev_parms parms;
        char use_long;
@@ -171,19 +172,27 @@ extern int unregister_dnaddr_notifier(struct notifier_block *nb);
 static inline int dn_dev_islocal(struct net_device *dev, __le16 addr)
 {
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db;
        struct dn_ifaddr *ifa;
+        int res = 0;
+        rcu_read_lock();
+        dn_db = rcu_dereference(dev->dn_ptr);
        if (dn_db == NULL) {
                printk(KERN_DEBUG "dn_dev_islocal: Called for non DECnet device\n");
-                return 0;
+                goto out;
        }
-        for(ifa = dn_db->ifa_list; ifa; ifa = ifa->ifa_next)
+        for (ifa = rcu_dereference(dn_db->ifa_list);
-                if ((addr ^ ifa->ifa_local) == 0)
+             ifa != NULL;
-                        return 1;
+             ifa = rcu_dereference(ifa->ifa_next))
+                if ((addr ^ ifa->ifa_local) == 0) {
-        return 0;
+                        res = 1;
+                        break;
+                }
+out:
+        rcu_read_unlock();
+        return res;
 }
 #endif /* _NET_DN_DEV_H */
diff --git a/include/net/dn_route.h b/include/net/dn_route.h
index ccadab3aa3f6..9b185df265fb 100644
--- a/include/net/dn_route.h
+++ b/include/net/dn_route.h
@@ -80,6 +80,16 @@ struct dn_route {
        unsigned rt_type;
 };
+static inline bool dn_is_input_route(struct dn_route *rt)
+{
+        return rt->fl.iif != 0;
+}
+static inline bool dn_is_output_route(struct dn_route *rt)
+{
+        return rt->fl.iif == 0;
+}
 extern void dn_route_init(void);
 extern void dn_route_cleanup(void);
diff --git a/include/net/dst.h b/include/net/dst.h
index ffe9cb719c0e..93b0310317be 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -70,7 +70,7 @@ struct dst_entry {
        struct  dst_ops         *ops;
-        u32                     metrics[RTAX_MAX];
+        u32                     _metrics[RTAX_MAX];
 #ifdef CONFIG_NET_CLS_ROUTE
        __u32                   tclassid;
@@ -94,19 +94,59 @@ struct dst_entry {
        int                     __use;
        unsigned long           lastuse;
        union {
-                struct dst_entry *next;
+                struct dst_entry        *next;
-                struct rtable __rcu *rt_next;
+                struct rtable __rcu     *rt_next;
-                struct rt6_info   *rt6_next;
+                struct rt6_info         *rt6_next;
-                struct dn_route  *dn_next;
+                struct dn_route __rcu   *dn_next;
        };
 };
 #ifdef __KERNEL__
 static inline u32
-dst_metric(const struct dst_entry *dst, int metric)
+dst_metric_raw(const struct dst_entry *dst, const int metric)
 {
-        return dst->metrics[metric-1];
+        return dst->_metrics[metric-1];
+}
+static inline u32
+dst_metric(const struct dst_entry *dst, const int metric)
+{
+        WARN_ON_ONCE(metric == RTAX_HOPLIMIT ||
+                     metric == RTAX_ADVMSS ||
+                     metric == RTAX_MTU);
+        return dst_metric_raw(dst, metric);
+}
+static inline u32
+dst_metric_advmss(const struct dst_entry *dst)
+{
+        u32 advmss = dst_metric_raw(dst, RTAX_ADVMSS);
+        if (!advmss)
+                advmss = dst->ops->default_advmss(dst);
+        return advmss;
+}
+static inline void dst_metric_set(struct dst_entry *dst, int metric, u32 val)
+{
+        dst->_metrics[metric-1] = val;
+}
+static inline void dst_import_metrics(struct dst_entry *dst, const u32 *src_metrics)
+{
+        memcpy(dst->_metrics, src_metrics, RTAX_MAX * sizeof(u32));
+}
+static inline void dst_copy_metrics(struct dst_entry *dest, const struct dst_entry *src)
+{
+        dst_import_metrics(dest, src->_metrics);
+}
+static inline u32 *dst_metrics_ptr(struct dst_entry *dst)
+{
+        return dst->_metrics;
 }
 static inline u32
@@ -117,11 +157,11 @@ dst_feature(const struct dst_entry *dst, u32 feature)
 static inline u32 dst_mtu(const struct dst_entry *dst)
 {
-        u32 mtu = dst_metric(dst, RTAX_MTU);
+        u32 mtu = dst_metric_raw(dst, RTAX_MTU);
-        /*
-         * Alexey put it here, so ask him about it :)
+        if (!mtu)
-         */
+                mtu = dst->ops->default_mtu(dst);
-        barrier();
        return mtu;
 }
@@ -134,7 +174,7 @@ static inline unsigned long dst_metric_rtt(const struct dst_entry *dst, int metr
 static inline void set_dst_metric_rtt(struct dst_entry *dst, int metric,
                                      unsigned long rtt)
 {
-        dst->metrics[metric-1] = jiffies_to_msecs(rtt);
+        dst_metric_set(dst, metric, jiffies_to_msecs(rtt));
 }
 static inline u32
@@ -147,7 +187,7 @@ dst_allfrag(const struct dst_entry *dst)
 }
 static inline int
-dst_metric_locked(struct dst_entry *dst, int metric)
+dst_metric_locked(const struct dst_entry *dst, int metric)
 {
        return dst_metric(dst, RTAX_LOCK) & (1<<metric);
 }
diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
index 51665b3461b8..21a320b8708e 100644
--- a/include/net/dst_ops.h
+++ b/include/net/dst_ops.h
@@ -16,6 +16,8 @@ struct dst_ops {
        int                     (*gc)(struct dst_ops *ops);
        struct dst_entry *      (*check)(struct dst_entry *, __u32 cookie);
+        unsigned int            (*default_advmss)(const struct dst_entry *);
+        unsigned int            (*default_mtu)(const struct dst_entry *);
        void                    (*destroy)(struct dst_entry *);
        void                    (*ifdown)(struct dst_entry *,
                                          struct net_device *dev, int how);
diff --git a/include/net/flow.h b/include/net/flow.h
index 0ac3fb5e0973..240b7f356c71 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -49,7 +49,6 @@ struct flowi {
        __u8    proto;
        __u8    flags;
 #define FLOWI_FLAG_ANYSRC 0x01
-#define FLOWI_FLAG_MATCH_ANY_IIF 0x02
        union {
                struct {
                        __be16  sport;
@@ -67,6 +66,7 @@ struct flowi {
                } dnports;
                __be32          spi;
+                __be32          gre_key;
                struct {
                        __u8    type;
@@ -78,6 +78,7 @@ struct flowi {
 #define fl_icmp_code    uli_u.icmpt.code
 #define fl_ipsec_spi    uli_u.spi
 #define fl_mh_type      uli_u.mht.type
+#define fl_gre_key      uli_u.gre_key
        __u32           secid;  /* used by xfrm; see secid.txt */
 } __attribute__((__aligned__(BITS_PER_LONG/8)));
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index f95ff8d9aa47..04977eefb0ee 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -89,10 +89,11 @@ struct ip6_sf_socklist {
 struct ipv6_mc_socklist {
        struct in6_addr         addr;
        int                     ifindex;
-        struct ipv6_mc_socklist *next;
+        struct ipv6_mc_socklist __rcu *next;
        rwlock_t                sflock;
        unsigned int            sfmode;         /* MCAST_{INCLUDE,EXCLUDE} */
        struct ip6_sf_socklist  *sflist;
+        struct rcu_head         rcu;
 };
 struct ip6_sf_list {
diff --git a/include/net/inet6_connection_sock.h b/include/net/inet6_connection_sock.h
index aae08f686633..ff013505236b 100644
--- a/include/net/inet6_connection_sock.h
+++ b/include/net/inet6_connection_sock.h
@@ -25,6 +25,9 @@ struct sockaddr;
 extern int inet6_csk_bind_conflict(const struct sock *sk,
                                   const struct inet_bind_bucket *tb);
+extern struct dst_entry* inet6_csk_route_req(struct sock *sk,
+                                             const struct request_sock *req);
 extern struct request_sock *inet6_csk_search_req(const struct sock *sk,
                                                 struct request_sock ***prevp,
                                                 const __be16 rport,
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index e4f494b42e06..6ac4e3b5007f 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -43,7 +43,7 @@ struct inet_connection_sock_af_ops {
        struct sock *(*syn_recv_sock)(struct sock *sk, struct sk_buff *skb,
                                      struct request_sock *req,
                                      struct dst_entry *dst);
-        int         (*remember_stamp)(struct sock *sk);
+        struct inet_peer *(*get_peer)(struct sock *sk, bool *release_it);
        u16         net_header_len;
        u16         sockaddr_len;
        int         (*setsockopt)(struct sock *sk, int level, int optname, 
@@ -132,7 +132,6 @@ struct inet_connection_sock {
 #define ICSK_TIME_RETRANS       1       /* Retransmit timer */
 #define ICSK_TIME_DACK          2       /* Delayed ack timer */
 #define ICSK_TIME_PROBE0        3       /* Zero window probe timer */
-#define ICSK_TIME_KEEPOPEN      4       /* Keepalive timer */
 static inline struct inet_connection_sock *inet_csk(const struct sock *sk)
 {
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 1989cfd7405f..8181498fa96c 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -116,8 +116,9 @@ struct inet_sock {
        struct ipv6_pinfo       *pinet6;
 #endif
        /* Socket demultiplex comparisons on incoming packets. */
-        __be32                  inet_daddr;
+#define inet_daddr              sk.__sk_common.skc_daddr
-        __be32                  inet_rcv_saddr;
+#define inet_rcv_saddr          sk.__sk_common.skc_rcv_saddr
        __be16                  inet_dport;
        __u16                   inet_num;
        __be32                  inet_saddr;
@@ -141,7 +142,7 @@ struct inet_sock {
                                nodefrag:1;
        int                     mc_index;
        __be32                  mc_addr;
-        struct ip_mc_socklist   *mc_list;
+        struct ip_mc_socklist __rcu     *mc_list;
        struct {
                unsigned int            flags;
                unsigned int            fragsize;
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index a066fdd50da6..17404b5388a7 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -88,12 +88,6 @@ extern void inet_twdr_hangman(unsigned long data);
 extern void inet_twdr_twkill_work(struct work_struct *work);
 extern void inet_twdr_twcal_tick(unsigned long data);
-#if (BITS_PER_LONG == 64)
-#define INET_TIMEWAIT_ADDRCMP_ALIGN_BYTES 8
-#else
-#define INET_TIMEWAIT_ADDRCMP_ALIGN_BYTES 4
-#endif
 struct inet_bind_bucket;
 /*
@@ -117,15 +111,15 @@ struct inet_timewait_sock {
 #define tw_hash                 __tw_common.skc_hash
 #define tw_prot                 __tw_common.skc_prot
 #define tw_net                  __tw_common.skc_net
+#define tw_daddr                __tw_common.skc_daddr
+#define tw_rcv_saddr            __tw_common.skc_rcv_saddr
        int                     tw_timeout;
        volatile unsigned char  tw_substate;
-        /* 3 bits hole, try to pack */
        unsigned char           tw_rcv_wscale;
        /* Socket demultiplex comparisons on incoming packets. */
-        /* these five are in inet_sock */
+        /* these three are in inet_sock */
        __be16                  tw_sport;
-        __be32                  tw_daddr __attribute__((aligned(INET_TIMEWAIT_ADDRCMP_ALIGN_BYTES)));
-        __be32                  tw_rcv_saddr;
        __be16                  tw_dport;
        __u16                   tw_num;
        kmemcheck_bitfield_begin(flags);
@@ -191,10 +185,10 @@ static inline struct inet_timewait_sock *inet_twsk(const struct sock *sk)
        return (struct inet_timewait_sock *)sk;
 }
-static inline __be32 inet_rcv_saddr(const struct sock *sk)
+static inline __be32 sk_rcv_saddr(const struct sock *sk)
 {
-        return likely(sk->sk_state != TCP_TIME_WAIT) ?
+/* both inet_sk() and inet_twsk() store rcv_saddr in skc_rcv_saddr */
-                inet_sk(sk)->inet_rcv_saddr : inet_twsk(sk)->tw_rcv_saddr;
+        return sk->__sk_common.skc_rcv_saddr;
 }
 extern void inet_twsk_put(struct inet_timewait_sock *tw);
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index fe239bfe5f7f..599d96e74114 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -11,12 +11,21 @@
 #include <linux/init.h>
 #include <linux/jiffies.h>
 #include <linux/spinlock.h>
+#include <net/ipv6.h>
 #include <asm/atomic.h>
+struct inetpeer_addr {
+        union {
+                __be32          a4;
+                __be32          a6[4];
+        };
+        __u16   family;
+};
 struct inet_peer {
        /* group together avl_left,avl_right,v4daddr to speedup lookups */
        struct inet_peer __rcu  *avl_left, *avl_right;
-        __be32                  v4daddr;        /* peer's address */
+        struct inetpeer_addr    daddr;
        __u32                   avl_height;
        struct list_head        unused;
        __u32                   dtime;          /* the time of last use of not
@@ -26,7 +35,6 @@ struct inet_peer {
         * Once inet_peer is queued for deletion (refcnt == -1), following fields
         * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
         * We can share memory with rcu_head to keep inet_peer small
-         * (less then 64 bytes)
         */
        union {
                struct {
@@ -42,7 +50,25 @@ struct inet_peer {
 void                    inet_initpeers(void) __init;
 /* can be called with or without local BH being disabled */
-struct inet_peer        *inet_getpeer(__be32 daddr, int create);
+struct inet_peer        *inet_getpeer(struct inetpeer_addr *daddr, int create);
+static inline struct inet_peer *inet_getpeer_v4(__be32 v4daddr, int create)
+{
+        struct inetpeer_addr daddr;
+        daddr.a4 = v4daddr;
+        daddr.family = AF_INET;
+        return inet_getpeer(&daddr, create);
+}
+static inline struct inet_peer *inet_getpeer_v6(struct in6_addr *v6daddr, int create)
+{
+        struct inetpeer_addr daddr;
+        ipv6_addr_copy((struct in6_addr *)daddr.a6, v6daddr);
+        daddr.family = AF_INET6;
+        return inet_getpeer(&daddr, create);
+}
 /* can be called from BH context or outside */
 extern void inet_putpeer(struct inet_peer *p);
diff --git a/include/net/ip.h b/include/net/ip.h
index 86e2b182a0c0..67fac78a186b 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -201,7 +201,6 @@ static inline int inet_is_reserved_local_port(int port)
        return test_bit(port, sysctl_local_reserved_ports);
 }
-extern int sysctl_ip_default_ttl;
 extern int sysctl_ip_nonlocal_bind;
 extern struct ctl_path net_core_path[];
@@ -428,15 +427,6 @@ extern void	ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
 extern void     ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,
                               u32 info);
-/* sysctl helpers - any sysctl which holds a value that ends up being
- * fed into the routing cache should use these handlers.
- */
-int ipv4_doint_and_flush(ctl_table *ctl, int write,
-                         void __user *buffer,
-                         size_t *lenp, loff_t *ppos);
-int ipv4_doint_and_flush_strategy(ctl_table *table,
-                                  void __user *oldval, size_t __user *oldlenp,
-                                  void __user *newval, size_t newlen);
 #ifdef CONFIG_PROC_FS
 extern int ip_misc_proc_init(void);
 #endif
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 062a823d311c..708ff7cb8806 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -21,6 +21,7 @@
 #include <net/dst.h>
 #include <net/flow.h>
 #include <net/netlink.h>
+#include <net/inetpeer.h>
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 #define FIB6_TABLE_HASHSZ 256
@@ -109,6 +110,7 @@ struct rt6_info {
        u32                             rt6i_metric;
        struct inet6_dev                *rt6i_idev;
+        struct inet_peer                *rt6i_peer;
 #ifdef CONFIG_XFRM
        u32                             rt6i_flow_cache_genid;
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 278312c95f96..8552f0a2e854 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -3,7 +3,6 @@
 #define IP6_RT_PRIO_USER        1024
 #define IP6_RT_PRIO_ADDRCONF    256
-#define IP6_RT_PRIO_KERN        512
 struct route_info {
        __u8                    type;
@@ -56,6 +55,18 @@ static inline unsigned int rt6_flags2srcprefs(int flags)
        return (flags >> 3) & 7;
 }
+extern void                     rt6_bind_peer(struct rt6_info *rt,
+                                              int create);
+static inline struct inet_peer *rt6_get_peer(struct rt6_info *rt)
+{
+        if (rt->rt6i_peer)
+                return rt->rt6i_peer;
+        rt6_bind_peer(rt, 0);
+        return rt->rt6i_peer;
+}
 extern void                     ip6_route_input(struct sk_buff *skb);
 extern struct dst_entry *       ip6_route_output(struct net *net,
@@ -164,5 +175,15 @@ static inline int ipv6_unicast_destination(struct sk_buff *skb)
        return rt->rt6i_flags & RTF_LOCAL;
 }
+int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
+{
+        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+        return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
+               skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
+}
 #endif
 #endif
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 9fdf982d1286..62c0ce2d1dc8 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -97,6 +97,20 @@ enum ieee80211_max_queues {
 };
 /**
+ * enum ieee80211_ac_numbers - AC numbers as used in mac80211
+ * @IEEE80211_AC_VO: voice
+ * @IEEE80211_AC_VI: video
+ * @IEEE80211_AC_BE: best effort
+ * @IEEE80211_AC_BK: background
+ */
+enum ieee80211_ac_numbers {
+        IEEE80211_AC_VO         = 0,
+        IEEE80211_AC_VI         = 1,
+        IEEE80211_AC_BE         = 2,
+        IEEE80211_AC_BK         = 3,
+};
+/**
 * struct ieee80211_tx_queue_params - transmit queue configuration
 *
 * The information provided in this structure is required for QoS
@@ -205,6 +219,7 @@ enum ieee80211_bss_change {
 * @basic_rates: bitmap of basic rates, each bit stands for an
 *      index into the rate table configured by the driver in
 *      the current band.
+ * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
 * @bssid: The BSSID for this BSS
 * @enable_beacon: whether beaconing should be enabled or not
 * @channel_type: Channel type for this BSS -- the hardware might be
@@ -244,6 +259,7 @@ struct ieee80211_bss_conf {
        u16 assoc_capability;
        u64 timestamp;
        u32 basic_rates;
+        int mcast_rate[IEEE80211_NUM_BANDS];
        u16 ht_operation_mode;
        s32 cqm_rssi_thold;
        u32 cqm_rssi_hyst;
@@ -321,6 +337,10 @@ struct ieee80211_bss_conf {
 * @IEEE80211_TX_CTL_LDPC: tells the driver to use LDPC for this frame
 * @IEEE80211_TX_CTL_STBC: Enables Space-Time Block Coding (STBC) for this
 *      frame and selects the maximum number of streams that it can use.
+ * @IEEE80211_TX_CTL_TX_OFFCHAN: Marks this packet to be transmitted on
+ *      the off-channel channel when a remain-on-channel offload is done
+ *      in hardware -- normal packets still flow and are expected to be
+ *      handled properly by the device.
 *
 * Note: If you have to add new flags to the enumeration, then don't
 *       forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
@@ -349,6 +369,7 @@ enum mac80211_tx_control_flags {
        IEEE80211_TX_INTFL_NL80211_FRAME_TX     = BIT(21),
        IEEE80211_TX_CTL_LDPC                   = BIT(22),
        IEEE80211_TX_CTL_STBC                   = BIT(23) | BIT(24),
+        IEEE80211_TX_CTL_TX_OFFCHAN             = BIT(25),
 };
 #define IEEE80211_TX_CTL_STBC_SHIFT             23
@@ -1652,6 +1673,11 @@ enum ieee80211_ampdu_mlme_action {
 *      and IV16) for the given key from hardware.
 *      The callback must be atomic.
 *
+ * @set_frag_threshold: Configuration of fragmentation threshold. Assign this
+ *      if the device does fragmentation by itself; if this callback is
+ *      implemented then the stack will not do fragmentation.
+ *      The callback can sleep.
+ *
 * @set_rts_threshold: Configuration of RTS threshold (if device needs it)
 *      The callback can sleep.
 *
@@ -1724,6 +1750,23 @@ enum ieee80211_ampdu_mlme_action {
 *      completion of the channel switch.
 *
 * @napi_poll: Poll Rx queue for incoming data frames.
+ *
+ * @set_antenna: Set antenna configuration (tx_ant, rx_ant) on the device.
+ *      Parameters are bitmaps of allowed antennas to use for TX/RX. Drivers may
+ *      reject TX/RX mask combinations they cannot support by returning -EINVAL
+ *      (also see nl80211.h @NL80211_ATTR_WIPHY_ANTENNA_TX).
+ *
+ * @get_antenna: Get current antenna configuration from device (tx_ant, rx_ant).
+ *
+ * @remain_on_channel: Starts an off-channel period on the given channel, must
+ *      call back to ieee80211_ready_on_channel() when on that channel. Note
+ *      that normal channel traffic is not stopped as this is intended for hw
+ *      offload. Frames to transmit on the off-channel channel are transmitted
+ *      normally except for the %IEEE80211_TX_CTL_TX_OFFCHAN flag. When the
+ *      duration (which will always be non-zero) expires, the driver must call
+ *      ieee80211_remain_on_channel_expired(). This callback may sleep.
+ * @cancel_remain_on_channel: Requests that an ongoing off-channel period is
+ *      aborted before it expires. This callback may sleep.
 */
 struct ieee80211_ops {
        int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1765,6 +1808,7 @@ struct ieee80211_ops {
                         struct ieee80211_low_level_stats *stats);
        void (*get_tkip_seq)(struct ieee80211_hw *hw, u8 hw_key_idx,
                             u32 *iv32, u16 *iv16);
+        int (*set_frag_threshold)(struct ieee80211_hw *hw, u32 value);
        int (*set_rts_threshold)(struct ieee80211_hw *hw, u32 value);
        int (*sta_add)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                       struct ieee80211_sta *sta);
@@ -1793,6 +1837,14 @@ struct ieee80211_ops {
        void (*channel_switch)(struct ieee80211_hw *hw,
                               struct ieee80211_channel_switch *ch_switch);
        int (*napi_poll)(struct ieee80211_hw *hw, int budget);
+        int (*set_antenna)(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant);
+        int (*get_antenna)(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant);
+        int (*remain_on_channel)(struct ieee80211_hw *hw,
+                                 struct ieee80211_channel *chan,
+                                 enum nl80211_channel_type channel_type,
+                                 int duration);
+        int (*cancel_remain_on_channel)(struct ieee80211_hw *hw);
 };
 /**
@@ -1821,11 +1873,39 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 */
 int ieee80211_register_hw(struct ieee80211_hw *hw);
+/**
+ * struct ieee80211_tpt_blink - throughput blink description
+ * @throughput: throughput in Kbit/sec
+ * @blink_time: blink time in milliseconds
+ *      (full cycle, ie. one off + one on period)
+ */
+struct ieee80211_tpt_blink {
+        int throughput;
+        int blink_time;
+};
+/**
+ * enum ieee80211_tpt_led_trigger_flags - throughput trigger flags
+ * @IEEE80211_TPT_LEDTRIG_FL_RADIO: enable blinking with radio
+ * @IEEE80211_TPT_LEDTRIG_FL_WORK: enable blinking when working
+ * @IEEE80211_TPT_LEDTRIG_FL_CONNECTED: enable blinking when at least one
+ *      interface is connected in some way, including being an AP
+ */
+enum ieee80211_tpt_led_trigger_flags {
+        IEEE80211_TPT_LEDTRIG_FL_RADIO          = BIT(0),
+        IEEE80211_TPT_LEDTRIG_FL_WORK           = BIT(1),
+        IEEE80211_TPT_LEDTRIG_FL_CONNECTED      = BIT(2),
+};
 #ifdef CONFIG_MAC80211_LEDS
 extern char *__ieee80211_get_tx_led_name(struct ieee80211_hw *hw);
 extern char *__ieee80211_get_rx_led_name(struct ieee80211_hw *hw);
 extern char *__ieee80211_get_assoc_led_name(struct ieee80211_hw *hw);
 extern char *__ieee80211_get_radio_led_name(struct ieee80211_hw *hw);
+extern char *__ieee80211_create_tpt_led_trigger(
+                                struct ieee80211_hw *hw, unsigned int flags,
+                                const struct ieee80211_tpt_blink *blink_table,
+                                unsigned int blink_table_len);
 #endif
 /**
 * ieee80211_get_tx_led_name - get name of TX LED
@@ -1904,6 +1984,30 @@ static inline char *ieee80211_get_radio_led_name(struct ieee80211_hw *hw)
 }
 /**
+ * ieee80211_create_tpt_led_trigger - create throughput LED trigger
+ * @hw: the hardware to create the trigger for
+ * @flags: trigger flags, see &enum ieee80211_tpt_led_trigger_flags
+ * @blink_table: the blink table -- needs to be ordered by throughput
+ * @blink_table_len: size of the blink table
+ *
+ * This function returns %NULL (in case of error, or if no LED
+ * triggers are configured) or the name of the new trigger.
+ * This function must be called before ieee80211_register_hw().
+ */
+static inline char *
+ieee80211_create_tpt_led_trigger(struct ieee80211_hw *hw, unsigned int flags,
+                                 const struct ieee80211_tpt_blink *blink_table,
+                                 unsigned int blink_table_len)
+{
+#ifdef CONFIG_MAC80211_LEDS
+        return __ieee80211_create_tpt_led_trigger(hw, flags, blink_table,
+                                                  blink_table_len);
+#else
+        return NULL;
+#endif
+}
+/**
 * ieee80211_unregister_hw - Unregister a hardware device
 *
 * This function instructs mac80211 to free allocated resources
@@ -2024,8 +2128,8 @@ static inline void ieee80211_rx_ni(struct ieee80211_hw *hw,
 *
 * This function may not be called in IRQ context. Calls to this function
 * for a single hardware must be synchronized against each other. Calls
- * to this function and ieee80211_tx_status_irqsafe() may not be mixed
+ * to this function, ieee80211_tx_status_ni() and ieee80211_tx_status_irqsafe()
- * for a single hardware.
+ * may not be mixed for a single hardware.
 *
 * @hw: the hardware the frame was transmitted by
 * @skb: the frame that was transmitted, owned by mac80211 after this call
@@ -2034,13 +2138,33 @@ void ieee80211_tx_status(struct ieee80211_hw *hw,
                         struct sk_buff *skb);
 /**
+ * ieee80211_tx_status_ni - transmit status callback (in process context)
+ *
+ * Like ieee80211_tx_status() but can be called in process context.
+ *
+ * Calls to this function, ieee80211_tx_status() and
+ * ieee80211_tx_status_irqsafe() may not be mixed
+ * for a single hardware.
+ *
+ * @hw: the hardware the frame was transmitted by
+ * @skb: the frame that was transmitted, owned by mac80211 after this call
+ */
+static inline void ieee80211_tx_status_ni(struct ieee80211_hw *hw,
+                                          struct sk_buff *skb)
+{
+        local_bh_disable();
+        ieee80211_tx_status(hw, skb);
+        local_bh_enable();
+}
+/**
 * ieee80211_tx_status_irqsafe - IRQ-safe transmit status callback
 *
 * Like ieee80211_tx_status() but can be called in IRQ context
 * (internally defers to a tasklet.)
 *
- * Calls to this function and ieee80211_tx_status() may not be mixed for a
+ * Calls to this function, ieee80211_tx_status() and
- * single hardware.
+ * ieee80211_tx_status_ni() may not be mixed for a single hardware.
 *
 * @hw: the hardware the frame was transmitted by
 * @skb: the frame that was transmitted, owned by mac80211 after this call
@@ -2384,6 +2508,7 @@ void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
 * ieee80211_start_tx_ba_session - Start a tx Block Ack session.
 * @sta: the station for which to start a BA session
 * @tid: the TID to BA on.
+ * @timeout: session timeout value (in TUs)
 *
 * Return: success if addBA request was sent, failure otherwise
 *
@@ -2391,7 +2516,8 @@ void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
 * the need to start aggregation on a certain RA/TID, the session level
 * will be managed by the mac80211.
 */
-int ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, u16 tid);
+int ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, u16 tid,
+                                  u16 timeout);
 /**
 * ieee80211_start_tx_ba_cb_irqsafe - low level driver ready to aggregate.
@@ -2501,6 +2627,21 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
                               struct ieee80211_sta *pubsta, bool block);
 /**
+ * ieee80211_ap_probereq_get - retrieve a Probe Request template
+ * @hw: pointer obtained from ieee80211_alloc_hw().
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * Creates a Probe Request template which can, for example, be uploaded to
+ * hardware. The template is filled with bssid, ssid and supported rate
+ * information. This function must only be called from within the
+ * .bss_info_changed callback function and only in managed mode. The function
+ * is only useful when the interface is associated, otherwise it will return
+ * NULL.
+ */
+struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif);
+/**
 * ieee80211_beacon_loss - inform hardware does not receive beacons
 *
 * @vif: &struct ieee80211_vif pointer from the add_interface callback.
@@ -2609,6 +2750,18 @@ void ieee80211_request_smps(struct ieee80211_vif *vif,
 */
 void ieee80211_key_removed(struct ieee80211_key_conf *key_conf);
+/**
+ * ieee80211_ready_on_channel - notification of remain-on-channel start
+ * @hw: pointer as obtained from ieee80211_alloc_hw()
+ */
+void ieee80211_ready_on_channel(struct ieee80211_hw *hw);
+/**
+ * ieee80211_remain_on_channel_expired - remain_on_channel duration expired
+ * @hw: pointer as obtained from ieee80211_alloc_hw()
+ */
+void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw);
 /* Rate control API */
 /**
@@ -2640,7 +2793,7 @@ enum rate_control_changed {
 * @rate_idx_mask: user-requested rate mask (not MCS for now)
 * @skb: the skb that will be transmitted, the control information in it needs
 *      to be filled in
- * @ap: whether this frame is sent out in AP mode
+ * @bss: whether this frame is sent out in AP or IBSS mode
 */
 struct ieee80211_tx_rate_control {
        struct ieee80211_hw *hw;
@@ -2651,7 +2804,7 @@ struct ieee80211_tx_rate_control {
        bool rts, short_preamble;
        u8 max_rate_idx;
        u32 rate_idx_mask;
-        bool ap;
+        bool bss;
 };
 struct rate_control_ops {
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 895997bc2ead..e0e594f8e9d9 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -42,9 +42,6 @@ enum {
 #define ND_REACHABLE_TIME               (30*HZ)
 #define ND_RETRANS_TIMER                HZ
-#define ND_MIN_RANDOM_FACTOR            (1/2)
-#define ND_MAX_RANDOM_FACTOR            (3/2)
 #ifdef __KERNEL__
 #include <linux/compiler.h>
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 6beb1ffc2b7f..4014b623880c 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -96,16 +96,16 @@ struct neighbour {
        struct neigh_parms      *parms;
        unsigned long           confirmed;
        unsigned long           updated;
-        __u8                    flags;
+        rwlock_t                lock;
-        __u8                    nud_state;
-        __u8                    type;
-        __u8                    dead;
        atomic_t                refcnt;
        struct sk_buff_head     arp_queue;
        struct timer_list       timer;
        unsigned long           used;
        atomic_t                probes;
-        rwlock_t                lock;
+        __u8                    flags;
+        __u8                    nud_state;
+        __u8                    type;
+        __u8                    dead;
        seqlock_t               ha_lock;
        unsigned char           ha[ALIGN(MAX_ADDR_LEN, sizeof(unsigned long))];
        struct hh_cache         *hh;
diff --git a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
index 1ee717eb5b09..a4c993685795 100644
--- a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
+++ b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
@@ -7,16 +7,6 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6;
-extern int nf_ct_frag6_init(void);
-extern void nf_ct_frag6_cleanup(void);
-extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user);
-extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
-                               struct net_device *in,
-                               struct net_device *out,
-                               int (*okfn)(struct sk_buff *));
-struct inet_frags_ctl;
 #include <linux/sysctl.h>
 extern struct ctl_table nf_ct_ipv6_sysctl_table[];
diff --git a/include/net/netfilter/ipv6/nf_defrag_ipv6.h b/include/net/netfilter/ipv6/nf_defrag_ipv6.h
index 94dd54d76b48..fd79c9a1779d 100644
--- a/include/net/netfilter/ipv6/nf_defrag_ipv6.h
+++ b/include/net/netfilter/ipv6/nf_defrag_ipv6.h
@@ -3,4 +3,14 @@
 extern void nf_defrag_ipv6_enable(void);
+extern int nf_ct_frag6_init(void);
+extern void nf_ct_frag6_cleanup(void);
+extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user);
+extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
+                               struct net_device *in,
+                               struct net_device *out,
+                               int (*okfn)(struct sk_buff *));
+struct inet_frags_ctl;
 #endif /* _NF_DEFRAG_IPV6_H */
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index caf17db87dbc..d85cff10e169 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -298,6 +298,8 @@ static inline int nf_ct_is_untracked(const struct nf_conn *ct)
 extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);
 extern unsigned int nf_conntrack_htable_size;
 extern unsigned int nf_conntrack_max;
+extern unsigned int nf_conntrack_hash_rnd;
+void init_nf_conntrack_hash_rnd(void);
 #define NF_CT_STAT_INC(net, count)      \
        __this_cpu_inc((net)->ct.stat->count)
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 9801c55de5d6..373f1a900cf4 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -225,13 +225,15 @@ extern int		nlmsg_notify(struct sock *sk, struct sk_buff *skb,
                                     u32 pid, unsigned int group, int report,
                                     gfp_t flags);
-extern int              nla_validate(struct nlattr *head, int len, int maxtype,
+extern int              nla_validate(const struct nlattr *head,
+                                     int len, int maxtype,
                                     const struct nla_policy *policy);
-extern int              nla_parse(struct nlattr *tb[], int maxtype,
+extern int              nla_parse(struct nlattr **tb, int maxtype,
-                                  struct nlattr *head, int len,
+                                  const struct nlattr *head, int len,
                                  const struct nla_policy *policy);
 extern int              nla_policy_len(const struct nla_policy *, int);
-extern struct nlattr *  nla_find(struct nlattr *head, int len, int attrtype);
+extern struct nlattr *  nla_find(const struct nlattr *head,
+                                 int len, int attrtype);
 extern size_t           nla_strlcpy(char *dst, const struct nlattr *nla,
                                    size_t dstsize);
 extern int              nla_memcpy(void *dest, const struct nlattr *src, int count);
@@ -346,7 +348,8 @@ static inline int nlmsg_ok(const struct nlmsghdr *nlh, int remaining)
 * Returns the next netlink message in the message stream and
 * decrements remaining by the size of the current message.
 */
-static inline struct nlmsghdr *nlmsg_next(struct nlmsghdr *nlh, int *remaining)
+static inline struct nlmsghdr *
+nlmsg_next(const struct nlmsghdr *nlh, int *remaining)
 {
        int totlen = NLMSG_ALIGN(nlh->nlmsg_len);
@@ -398,7 +401,8 @@ static inline struct nlattr *nlmsg_find_attr(const struct nlmsghdr *nlh,
 * @maxtype: maximum attribute type to be expected
 * @policy: validation policy
 */
-static inline int nlmsg_validate(struct nlmsghdr *nlh, int hdrlen, int maxtype,
+static inline int nlmsg_validate(const struct nlmsghdr *nlh,
+                                 int hdrlen, int maxtype,
                                 const struct nla_policy *policy)
 {
        if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
@@ -727,7 +731,8 @@ static inline struct nlattr *nla_next(const struct nlattr *nla, int *remaining)
 *
 * Returns the first attribute which matches the specified type.
 */
-static inline struct nlattr *nla_find_nested(struct nlattr *nla, int attrtype)
+static inline struct nlattr *
+nla_find_nested(const struct nlattr *nla, int attrtype)
 {
        return nla_find(nla_data(nla), nla_len(nla), attrtype);
 }
@@ -1032,7 +1037,7 @@ static inline void nla_nest_cancel(struct sk_buff *skb, struct nlattr *start)
 *
 * Returns 0 on success or a negative error code.
 */
-static inline int nla_validate_nested(struct nlattr *start, int maxtype,
+static inline int nla_validate_nested(const struct nlattr *start, int maxtype,
                                      const struct nla_policy *policy)
 {
        return nla_validate(nla_data(start), nla_len(start), maxtype, policy);
diff --git a/include/net/netns/generic.h b/include/net/netns/generic.h
index 81a31c0db3e7..3419bf5cd154 100644
--- a/include/net/netns/generic.h
+++ b/include/net/netns/generic.h
@@ -30,7 +30,7 @@ struct net_generic {
        void *ptr[0];
 };
-static inline void *net_generic(struct net *net, int id)
+static inline void *net_generic(const struct net *net, int id)
 {
        struct net_generic *ng;
        void *ptr;
diff --git a/include/net/phonet/phonet.h b/include/net/phonet/phonet.h
index d5df797f9540..5395e09187df 100644
--- a/include/net/phonet/phonet.h
+++ b/include/net/phonet/phonet.h
@@ -107,8 +107,8 @@ struct phonet_protocol {
        int                     sock_type;
 };
-int phonet_proto_register(int protocol, struct phonet_protocol *pp);
+int phonet_proto_register(unsigned int protocol, struct phonet_protocol *pp);
-void phonet_proto_unregister(int protocol, struct phonet_protocol *pp);
+void phonet_proto_unregister(unsigned int protocol, struct phonet_protocol *pp);
 int phonet_sysctl_init(void);
 void phonet_sysctl_exit(void);
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index dd3031aed9d5..9fcc680ab6b9 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -323,7 +323,9 @@ static inline unsigned char * tcf_get_base_ptr(struct sk_buff *skb, int layer)
 static inline int tcf_valid_offset(const struct sk_buff *skb,
                                   const unsigned char *ptr, const int len)
 {
-        return unlikely((ptr + len) < skb_tail_pointer(skb) && ptr > skb->head);
+        return likely((ptr + len) <= skb_tail_pointer(skb) &&
+                      ptr >= skb->head &&
+                      (ptr <= (ptr + len)));
 }
 #ifdef CONFIG_NET_CLS_IND
diff --git a/include/net/red.h b/include/net/red.h
index 995108e54d9f..3319f16b3beb 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -97,7 +97,6 @@ struct red_stats {
        u32             forced_mark;    /* Forced marks, qavg > max_thresh */
        u32             pdrop;          /* Drops due to queue limits */
        u32             other;          /* Drops due to drop() calls */
-        u32             backlog;
 };
 struct red_parms {
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 9e103a4e91ee..356d6e3dc20a 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -43,6 +43,12 @@ enum environment_cap {
 * @intersect: indicates whether the wireless core should intersect
 *      the requested regulatory domain with the presently set regulatory
 *      domain.
+ * @processed: indicates whether or not this requests has already been
+ *      processed. When the last request is processed it means that the
+ *      currently regulatory domain set on cfg80211 is updated from
+ *      CRDA and can be used by other regulatory requests. When a
+ *      the last request is not yet processed we must yield until it
+ *      is processed before processing any new requests.
 * @country_ie_checksum: checksum of the last processed and accepted
 *      country IE
 * @country_ie_env: lets us know if the AP is telling us we are outdoor,
@@ -54,6 +60,7 @@ struct regulatory_request {
        enum nl80211_reg_initiator initiator;
        char alpha2[2];
        bool intersect;
+        bool processed;
        enum environment_cap country_ie_env;
        struct list_head list;
 };
diff --git a/include/net/route.h b/include/net/route.h
index 7e5e73bfa4de..93e10c453f6b 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -55,8 +55,6 @@ struct rtable {
        /* Cache lookup keys */
        struct flowi            fl;
-        struct in_device        *idev;
-        
        int                     rt_genid;
        unsigned                rt_flags;
        __u16                   rt_type;
@@ -73,6 +71,16 @@ struct rtable {
        struct inet_peer        *peer; /* long-living peer info */
 };
+static inline bool rt_is_input_route(struct rtable *rt)
+{
+        return rt->fl.iif != 0;
+}
+static inline bool rt_is_output_route(struct rtable *rt)
+{
+        return rt->fl.iif == 0;
+}
 struct ip_rt_acct {
        __u32   o_bytes;
        __u32   o_packets;
@@ -106,7 +114,7 @@ extern int		ip_rt_init(void);
 extern void             ip_rt_redirect(__be32 old_gw, __be32 dst, __be32 new_gw,
                                       __be32 src, struct net_device *dev);
 extern void             rt_cache_flush(struct net *net, int how);
-extern void             rt_cache_flush_batch(void);
+extern void             rt_cache_flush_batch(struct net *net);
 extern int              __ip_route_output_key(struct net *, struct rtable **, const struct flowi *flp);
 extern int              ip_route_output_key(struct net *, struct rtable **, struct flowi *flp);
 extern int              ip_route_output_flow(struct net *, struct rtable **rp, struct flowi *flp, struct sock *sk, int flags);
@@ -161,14 +169,12 @@ static inline int ip_route_connect(struct rtable **rp, __be32 dst,
 {
        struct flowi fl = { .oif = oif,
                            .mark = sk->sk_mark,
-                            .nl_u = { .ip4_u = { .daddr = dst,
+                            .fl4_dst = dst,
-                                                 .saddr = src,
+                            .fl4_src = src,
-                                                 .tos   = tos } },
+                            .fl4_tos = tos,
                            .proto = protocol,
-                            .uli_u = { .ports =
+                            .fl_ip_sport = sport,
-                                       { .sport = sport,
+                            .fl_ip_dport = dport };
-                                         .dport = dport } } };
        int err;
        struct net *net = sock_net(sk);
@@ -225,4 +231,15 @@ static inline int inet_iif(const struct sk_buff *skb)
        return skb_rtable(skb)->rt_iif;
 }
+extern int sysctl_ip_default_ttl;
+static inline int ip4_dst_hoplimit(const struct dst_entry *dst)
+{
+        int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT);
+        if (hoplimit == 0)
+                hoplimit = sysctl_ip_default_ttl;
+        return hoplimit;
+}
 #endif  /* _ROUTE_H */
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index e013c68bfb00..4093ca78cf60 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -83,6 +83,41 @@ extern void	__rtnl_link_unregister(struct rtnl_link_ops *ops);
 extern int      rtnl_link_register(struct rtnl_link_ops *ops);
 extern void     rtnl_link_unregister(struct rtnl_link_ops *ops);
+/**
+ *      struct rtnl_af_ops - rtnetlink address family operations
+ *
+ *      @list: Used internally
+ *      @family: Address family
+ *      @fill_link_af: Function to fill IFLA_AF_SPEC with address family
+ *                     specific netlink attributes.
+ *      @get_link_af_size: Function to calculate size of address family specific
+ *                         netlink attributes exlusive the container attribute.
+ *      @validate_link_af: Validate a IFLA_AF_SPEC attribute, must check attr
+ *                         for invalid configuration settings.
+ *      @set_link_af: Function to parse a IFLA_AF_SPEC attribute and modify
+ *                    net_device accordingly.
+ */
+struct rtnl_af_ops {
+        struct list_head        list;
+        int                     family;
+        int                     (*fill_link_af)(struct sk_buff *skb,
+                                                const struct net_device *dev);
+        size_t                  (*get_link_af_size)(const struct net_device *dev);
+        int                     (*validate_link_af)(const struct net_device *dev,
+                                                    const struct nlattr *attr);
+        int                     (*set_link_af)(struct net_device *dev,
+                                               const struct nlattr *attr);
+};
+extern int      __rtnl_af_register(struct rtnl_af_ops *ops);
+extern void     __rtnl_af_unregister(struct rtnl_af_ops *ops);
+extern int      rtnl_af_register(struct rtnl_af_ops *ops);
+extern void     rtnl_af_unregister(struct rtnl_af_ops *ops);
 extern struct net *rtnl_link_get_net(struct net *src_net, struct nlattr *tb[]);
 extern struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
        char *ifname, const struct rtnl_link_ops *ops, struct nlattr *tb[]);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index ea1f8a83160d..e9eee99d8b1f 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -207,7 +207,7 @@ static inline int qdisc_qlen(struct Qdisc *q)
        return q->q.qlen;
 }
-static inline struct qdisc_skb_cb *qdisc_skb_cb(struct sk_buff *skb)
+static inline struct qdisc_skb_cb *qdisc_skb_cb(const struct sk_buff *skb)
 {
        return (struct qdisc_skb_cb *)skb->cb;
 }
@@ -321,6 +321,7 @@ extern void dev_init_scheduler(struct net_device *dev);
 extern void dev_shutdown(struct net_device *dev);
 extern void dev_activate(struct net_device *dev);
 extern void dev_deactivate(struct net_device *dev);
+extern void dev_deactivate_many(struct list_head *head);
 extern struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
                                     struct Qdisc *qdisc);
 extern void qdisc_reset(struct Qdisc *qdisc);
@@ -393,7 +394,7 @@ static inline bool qdisc_tx_is_noop(const struct net_device *dev)
        return true;
 }
-static inline unsigned int qdisc_pkt_len(struct sk_buff *skb)
+static inline unsigned int qdisc_pkt_len(const struct sk_buff *skb)
 {
        return qdisc_skb_cb(skb)->pkt_len;
 }
@@ -425,10 +426,18 @@ static inline int qdisc_enqueue_root(struct sk_buff *skb, struct Qdisc *sch)
        return qdisc_enqueue(skb, sch) & NET_XMIT_MASK;
 }
-static inline void __qdisc_update_bstats(struct Qdisc *sch, unsigned int len)
+static inline void bstats_update(struct gnet_stats_basic_packed *bstats,
+                                 const struct sk_buff *skb)
+{
+        bstats->bytes += qdisc_pkt_len(skb);
+        bstats->packets += skb_is_gso(skb) ? skb_shinfo(skb)->gso_segs : 1;
+}
+static inline void qdisc_bstats_update(struct Qdisc *sch,
+                                       const struct sk_buff *skb)
 {
-        sch->bstats.bytes += len;
+        bstats_update(&sch->bstats, skb);
-        sch->bstats.packets++;
 }
 static inline int __qdisc_enqueue_tail(struct sk_buff *skb, struct Qdisc *sch,
@@ -436,7 +445,7 @@ static inline int __qdisc_enqueue_tail(struct sk_buff *skb, struct Qdisc *sch,
 {
        __skb_queue_tail(list, skb);
        sch->qstats.backlog += qdisc_pkt_len(skb);
-        __qdisc_update_bstats(sch, qdisc_pkt_len(skb));
+        qdisc_bstats_update(sch, skb);
        return NET_XMIT_SUCCESS;
 }
@@ -610,11 +619,7 @@ static inline struct sk_buff *skb_act_clone(struct sk_buff *skb, gfp_t gfp_mask,
 {
        struct sk_buff *n;
-        if ((action == TC_ACT_STOLEN || action == TC_ACT_QUEUED) &&
+        n = skb_clone(skb, gfp_mask);
-            !skb_shared(skb))
-                n = skb_get(skb);
-        else
-                n = skb_clone(skb, gfp_mask);
        if (n) {
                n->tc_verd = SET_TC_VERD(n->tc_verd, 0);
diff --git a/include/net/scm.h b/include/net/scm.h
index 31656506d967..745460fa2f02 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -10,11 +10,12 @@
 /* Well, we should have at least one descriptor open
 * to accept passed FDs 8)
 */
-#define SCM_MAX_FD      255
+#define SCM_MAX_FD      253
 struct scm_fp_list {
        struct list_head        list;
-        int                     count;
+        short                   count;
+        short                   max;
        struct file             *fp[SCM_MAX_FD];
 };
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 2c55a7ea20af..c01dc99def07 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -111,9 +111,6 @@ typedef enum {
        SCTP_CMD_LAST
 } sctp_verb_t;
-#define SCTP_CMD_MAX            (SCTP_CMD_LAST - 1)
-#define SCTP_CMD_NUM_VERBS      (SCTP_CMD_MAX + 1)
 /* How many commands can you put in an sctp_cmd_seq_t?
 * This is a rather arbitrary number, ideally derived from a careful
 * analysis of the state functions, but in reality just taken from
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index 63908840eef0..c70d8ccc55cb 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -61,7 +61,6 @@ enum { SCTP_DEFAULT_INSTREAMS = SCTP_MAX_STREAM };
 * symbols.  CIDs are dense through SCTP_CID_BASE_MAX.
 */
 #define SCTP_CID_BASE_MAX               SCTP_CID_SHUTDOWN_COMPLETE
-#define SCTP_CID_MAX                    SCTP_CID_ASCONF_ACK
 #define SCTP_NUM_BASE_CHUNK_TYPES       (SCTP_CID_BASE_MAX + 1)
@@ -86,9 +85,6 @@ typedef enum {
 } sctp_event_t;
-#define SCTP_EVENT_T_MAX SCTP_EVENT_T_PRIMITIVE
-#define SCTP_EVENT_T_NUM (SCTP_EVENT_T_MAX + 1)
 /* As a convenience for the state machine, we append SCTP_EVENT_* and
 * SCTP_ULP_* to the list of possible chunks.
 */
@@ -162,9 +158,6 @@ SCTP_SUBTYPE_CONSTRUCTOR(PRIMITIVE,	sctp_event_primitive_t,	primitive)
                                - (unsigned long)(c->chunk_hdr)\
                                - sizeof(sctp_data_chunk_t)))
-#define SCTP_MAX_ERROR_CAUSE  SCTP_ERROR_NONEXIST_IP
-#define SCTP_NUM_ERROR_CAUSE  10
 /* Internal error codes */
 typedef enum {
@@ -266,7 +259,6 @@ enum { SCTP_ARBITRARY_COOKIE_ECHO_LEN = 200 };
 #define SCTP_TSN_MAP_INITIAL BITS_PER_LONG
 #define SCTP_TSN_MAP_INCREMENT SCTP_TSN_MAP_INITIAL
 #define SCTP_TSN_MAP_SIZE 4096
-#define SCTP_TSN_MAX_GAP  65535
 /* We will not record more than this many duplicate TSNs between two
 * SACKs.  The minimum PMTU is 576.  Remove all the headers and there
@@ -301,9 +293,6 @@ enum { SCTP_MAX_GABS = 16 };
 #define SCTP_CLOCK_GRANULARITY  1       /* 1 jiffy */
-#define SCTP_DEF_MAX_INIT 6
-#define SCTP_DEF_MAX_SEND 10
 #define SCTP_DEFAULT_COOKIE_LIFE        (60 * 1000) /* 60 seconds */
 #define SCTP_DEFAULT_MINWINDOW  1500    /* default minimum rwnd size */
@@ -317,9 +306,6 @@ enum { SCTP_MAX_GABS = 16 };
                                         */
 #define SCTP_DEFAULT_MINSEGMENT 512     /* MTU size ... if no mtu disc */
 #define SCTP_HOW_MANY_SECRETS 2         /* How many secrets I keep */
-#define SCTP_HOW_LONG_COOKIE_LIVE 3600  /* How many seconds the current
-                                         * secret will live?
-                                         */
 #define SCTP_SECRET_SIZE 32             /* Number of octets in a 256 bits. */
 #define SCTP_SIGNATURE_SIZE 20          /* size of a SLA-1 signature */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 69fef4fb79c0..cc9185ca8fd1 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -261,8 +261,6 @@ extern struct sctp_globals {
 #define sctp_assoc_hashsize             (sctp_globals.assoc_hashsize)
 #define sctp_assoc_hashtable            (sctp_globals.assoc_hashtable)
 #define sctp_port_hashsize              (sctp_globals.port_hashsize)
-#define sctp_port_rover                 (sctp_globals.port_rover)
-#define sctp_port_alloc_lock            (sctp_globals.port_alloc_lock)
 #define sctp_port_hashtable             (sctp_globals.port_hashtable)
 #define sctp_local_addr_list            (sctp_globals.local_addr_list)
 #define sctp_local_addr_lock            (sctp_globals.addr_list_lock)
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 2b2769c5ca9f..2a128c8c2718 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -99,8 +99,8 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_SOCKOPT_PEELOFF    102     /* peel off association. */
 /* Options 104-106 are deprecated and removed. Do not use this space */
 #define SCTP_SOCKOPT_CONNECTX_OLD       107     /* CONNECTX old requests. */
-#define SCTP_GET_PEER_ADDRS     108             /* Get all peer addresss. */
+#define SCTP_GET_PEER_ADDRS     108             /* Get all peer address. */
-#define SCTP_GET_LOCAL_ADDRS    109             /* Get all local addresss. */
+#define SCTP_GET_LOCAL_ADDRS    109             /* Get all local address. */
 #define SCTP_SOCKOPT_CONNECTX   110             /* CONNECTX requests. */
 #define SCTP_SOCKOPT_CONNECTX3  111     /* CONNECTX requests (updated) */
diff --git a/include/net/snmp.h b/include/net/snmp.h
index a0e61806d480..762e2abce889 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -60,9 +60,7 @@ struct ipstats_mib {
 };
 /* ICMP */
-#define ICMP_MIB_DUMMY  __ICMP_MIB_MAX
+#define ICMP_MIB_MAX    __ICMP_MIB_MAX
-#define ICMP_MIB_MAX    (__ICMP_MIB_MAX + 1)
 struct icmp_mib {
        unsigned long   mibs[ICMP_MIB_MAX];
 };
diff --git a/include/net/sock.h b/include/net/sock.h
index a6338d039857..d884d268c704 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -57,7 +57,7 @@
 #include <linux/rculist_nulls.h>
 #include <linux/poll.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <net/dst.h>
 #include <net/checksum.h>
@@ -105,10 +105,8 @@ struct net;
 /**
 *      struct sock_common - minimal network layer representation of sockets
- *      @skc_node: main hash linkage for various protocol lookup tables
+ *      @skc_daddr: Foreign IPv4 addr
- *      @skc_nulls_node: main hash linkage for TCP/UDP/UDP-Lite protocol
+ *      @skc_rcv_saddr: Bound local IPv4 addr
- *      @skc_refcnt: reference count
- *      @skc_tx_queue_mapping: tx queue number for this connection
 *      @skc_hash: hash value used with various protocol lookup tables
 *      @skc_u16hashes: two u16 hash values used by UDP lookup tables
 *      @skc_family: network address family
@@ -119,20 +117,20 @@ struct net;
 *      @skc_portaddr_node: second hash linkage for UDP/UDP-Lite protocol
 *      @skc_prot: protocol handlers inside a network family
 *      @skc_net: reference to the network namespace of this socket
+ *      @skc_node: main hash linkage for various protocol lookup tables
+ *      @skc_nulls_node: main hash linkage for TCP/UDP/UDP-Lite protocol
+ *      @skc_tx_queue_mapping: tx queue number for this connection
+ *      @skc_refcnt: reference count
 *
 *      This is the minimal network layer representation of sockets, the header
 *      for struct sock and struct inet_timewait_sock.
 */
 struct sock_common {
-        /*
+        /* skc_daddr and skc_rcv_saddr must be grouped :
-         * first fields are not copied in sock_copy()
+         * cf INET_MATCH() and INET_TW_MATCH()
         */
-        union {
+        __be32                  skc_daddr;
-                struct hlist_node       skc_node;
+        __be32                  skc_rcv_saddr;
-                struct hlist_nulls_node skc_nulls_node;
-        };
-        atomic_t                skc_refcnt;
-        int                     skc_tx_queue_mapping;
        union  {
                unsigned int    skc_hash;
@@ -150,6 +148,22 @@ struct sock_common {
 #ifdef CONFIG_NET_NS
        struct net              *skc_net;
 #endif
+        /*
+         * fields between dontcopy_begin/dontcopy_end
+         * are not copied in sock_copy()
+         */
+        /* private: */
+        int                     skc_dontcopy_begin[0];
+        /* public: */
+        union {
+                struct hlist_node       skc_node;
+                struct hlist_nulls_node skc_nulls_node;
+        };
+        int                     skc_tx_queue_mapping;
+        atomic_t                skc_refcnt;
+        /* private: */
+        int                     skc_dontcopy_end[0];
+        /* public: */
 };
 /**
@@ -232,7 +246,8 @@ struct sock {
 #define sk_refcnt               __sk_common.skc_refcnt
 #define sk_tx_queue_mapping     __sk_common.skc_tx_queue_mapping
-#define sk_copy_start           __sk_common.skc_hash
+#define sk_dontcopy_begin       __sk_common.skc_dontcopy_begin
+#define sk_dontcopy_end         __sk_common.skc_dontcopy_end
 #define sk_hash                 __sk_common.skc_hash
 #define sk_family               __sk_common.skc_family
 #define sk_state                __sk_common.skc_state
@@ -241,59 +256,67 @@ struct sock {
 #define sk_bind_node            __sk_common.skc_bind_node
 #define sk_prot                 __sk_common.skc_prot
 #define sk_net                  __sk_common.skc_net
-        kmemcheck_bitfield_begin(flags);
-        unsigned int            sk_shutdown  : 2,
-                                sk_no_check  : 2,
-                                sk_userlocks : 4,
-                                sk_protocol  : 8,
-                                sk_type      : 16;
-        kmemcheck_bitfield_end(flags);
-        int                     sk_rcvbuf;
        socket_lock_t           sk_lock;
+        struct sk_buff_head     sk_receive_queue;
        /*
         * The backlog queue is special, it is always used with
         * the per-socket spinlock held and requires low latency
         * access. Therefore we special case it's implementation.
+         * Note : rmem_alloc is in this structure to fill a hole
+         * on 64bit arches, not because its logically part of
+         * backlog.
         */
        struct {
-                struct sk_buff *head;
+                atomic_t        rmem_alloc;
-                struct sk_buff *tail;
+                int             len;
-                int len;
+                struct sk_buff  *head;
+                struct sk_buff  *tail;
        } sk_backlog;
+#define sk_rmem_alloc sk_backlog.rmem_alloc
+        int                     sk_forward_alloc;
+#ifdef CONFIG_RPS
+        __u32                   sk_rxhash;
+#endif
+        atomic_t                sk_drops;
+        int                     sk_rcvbuf;
+        struct sk_filter __rcu  *sk_filter;
        struct socket_wq        *sk_wq;
-        struct dst_entry        *sk_dst_cache;
+#ifdef CONFIG_NET_DMA
+        struct sk_buff_head     sk_async_wait_queue;
+#endif
 #ifdef CONFIG_XFRM
        struct xfrm_policy      *sk_policy[2];
 #endif
+        unsigned long           sk_flags;
+        struct dst_entry        *sk_dst_cache;
        spinlock_t              sk_dst_lock;
-        atomic_t                sk_rmem_alloc;
        atomic_t                sk_wmem_alloc;
        atomic_t                sk_omem_alloc;
        int                     sk_sndbuf;
-        struct sk_buff_head     sk_receive_queue;
        struct sk_buff_head     sk_write_queue;
-#ifdef CONFIG_NET_DMA
+        kmemcheck_bitfield_begin(flags);
-        struct sk_buff_head     sk_async_wait_queue;
+        unsigned int            sk_shutdown  : 2,
-#endif
+                                sk_no_check  : 2,
+                                sk_userlocks : 4,
+                                sk_protocol  : 8,
+                                sk_type      : 16;
+        kmemcheck_bitfield_end(flags);
        int                     sk_wmem_queued;
-        int                     sk_forward_alloc;
        gfp_t                   sk_allocation;
        int                     sk_route_caps;
        int                     sk_route_nocaps;
        int                     sk_gso_type;
        unsigned int            sk_gso_max_size;
        int                     sk_rcvlowat;
-#ifdef CONFIG_RPS
-        __u32                   sk_rxhash;
-#endif
-        unsigned long           sk_flags;
        unsigned long           sk_lingertime;
        struct sk_buff_head     sk_error_queue;
        struct proto            *sk_prot_creator;
        rwlock_t                sk_callback_lock;
        int                     sk_err,
                                sk_err_soft;
-        atomic_t                sk_drops;
        unsigned short          sk_ack_backlog;
        unsigned short          sk_max_ack_backlog;
        __u32                   sk_priority;
@@ -301,7 +324,6 @@ struct sock {
        const struct cred       *sk_peer_cred;
        long                    sk_rcvtimeo;
        long                    sk_sndtimeo;
-        struct sk_filter __rcu  *sk_filter;
        void                    *sk_protinfo;
        struct timer_list       sk_timer;
        ktime_t                 sk_stamp;
@@ -509,9 +531,6 @@ static __inline__ void sk_add_bind_node(struct sock *sk,
 #define sk_nulls_for_each_from(__sk, node) \
        if (__sk && ({ node = &(__sk)->sk_nulls_node; 1; })) \
                hlist_nulls_for_each_entry_from(__sk, node, sk_nulls_node)
-#define sk_for_each_continue(__sk, node) \
-        if (__sk && ({ node = &(__sk)->sk_node; 1; })) \
-                hlist_for_each_entry_continue(__sk, node, sk_node)
 #define sk_for_each_safe(__sk, node, tmp, list) \
        hlist_for_each_entry_safe(__sk, node, tmp, list, sk_node)
 #define sk_for_each_bound(__sk, node, list) \
@@ -754,6 +773,7 @@ struct proto {
        void                    (*unhash)(struct sock *sk);
        void                    (*rehash)(struct sock *sk);
        int                     (*get_port)(struct sock *sk, unsigned short snum);
+        void                    (*clear_sk)(struct sock *sk, int size);
        /* Keeping track of sockets in use */
 #ifdef CONFIG_PROC_FS
@@ -852,6 +872,8 @@ static inline void __sk_prot_rehash(struct sock *sk)
        sk->sk_prot->hash(sk);
 }
+void sk_prot_clear_portaddr_nulls(struct sock *sk, int size);
 /* About 10 seconds */
 #define SOCK_DESTROY_TIME (10*HZ)
@@ -1155,6 +1177,8 @@ extern void sk_common_release(struct sock *sk);
 /* Initialise core socket variables */
 extern void sock_init_data(struct socket *sock, struct sock *sk);
+extern void sk_filter_release_rcu(struct rcu_head *rcu);
 /**
 *      sk_filter_release - release a socket filter
 *      @fp: filter to remove
@@ -1165,7 +1189,7 @@ extern void sock_init_data(struct socket *sock, struct sock *sk);
 static inline void sk_filter_release(struct sk_filter *fp)
 {
        if (atomic_dec_and_test(&fp->refcnt))
-                kfree(fp);
+                call_rcu_bh(&fp->rcu, sk_filter_release_rcu);
 }
 static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e36c874c7fb1..38509f047382 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -60,6 +60,9 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 */
 #define MAX_TCP_WINDOW          32767U
+/* Offer an initial receive window of 10 mss. */
+#define TCP_DEFAULT_INIT_RCVWND 10
 /* Minimal accepted MSS. It is (60+60+8) - (20+20). */
 #define TCP_MIN_MSS             88U
@@ -100,12 +103,6 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCP_SYNACK_RETRIES 5    /* number of times to retry passive opening a
                                 * connection: ~180sec is RFC minimum   */
-#define TCP_ORPHAN_RETRIES 7    /* number of times to retry on an orphaned
-                                 * socket. 7 is ~50sec-16min.
-                                 */
 #define TCP_TIMEWAIT_LEN (60*HZ) /* how long to wait to destroy TIME-WAIT
                                  * state, about 60 seconds     */
 #define TCP_FIN_TIMEOUT TCP_TIMEWAIT_LEN
@@ -312,7 +309,8 @@ extern void tcp_shutdown (struct sock *sk, int how);
 extern int tcp_v4_rcv(struct sk_buff *skb);
-extern int tcp_v4_remember_stamp(struct sock *sk);
+extern struct inet_peer *tcp_v4_get_peer(struct sock *sk, bool *release_it);
+extern void *tcp_v4_tw_get_peer(struct sock *sk);
 extern int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
 extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                       size_t size);
@@ -1043,7 +1041,13 @@ static inline int tcp_paws_check(const struct tcp_options_received *rx_opt,
                return 1;
        if (unlikely(get_seconds() >= rx_opt->ts_recent_stamp + TCP_PAWS_24DAYS))
                return 1;
+        /*
+         * Some OSes send SYN and SYNACK messages with tsval=0 tsecr=0,
+         * then following tcp messages have valid values. Ignore 0 value,
+         * or else 'negative' tsval might forbid us to accept their packets.
+         */
+        if (!rx_opt->ts_recent)
+                return 1;
        return 0;
 }
@@ -1157,8 +1161,6 @@ struct tcp_md5sig_pool {
        union tcp_md5sum_block  md5_blk;
 };
-#define TCP_MD5SIG_MAXKEYS      (~(u32)0)       /* really?! */
 /* - functions */
 extern int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
                               struct sock *sk, struct request_sock *req,
diff --git a/include/net/timewait_sock.h b/include/net/timewait_sock.h
index 97c3b14da55d..053b3cf2c66a 100644
--- a/include/net/timewait_sock.h
+++ b/include/net/timewait_sock.h
@@ -21,6 +21,7 @@ struct timewait_sock_ops {
        int             (*twsk_unique)(struct sock *sk,
                                       struct sock *sktw, void *twp);
        void            (*twsk_destructor)(struct sock *sk);
+        void            *(*twsk_getpeer)(struct sock *sk);
 };
 static inline int twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
@@ -39,4 +40,11 @@ static inline void twsk_destructor(struct sock *sk)
                sk->sk_prot->twsk_prot->twsk_destructor(sk);
 }
+static inline void *twsk_getpeer(struct sock *sk)
+{
+        if (sk->sk_prot->twsk_prot->twsk_getpeer)
+                return sk->sk_prot->twsk_prot->twsk_getpeer(sk);
+        return NULL;
+}
 #endif /* _TIMEWAIT_SOCK_H */
diff --git a/include/net/tipc/tipc.h b/include/net/tipc/tipc.h
deleted file mode 100644
index 1e0645e1eed2..000000000000
--- a/include/net/tipc/tipc.h
+++ /dev/null
@@ -1,186 +0,0 @@
-/*
- * include/net/tipc/tipc.h: Main include file for TIPC users
- * 
- * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005,2010 Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef _NET_TIPC_H_
-#define _NET_TIPC_H_
-#ifdef __KERNEL__
-#include <linux/tipc.h>
-#include <linux/skbuff.h>
-/* 
- * Native API
- */
-/*
- * TIPC operating mode routines
- */
-#define TIPC_NOT_RUNNING  0
-#define TIPC_NODE_MODE    1
-#define TIPC_NET_MODE     2
-typedef void (*tipc_mode_event)(void *usr_handle, int mode, u32 addr);
-int tipc_attach(unsigned int *userref, tipc_mode_event, void *usr_handle);
-void tipc_detach(unsigned int userref);
-/*
- * TIPC port manipulation routines
- */
-typedef void (*tipc_msg_err_event) (void *usr_handle,
-                                    u32 portref,
-                                    struct sk_buff **buf,
-                                    unsigned char const *data,
-                                    unsigned int size,
-                                    int reason, 
-                                    struct tipc_portid const *attmpt_destid);
-typedef void (*tipc_named_msg_err_event) (void *usr_handle,
-                                          u32 portref,
-                                          struct sk_buff **buf,
-                                          unsigned char const *data,
-                                          unsigned int size,
-                                          int reason, 
-                                          struct tipc_name_seq const *attmpt_dest);
-typedef void (*tipc_conn_shutdown_event) (void *usr_handle,
-                                          u32 portref,
-                                          struct sk_buff **buf,
-                                          unsigned char const *data,
-                                          unsigned int size,
-                                          int reason);
-typedef void (*tipc_msg_event) (void *usr_handle,
-                                u32 portref,
-                                struct sk_buff **buf,
-                                unsigned char const *data,
-                                unsigned int size,
-                                unsigned int importance, 
-                                struct tipc_portid const *origin);
-typedef void (*tipc_named_msg_event) (void *usr_handle,
-                                      u32 portref,
-                                      struct sk_buff **buf,
-                                      unsigned char const *data,
-                                      unsigned int size,
-                                      unsigned int importance, 
-                                      struct tipc_portid const *orig,
-                                      struct tipc_name_seq const *dest);
-typedef void (*tipc_conn_msg_event) (void *usr_handle,
-                                     u32 portref,
-                                     struct sk_buff **buf,
-                                     unsigned char const *data,
-                                     unsigned int size);
-typedef void (*tipc_continue_event) (void *usr_handle, 
-                                     u32 portref);
-int tipc_createport(unsigned int tipc_user, 
-                    void *usr_handle, 
-                    unsigned int importance, 
-                    tipc_msg_err_event error_cb, 
-                    tipc_named_msg_err_event named_error_cb, 
-                    tipc_conn_shutdown_event conn_error_cb, 
-                    tipc_msg_event message_cb, 
-                    tipc_named_msg_event named_message_cb, 
-                    tipc_conn_msg_event conn_message_cb, 
-                    tipc_continue_event continue_event_cb,
-                    u32 *portref);
-int tipc_deleteport(u32 portref);
-int tipc_ownidentity(u32 portref, struct tipc_portid *port);
-int tipc_portimportance(u32 portref, unsigned int *importance);
-int tipc_set_portimportance(u32 portref, unsigned int importance);
-int tipc_portunreliable(u32 portref, unsigned int *isunreliable);
-int tipc_set_portunreliable(u32 portref, unsigned int isunreliable);
-int tipc_portunreturnable(u32 portref, unsigned int *isunreturnable);
-int tipc_set_portunreturnable(u32 portref, unsigned int isunreturnable);
-int tipc_publish(u32 portref, unsigned int scope, 
-                 struct tipc_name_seq const *name_seq);
-int tipc_withdraw(u32 portref, unsigned int scope,
-                  struct tipc_name_seq const *name_seq);
-int tipc_connect2port(u32 portref, struct tipc_portid const *port);
-int tipc_disconnect(u32 portref);
-int tipc_shutdown(u32 ref);
-/*
- * TIPC messaging routines
- */
-#define TIPC_PORT_IMPORTANCE 100        /* send using current port setting */
-int tipc_send(u32 portref,
-              unsigned int num_sect,
-              struct iovec const *msg_sect);
-int tipc_send2name(u32 portref, 
-                   struct tipc_name const *name, 
-                   u32 domain,
-                   unsigned int num_sect,
-                   struct iovec const *msg_sect);
-int tipc_send2port(u32 portref,
-                   struct tipc_portid const *dest,
-                   unsigned int num_sect,
-                   struct iovec const *msg_sect);
-int tipc_send_buf2port(u32 portref,
-                       struct tipc_portid const *dest,
-                       struct sk_buff *buf,
-                       unsigned int dsz);
-int tipc_multicast(u32 portref, 
-                   struct tipc_name_seq const *seq, 
-                   u32 domain,  /* currently unused */
-                   unsigned int section_count,
-                   struct iovec const *msg);
-#endif
-#endif
diff --git a/include/net/tipc/tipc_bearer.h b/include/net/tipc/tipc_bearer.h
deleted file mode 100644
index ee2f304e4919..000000000000
--- a/include/net/tipc/tipc_bearer.h
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- * include/net/tipc/tipc_bearer.h: Include file for privileged access to TIPC bearers
- * 
- * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef _NET_TIPC_BEARER_H_
-#define _NET_TIPC_BEARER_H_
-#ifdef __KERNEL__
-#include <linux/tipc_config.h>
-#include <linux/skbuff.h>
-#include <linux/spinlock.h>
-/*
- * Identifiers of supported TIPC media types
- */
-#define TIPC_MEDIA_TYPE_ETH     1
-/* 
- * Destination address structure used by TIPC bearers when sending messages
- * 
- * IMPORTANT: The fields of this structure MUST be stored using the specified
- * byte order indicated below, as the structure is exchanged between nodes
- * as part of a link setup process.
- */
-struct tipc_media_addr {
-        __be32  type;                   /* bearer type (network byte order) */
-        union {
-                __u8   eth_addr[6];     /* 48 bit Ethernet addr (byte array) */ 
-#if 0
-                /* Prototypes for other possible bearer types */
-                struct {
-                        __u16 sin_family;
-                        __u16 sin_port;
-                        struct {
-                                __u32 s_addr;
-                        } sin_addr;
-                        char pad[4];
-                } addr_in;              /* IP-based bearer */
-                __u16  sock_descr;      /* generic socket bearer */
-#endif
-        } dev_addr;
-};
-/**
- * struct tipc_bearer - TIPC bearer info available to privileged users
- * @usr_handle: pointer to additional user-defined information about bearer
- * @mtu: max packet size bearer can support
- * @blocked: non-zero if bearer is blocked
- * @lock: spinlock for controlling access to bearer
- * @addr: media-specific address associated with bearer
- * @name: bearer name (format = media:interface)
- * 
- * Note: TIPC initializes "name" and "lock" fields; user is responsible for
- * initialization all other fields when a bearer is enabled.
- */
-struct tipc_bearer {
-        void *usr_handle;
-        u32 mtu;
-        int blocked;
-        spinlock_t lock;
-        struct tipc_media_addr addr;
-        char name[TIPC_MAX_BEARER_NAME];
-};
-/*
- * TIPC routines available to supported media types
- */
-int  tipc_register_media(u32 media_type,
-                         char *media_name, 
-                         int (*enable)(struct tipc_bearer *), 
-                         void (*disable)(struct tipc_bearer *), 
-                         int (*send_msg)(struct sk_buff *, 
-                                         struct tipc_bearer *,
-                                         struct tipc_media_addr *), 
-                         char *(*addr2str)(struct tipc_media_addr *a,
-                                           char *str_buf,
-                                           int str_size),
-                         struct tipc_media_addr *bcast_addr,
-                         const u32 bearer_priority,
-                         const u32 link_tolerance,  /* [ms] */
-                         const u32 send_window_limit); 
-void tipc_recv_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr);
-int  tipc_block_bearer(const char *name);
-void tipc_continue(struct tipc_bearer *tb_ptr); 
-int tipc_enable_bearer(const char *bearer_name, u32 bcast_scope, u32 priority);
-int tipc_disable_bearer(const char *name);
-/*
- * Routines made available to TIPC by supported media types
- */
-int  tipc_eth_media_start(void);
-void tipc_eth_media_stop(void);
-#endif
-#endif
diff --git a/include/net/tipc/tipc_msg.h b/include/net/tipc/tipc_msg.h
deleted file mode 100644
index ffe50b4e7b93..000000000000
--- a/include/net/tipc/tipc_msg.h
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * include/net/tipc/tipc_msg.h: Include file for privileged access to TIPC message headers
- * 
- * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef _NET_TIPC_MSG_H_
-#define _NET_TIPC_MSG_H_
-#ifdef __KERNEL__
-struct tipc_msg {
-        __be32 hdr[15];
-};
-/*
-                TIPC user data message header format, version 2:
-       1 0 9 8 7 6 5 4|3 2 1 0 9 8 7 6|5 4 3 2 1 0 9 8|7 6 5 4 3 2 1 0 
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w0:|vers | user  |hdr sz |n|d|s|-|          message size           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w1:|mstyp| error |rer cnt|lsc|opt p|      broadcast ack no         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w2:|        link level ack no      |   broadcast/link level seq no |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w3:|                       previous node                           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w4:|                      originating port                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w5:|                      destination port                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    
-   w6:|                      originating node                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w7:|                      destination node                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w8:|            name type / transport sequence number              |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w9:|              name instance/multicast lower bound              |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    
-   wA:|                    multicast upper bound                      |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    
-      /                                                               /
-      \                           options                             \
-      /                                                               /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-*/
-#define TIPC_CONN_MSG   0
-#define TIPC_MCAST_MSG  1
-#define TIPC_NAMED_MSG  2
-#define TIPC_DIRECT_MSG 3
-static inline u32 msg_word(struct tipc_msg *m, u32 pos)
-{
-        return ntohl(m->hdr[pos]);
-}
-static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask)
-{
-        return (msg_word(m, w) >> pos) & mask;
-}
-static inline u32 msg_importance(struct tipc_msg *m)
-{
-        return msg_bits(m, 0, 25, 0xf);
-}
-static inline u32 msg_hdr_sz(struct tipc_msg *m)
-{
-        return msg_bits(m, 0, 21, 0xf) << 2;
-}
-static inline int msg_short(struct tipc_msg *m)
-{
-        return msg_hdr_sz(m) == 24;
-}
-static inline u32 msg_size(struct tipc_msg *m)
-{
-        return msg_bits(m, 0, 0, 0x1ffff);
-}
-static inline u32 msg_data_sz(struct tipc_msg *m)
-{
-        return msg_size(m) - msg_hdr_sz(m);
-}
-static inline unchar *msg_data(struct tipc_msg *m)
-{
-        return ((unchar *)m) + msg_hdr_sz(m);
-}
-static inline u32 msg_type(struct tipc_msg *m)
-{
-        return msg_bits(m, 1, 29, 0x7);
-}
-static inline u32 msg_named(struct tipc_msg *m)
-{
-        return msg_type(m) == TIPC_NAMED_MSG;
-}
-static inline u32 msg_mcast(struct tipc_msg *m)
-{
-        return msg_type(m) == TIPC_MCAST_MSG;
-}
-static inline u32 msg_connected(struct tipc_msg *m)
-{
-        return msg_type(m) == TIPC_CONN_MSG;
-}
-static inline u32 msg_errcode(struct tipc_msg *m)
-{
-        return msg_bits(m, 1, 25, 0xf);
-}
-static inline u32 msg_prevnode(struct tipc_msg *m)
-{
-        return msg_word(m, 3);
-}
-static inline u32 msg_origport(struct tipc_msg *m)
-{
-        return msg_word(m, 4);
-}
-static inline u32 msg_destport(struct tipc_msg *m)
-{
-        return msg_word(m, 5);
-}
-static inline u32 msg_mc_netid(struct tipc_msg *m)
-{
-        return msg_word(m, 5);
-}
-static inline u32 msg_orignode(struct tipc_msg *m)
-{
-        if (likely(msg_short(m)))
-                return msg_prevnode(m);
-        return msg_word(m, 6);
-}
-static inline u32 msg_destnode(struct tipc_msg *m)
-{
-        return msg_word(m, 7);
-}
-static inline u32 msg_nametype(struct tipc_msg *m)
-{
-        return msg_word(m, 8);
-}
-static inline u32 msg_nameinst(struct tipc_msg *m)
-{
-        return msg_word(m, 9);
-}
-static inline u32 msg_namelower(struct tipc_msg *m)
-{
-        return msg_nameinst(m);
-}
-static inline u32 msg_nameupper(struct tipc_msg *m)
-{
-        return msg_word(m, 10);
-}
-#endif
-#endif
diff --git a/include/net/tipc/tipc_port.h b/include/net/tipc/tipc_port.h
deleted file mode 100644
index 1893aaf49426..000000000000
--- a/include/net/tipc/tipc_port.h
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * include/net/tipc/tipc_port.h: Include file for privileged access to TIPC ports
- * 
- * Copyright (c) 1994-2007, Ericsson AB
- * Copyright (c) 2005-2008, Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef _NET_TIPC_PORT_H_
-#define _NET_TIPC_PORT_H_
-#ifdef __KERNEL__
-#include <linux/tipc.h>
-#include <linux/skbuff.h>
-#include <net/tipc/tipc_msg.h>
-#define TIPC_FLOW_CONTROL_WIN 512
-/**
- * struct tipc_port - native TIPC port info available to privileged users
- * @usr_handle: pointer to additional user-defined information about port
- * @lock: pointer to spinlock for controlling access to port
- * @connected: non-zero if port is currently connected to a peer port
- * @conn_type: TIPC type used when connection was established
- * @conn_instance: TIPC instance used when connection was established
- * @conn_unacked: number of unacknowledged messages received from peer port
- * @published: non-zero if port has one or more associated names
- * @congested: non-zero if cannot send because of link or port congestion
- * @max_pkt: maximum packet size "hint" used when building messages sent by port
- * @ref: unique reference to port in TIPC object registry
- * @phdr: preformatted message header used when sending messages
- */
-struct tipc_port {
-        void *usr_handle;
-        spinlock_t *lock;
-        int connected;
-        u32 conn_type;
-        u32 conn_instance;
-        u32 conn_unacked;
-        int published;
-        u32 congested;
-        u32 max_pkt;
-        u32 ref;
-        struct tipc_msg phdr;
-};
-struct tipc_port *tipc_createport_raw(void *usr_handle,
-                        u32 (*dispatcher)(struct tipc_port *, struct sk_buff *),
-                        void (*wakeup)(struct tipc_port *),
-                        const u32 importance);
-int tipc_reject_msg(struct sk_buff *buf, u32 err);
-int tipc_send_buf_fast(struct sk_buff *buf, u32 destnode);
-void tipc_acknowledge(u32 port_ref,u32 ack);
-struct tipc_port *tipc_get_port(const u32 ref);
-/*
- * The following routines require that the port be locked on entry
- */
-int tipc_disconnect_port(struct tipc_port *tp_ptr);
-#endif
-#endif
diff --git a/include/net/x25.h b/include/net/x25.h
index 1479cb4a41fc..a06119a05129 100644
--- a/include/net/x25.h
+++ b/include/net/x25.h
@@ -315,6 +315,8 @@ extern struct list_head x25_route_list;
 extern rwlock_t x25_route_list_lock;
 extern struct list_head x25_forward_list;
 extern rwlock_t x25_forward_list_lock;
+extern struct list_head x25_neigh_list;
+extern rwlock_t x25_neigh_list_lock;
 extern int x25_proc_init(void);
 extern void x25_proc_exit(void);
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index bcfb6b24b019..b9f385da758e 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -143,6 +143,7 @@ struct xfrm_state {
        struct xfrm_id          id;
        struct xfrm_selector    sel;
        struct xfrm_mark        mark;
+        u32                     tfcpad;
        u32                     genid;
@@ -805,6 +806,9 @@ __be16 xfrm_flowi_sport(struct flowi *fl)
        case IPPROTO_MH:
                port = htons(fl->fl_mh_type);
                break;
+        case IPPROTO_GRE:
+                port = htons(ntohl(fl->fl_gre_key) >> 16);
+                break;
        default:
                port = 0;       /*XXX*/
        }
@@ -826,6 +830,9 @@ __be16 xfrm_flowi_dport(struct flowi *fl)
        case IPPROTO_ICMPV6:
                port = htons(fl->fl_icmp_code);
                break;
+        case IPPROTO_GRE:
+                port = htons(ntohl(fl->fl_gre_key) & 0xffff);
+                break;
        default:
                port = 0;       /*XXX*/
        }