139 files changed, 5239 insertions, 2277 deletions

diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index a8de812ccbc8..008711e8e78f 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -86,6 +86,8 @@ do { \
 
 /**
  * enum p9_msg_t - 9P message types
+ * @P9_TLERROR: not used
+ * @P9_RLERROR: response for any failed request for 9P2000.L
  * @P9_TSTATFS: file system status request
  * @P9_RSTATFS: file system status response
  * @P9_TSYMLINK: make symlink request
@@ -117,7 +119,7 @@ do { \
  * @P9_TREAD: request to transfer data from a file or directory
  * @P9_RREAD: response with data requested
  * @P9_TWRITE: reuqest to transfer data to a file
- * @P9_RWRITE: response with out much data was transfered to file
+ * @P9_RWRITE: response with out much data was transferred to file
  * @P9_TCLUNK: forget about a handle to an entity within the file system
  * @P9_RCLUNK: response when server has forgotten about the handle
  * @P9_TREMOVE: request to remove an entity from the hierarchy
@@ -137,6 +139,8 @@ do { \
  */
 
 enum p9_msg_t {
+        P9_TLERROR = 6,
+        P9_RLERROR,
         P9_TSTATFS = 8,
         P9_RSTATFS,
         P9_TLOPEN = 12,
@@ -149,6 +153,8 @@ enum p9_msg_t {
         P9_RMKNOD,
         P9_TRENAME = 20,
         P9_RRENAME,
+        P9_TREADLINK = 22,
+        P9_RREADLINK,
         P9_TGETATTR = 24,
         P9_RGETATTR,
         P9_TSETATTR = 26,
@@ -159,6 +165,12 @@ enum p9_msg_t {
         P9_RXATTRCREATE,
         P9_TREADDIR = 40,
         P9_RREADDIR,
+        P9_TFSYNC = 50,
+        P9_RFSYNC,
+        P9_TLOCK = 52,
+        P9_RLOCK,
+        P9_TGETLOCK = 54,
+        P9_RGETLOCK,
         P9_TLINK = 70,
         P9_RLINK,
         P9_TMKDIR = 72,
@@ -229,10 +241,10 @@ enum p9_open_mode_t {
 
 /**
  * enum p9_perm_t - 9P permissions
- * @P9_DMDIR: mode bite for directories
+ * @P9_DMDIR: mode bit for directories
  * @P9_DMAPPEND: mode bit for is append-only
  * @P9_DMEXCL: mode bit for excluse use (only one open handle allowed)
- * @P9_DMMOUNT: mode bite for mount points
+ * @P9_DMMOUNT: mode bit for mount points
  * @P9_DMAUTH: mode bit for authentication file
  * @P9_DMTMP: mode bit for non-backed-up files
  * @P9_DMSYMLINK: mode bit for symbolic links (9P2000.u)
@@ -280,7 +292,7 @@ enum p9_perm_t {
  *
  * QID types are a subset of permissions - they are primarily
  * used to differentiate semantics for a file system entity via
- * a jump-table.  Their value is also the most signifigant 16 bits
+ * a jump-table.  Their value is also the most significant 16 bits
  * of the permission_t
  *
  * See Also: http://plan9.bell-labs.com/magic/man2html/2/stat
@@ -350,10 +362,10 @@ struct p9_qid {
 };
 
 /**
- * struct p9_stat - file system metadata information
+ * struct p9_wstat - file system metadata information
  * @size: length prefix for this stat structure instance
- * @type: the type of the server (equivilent to a major number)
- * @dev: the sub-type of the server (equivilent to a minor number)
+ * @type: the type of the server (equivalent to a major number)
+ * @dev: the sub-type of the server (equivalent to a minor number)
  * @qid: unique id from the server of type &p9_qid
  * @mode: Plan 9 format permissions of type &p9_perm_t
  * @atime: Last access/read time
@@ -458,6 +470,48 @@ struct p9_iattr_dotl {
         u64 mtime_nsec;
 };
 
+#define P9_LOCK_SUCCESS 0
+#define P9_LOCK_BLOCKED 1
+#define P9_LOCK_ERROR 2
+#define P9_LOCK_GRACE 3
+
+#define P9_LOCK_FLAGS_BLOCK 1
+#define P9_LOCK_FLAGS_RECLAIM 2
+
+/* struct p9_flock: POSIX lock structure
+ * @type - type of lock
+ * @flags - lock flags
+ * @start - starting offset of the lock
+ * @length - number of bytes
+ * @proc_id - process id which wants to take lock
+ * @client_id - client id
+ */
+
+struct p9_flock {
+        u8 type;
+        u32 flags;
+        u64 start;
+        u64 length;
+        u32 proc_id;
+        char *client_id;
+};
+
+/* struct p9_getlock: getlock structure
+ * @type - type of lock
+ * @start - starting offset of the lock
+ * @length - number of bytes
+ * @proc_id - process id which wants to take lock
+ * @client_id - client id
+ */
+
+struct p9_getlock {
+        u8 type;
+        u64 start;
+        u64 length;
+        u32 proc_id;
+        char *client_id;
+};
+
 /* Structures for Protocol Operations */
 struct p9_tstatfs {
         u32 fid;
@@ -633,8 +687,12 @@ struct p9_rwstat {
  * @size: prefixed length of the structure
  * @id: protocol operating identifier of type &p9_msg_t
  * @tag: transaction id of the request
- * @offset: used by marshalling routines to track currentposition in buffer
- * @capacity: used by marshalling routines to track total capacity
+ * @offset: used by marshalling routines to track current position in buffer
+ * @capacity: used by marshalling routines to track total malloc'd capacity
+ * @pubuf: Payload user buffer given by the caller
+ * @pkbuf: Payload kernel buffer given by the caller
+ * @pbuf_size: pubuf/pkbuf(only one will be !NULL) size to be read/write.
+ * @private: For transport layer's use.
  * @sdata: payload
  *
  * &p9_fcall represents the structure for all 9P RPC
@@ -651,8 +709,12 @@ struct p9_fcall {
 
         size_t offset;
         size_t capacity;
+        char __user *pubuf;
+        char *pkbuf;
+        size_t pbuf_size;
+        void *private;
 
-        uint8_t *sdata;
+        u8 *sdata;
 };
 
 struct p9_idpool;
@@ -666,7 +728,6 @@ void p9_idpool_put(int id, struct p9_idpool *p);
 int p9_idpool_check(int id, struct p9_idpool *p);
 
 int p9_error_init(void);
-int p9_errstr2errno(char *, int);
 int p9_trans_fd_init(void);
 void p9_trans_fd_exit(void);
 #endif /* NET_9P_H */
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index d1aa2cfb30f0..d26d5e98a173 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -60,7 +60,7 @@ enum p9_trans_status {
 };
 
 /**
- * enum p9_req_status_t - virtio request status
+ * enum p9_req_status_t - status of a request
  * @REQ_STATUS_IDLE: request slot unused
  * @REQ_STATUS_ALLOC: request has been allocated but not sent
  * @REQ_STATUS_UNSENT: request waiting to be sent
@@ -101,7 +101,7 @@ enum p9_req_status_t {
  * Transport use an array to track outstanding requests
  * instead of a list.  While this may incurr overhead during initial
  * allocation or expansion, it makes request lookup much easier as the
- * tag id is a index into an array.  (We use tag+1 so that we can accomodate
+ * tag id is a index into an array.  (We use tag+1 so that we can accommodate
  * the -1 tag for the T_VERSION request).
  * This also has the nice effect of only having to allocate wait_queues
  * once, instead of constantly allocating and freeing them.  Its possible
@@ -212,17 +212,14 @@ struct p9_dirent {
 
 int p9_client_statfs(struct p9_fid *fid, struct p9_rstatfs *sb);
 int p9_client_rename(struct p9_fid *fid, struct p9_fid *newdirfid, char *name);
-int p9_client_version(struct p9_client *);
 struct p9_client *p9_client_create(const char *dev_name, char *options);
 void p9_client_destroy(struct p9_client *clnt);
 void p9_client_disconnect(struct p9_client *clnt);
 void p9_client_begin_disconnect(struct p9_client *clnt);
 struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
                                         char *uname, u32 n_uname, char *aname);
-struct p9_fid *p9_client_auth(struct p9_client *clnt, char *uname,
-                                                u32 n_uname, char *aname);
-struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
-                                                                int clone);
+struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
+                char **wnames, int clone);
 int p9_client_open(struct p9_fid *fid, int mode);
 int p9_client_fcreate(struct p9_fid *fid, char *name, u32 perm, int mode,
                                                         char *extension);
@@ -232,6 +229,7 @@ int p9_client_symlink(struct p9_fid *fid, char *name, char *symname, gid_t gid,
 int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
                 gid_t gid, struct p9_qid *qid);
 int p9_client_clunk(struct p9_fid *fid);
+int p9_client_fsync(struct p9_fid *fid, int datasync);
 int p9_client_remove(struct p9_fid *fid);
 int p9_client_read(struct p9_fid *fid, char *data, char __user *udata,
                                                         u64 offset, u32 count);
@@ -251,6 +249,8 @@ int p9_client_mknod_dotl(struct p9_fid *oldfid, char *name, int mode,
                         dev_t rdev, gid_t gid, struct p9_qid *);
 int p9_client_mkdir_dotl(struct p9_fid *fid, char *name, int mode,
                                 gid_t gid, struct p9_qid *);
+int p9_client_lock_dotl(struct p9_fid *fid, struct p9_flock *flock, u8 *status);
+int p9_client_getlock_dotl(struct p9_fid *fid, struct p9_getlock *fl);
 struct p9_req_t *p9_tag_lookup(struct p9_client *, u16);
 void p9_client_cb(struct p9_client *c, struct p9_req_t *req);
 
@@ -262,5 +262,6 @@ int p9_is_proto_dotu(struct p9_client *clnt);
 int p9_is_proto_dotl(struct p9_client *clnt);
 struct p9_fid *p9_client_xattrwalk(struct p9_fid *, const char *, u64 *);
 int p9_client_xattrcreate(struct p9_fid *, const char *, u64, int);
+int p9_client_readlink(struct p9_fid *fid, char **target);
 
 #endif /* NET_9P_CLIENT_H */
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index 6d5886efb102..d8549fb9c742 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -26,13 +26,22 @@
 #ifndef NET_9P_TRANSPORT_H
 #define NET_9P_TRANSPORT_H
 
+#define P9_TRANS_PREF_PAYLOAD_MASK 0x1
+
+/* Default. Add Payload to PDU before sending it down to transport layer */
+#define P9_TRANS_PREF_PAYLOAD_DEF  0x0
+/* Send pay load separately to transport layer along with PDU.*/
+#define P9_TRANS_PREF_PAYLOAD_SEP  0x1
+
 /**
  * struct p9_trans_module - transport module interface
  * @list: used to maintain a list of currently available transports
  * @name: the human-readable name of the transport
  * @maxsize: transport provided maximum packet size
+ * @pref: Preferences of this transport
  * @def: set if this transport should be considered the default
  * @create: member function to create a new connection on this transport
+ * @close: member function to discard a connection on this transport
  * @request: member function to issue a request to the transport
  * @cancel: member function to cancel a request (if it hasn't been sent)
  *
@@ -40,13 +49,14 @@
  * transport module with the 9P core network module and used by the client
  * to instantiate a new connection on a transport.
  *
- * BUGS: the transport module list isn't protected.
+ * The transport module list is protected by v9fs_trans_lock.
  */
 
 struct p9_trans_module {
         struct list_head list;
         char *name;             /* name of transport */
         int maxsize;            /* max message size of transport */
+        int pref;               /* Preferences of this transport */
         int def;                /* this transport should be default */
         struct module *owner;
         int (*create)(struct p9_client *, const char *, char *);
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 4d40c4d0230b..582e4ae70753 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -1,8 +1,6 @@
 #ifndef _ADDRCONF_H
 #define _ADDRCONF_H
 
-#define RETRANS_TIMER   HZ
-
 #define MAX_RTR_SOLICITATIONS           3
 #define RTR_SOLICITATION_INTERVAL       (4*HZ)
 
@@ -44,8 +42,6 @@ struct prefix_info {
 };
 
 
-#ifdef __KERNEL__
-
 #include <linux/netdevice.h>
 #include <net/if_inet6.h>
 #include <net/ipv6.h>
@@ -63,16 +59,16 @@ extern int			addrconf_set_dstaddr(struct net *net,
                                                      void __user *arg);
 
 extern int                      ipv6_chk_addr(struct net *net,
-                                              struct in6_addr *addr,
+                                              const struct in6_addr *addr,
                                               struct net_device *dev,
                                               int strict);
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 extern int                      ipv6_chk_home_addr(struct net *net,
-                                                   struct in6_addr *addr);
+                                                   const struct in6_addr *addr);
 #endif
 
-extern int                      ipv6_chk_prefix(struct in6_addr *addr,
+extern int                      ipv6_chk_prefix(const struct in6_addr *addr,
                                                 struct net_device *dev);
 
 extern struct inet6_ifaddr      *ipv6_get_ifaddr(struct net *net,
@@ -91,9 +87,9 @@ extern int			ipv6_get_lladdr(struct net_device *dev,
 extern int                      ipv6_rcv_saddr_equal(const struct sock *sk,
                                                     const struct sock *sk2);
 extern void                     addrconf_join_solict(struct net_device *dev,
-                                        struct in6_addr *addr);
+                                        const struct in6_addr *addr);
 extern void                     addrconf_leave_solict(struct inet6_dev *idev,
-                                        struct in6_addr *addr);
+                                        const struct in6_addr *addr);
 
 static inline unsigned long addrconf_timeout_fixup(u32 timeout,
                                                     unsigned unit)
@@ -160,35 +156,47 @@ extern void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len);
 /*
  *      anycast prototypes (anycast.c)
  */
-extern int ipv6_sock_ac_join(struct sock *sk,int ifindex,struct in6_addr *addr);
-extern int ipv6_sock_ac_drop(struct sock *sk,int ifindex,struct in6_addr *addr);
+extern int ipv6_sock_ac_join(struct sock *sk,int ifindex, const struct in6_addr *addr);
+extern int ipv6_sock_ac_drop(struct sock *sk,int ifindex, const struct in6_addr *addr);
 extern void ipv6_sock_ac_close(struct sock *sk);
-extern int inet6_ac_check(struct sock *sk, struct in6_addr *addr, int ifindex);
+extern int inet6_ac_check(struct sock *sk, const struct in6_addr *addr, int ifindex);
 
-extern int ipv6_dev_ac_inc(struct net_device *dev, struct in6_addr *addr);
-extern int __ipv6_dev_ac_dec(struct inet6_dev *idev, struct in6_addr *addr);
+extern int ipv6_dev_ac_inc(struct net_device *dev, const struct in6_addr *addr);
+extern int __ipv6_dev_ac_dec(struct inet6_dev *idev, const struct in6_addr *addr);
 extern int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
-                               struct in6_addr *addr);
+                               const struct in6_addr *addr);
 
 
 /* Device notifier */
 extern int register_inet6addr_notifier(struct notifier_block *nb);
 extern int unregister_inet6addr_notifier(struct notifier_block *nb);
 
-static inline struct inet6_dev *
-__in6_dev_get(struct net_device *dev)
+/**
+ * __in6_dev_get - get inet6_dev pointer from netdevice
+ * @dev: network device
+ *
+ * Caller must hold rcu_read_lock or RTNL, because this function
+ * does not take a reference on the inet6_dev.
+ */
+static inline struct inet6_dev *__in6_dev_get(const struct net_device *dev)
 {
-        return rcu_dereference_check(dev->ip6_ptr,
-                                     rcu_read_lock_held() ||
-                                     lockdep_rtnl_is_held());
+        return rcu_dereference_rtnl(dev->ip6_ptr);
 }
 
-static inline struct inet6_dev *
-in6_dev_get(struct net_device *dev)
+/**
+ * in6_dev_get - get inet6_dev pointer from netdevice
+ * @dev: network device
+ *
+ * This version can be used in any context, and takes a reference
+ * on the inet6_dev. Callers must use in6_dev_put() later to
+ * release this reference.
+ */
+static inline struct inet6_dev *in6_dev_get(const struct net_device *dev)
 {
-        struct inet6_dev *idev = NULL;
+        struct inet6_dev *idev;
+
         rcu_read_lock();
-        idev = __in6_dev_get(dev);
+        idev = rcu_dereference(dev->ip6_ptr);
         if (idev)
                 atomic_inc(&idev->refcnt);
         rcu_read_unlock();
@@ -197,16 +205,21 @@ in6_dev_get(struct net_device *dev)
 
 extern void in6_dev_finish_destroy(struct inet6_dev *idev);
 
-static inline void
-in6_dev_put(struct inet6_dev *idev)
+static inline void in6_dev_put(struct inet6_dev *idev)
 {
         if (atomic_dec_and_test(&idev->refcnt))
                 in6_dev_finish_destroy(idev);
 }
 
-#define __in6_dev_put(idev)  atomic_dec(&(idev)->refcnt)
-#define in6_dev_hold(idev)   atomic_inc(&(idev)->refcnt)
+static inline void __in6_dev_put(struct inet6_dev *idev)
+{
+        atomic_dec(&idev->refcnt);
+}
 
+static inline void in6_dev_hold(struct inet6_dev *idev)
+{
+        atomic_inc(&idev->refcnt);
+}
 
 extern void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp);
 
@@ -216,9 +229,15 @@ static inline void in6_ifa_put(struct inet6_ifaddr *ifp)
                 inet6_ifa_finish_destroy(ifp);
 }
 
-#define __in6_ifa_put(ifp)      atomic_dec(&(ifp)->refcnt)
-#define in6_ifa_hold(ifp)       atomic_inc(&(ifp)->refcnt)
+static inline void __in6_ifa_put(struct inet6_ifaddr *ifp)
+{
+        atomic_dec(&ifp->refcnt);
+}
 
+static inline void in6_ifa_hold(struct inet6_ifaddr *ifp)
+{
+        atomic_inc(&ifp->refcnt);
+}
 
 
 /*
@@ -241,23 +260,21 @@ static inline int ipv6_addr_is_multicast(const struct in6_addr *addr)
 
 static inline int ipv6_addr_is_ll_all_nodes(const struct in6_addr *addr)
 {
-        return (((addr->s6_addr32[0] ^ htonl(0xff020000)) |
+        return ((addr->s6_addr32[0] ^ htonl(0xff020000)) |
                 addr->s6_addr32[1] | addr->s6_addr32[2] |
-                (addr->s6_addr32[3] ^ htonl(0x00000001))) == 0);
+                (addr->s6_addr32[3] ^ htonl(0x00000001))) == 0;
 }
 
 static inline int ipv6_addr_is_ll_all_routers(const struct in6_addr *addr)
 {
-        return (((addr->s6_addr32[0] ^ htonl(0xff020000)) |
+        return ((addr->s6_addr32[0] ^ htonl(0xff020000)) |
                 addr->s6_addr32[1] | addr->s6_addr32[2] |
-                (addr->s6_addr32[3] ^ htonl(0x00000002))) == 0);
+                (addr->s6_addr32[3] ^ htonl(0x00000002))) == 0;
 }
 
-extern int __ipv6_isatap_ifid(u8 *eui, __be32 addr);
-
 static inline int ipv6_addr_is_isatap(const struct in6_addr *addr)
 {
-        return ((addr->s6_addr32[2] | htonl(0x02000000)) == htonl(0x02005EFE));
+        return (addr->s6_addr32[2] | htonl(0x02000000)) == htonl(0x02005EFE);
 }
 
 #ifdef CONFIG_PROC_FS
@@ -266,4 +283,3 @@ extern void if6_proc_exit(void);
 #endif
 
 #endif
-#endif
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index 00c2eaa07c25..03e6e9453623 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -12,8 +12,6 @@
 #ifndef _NET_RXRPC_H
 #define _NET_RXRPC_H
 
-#ifdef __KERNEL__
-
 #include <linux/rxrpc.h>
 
 struct rxrpc_call;
@@ -53,5 +51,4 @@ extern struct rxrpc_call *rxrpc_kernel_accept_call(struct socket *,
                                                    unsigned long);
 extern int rxrpc_kernel_reject_call(struct socket *);
 
-#endif /* __KERNEL__ */
 #endif /* _NET_RXRPC_H */
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 90c9e2872f27..91ab5b01678a 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -10,6 +10,7 @@ extern void unix_inflight(struct file *fp);
 extern void unix_notinflight(struct file *fp);
 extern void unix_gc(void);
 extern void wait_for_unix_gc(void);
+extern struct sock *unix_get_socket(struct file *filp);
 
 #define UNIX_HASH_SIZE  256
 
@@ -40,7 +41,6 @@ struct unix_skb_parms {
                                 spin_lock_nested(&unix_sk(s)->lock, \
                                 SINGLE_DEPTH_NESTING)
 
-#ifdef __KERNEL__
 /* The AF_UNIX socket */
 struct unix_sock {
         /* WARNING: sk has to be the first member */
@@ -56,6 +56,7 @@ struct unix_sock {
         spinlock_t              lock;
         unsigned int            gc_candidate : 1;
         unsigned int            gc_maybe_cycle : 1;
+        unsigned char           recursion_level;
         struct socket_wq        peer_wq;
 };
 #define unix_sk(__sk) ((struct unix_sock *)__sk)
@@ -70,4 +71,3 @@ static inline int unix_sysctl_register(struct net *net) { return 0; }
 static inline void unix_sysctl_unregister(struct net *net) {}
 #endif
 #endif
-#endif
diff --git a/include/net/ah.h b/include/net/ah.h
index f0129f79a31a..ca95b98969dd 100644
--- a/include/net/ah.h
+++ b/include/net/ah.h
@@ -4,7 +4,7 @@
 #include <linux/skbuff.h>
 
 /* This is the maximum truncated ICV length that we know of. */
-#define MAX_AH_AUTH_LEN 12
+#define MAX_AH_AUTH_LEN 64
 
 struct crypto_ahash;
 
diff --git a/include/net/arp.h b/include/net/arp.h
index 716f43c5c98e..91f0568a04ef 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -25,7 +25,6 @@ extern struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
                                   const unsigned char *src_hw,
                                   const unsigned char *target_hw);
 extern void arp_xmit(struct sk_buff *skb);
-
-extern const struct neigh_ops arp_broken_ops;
+int arp_invalidate(struct net_device *dev, __be32 ip);
 
 #endif  /* _ARP_H */
diff --git a/include/net/atmclip.h b/include/net/atmclip.h
index 467c531b8a7e..497ef6444a7a 100644
--- a/include/net/atmclip.h
+++ b/include/net/atmclip.h
@@ -54,8 +54,6 @@ struct clip_priv {
 };
 
 
-#ifdef __KERNEL__
 extern struct neigh_table *clip_tbl_hook;
-#endif
 
 #endif
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 30fce0128dd7..43750439c521 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -64,6 +64,11 @@ struct bt_security {
 
 #define BT_DEFER_SETUP  7
 
+#define BT_FLUSHABLE    8
+
+#define BT_FLUSHABLE_OFF        0
+#define BT_FLUSHABLE_ON         1
+
 #define BT_INFO(fmt, arg...) printk(KERN_INFO "Bluetooth: " fmt "\n" , ## arg)
 #define BT_ERR(fmt, arg...)  printk(KERN_ERR "%s: " fmt "\n" , __func__ , ## arg)
 #define BT_DBG(fmt, arg...)  pr_debug("%s: " fmt "\n" , __func__ , ## arg)
@@ -126,6 +131,8 @@ int  bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
 int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags);
+int  bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+                        struct msghdr *msg, size_t len, int flags);
 uint bt_sock_poll(struct file * file, struct socket *sock, poll_table *wait);
 int  bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int  bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo);
@@ -142,6 +149,7 @@ struct bt_skb_cb {
         __u8 tx_seq;
         __u8 retries;
         __u8 sar;
+        unsigned short channel;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
 
@@ -197,4 +205,32 @@ extern void bt_sysfs_cleanup(void);
 
 extern struct dentry *bt_debugfs;
 
+#ifdef CONFIG_BT_L2CAP
+int l2cap_init(void);
+void l2cap_exit(void);
+#else
+static inline int l2cap_init(void)
+{
+        return 0;
+}
+
+static inline void l2cap_exit(void)
+{
+}
+#endif
+
+#ifdef CONFIG_BT_SCO
+int sco_init(void);
+void sco_exit(void);
+#else
+static inline int sco_init(void)
+{
+        return 0;
+}
+
+static inline void sco_exit(void)
+{
+}
+#endif
+
 #endif /* __BLUETOOTH_H */
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index bcbdd6d4e6dd..0c20227e57f6 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -1,4 +1,4 @@
-/* 
+/*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (C) 2000-2001 Qualcomm Incorporated
 
@@ -12,13 +12,13 @@
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
    SOFTWARE IS DISCLAIMED.
 */
 
@@ -54,7 +54,7 @@
 
 /* HCI controller types */
 #define HCI_BREDR       0x00
-#define HCI_80211       0x01
+#define HCI_AMP         0x01
 
 /* HCI device quirks */
 enum {
@@ -76,6 +76,16 @@ enum {
         HCI_INQUIRY,
 
         HCI_RAW,
+
+        HCI_SETUP,
+        HCI_AUTO_OFF,
+        HCI_MGMT,
+        HCI_PAIRABLE,
+        HCI_SERVICE_CACHE,
+        HCI_LINK_KEYS,
+        HCI_DEBUG_KEYS,
+
+        HCI_RESET,
 };
 
 /* HCI ioctl defines */
@@ -111,6 +121,7 @@ enum {
 #define HCI_PAIRING_TIMEOUT     (60000) /* 60 seconds */
 #define HCI_IDLE_TIMEOUT        (6000)  /* 6 seconds */
 #define HCI_INIT_TIMEOUT        (10000) /* 10 seconds */
+#define HCI_CMD_TIMEOUT         (1000)  /* 1 seconds */
 
 /* HCI data types */
 #define HCI_COMMAND_PKT         0x01
@@ -150,6 +161,7 @@ enum {
 #define EDR_ESCO_MASK  (ESCO_2EV3 | ESCO_3EV3 | ESCO_2EV5 | ESCO_3EV5)
 
 /* ACL flags */
+#define ACL_START_NO_FLUSH      0x00
 #define ACL_CONT                0x01
 #define ACL_START               0x02
 #define ACL_ACTIVE_BCAST        0x04
@@ -159,6 +171,8 @@ enum {
 #define SCO_LINK        0x00
 #define ACL_LINK        0x01
 #define ESCO_LINK       0x02
+/* Low Energy links do not have defined link type. Use invented one */
+#define LE_LINK         0x80
 
 /* LMP features */
 #define LMP_3SLOT       0x01
@@ -183,17 +197,25 @@ enum {
 #define LMP_PSCHEME     0x02
 #define LMP_PCONTROL    0x04
 
+#define LMP_RSSI_INQ    0x40
 #define LMP_ESCO        0x80
 
 #define LMP_EV4         0x01
 #define LMP_EV5         0x02
+#define LMP_LE          0x40
 
 #define LMP_SNIFF_SUBR  0x02
+#define LMP_PAUSE_ENC   0x04
 #define LMP_EDR_ESCO_2M 0x20
 #define LMP_EDR_ESCO_3M 0x40
 #define LMP_EDR_3S_ESCO 0x80
 
+#define LMP_EXT_INQ     0x01
 #define LMP_SIMPLE_PAIR 0x08
+#define LMP_NO_FLUSH    0x40
+
+#define LMP_LSTO        0x01
+#define LMP_INQ_TX_PWR  0x02
 
 /* Connection modes */
 #define HCI_CM_ACTIVE   0x0000
@@ -224,7 +246,18 @@ enum {
 #define HCI_AT_GENERAL_BONDING          0x04
 #define HCI_AT_GENERAL_BONDING_MITM     0x05
 
+/* Link Key types */
+#define HCI_LK_COMBINATION              0x00
+#define HCI_LK_LOCAL_UNIT               0x01
+#define HCI_LK_REMOTE_UNIT              0x02
+#define HCI_LK_DEBUG_COMBINATION        0x03
+#define HCI_LK_UNAUTH_COMBINATION       0x04
+#define HCI_LK_AUTH_COMBINATION         0x05
+#define HCI_LK_CHANGED_COMBINATION      0x06
+
 /* -----  HCI Commands ---- */
+#define HCI_OP_NOP                      0x0000
+
 #define HCI_OP_INQUIRY                  0x0401
 struct hci_cp_inquiry {
         __u8     lap[3];
@@ -292,11 +325,19 @@ struct hci_cp_pin_code_reply {
         __u8     pin_len;
         __u8     pin_code[16];
 } __packed;
+struct hci_rp_pin_code_reply {
+        __u8     status;
+        bdaddr_t bdaddr;
+} __packed;
 
 #define HCI_OP_PIN_CODE_NEG_REPLY       0x040e
 struct hci_cp_pin_code_neg_reply {
         bdaddr_t bdaddr;
 } __packed;
+struct hci_rp_pin_code_neg_reply {
+        __u8     status;
+        bdaddr_t bdaddr;
+} __packed;
 
 #define HCI_OP_CHANGE_CONN_PTYPE        0x040f
 struct hci_cp_change_conn_ptype {
@@ -377,6 +418,43 @@ struct hci_cp_reject_sync_conn_req {
         __u8     reason;
 } __packed;
 
+#define HCI_OP_IO_CAPABILITY_REPLY      0x042b
+struct hci_cp_io_capability_reply {
+        bdaddr_t bdaddr;
+        __u8     capability;
+        __u8     oob_data;
+        __u8     authentication;
+} __packed;
+
+#define HCI_OP_USER_CONFIRM_REPLY               0x042c
+struct hci_cp_user_confirm_reply {
+        bdaddr_t bdaddr;
+} __packed;
+struct hci_rp_user_confirm_reply {
+        __u8     status;
+        bdaddr_t bdaddr;
+} __packed;
+
+#define HCI_OP_USER_CONFIRM_NEG_REPLY   0x042d
+
+#define HCI_OP_REMOTE_OOB_DATA_REPLY    0x0430
+struct hci_cp_remote_oob_data_reply {
+        bdaddr_t bdaddr;
+        __u8     hash[16];
+        __u8     randomizer[16];
+} __packed;
+
+#define HCI_OP_REMOTE_OOB_DATA_NEG_REPLY        0x0433
+struct hci_cp_remote_oob_data_neg_reply {
+        bdaddr_t bdaddr;
+} __packed;
+
+#define HCI_OP_IO_CAPABILITY_NEG_REPLY  0x0434
+struct hci_cp_io_capability_neg_reply {
+        bdaddr_t bdaddr;
+        __u8     reason;
+} __packed;
+
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
         __le16   handle;
@@ -474,22 +552,30 @@ struct hci_cp_set_event_flt {
 #define HCI_CONN_SETUP_AUTO_OFF 0x01
 #define HCI_CONN_SETUP_AUTO_ON  0x02
 
+#define HCI_OP_DELETE_STORED_LINK_KEY   0x0c12
+struct hci_cp_delete_stored_link_key {
+        bdaddr_t bdaddr;
+        __u8     delete_all;
+} __packed;
+
+#define HCI_MAX_NAME_LENGTH             248
+
 #define HCI_OP_WRITE_LOCAL_NAME         0x0c13
 struct hci_cp_write_local_name {
-        __u8     name[248];
+        __u8     name[HCI_MAX_NAME_LENGTH];
 } __packed;
 
 #define HCI_OP_READ_LOCAL_NAME          0x0c14
 struct hci_rp_read_local_name {
         __u8     status;
-        __u8     name[248];
+        __u8     name[HCI_MAX_NAME_LENGTH];
 } __packed;
 
 #define HCI_OP_WRITE_CA_TIMEOUT         0x0c16
 
 #define HCI_OP_WRITE_PG_TIMEOUT         0x0c18
 
-#define HCI_OP_WRITE_SCAN_ENABLE        0x0c1a
+#define HCI_OP_WRITE_SCAN_ENABLE        0x0c1a
         #define SCAN_DISABLED           0x00
         #define SCAN_INQUIRY            0x01
         #define SCAN_PAGE               0x02
@@ -537,6 +623,16 @@ struct hci_cp_host_buffer_size {
         __le16   sco_max_pkt;
 } __packed;
 
+#define HCI_OP_WRITE_INQUIRY_MODE       0x0c45
+
+#define HCI_MAX_EIR_LENGTH              240
+
+#define HCI_OP_WRITE_EIR                0x0c52
+struct hci_cp_write_eir {
+        uint8_t         fec;
+        uint8_t         data[HCI_MAX_EIR_LENGTH];
+} __packed;
+
 #define HCI_OP_READ_SSP_MODE            0x0c55
 struct hci_rp_read_ssp_mode {
         __u8     status;
@@ -548,6 +644,15 @@ struct hci_cp_write_ssp_mode {
         __u8     mode;
 } __packed;
 
+#define HCI_OP_READ_LOCAL_OOB_DATA              0x0c57
+struct hci_rp_read_local_oob_data {
+        __u8     status;
+        __u8     hash[16];
+        __u8     randomizer[16];
+} __packed;
+
+#define HCI_OP_READ_INQ_RSP_TX_POWER    0x0c58
+
 #define HCI_OP_READ_LOCAL_VERSION       0x1001
 struct hci_rp_read_local_version {
         __u8     status;
@@ -593,6 +698,47 @@ struct hci_rp_read_bd_addr {
         bdaddr_t bdaddr;
 } __packed;
 
+#define HCI_OP_LE_SET_EVENT_MASK        0x2001
+struct hci_cp_le_set_event_mask {
+        __u8     mask[8];
+} __packed;
+
+#define HCI_OP_LE_READ_BUFFER_SIZE      0x2002
+struct hci_rp_le_read_buffer_size {
+        __u8     status;
+        __le16   le_mtu;
+        __u8     le_max_pkt;
+} __packed;
+
+#define HCI_OP_LE_CREATE_CONN           0x200d
+struct hci_cp_le_create_conn {
+        __le16   scan_interval;
+        __le16   scan_window;
+        __u8     filter_policy;
+        __u8     peer_addr_type;
+        bdaddr_t peer_addr;
+        __u8     own_address_type;
+        __le16   conn_interval_min;
+        __le16   conn_interval_max;
+        __le16   conn_latency;
+        __le16   supervision_timeout;
+        __le16   min_ce_len;
+        __le16   max_ce_len;
+} __packed;
+
+#define HCI_OP_LE_CREATE_CONN_CANCEL    0x200e
+
+#define HCI_OP_LE_CONN_UPDATE           0x2013
+struct hci_cp_le_conn_update {
+        __le16   handle;
+        __le16   conn_interval_min;
+        __le16   conn_interval_max;
+        __le16   conn_latency;
+        __le16   supervision_timeout;
+        __le16   min_ce_len;
+        __le16   max_ce_len;
+} __packed;
+
 /* ---- HCI Events ---- */
 #define HCI_EV_INQUIRY_COMPLETE         0x01
 
@@ -639,7 +785,7 @@ struct hci_ev_auth_complete {
 struct hci_ev_remote_name {
         __u8     status;
         bdaddr_t bdaddr;
-        __u8     name[248];
+        __u8     name[HCI_MAX_NAME_LENGTH];
 } __packed;
 
 #define HCI_EV_ENCRYPT_CHANGE           0x08
@@ -833,6 +979,25 @@ struct hci_ev_io_capa_request {
         bdaddr_t bdaddr;
 } __packed;
 
+#define HCI_EV_IO_CAPA_REPLY            0x32
+struct hci_ev_io_capa_reply {
+        bdaddr_t bdaddr;
+        __u8     capability;
+        __u8     oob_data;
+        __u8     authentication;
+} __packed;
+
+#define HCI_EV_USER_CONFIRM_REQUEST     0x33
+struct hci_ev_user_confirm_req {
+        bdaddr_t        bdaddr;
+        __le32          passkey;
+} __packed;
+
+#define HCI_EV_REMOTE_OOB_DATA_REQUEST  0x35
+struct hci_ev_remote_oob_data_request {
+        bdaddr_t bdaddr;
+} __packed;
+
 #define HCI_EV_SIMPLE_PAIR_COMPLETE     0x36
 struct hci_ev_simple_pair_complete {
         __u8     status;
@@ -845,6 +1010,25 @@ struct hci_ev_remote_host_features {
         __u8     features[8];
 } __packed;
 
+#define HCI_EV_LE_META                  0x3e
+struct hci_ev_le_meta {
+        __u8     subevent;
+} __packed;
+
+/* Low energy meta events */
+#define HCI_EV_LE_CONN_COMPLETE         0x01
+struct hci_ev_le_conn_complete {
+        __u8     status;
+        __le16   handle;
+        __u8     role;
+        __u8     bdaddr_type;
+        bdaddr_t bdaddr;
+        __le16   interval;
+        __le16   latency;
+        __le16   supervision_timeout;
+        __u8     clk_accurancy;
+} __packed;
+
 /* Internal events generated by Bluetooth stack */
 #define HCI_EV_STACK_INTERNAL   0xfd
 struct hci_ev_stack_internal {
@@ -874,7 +1058,7 @@ struct hci_ev_si_security {
 
 struct hci_command_hdr {
         __le16  opcode;         /* OCF & OGF */
-        __u8    plen;
+        __u8    plen;
 } __packed;
 
 struct hci_event_hdr {
@@ -892,7 +1076,6 @@ struct hci_sco_hdr {
         __u8    dlen;
 } __packed;
 
-#ifdef __KERNEL__
 #include <linux/skbuff.h>
 static inline struct hci_event_hdr *hci_event_hdr(const struct sk_buff *skb)
 {
@@ -908,7 +1091,6 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
 {
         return (struct hci_sco_hdr *) skb->data;
 }
-#endif
 
 /* Command opcode pack/unpack */
 #define hci_opcode_pack(ogf, ocf)       (__u16) ((ocf & 0x03ff)|(ogf << 10))
@@ -934,9 +1116,13 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
 struct sockaddr_hci {
         sa_family_t    hci_family;
         unsigned short hci_dev;
+        unsigned short hci_channel;
 };
 #define HCI_DEV_NONE    0xffff
 
+#define HCI_CHANNEL_RAW         0
+#define HCI_CHANNEL_CONTROL     1
+
 struct hci_filter {
         unsigned long type_mask;
         unsigned long event_mask[2];
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 4568b938ca35..6c994c004d15 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -44,15 +44,15 @@ struct inquiry_data {
 };
 
 struct inquiry_entry {
-        struct inquiry_entry    *next;
+        struct inquiry_entry    *next;
         __u32                   timestamp;
         struct inquiry_data     data;
 };
 
 struct inquiry_cache {
-        spinlock_t              lock;
+        spinlock_t              lock;
         __u32                   timestamp;
-        struct inquiry_entry    *list;
+        struct inquiry_entry    *list;
 };
 
 struct hci_conn_hash {
@@ -60,12 +60,35 @@ struct hci_conn_hash {
         spinlock_t       lock;
         unsigned int     acl_num;
         unsigned int     sco_num;
+        unsigned int     le_num;
 };
 
 struct bdaddr_list {
         struct list_head list;
         bdaddr_t bdaddr;
 };
+
+struct bt_uuid {
+        struct list_head list;
+        u8 uuid[16];
+        u8 svc_hint;
+};
+
+struct link_key {
+        struct list_head list;
+        bdaddr_t bdaddr;
+        u8 type;
+        u8 val[16];
+        u8 pin_len;
+};
+
+struct oob_data {
+        struct list_head list;
+        bdaddr_t bdaddr;
+        u8 hash[16];
+        u8 randomizer[16];
+};
+
 #define NUM_REASSEMBLY 4
 struct hci_dev {
         struct list_head list;
@@ -78,15 +101,21 @@ struct hci_dev {
         __u8            bus;
         __u8            dev_type;
         bdaddr_t        bdaddr;
-        __u8            dev_name[248];
+        __u8            dev_name[HCI_MAX_NAME_LENGTH];
+        __u8            eir[HCI_MAX_EIR_LENGTH];
         __u8            dev_class[3];
+        __u8            major_class;
+        __u8            minor_class;
         __u8            features[8];
         __u8            commands[64];
         __u8            ssp_mode;
         __u8            hci_ver;
         __u16           hci_rev;
+        __u8            lmp_ver;
         __u16           manufacturer;
+        __le16          lmp_subver;
         __u16           voice_setting;
+        __u8            io_capability;
 
         __u16           pkt_type;
         __u16           esco_type;
@@ -97,23 +126,33 @@ struct hci_dev {
         __u16           sniff_min_interval;
         __u16           sniff_max_interval;
 
+        unsigned int    auto_accept_delay;
+
         unsigned long   quirks;
 
         atomic_t        cmd_cnt;
         unsigned int    acl_cnt;
         unsigned int    sco_cnt;
+        unsigned int    le_cnt;
 
         unsigned int    acl_mtu;
         unsigned int    sco_mtu;
+        unsigned int    le_mtu;
         unsigned int    acl_pkts;
         unsigned int    sco_pkts;
+        unsigned int    le_pkts;
 
-        unsigned long   cmd_last_tx;
         unsigned long   acl_last_tx;
         unsigned long   sco_last_tx;
+        unsigned long   le_last_tx;
 
         struct workqueue_struct *workqueue;
 
+        struct work_struct      power_on;
+        struct work_struct      power_off;
+        struct timer_list       off_timer;
+
+        struct timer_list       cmd_timer;
         struct tasklet_struct   cmd_task;
         struct tasklet_struct   rx_task;
         struct tasklet_struct   tx_task;
@@ -130,10 +169,18 @@ struct hci_dev {
         __u32                   req_status;
         __u32                   req_result;
 
+        __u16                   init_last_cmd;
+
         struct inquiry_cache    inq_cache;
         struct hci_conn_hash    conn_hash;
         struct list_head        blacklist;
 
+        struct list_head        uuids;
+
+        struct list_head        link_keys;
+
+        struct list_head        remote_oob_data;
+
         struct hci_dev_stats    stat;
 
         struct sk_buff_head     driver_init;
@@ -141,7 +188,7 @@ struct hci_dev {
         void                    *driver_data;
         void                    *core_data;
 
-        atomic_t                promisc;
+        atomic_t                promisc;
 
         struct dentry           *debugfs;
 
@@ -150,7 +197,7 @@ struct hci_dev {
 
         struct rfkill           *rfkill;
 
-        struct module           *owner;
+        struct module           *owner;
 
         int (*open)(struct hci_dev *hdev);
         int (*close)(struct hci_dev *hdev);
@@ -164,35 +211,44 @@ struct hci_dev {
 struct hci_conn {
         struct list_head list;
 
-        atomic_t         refcnt;
-        spinlock_t       lock;
-
-        bdaddr_t         dst;
-        __u16            handle;
-        __u16            state;
-        __u8             mode;
-        __u8             type;
-        __u8             out;
-        __u8             attempt;
-        __u8             dev_class[3];
-        __u8             features[8];
-        __u8             ssp_mode;
-        __u16            interval;
-        __u16            pkt_type;
-        __u16            link_policy;
-        __u32            link_mode;
-        __u8             auth_type;
-        __u8             sec_level;
-        __u8             power_save;
-        __u16            disc_timeout;
-        unsigned long    pend;
-
-        unsigned int     sent;
+        atomic_t        refcnt;
+        spinlock_t      lock;
+
+        bdaddr_t        dst;
+        __u16           handle;
+        __u16           state;
+        __u8            mode;
+        __u8            type;
+        __u8            out;
+        __u8            attempt;
+        __u8            dev_class[3];
+        __u8            features[8];
+        __u8            ssp_mode;
+        __u16           interval;
+        __u16           pkt_type;
+        __u16           link_policy;
+        __u32           link_mode;
+        __u8            key_type;
+        __u8            auth_type;
+        __u8            sec_level;
+        __u8            pending_sec_level;
+        __u8            pin_length;
+        __u8            io_capability;
+        __u8            power_save;
+        __u16           disc_timeout;
+        unsigned long   pend;
+
+        __u8            remote_cap;
+        __u8            remote_oob;
+        __u8            remote_auth;
+
+        unsigned int    sent;
 
         struct sk_buff_head data_q;
 
         struct timer_list disc_timer;
         struct timer_list idle_timer;
+        struct timer_list auto_accept_timer;
 
         struct work_struct work_add;
         struct work_struct work_del;
@@ -206,6 +262,10 @@ struct hci_conn {
         void            *priv;
 
         struct hci_conn *link;
+
+        void (*connect_cfm_cb)  (struct hci_conn *conn, u8 status);
+        void (*security_cfm_cb) (struct hci_conn *conn, u8 status);
+        void (*disconn_cfm_cb)  (struct hci_conn *conn, u8 reason);
 };
 
 extern struct hci_proto *hci_proto[];
@@ -215,8 +275,8 @@ extern rwlock_t hci_dev_list_lock;
 extern rwlock_t hci_cb_list_lock;
 
 /* ----- Inquiry cache ----- */
-#define INQUIRY_CACHE_AGE_MAX   (HZ*30)   // 30 seconds
-#define INQUIRY_ENTRY_AGE_MAX   (HZ*60)   // 60 seconds
+#define INQUIRY_CACHE_AGE_MAX   (HZ*30)   /* 30 seconds */
+#define INQUIRY_ENTRY_AGE_MAX   (HZ*60)   /* 60 seconds */
 
 #define inquiry_cache_lock(c)           spin_lock(&c->lock)
 #define inquiry_cache_unlock(c)         spin_unlock(&c->lock)
@@ -233,7 +293,7 @@ static inline void inquiry_cache_init(struct hci_dev *hdev)
 static inline int inquiry_cache_empty(struct hci_dev *hdev)
 {
         struct inquiry_cache *c = &hdev->inq_cache;
-        return (c->list == NULL);
+        return c->list == NULL;
 }
 
 static inline long inquiry_cache_age(struct hci_dev *hdev)
@@ -272,24 +332,40 @@ static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         list_add(&c->list, &h->list);
-        if (c->type == ACL_LINK)
+        switch (c->type) {
+        case ACL_LINK:
                 h->acl_num++;
-        else
+                break;
+        case LE_LINK:
+                h->le_num++;
+                break;
+        case SCO_LINK:
+        case ESCO_LINK:
                 h->sco_num++;
+                break;
+        }
 }
 
 static inline void hci_conn_hash_del(struct hci_dev *hdev, struct hci_conn *c)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         list_del(&c->list);
-        if (c->type == ACL_LINK)
+        switch (c->type) {
+        case ACL_LINK:
                 h->acl_num--;
-        else
+                break;
+        case LE_LINK:
+                h->le_num--;
+                break;
+        case SCO_LINK:
+        case ESCO_LINK:
                 h->sco_num--;
+                break;
+        }
 }
 
 static inline struct hci_conn *hci_conn_hash_lookup_handle(struct hci_dev *hdev,
-                                        __u16 handle)
+                                                                __u16 handle)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         struct list_head *p;
@@ -304,7 +380,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_handle(struct hci_dev *hdev,
 }
 
 static inline struct hci_conn *hci_conn_hash_lookup_ba(struct hci_dev *hdev,
-                                        __u8 type, bdaddr_t *ba)
+                                                        __u8 type, bdaddr_t *ba)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         struct list_head *p;
@@ -319,7 +395,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_ba(struct hci_dev *hdev,
 }
 
 static inline struct hci_conn *hci_conn_hash_lookup_state(struct hci_dev *hdev,
-                                        __u8 type, __u16 state)
+                                                        __u8 type, __u16 state)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         struct list_head *p;
@@ -346,6 +422,7 @@ void hci_conn_check_pending(struct hci_dev *hdev);
 
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type);
 int hci_conn_check_link_mode(struct hci_conn *conn);
+int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type);
 int hci_conn_change_link_key(struct hci_conn *conn);
 int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
@@ -435,6 +512,23 @@ int hci_inquiry(void __user *arg);
 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_blacklist_clear(struct hci_dev *hdev);
 
+int hci_uuids_clear(struct hci_dev *hdev);
+
+int hci_link_keys_clear(struct hci_dev *hdev);
+struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
+                        bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
+int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
+
+int hci_remote_oob_data_clear(struct hci_dev *hdev);
+struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
+                                                        bdaddr_t *bdaddr);
+int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
+                                                                u8 *randomizer);
+int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
+
+void hci_del_off_timer(struct hci_dev *hdev);
+
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
 
 int hci_recv_frame(struct sk_buff *skb);
@@ -456,6 +550,8 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define lmp_sniffsubr_capable(dev) ((dev)->features[5] & LMP_SNIFF_SUBR)
 #define lmp_esco_capable(dev)      ((dev)->features[3] & LMP_ESCO)
 #define lmp_ssp_capable(dev)       ((dev)->features[6] & LMP_SIMPLE_PAIR)
+#define lmp_no_flush_capable(dev)  ((dev)->features[6] & LMP_NO_FLUSH)
+#define lmp_le_capable(dev)        ((dev)->features[4] & LMP_LE)
 
 /* ----- HCI protocols ----- */
 struct hci_proto {
@@ -501,6 +597,9 @@ static inline void hci_proto_connect_cfm(struct hci_conn *conn, __u8 status)
         hp = hci_proto[HCI_PROTO_SCO];
         if (hp && hp->connect_cfm)
                 hp->connect_cfm(conn, status);
+
+        if (conn->connect_cfm_cb)
+                conn->connect_cfm_cb(conn, status);
 }
 
 static inline int hci_proto_disconn_ind(struct hci_conn *conn)
@@ -530,6 +629,9 @@ static inline void hci_proto_disconn_cfm(struct hci_conn *conn, __u8 reason)
         hp = hci_proto[HCI_PROTO_SCO];
         if (hp && hp->disconn_cfm)
                 hp->disconn_cfm(conn, reason);
+
+        if (conn->disconn_cfm_cb)
+                conn->disconn_cfm_cb(conn, reason);
 }
 
 static inline void hci_proto_auth_cfm(struct hci_conn *conn, __u8 status)
@@ -549,6 +651,9 @@ static inline void hci_proto_auth_cfm(struct hci_conn *conn, __u8 status)
         hp = hci_proto[HCI_PROTO_SCO];
         if (hp && hp->security_cfm)
                 hp->security_cfm(conn, status, encrypt);
+
+        if (conn->security_cfm_cb)
+                conn->security_cfm_cb(conn, status);
 }
 
 static inline void hci_proto_encrypt_cfm(struct hci_conn *conn, __u8 status, __u8 encrypt)
@@ -562,6 +667,9 @@ static inline void hci_proto_encrypt_cfm(struct hci_conn *conn, __u8 status, __u
         hp = hci_proto[HCI_PROTO_SCO];
         if (hp && hp->security_cfm)
                 hp->security_cfm(conn, status, encrypt);
+
+        if (conn->security_cfm_cb)
+                conn->security_cfm_cb(conn, status);
 }
 
 int hci_register_proto(struct hci_proto *hproto);
@@ -658,7 +766,37 @@ void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode);
 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data);
 
 /* ----- HCI Sockets ----- */
-void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb);
+void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb,
+                                                        struct sock *skip_sk);
+
+/* Management interface */
+int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
+int mgmt_index_added(u16 index);
+int mgmt_index_removed(u16 index);
+int mgmt_powered(u16 index, u8 powered);
+int mgmt_discoverable(u16 index, u8 discoverable);
+int mgmt_connectable(u16 index, u8 connectable);
+int mgmt_new_key(u16 index, struct link_key *key, u8 persistent);
+int mgmt_connected(u16 index, bdaddr_t *bdaddr);
+int mgmt_disconnected(u16 index, bdaddr_t *bdaddr);
+int mgmt_disconnect_failed(u16 index);
+int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 status);
+int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr, u8 secure);
+int mgmt_pin_code_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status);
+int mgmt_pin_code_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status);
+int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value,
+                                                        u8 confirm_hint);
+int mgmt_user_confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status);
+int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr,
+                                                                u8 status);
+int mgmt_auth_failed(u16 index, bdaddr_t *bdaddr, u8 status);
+int mgmt_set_local_name_complete(u16 index, u8 *name, u8 status);
+int mgmt_read_local_oob_data_reply_complete(u16 index, u8 *hash, u8 *randomizer,
+                                                                u8 status);
+int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 *dev_class, s8 rssi,
+                                                                u8 *eir);
+int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name);
+int mgmt_discovering(u16 index, u8 discovering);
 
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
@@ -668,6 +806,7 @@ struct hci_pinfo {
         struct hci_dev    *hdev;
         struct hci_filter filter;
         __u32             cmsg_mask;
+        unsigned short   channel;
 };
 
 /* HCI security filter */
@@ -687,6 +826,8 @@ struct hci_sec_filter {
 #define hci_req_lock(d)         mutex_lock(&d->req_lock)
 #define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
 
-void hci_req_complete(struct hci_dev *hdev, int result);
+void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result);
 
+void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
+                                        u16 latency, u16 to_multiplier);
 #endif /* __HCI_CORE_H */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 6c241444f902..d09c9b1118e3 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -1,4 +1,4 @@
-/* 
+/*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (C) 2000-2001 Qualcomm Incorporated
    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
@@ -14,13 +14,13 @@
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
    SOFTWARE IS DISCLAIMED.
 */
 
@@ -38,6 +38,7 @@
 #define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
 #define L2CAP_DEFAULT_ACK_TO            200
 #define L2CAP_LOCAL_BUSY_TRIES          12
+#define L2CAP_LE_DEFAULT_MTU            23
 
 #define L2CAP_CONN_TIMEOUT      (40000) /* 40 seconds */
 #define L2CAP_INFO_TIMEOUT      (4000)  /*  4 seconds */
@@ -88,6 +89,8 @@ struct l2cap_conninfo {
 #define L2CAP_ECHO_RSP          0x09
 #define L2CAP_INFO_REQ          0x0a
 #define L2CAP_INFO_RSP          0x0b
+#define L2CAP_CONN_PARAM_UPDATE_REQ     0x12
+#define L2CAP_CONN_PARAM_UPDATE_RSP     0x13
 
 /* L2CAP feature mask */
 #define L2CAP_FEAT_FLOWCTL      0x00000001
@@ -160,6 +163,9 @@ struct l2cap_conn_rsp {
 /* channel indentifier */
 #define L2CAP_CID_SIGNALING     0x0001
 #define L2CAP_CID_CONN_LESS     0x0002
+#define L2CAP_CID_LE_DATA       0x0004
+#define L2CAP_CID_LE_SIGNALING  0x0005
+#define L2CAP_CID_SMP           0x0006
 #define L2CAP_CID_DYN_START     0x0040
 #define L2CAP_CID_DYN_END       0xffff
 
@@ -255,63 +261,32 @@ struct l2cap_info_rsp {
 #define L2CAP_IR_SUCCESS    0x0000
 #define L2CAP_IR_NOTSUPP    0x0001
 
-/* ----- L2CAP connections ----- */
-struct l2cap_chan_list {
-        struct sock     *head;
-        rwlock_t        lock;
-        long            num;
-};
-
-struct l2cap_conn {
-        struct hci_conn *hcon;
-
-        bdaddr_t        *dst;
-        bdaddr_t        *src;
-
-        unsigned int    mtu;
-
-        __u32           feat_mask;
-
-        __u8            info_state;
-        __u8            info_ident;
-
-        struct timer_list info_timer;
-
-        spinlock_t      lock;
-
-        struct sk_buff *rx_skb;
-        __u32           rx_len;
-        __u8            rx_ident;
-        __u8            tx_ident;
-
-        __u8            disc_reason;
-
-        struct l2cap_chan_list chan_list;
-};
-
-struct sock_del_list {
-        struct sock *sk;
-        struct list_head list;
-};
+struct l2cap_conn_param_update_req {
+        __le16      min;
+        __le16      max;
+        __le16      latency;
+        __le16      to_multiplier;
+} __packed;
 
-#define L2CAP_INFO_CL_MTU_REQ_SENT      0x01
-#define L2CAP_INFO_FEAT_MASK_REQ_SENT   0x04
-#define L2CAP_INFO_FEAT_MASK_REQ_DONE   0x08
+struct l2cap_conn_param_update_rsp {
+        __le16      result;
+} __packed;
 
-/* ----- L2CAP channel and socket info ----- */
-#define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
-#define TX_QUEUE(sk) (&l2cap_pi(sk)->tx_queue)
-#define SREJ_QUEUE(sk) (&l2cap_pi(sk)->srej_queue)
-#define BUSY_QUEUE(sk) (&l2cap_pi(sk)->busy_queue)
-#define SREJ_LIST(sk) (&l2cap_pi(sk)->srej_l.list)
+/* Connection Parameters result */
+#define L2CAP_CONN_PARAM_ACCEPTED       0x0000
+#define L2CAP_CONN_PARAM_REJECTED       0x0001
 
+/* ----- L2CAP channels and connections ----- */
 struct srej_list {
         __u8    tx_seq;
         struct list_head list;
 };
 
-struct l2cap_pinfo {
-        struct bt_sock  bt;
+struct l2cap_chan {
+        struct sock *sk;
+
+        struct l2cap_conn       *conn;
+
         __le16          psm;
         __u16           dcid;
         __u16           scid;
@@ -320,16 +295,29 @@ struct l2cap_pinfo {
         __u16           omtu;
         __u16           flush_to;
         __u8            mode;
-        __u8            num_conf_req;
-        __u8            num_conf_rsp;
 
-        __u8            fcs;
+        __le16          sport;
+
         __u8            sec_level;
         __u8            role_switch;
         __u8            force_reliable;
+        __u8            flushable;
+
+        __u8            ident;
 
         __u8            conf_req[64];
         __u8            conf_len;
+        __u8            num_conf_req;
+        __u8            num_conf_rsp;
+
+        __u8            fcs;
+
+        __u8            tx_win;
+        __u8            max_tx;
+        __u16           retrans_timeout;
+        __u16           monitor_timeout;
+        __u16           mps;
+
         __u8            conf_state;
         __u16           conn_state;
 
@@ -347,30 +335,61 @@ struct l2cap_pinfo {
         __u16           partial_sdu_len;
         struct sk_buff  *sdu;
 
-        __u8            ident;
-
-        __u8            tx_win;
-        __u8            max_tx;
         __u8            remote_tx_win;
         __u8            remote_max_tx;
-        __u16           retrans_timeout;
-        __u16           monitor_timeout;
         __u16           remote_mps;
-        __u16           mps;
-
-        __le16          sport;
 
         struct timer_list       retrans_timer;
         struct timer_list       monitor_timer;
         struct timer_list       ack_timer;
-        struct sk_buff_head     tx_queue;
-        struct sk_buff_head     srej_queue;
-        struct sk_buff_head     busy_queue;
+        struct sk_buff          *tx_send_head;
+        struct sk_buff_head     tx_q;
+        struct sk_buff_head     srej_q;
+        struct sk_buff_head     busy_q;
         struct work_struct      busy_work;
-        struct srej_list        srej_l;
-        struct l2cap_conn       *conn;
-        struct sock             *next_c;
-        struct sock             *prev_c;
+        struct list_head        srej_l;
+
+        struct list_head list;
+        struct list_head global_l;
+};
+
+struct l2cap_conn {
+        struct hci_conn *hcon;
+
+        bdaddr_t        *dst;
+        bdaddr_t        *src;
+
+        unsigned int    mtu;
+
+        __u32           feat_mask;
+
+        __u8            info_state;
+        __u8            info_ident;
+
+        struct timer_list info_timer;
+
+        spinlock_t      lock;
+
+        struct sk_buff *rx_skb;
+        __u32           rx_len;
+        __u8            tx_ident;
+
+        __u8            disc_reason;
+
+        struct list_head chan_l;
+        rwlock_t        chan_lock;
+};
+
+#define L2CAP_INFO_CL_MTU_REQ_SENT      0x01
+#define L2CAP_INFO_FEAT_MASK_REQ_SENT   0x04
+#define L2CAP_INFO_FEAT_MASK_REQ_DONE   0x08
+
+/* ----- L2CAP socket info ----- */
+#define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
+
+struct l2cap_pinfo {
+        struct bt_sock  bt;
+        struct l2cap_chan       *chan;
 };
 
 #define L2CAP_CONF_REQ_SENT       0x01
@@ -397,32 +416,62 @@ struct l2cap_pinfo {
 #define L2CAP_CONN_RNR_SENT        0x0200
 #define L2CAP_CONN_SAR_RETRY       0x0400
 
-#define __mod_retrans_timer() mod_timer(&l2cap_pi(sk)->retrans_timer, \
+#define __mod_retrans_timer() mod_timer(&chan->retrans_timer, \
                 jiffies +  msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
-#define __mod_monitor_timer() mod_timer(&l2cap_pi(sk)->monitor_timer, \
+#define __mod_monitor_timer() mod_timer(&chan->monitor_timer, \
                 jiffies + msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
-#define __mod_ack_timer() mod_timer(&l2cap_pi(sk)->ack_timer, \
+#define __mod_ack_timer() mod_timer(&chan->ack_timer, \
                 jiffies + msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
 
-static inline int l2cap_tx_window_full(struct sock *sk)
+static inline int l2cap_tx_window_full(struct l2cap_chan *ch)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         int sub;
 
-        sub = (pi->next_tx_seq - pi->expected_ack_seq) % 64;
+        sub = (ch->next_tx_seq - ch->expected_ack_seq) % 64;
 
         if (sub < 0)
                 sub += 64;
 
-        return (sub == pi->remote_tx_win);
+        return sub == ch->remote_tx_win;
 }
 
-#define __get_txseq(ctrl) ((ctrl) & L2CAP_CTRL_TXSEQ) >> 1
-#define __get_reqseq(ctrl) ((ctrl) & L2CAP_CTRL_REQSEQ) >> 8
-#define __is_iframe(ctrl) !((ctrl) & L2CAP_CTRL_FRAME_TYPE)
-#define __is_sframe(ctrl) (ctrl) & L2CAP_CTRL_FRAME_TYPE
-#define __is_sar_start(ctrl) ((ctrl) & L2CAP_CTRL_SAR) == L2CAP_SDU_START
-
-void l2cap_load(void);
+#define __get_txseq(ctrl)       (((ctrl) & L2CAP_CTRL_TXSEQ) >> 1)
+#define __get_reqseq(ctrl)      (((ctrl) & L2CAP_CTRL_REQSEQ) >> 8)
+#define __is_iframe(ctrl)       (!((ctrl) & L2CAP_CTRL_FRAME_TYPE))
+#define __is_sframe(ctrl)       ((ctrl) & L2CAP_CTRL_FRAME_TYPE)
+#define __is_sar_start(ctrl)    (((ctrl) & L2CAP_CTRL_SAR) == L2CAP_SDU_START)
+
+extern int disable_ertm;
+
+int l2cap_init_sockets(void);
+void l2cap_cleanup_sockets(void);
+
+void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data);
+void __l2cap_connect_rsp_defer(struct l2cap_chan *chan);
+int __l2cap_wait_ack(struct sock *sk);
+
+struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
+struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
+struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len, u16 control, u16 sdulen);
+int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
+void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb);
+void l2cap_streaming_send(struct l2cap_chan *chan);
+int l2cap_ertm_send(struct l2cap_chan *chan);
+
+int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm);
+int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
+
+void l2cap_sock_set_timer(struct sock *sk, long timeout);
+void l2cap_sock_clear_timer(struct sock *sk);
+void __l2cap_sock_close(struct sock *sk, int reason);
+void l2cap_sock_kill(struct sock *sk);
+void l2cap_sock_init(struct sock *sk, struct sock *parent);
+struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
+                                                        int proto, gfp_t prio);
+void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err);
+struct l2cap_chan *l2cap_chan_create(struct sock *sk);
+void l2cap_chan_del(struct l2cap_chan *chan, int err);
+void l2cap_chan_destroy(struct l2cap_chan *chan);
+int l2cap_chan_connect(struct l2cap_chan *chan);
 
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
new file mode 100644
index 000000000000..4899286ed4e4
--- /dev/null
+++ b/include/net/bluetooth/mgmt.h
@@ -0,0 +1,291 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+
+   Copyright (C) 2010  Nokia Corporation
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#define MGMT_INDEX_NONE                 0xFFFF
+
+struct mgmt_hdr {
+        __le16 opcode;
+        __le16 index;
+        __le16 len;
+} __packed;
+
+#define MGMT_OP_READ_VERSION            0x0001
+struct mgmt_rp_read_version {
+        __u8 version;
+        __le16 revision;
+} __packed;
+
+#define MGMT_OP_READ_INDEX_LIST         0x0003
+struct mgmt_rp_read_index_list {
+        __le16 num_controllers;
+        __le16 index[0];
+} __packed;
+
+/* Reserve one extra byte for names in management messages so that they
+ * are always guaranteed to be nul-terminated */
+#define MGMT_MAX_NAME_LENGTH            (HCI_MAX_NAME_LENGTH + 1)
+
+#define MGMT_OP_READ_INFO               0x0004
+struct mgmt_rp_read_info {
+        __u8 type;
+        __u8 powered;
+        __u8 connectable;
+        __u8 discoverable;
+        __u8 pairable;
+        __u8 sec_mode;
+        bdaddr_t bdaddr;
+        __u8 dev_class[3];
+        __u8 features[8];
+        __u16 manufacturer;
+        __u8 hci_ver;
+        __u16 hci_rev;
+        __u8 name[MGMT_MAX_NAME_LENGTH];
+} __packed;
+
+struct mgmt_mode {
+        __u8 val;
+} __packed;
+
+#define MGMT_OP_SET_POWERED             0x0005
+
+#define MGMT_OP_SET_DISCOVERABLE        0x0006
+
+#define MGMT_OP_SET_CONNECTABLE         0x0007
+
+#define MGMT_OP_SET_PAIRABLE            0x0008
+
+#define MGMT_OP_ADD_UUID                0x0009
+struct mgmt_cp_add_uuid {
+        __u8 uuid[16];
+        __u8 svc_hint;
+} __packed;
+
+#define MGMT_OP_REMOVE_UUID             0x000A
+struct mgmt_cp_remove_uuid {
+        __u8 uuid[16];
+} __packed;
+
+#define MGMT_OP_SET_DEV_CLASS           0x000B
+struct mgmt_cp_set_dev_class {
+        __u8 major;
+        __u8 minor;
+} __packed;
+
+#define MGMT_OP_SET_SERVICE_CACHE       0x000C
+struct mgmt_cp_set_service_cache {
+        __u8 enable;
+} __packed;
+
+struct mgmt_key_info {
+        bdaddr_t bdaddr;
+        u8 type;
+        u8 val[16];
+        u8 pin_len;
+} __packed;
+
+#define MGMT_OP_LOAD_KEYS               0x000D
+struct mgmt_cp_load_keys {
+        __u8 debug_keys;
+        __le16 key_count;
+        struct mgmt_key_info keys[0];
+} __packed;
+
+#define MGMT_OP_REMOVE_KEY              0x000E
+struct mgmt_cp_remove_key {
+        bdaddr_t bdaddr;
+        __u8 disconnect;
+} __packed;
+
+#define MGMT_OP_DISCONNECT              0x000F
+struct mgmt_cp_disconnect {
+        bdaddr_t bdaddr;
+} __packed;
+struct mgmt_rp_disconnect {
+        bdaddr_t bdaddr;
+} __packed;
+
+#define MGMT_OP_GET_CONNECTIONS         0x0010
+struct mgmt_rp_get_connections {
+        __le16 conn_count;
+        bdaddr_t conn[0];
+} __packed;
+
+#define MGMT_OP_PIN_CODE_REPLY          0x0011
+struct mgmt_cp_pin_code_reply {
+        bdaddr_t bdaddr;
+        __u8 pin_len;
+        __u8 pin_code[16];
+} __packed;
+struct mgmt_rp_pin_code_reply {
+        bdaddr_t bdaddr;
+        uint8_t status;
+} __packed;
+
+#define MGMT_OP_PIN_CODE_NEG_REPLY      0x0012
+struct mgmt_cp_pin_code_neg_reply {
+        bdaddr_t bdaddr;
+} __packed;
+
+#define MGMT_OP_SET_IO_CAPABILITY       0x0013
+struct mgmt_cp_set_io_capability {
+        __u8 io_capability;
+} __packed;
+
+#define MGMT_OP_PAIR_DEVICE             0x0014
+struct mgmt_cp_pair_device {
+        bdaddr_t bdaddr;
+        __u8 io_cap;
+} __packed;
+struct mgmt_rp_pair_device {
+        bdaddr_t bdaddr;
+        __u8 status;
+} __packed;
+
+#define MGMT_OP_USER_CONFIRM_REPLY      0x0015
+struct mgmt_cp_user_confirm_reply {
+        bdaddr_t bdaddr;
+} __packed;
+struct mgmt_rp_user_confirm_reply {
+        bdaddr_t bdaddr;
+        __u8 status;
+} __packed;
+
+#define MGMT_OP_USER_CONFIRM_NEG_REPLY  0x0016
+
+#define MGMT_OP_SET_LOCAL_NAME          0x0017
+struct mgmt_cp_set_local_name {
+        __u8 name[MGMT_MAX_NAME_LENGTH];
+} __packed;
+
+#define MGMT_OP_READ_LOCAL_OOB_DATA     0x0018
+struct mgmt_rp_read_local_oob_data {
+        __u8 hash[16];
+        __u8 randomizer[16];
+} __packed;
+
+#define MGMT_OP_ADD_REMOTE_OOB_DATA     0x0019
+struct mgmt_cp_add_remote_oob_data {
+        bdaddr_t bdaddr;
+        __u8 hash[16];
+        __u8 randomizer[16];
+} __packed;
+
+#define MGMT_OP_REMOVE_REMOTE_OOB_DATA  0x001A
+struct mgmt_cp_remove_remote_oob_data {
+        bdaddr_t bdaddr;
+} __packed;
+
+#define MGMT_OP_START_DISCOVERY         0x001B
+
+#define MGMT_OP_STOP_DISCOVERY          0x001C
+
+#define MGMT_EV_CMD_COMPLETE            0x0001
+struct mgmt_ev_cmd_complete {
+        __le16 opcode;
+        __u8 data[0];
+} __packed;
+
+#define MGMT_EV_CMD_STATUS              0x0002
+struct mgmt_ev_cmd_status {
+        __u8 status;
+        __le16 opcode;
+} __packed;
+
+#define MGMT_EV_CONTROLLER_ERROR        0x0003
+struct mgmt_ev_controller_error {
+        __u8 error_code;
+} __packed;
+
+#define MGMT_EV_INDEX_ADDED             0x0004
+
+#define MGMT_EV_INDEX_REMOVED           0x0005
+
+#define MGMT_EV_POWERED                 0x0006
+
+#define MGMT_EV_DISCOVERABLE            0x0007
+
+#define MGMT_EV_CONNECTABLE             0x0008
+
+#define MGMT_EV_PAIRABLE                0x0009
+
+#define MGMT_EV_NEW_KEY                 0x000A
+struct mgmt_ev_new_key {
+        __u8 store_hint;
+        struct mgmt_key_info key;
+} __packed;
+
+#define MGMT_EV_CONNECTED               0x000B
+struct mgmt_ev_connected {
+        bdaddr_t bdaddr;
+} __packed;
+
+#define MGMT_EV_DISCONNECTED            0x000C
+struct mgmt_ev_disconnected {
+        bdaddr_t bdaddr;
+} __packed;
+
+#define MGMT_EV_CONNECT_FAILED          0x000D
+struct mgmt_ev_connect_failed {
+        bdaddr_t bdaddr;
+        __u8 status;
+} __packed;
+
+#define MGMT_EV_PIN_CODE_REQUEST        0x000E
+struct mgmt_ev_pin_code_request {
+        bdaddr_t bdaddr;
+        __u8 secure;
+} __packed;
+
+#define MGMT_EV_USER_CONFIRM_REQUEST    0x000F
+struct mgmt_ev_user_confirm_request {
+        bdaddr_t bdaddr;
+        __u8 confirm_hint;
+        __le32 value;
+} __packed;
+
+#define MGMT_EV_AUTH_FAILED             0x0010
+struct mgmt_ev_auth_failed {
+        bdaddr_t bdaddr;
+        __u8 status;
+} __packed;
+
+#define MGMT_EV_LOCAL_NAME_CHANGED      0x0011
+struct mgmt_ev_local_name_changed {
+        __u8 name[MGMT_MAX_NAME_LENGTH];
+} __packed;
+
+#define MGMT_EV_DEVICE_FOUND            0x0012
+struct mgmt_ev_device_found {
+        bdaddr_t bdaddr;
+        __u8 dev_class[3];
+        __s8 rssi;
+        __u8 eir[HCI_MAX_EIR_LENGTH];
+} __packed;
+
+#define MGMT_EV_REMOTE_NAME             0x0013
+struct mgmt_ev_remote_name {
+        bdaddr_t bdaddr;
+        __u8 name[MGMT_MAX_NAME_LENGTH];
+} __packed;
+
+#define MGMT_EV_DISCOVERING             0x0014
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index a140847d622c..6eac4a760c3b 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -1,5 +1,5 @@
-/* 
-   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
+/*
+   RFCOMM implementation for Linux Bluetooth stack (BlueZ)
    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
 
@@ -11,13 +11,13 @@
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
    SOFTWARE IS DISCLAIMED.
 */
 
@@ -105,7 +105,7 @@
 struct rfcomm_hdr {
         u8 addr;
         u8 ctrl;
-        u8 len;    // Actual size can be 2 bytes
+        u8 len;    /* Actual size can be 2 bytes */
 } __packed;
 
 struct rfcomm_cmd {
@@ -213,11 +213,6 @@ struct rfcomm_dlc {
 #define RFCOMM_DEFER_SETUP  8
 
 /* Scheduling flags and events */
-#define RFCOMM_SCHED_STATE  0
-#define RFCOMM_SCHED_RX     1
-#define RFCOMM_SCHED_TX     2
-#define RFCOMM_SCHED_TIMEO  3
-#define RFCOMM_SCHED_AUTH   4
 #define RFCOMM_SCHED_WAKEUP 31
 
 /* MSC exchange flags */
@@ -233,7 +228,7 @@ struct rfcomm_dlc {
 /* ---- RFCOMM SEND RPN ---- */
 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
                         u8 bit_rate, u8 data_bits, u8 stop_bits,
-                        u8 parity, u8 flow_ctrl_settings, 
+                        u8 parity, u8 flow_ctrl_settings,
                         u8 xon_char, u8 xoff_char, u16 param_mask);
 
 /* ---- RFCOMM DLCs (channels) ---- */
diff --git a/include/net/bluetooth/sco.h b/include/net/bluetooth/sco.h
index e28a2a771471..1e35c43657c8 100644
--- a/include/net/bluetooth/sco.h
+++ b/include/net/bluetooth/sco.h
@@ -1,4 +1,4 @@
-/* 
+/*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (C) 2000-2001 Qualcomm Incorporated
 
@@ -12,13 +12,13 @@
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
    SOFTWARE IS DISCLAIMED.
 */
 
@@ -55,11 +55,11 @@ struct sco_conninfo {
 struct sco_conn {
         struct hci_conn *hcon;
 
-        bdaddr_t        *dst;
-        bdaddr_t        *src;
-        
+        bdaddr_t        *dst;
+        bdaddr_t        *src;
+
         spinlock_t      lock;
-        struct sock     *sk;
+        struct sock     *sk;
 
         unsigned int    mtu;
 };
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
new file mode 100644
index 000000000000..8f2edbf979dc
--- /dev/null
+++ b/include/net/bluetooth/smp.h
@@ -0,0 +1,76 @@
+#ifndef __SMP_H
+#define __SMP_H
+
+struct smp_command_hdr {
+        __u8    code;
+} __packed;
+
+#define SMP_CMD_PAIRING_REQ     0x01
+#define SMP_CMD_PAIRING_RSP     0x02
+struct smp_cmd_pairing {
+        __u8    io_capability;
+        __u8    oob_flag;
+        __u8    auth_req;
+        __u8    max_key_size;
+        __u8    init_key_dist;
+        __u8    resp_key_dist;
+} __packed;
+
+#define SMP_CMD_PAIRING_CONFIRM 0x03
+struct smp_cmd_pairing_confirm {
+        __u8    confirm_val[16];
+} __packed;
+
+#define SMP_CMD_PAIRING_RANDOM  0x04
+struct smp_cmd_pairing_random {
+        __u8    rand_val[16];
+} __packed;
+
+#define SMP_CMD_PAIRING_FAIL    0x05
+struct smp_cmd_pairing_fail {
+        __u8    reason;
+} __packed;
+
+#define SMP_CMD_ENCRYPT_INFO    0x06
+struct smp_cmd_encrypt_info {
+        __u8    ltk[16];
+} __packed;
+
+#define SMP_CMD_MASTER_IDENT    0x07
+struct smp_cmd_master_ident {
+        __u16   ediv;
+        __u8    rand[8];
+} __packed;
+
+#define SMP_CMD_IDENT_INFO      0x08
+struct smp_cmd_ident_info {
+        __u8    irk[16];
+} __packed;
+
+#define SMP_CMD_IDENT_ADDR_INFO 0x09
+struct smp_cmd_ident_addr_info {
+        __u8    addr_type;
+        bdaddr_t bdaddr;
+} __packed;
+
+#define SMP_CMD_SIGN_INFO       0x0a
+struct smp_cmd_sign_info {
+        __u8    csrk[16];
+} __packed;
+
+#define SMP_CMD_SECURITY_REQ    0x0b
+struct smp_cmd_security_req {
+        __u8    auth_req;
+} __packed;
+
+#define SMP_PASSKEY_ENTRY_FAILED        0x01
+#define SMP_OOB_NOT_AVAIL               0x02
+#define SMP_AUTH_REQUIREMENTS           0x03
+#define SMP_CONFIRM_FAILED              0x04
+#define SMP_PAIRING_NOTSUPP             0x05
+#define SMP_ENC_KEY_SIZE                0x06
+#define SMP_CMD_NOTSUPP         0x07
+#define SMP_UNSPECIFIED         0x08
+#define SMP_REPEATED_ATTEMPTS           0x09
+
+#endif /* __SMP_H */
diff --git a/include/net/caif/caif_dev.h b/include/net/caif/caif_dev.h
index 6da573c75d54..c011281d92c0 100644
--- a/include/net/caif/caif_dev.h
+++ b/include/net/caif/caif_dev.h
@@ -11,6 +11,7 @@
 #include <net/caif/cfcnfg.h>
 #include <linux/caif/caif_socket.h>
 #include <linux/if.h>
+#include <linux/net.h>
 
 /**
  * struct caif_param - CAIF parameters.
@@ -28,7 +29,7 @@ struct caif_param {
  * @sockaddr:           Socket address to connect.
  * @priority:           Priority of the connection.
  * @link_selector:      Link selector (high bandwidth or low latency)
- * @link_name:          Name of the CAIF Link Layer to use.
+ * @ifindex:            kernel index of the interface.
  * @param:              Connect Request parameters (CAIF_SO_REQ_PARAM).
  *
  * This struct is used when connecting a CAIF channel.
@@ -39,7 +40,7 @@ struct caif_connect_request {
         struct sockaddr_caif sockaddr;
         enum caif_channel_priority priority;
         enum caif_link_selector link_selector;
-        char link_name[16];
+        int ifindex;
         struct caif_param param;
 };
 
@@ -62,46 +63,45 @@ struct caif_connect_request {
  * E.g. CAIF Socket will call this function for each socket it connects
  * and have one client_layer instance for each socket.
  */
-int caif_connect_client(struct caif_connect_request *conn_req,
+int caif_connect_client(struct net *net,
+                        struct caif_connect_request *conn_req,
                         struct cflayer *client_layer, int *ifindex,
                         int *headroom, int *tailroom);
 
 /**
  * caif_disconnect_client - Disconnects a client from the CAIF stack.
  *
- * @client_layer: Client layer to be removed.
+ * @client_layer: Client layer to be disconnected.
  */
-int caif_disconnect_client(struct cflayer *client_layer);
+int caif_disconnect_client(struct net *net, struct cflayer *client_layer);
+
 
 /**
- * caif_release_client - Release adaptation layer reference to client.
+ * caif_client_register_refcnt - register ref-count functions provided by client.
  *
- * @client_layer: Client layer.
+ * @adapt_layer: Client layer using CAIF Stack.
+ * @hold:       Function provided by client layer increasing ref-count
+ * @put:        Function provided by client layer decreasing ref-count
  *
- * Releases a client/adaptation layer use of the caif stack.
- * This function must be used after caif_disconnect_client to
- * decrease the reference count of the service layer.
- */
-void caif_release_client(struct cflayer *client_layer);
-
-/**
- * connect_req_to_link_param - Translate configuration parameters
- *                              from socket format to internal format.
- * @cnfg:       Pointer to configuration handler
- * @con_req:    Configuration parameters supplied in function
- *              caif_connect_client
- * @channel_setup_param: Parameters supplied to the CAIF Core stack for
- *                       setting up channels.
+ * Client of the CAIF Stack must register functions for reference counting.
+ * These functions are called by the CAIF Stack for every upstream packet,
+ * and must therefore be implemented efficiently.
  *
+ * Client should call caif_free_client when reference count degrease to zero.
  */
-int connect_req_to_link_param(struct cfcnfg *cnfg,
-                                struct caif_connect_request *con_req,
-                                struct cfctrl_link_param *channel_setup_param);
 
+void caif_client_register_refcnt(struct cflayer *adapt_layer,
+                                        void (*hold)(struct cflayer *lyr),
+                                        void (*put)(struct cflayer *lyr));
 /**
- * get_caif_conf() - Get the configuration handler.
+ * caif_free_client - Free memory used to manage the client in the CAIF Stack.
+ *
+ * @client_layer: Client layer to be removed.
+ *
+ * This function must be called from client layer in order to free memory.
+ * Caller must guarantee that no packets are in flight upstream when calling
+ * this function.
  */
-struct cfcnfg *get_caif_conf(void);
-
+void caif_free_client(struct cflayer *adap_layer);
 
 #endif /* CAIF_DEV_H_ */
diff --git a/include/net/caif/caif_layer.h b/include/net/caif/caif_layer.h
index c8b07a904e78..35bc7883cf97 100644
--- a/include/net/caif/caif_layer.h
+++ b/include/net/caif/caif_layer.h
@@ -15,7 +15,6 @@ struct cfpktq;
 struct caif_payload_info;
 struct caif_packet_funcs;
 
-
 #define CAIF_LAYER_NAME_SZ 16
 
 /**
@@ -33,7 +32,6 @@ do {								\
         }                                                       \
 } while (0)
 
-
 /**
  * enum caif_ctrlcmd - CAIF Stack Control Signaling sent in layer.ctrlcmd().
  *
@@ -141,7 +139,7 @@ enum caif_direction {
  *    - All layers must use this structure. If embedding it, then place this
  *      structure first in the layer specific structure.
  *
- *    - Each layer should not depend on any others layer private data.
+ *    - Each layer should not depend on any others layer's private data.
  *
  *    - In order to send data upwards do
  *      layer->up->receive(layer->up, packet);
@@ -155,16 +153,23 @@ struct cflayer {
         struct list_head node;
 
         /*
-         *  receive() - Receive Function.
+         *  receive() - Receive Function (non-blocking).
          *  Contract: Each layer must implement a receive function passing the
          *  CAIF packets upwards in the stack.
          *      Packet handling rules:
-         *            - The CAIF packet (cfpkt) cannot be accessed after
-         *                   passing it to the next layer using up->receive().
+         *            - The CAIF packet (cfpkt) ownership is passed to the
+         *              called receive function. This means that the the
+         *              packet cannot be accessed after passing it to the
+         *              above layer using up->receive().
+         *
          *            - If parsing of the packet fails, the packet must be
-         *                   destroyed and -1 returned from the function.
+         *              destroyed and negative error code returned
+         *              from the function.
+         *              EXCEPTION: If the framing layer (cffrml) returns
+         *                      -EILSEQ, the packet is not freed.
+         *
          *            - If parsing succeeds (and above layers return OK) then
-         *                    the function must return a value > 0.
+         *                    the function must return a value >= 0.
          *
          *  Returns result < 0 indicates an error, 0 or positive value
          *           indicates success.
@@ -176,7 +181,7 @@ struct cflayer {
         int (*receive)(struct cflayer *layr, struct cfpkt *cfpkt);
 
         /*
-         *  transmit() - Transmit Function.
+         *  transmit() - Transmit Function (non-blocking).
          *  Contract: Each layer must implement a transmit function passing the
          *      CAIF packet downwards in the stack.
          *      Packet handling rules:
@@ -185,15 +190,16 @@ struct cflayer {
          *              cannot be accessed after passing it to the below
          *              layer using dn->transmit().
          *
-         *            - If transmit fails, however, the ownership is returned
-         *              to thecaller. The caller of "dn->transmit()" must
-         *              destroy or resend packet.
+         *            - Upon error the packet ownership is still passed on,
+         *              so the packet shall be freed where error is detected.
+         *              Callers of the transmit function shall not free packets,
+         *              but errors shall be returned.
          *
          *            - Return value less than zero means error, zero or
          *              greater than zero means OK.
          *
-         *       result < 0 indicates an error, 0 or positive value
-         *       indicate success.
+         *  Returns result < 0 indicates an error, 0 or positive value
+         *              indicates success.
          *
          *  @layr:      Pointer to the current layer the receive function
          *              isimplemented for (this pointer).
@@ -202,7 +208,7 @@ struct cflayer {
         int (*transmit) (struct cflayer *layr, struct cfpkt *cfpkt);
 
         /*
-         *  cttrlcmd() - Control Function upwards in CAIF Stack.
+         *  cttrlcmd() - Control Function upwards in CAIF Stack  (non-blocking).
          *  Used for signaling responses (CAIF_CTRLCMD_*_RSP)
          *  and asynchronous events from the modem  (CAIF_CTRLCMD_*_IND)
          *
diff --git a/include/net/caif/caif_shm.h b/include/net/caif/caif_shm.h
new file mode 100644
index 000000000000..5bcce55438cf
--- /dev/null
+++ b/include/net/caif/caif_shm.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) ST-Ericsson AB 2010
+ * Contact: Sjur Brendeland / sjur.brandeland@stericsson.com
+ * Author: Amarnath Revanna / amarnath.bangalore.revanna@stericsson.com
+ * License terms: GNU General Public License (GPL) version 2
+ */
+
+#ifndef CAIF_SHM_H_
+#define CAIF_SHM_H_
+
+struct shmdev_layer {
+        u32 shm_base_addr;
+        u32 shm_total_sz;
+        u32 shm_id;
+        u32 shm_loopback;
+        void *hmbx;
+        int (*pshmdev_mbxsend) (u32 shm_id, u32 mbx_msg);
+        int (*pshmdev_mbxsetup) (void *pshmdrv_cb,
+                                struct shmdev_layer *pshm_dev, void *pshm_drv);
+        struct net_device *pshm_netdev;
+};
+
+extern int caif_shmcore_probe(struct shmdev_layer *pshm_dev);
+extern void caif_shmcore_remove(struct net_device *pshm_netdev);
+
+#endif
diff --git a/include/net/caif/caif_spi.h b/include/net/caif/caif_spi.h
index ce4570dff020..87c3d11b8e55 100644
--- a/include/net/caif/caif_spi.h
+++ b/include/net/caif/caif_spi.h
@@ -121,6 +121,8 @@ struct cfspi {
         wait_queue_head_t wait;
         spinlock_t lock;
         bool flow_stop;
+        bool slave;
+        bool slave_talked;
 #ifdef CONFIG_DEBUG_FS
         enum cfspi_state dbg_state;
         u16 pcmd;
diff --git a/include/net/caif/cfcnfg.h b/include/net/caif/cfcnfg.h
index bd646faffa47..3e93a4a4b677 100644
--- a/include/net/caif/cfcnfg.h
+++ b/include/net/caif/cfcnfg.h
@@ -46,6 +46,12 @@ enum cfcnfg_phy_preference {
 };
 
 /**
+ * cfcnfg_create() - Get the CAIF configuration object given network.
+ * @net:        Network for the CAIF configuration object.
+ */
+struct cfcnfg *get_cfcnfg(struct net *net);
+
+/**
  * cfcnfg_create() - Create the CAIF configuration object.
  */
 struct cfcnfg *cfcnfg_create(void);
@@ -65,8 +71,6 @@ void cfcnfg_remove(struct cfcnfg *cfg);
  * @dev:        Pointer to link layer device
  * @phy_layer:  Specify the physical layer. The transmit function
  *              MUST be set in the structure.
- * @phyid:      The assigned physical ID for this layer, used in
- *              cfcnfg_add_adapt_layer to specify PHY for the link.
  * @pref:       The phy (link layer) preference.
  * @fcs:        Specify if checksum is used in CAIF Framing Layer.
  * @stx:        Specify if Start Of Frame eXtention is used.
@@ -75,7 +79,7 @@ void cfcnfg_remove(struct cfcnfg *cfg);
 void
 cfcnfg_add_phy_layer(struct cfcnfg *cnfg, enum cfcnfg_phy_type phy_type,
                      struct net_device *dev, struct cflayer *phy_layer,
-                     u16 *phyid, enum cfcnfg_phy_preference pref,
+                     enum cfcnfg_phy_preference pref,
                      bool fcs, bool stx);
 
 /**
@@ -88,61 +92,12 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg, enum cfcnfg_phy_type phy_type,
 int cfcnfg_del_phy_layer(struct cfcnfg *cnfg, struct cflayer *phy_layer);
 
 /**
- * cfcnfg_disconn_adapt_layer - Disconnects an adaptation layer.
- *
- * @cnfg:       Pointer to a CAIF configuration object, created by
- *              cfcnfg_create().
- * @adap_layer: Adaptation layer to be removed.
- */
-int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg,
-                        struct cflayer *adap_layer);
-
-/**
- * cfcnfg_release_adap_layer - Used by client to release the adaptation layer.
- *
- * @adap_layer: Adaptation layer.
- */
-void cfcnfg_release_adap_layer(struct cflayer *adap_layer);
-
-/**
- * cfcnfg_add_adaptation_layer - Add an adaptation layer to the CAIF stack.
- *
- * The adaptation Layer is where the interface to application or higher-level
- * driver functionality is implemented.
- *
- * @cnfg:               Pointer to a CAIF configuration object, created by
- *                      cfcnfg_create().
- * @param:              Link setup parameters.
- * @adap_layer:         Specify the adaptation layer; the receive and
- *                      flow-control functions MUST be set in the structure.
- * @ifindex:            Link layer interface index used for this connection.
- * @proto_head:         Protocol head-space needed by CAIF protocol,
- *                      excluding link layer.
- * @proto_tail:         Protocol tail-space needed by CAIF protocol,
- *                      excluding link layer.
- */
-int cfcnfg_add_adaptation_layer(struct cfcnfg *cnfg,
-                            struct cfctrl_link_param *param,
-                            struct cflayer *adap_layer,
-                            int *ifindex,
-                            int *proto_head,
-                            int *proto_tail);
-
-/**
- * cfcnfg_get_phyid() - Get physical ID, given type.
- * Returns one of the physical interfaces matching the given type.
- * Zero if no match is found.
- * @cnfg:       Configuration object
- * @phy_pref:   Caif Link Layer preference
- */
-struct dev_info *cfcnfg_get_phyid(struct cfcnfg *cnfg,
-                     enum cfcnfg_phy_preference phy_pref);
-
-/**
- * cfcnfg_get_named() - Get the Physical Identifier of CAIF Link Layer
+ * cfcnfg_set_phy_state() - Set the state of the physical interface device.
  * @cnfg:       Configuration object
- * @name:       Name of the Physical Layer (Caif Link Layer)
+ * @phy_layer:  Physical Layer representation
+ * @up: State of device
  */
-int cfcnfg_get_named(struct cfcnfg *cnfg, char *name);
+int cfcnfg_set_phy_state(struct cfcnfg *cnfg, struct cflayer *phy_layer,
+                                bool up);
 
 #endif                          /* CFCNFG_H_ */
diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
index 9402543fc20d..9e5425b4a1d7 100644
--- a/include/net/caif/cfctrl.h
+++ b/include/net/caif/cfctrl.h
@@ -51,7 +51,7 @@ struct cfctrl_rsp {
         void (*restart_rsp)(void);
         void (*radioset_rsp)(void);
         void (*reject_rsp)(struct cflayer *layer, u8 linkid,
-                                struct cflayer *client_layer);;
+                                struct cflayer *client_layer);
 };
 
 /* Link Setup Parameters for CAIF-Links. */
@@ -121,19 +121,10 @@ int cfctrl_linkup_request(struct cflayer *cfctrl,
                            struct cflayer *user_layer);
 int  cfctrl_linkdown_req(struct cflayer *cfctrl, u8 linkid,
                          struct cflayer *client);
-void cfctrl_sleep_req(struct cflayer *cfctrl);
-void cfctrl_wake_req(struct cflayer *cfctrl);
-void cfctrl_getstartreason_req(struct cflayer *cfctrl);
+
 struct cflayer *cfctrl_create(void);
-void cfctrl_set_dnlayer(struct cflayer *this, struct cflayer *dn);
-void cfctrl_set_uplayer(struct cflayer *this, struct cflayer *up);
 struct cfctrl_rsp *cfctrl_get_respfuncs(struct cflayer *layer);
-bool cfctrl_req_eq(struct cfctrl_request_info *r1,
-                   struct cfctrl_request_info *r2);
-void cfctrl_insert_req(struct cfctrl *ctrl,
-                              struct cfctrl_request_info *req);
-struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
-                                              struct cfctrl_request_info *req);
-void cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer);
+int cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer);
+void cfctrl_remove(struct cflayer *layr);
 
 #endif                          /* CFCTRL_H_ */
diff --git a/include/net/caif/cffrml.h b/include/net/caif/cffrml.h
index 3f14d2e1ce61..afac1a48cce7 100644
--- a/include/net/caif/cffrml.h
+++ b/include/net/caif/cffrml.h
@@ -7,10 +7,15 @@
 #ifndef CFFRML_H_
 #define CFFRML_H_
 #include <net/caif/caif_layer.h>
+#include <linux/netdevice.h>
 
 struct cffrml;
-struct cflayer *cffrml_create(u16 phyid, bool DoFCS);
+struct cflayer *cffrml_create(u16 phyid, bool use_fcs);
+void cffrml_free(struct cflayer *layr);
 void cffrml_set_uplayer(struct cflayer *this, struct cflayer *up);
 void cffrml_set_dnlayer(struct cflayer *this, struct cflayer *dn);
+void cffrml_put(struct cflayer *layr);
+void cffrml_hold(struct cflayer *layr);
+int cffrml_refcnt_read(struct cflayer *layr);
 
 #endif /* CFFRML_H_ */
diff --git a/include/net/caif/cfmuxl.h b/include/net/caif/cfmuxl.h
index 4e1b4f33423e..5847a196b8ad 100644
--- a/include/net/caif/cfmuxl.h
+++ b/include/net/caif/cfmuxl.h
@@ -16,7 +16,5 @@ int cfmuxl_set_uplayer(struct cflayer *layr, struct cflayer *up, u8 linkid);
 struct cflayer *cfmuxl_remove_dnlayer(struct cflayer *layr, u8 phyid);
 int cfmuxl_set_dnlayer(struct cflayer *layr, struct cflayer *up, u8 phyid);
 struct cflayer *cfmuxl_remove_uplayer(struct cflayer *layr, u8 linkid);
-bool cfmuxl_is_phy_inuse(struct cflayer *layr, u8 phyid);
-u8 cfmuxl_get_phyid(struct cflayer *layr, u8 channel_id);
 
 #endif                          /* CFMUXL_H_ */
diff --git a/include/net/caif/cfpkt.h b/include/net/caif/cfpkt.h
index fbc681beff52..6bd200a4754a 100644
--- a/include/net/caif/cfpkt.h
+++ b/include/net/caif/cfpkt.h
@@ -16,12 +16,6 @@ struct cfpkt;
  */
 struct cfpkt *cfpkt_create(u16 len);
 
-/* Create a CAIF packet.
- * data Data to copy.
- * len Length of packet to be created
- * @return New packet.
- */
-struct cfpkt *cfpkt_create_uplink(const unsigned char *data, unsigned int len);
 /*
  * Destroy a CAIF Packet.
  * pkt Packet to be destoyed.
@@ -181,22 +175,6 @@ u16 cfpkt_iterate(struct cfpkt *pkt,
                 u16 (*iter_func)(u16 chks, void *buf, u16 len),
                 u16 data);
 
-/* Append by giving user access to packet buffer
- * cfpkt Packet to append to
- * buf Buffer inside pkt that user shall copy data into
- * buflen Length of buffer and number of bytes added to packet
- * @return 0 on error, 1 on success
- */
-int cfpkt_raw_append(struct cfpkt *cfpkt, void **buf, unsigned int buflen);
-
-/* Extract by giving user access to packet buffer
- * cfpkt Packet to extract from
- * buf Buffer inside pkt that user shall copy data from
- * buflen Length of buffer and number of bytes removed from packet
- * @return 0 on error, 1 on success
- */
-int cfpkt_raw_extract(struct cfpkt *cfpkt, void **buf, unsigned int buflen);
-
 /* Map from a "native" packet (e.g. Linux Socket Buffer) to a CAIF packet.
  *  dir - Direction indicating whether this packet is to be sent or received.
  *  nativepkt  - The native packet to be transformed to a CAIF packet
@@ -210,59 +188,6 @@ struct cfpkt *cfpkt_fromnative(enum caif_direction dir, void *nativepkt);
  */
 void *cfpkt_tonative(struct cfpkt *pkt);
 
-/*
- * Insert a packet in the packet queue.
- * pktq Packet queue to insert into
- * pkt Packet to be inserted in queue
- * prio Priority of packet
- */
-void cfpkt_queue(struct cfpktq *pktq, struct cfpkt *pkt,
-                 unsigned short prio);
-
-/*
- * Remove a packet from the packet queue.
- * pktq Packet queue to fetch packets from.
- * @return Dequeued packet.
- */
-struct cfpkt *cfpkt_dequeue(struct cfpktq *pktq);
-
-/*
- * Peek into a packet from the packet queue.
- * pktq Packet queue to fetch packets from.
- * @return Peeked packet.
- */
-struct cfpkt *cfpkt_qpeek(struct cfpktq *pktq);
-
-/*
- * Initiates the packet queue.
- * @return Pointer to new packet queue.
- */
-struct cfpktq *cfpktq_create(void);
-
-/*
- * Get the number of packets in the queue.
- * pktq Packet queue to fetch count from.
- * @return Number of packets in queue.
- */
-int cfpkt_qcount(struct cfpktq *pktq);
-
-/*
- * Put content of packet into buffer for debuging purposes.
- * pkt Packet to copy data from
- * buf Buffer to copy data into
- * buflen Length of data to copy
- * @return Pointer to copied data
- */
-char *cfpkt_log_pkt(struct cfpkt *pkt, char *buf, int buflen);
-
-/*
- * Clones a packet and releases the original packet.
- * This is used for taking ownership of a packet e.g queueing.
- * pkt Packet to clone and release.
- * @return Cloned packet.
- */
-struct cfpkt *cfpkt_clone_release(struct cfpkt *pkt);
-
 
 /*
  * Returns packet information for a packet.
@@ -270,5 +195,4 @@ struct cfpkt *cfpkt_clone_release(struct cfpkt *pkt);
  * @return Packet information
  */
 struct caif_payload_info *cfpkt_info(struct cfpkt *pkt);
-/*! @} */
 #endif                          /* CFPKT_H_ */
diff --git a/include/net/caif/cfsrvl.h b/include/net/caif/cfsrvl.h
index b1fa87ee0992..0f5905241843 100644
--- a/include/net/caif/cfsrvl.h
+++ b/include/net/caif/cfsrvl.h
@@ -10,6 +10,7 @@
 #include <linux/stddef.h>
 #include <linux/types.h>
 #include <linux/kref.h>
+#include <linux/rculist.h>
 
 struct cfsrvl {
         struct cflayer layer;
@@ -17,12 +18,13 @@ struct cfsrvl {
         bool phy_flow_on;
         bool modem_flow_on;
         bool supports_flowctrl;
-        void (*release)(struct kref *);
+        void (*release)(struct cflayer *layer);
         struct dev_info dev_info;
-        struct kref ref;
+        void (*hold)(struct cflayer *lyr);
+        void (*put)(struct cflayer *lyr);
+        struct rcu_head rcu;
 };
 
-void cfsrvl_release(struct kref *kref);
 struct cflayer *cfvei_create(u8 linkid, struct dev_info *dev_info);
 struct cflayer *cfdgml_create(u8 linkid, struct dev_info *dev_info);
 struct cflayer *cfutill_create(u8 linkid, struct dev_info *dev_info);
@@ -30,8 +32,12 @@ struct cflayer *cfvidl_create(u8 linkid, struct dev_info *dev_info);
 struct cflayer *cfrfml_create(u8 linkid, struct dev_info *dev_info,
                                 int mtu_size);
 struct cflayer *cfdbgl_create(u8 linkid, struct dev_info *dev_info);
+
+void cfsrvl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
+                     int phyid);
+
 bool cfsrvl_phyid_match(struct cflayer *layer, int phyid);
-void cfservl_destroy(struct cflayer *layer);
+
 void cfsrvl_init(struct cfsrvl *service,
                         u8 channel_id,
                         struct dev_info *dev_info,
@@ -41,23 +47,19 @@ u8 cfsrvl_getphyid(struct cflayer *layer);
 
 static inline void cfsrvl_get(struct cflayer *layr)
 {
-        struct cfsrvl *s;
-        if (layr == NULL)
+        struct cfsrvl *s = container_of(layr, struct cfsrvl, layer);
+        if (layr == NULL || layr->up == NULL || s->hold == NULL)
                 return;
-        s = container_of(layr, struct cfsrvl, layer);
-        kref_get(&s->ref);
+
+        s->hold(layr->up);
 }
 
 static inline void cfsrvl_put(struct cflayer *layr)
 {
-        struct cfsrvl *s;
-        if (layr == NULL)
+        struct cfsrvl *s = container_of(layr, struct cfsrvl, layer);
+        if (layr == NULL || layr->up == NULL || s->hold == NULL)
                 return;
-        s = container_of(layr, struct cfsrvl, layer);
 
-        WARN_ON(!s->release);
-        if (s->release)
-                kref_put(&s->ref, s->release);
+        s->put(layr->up);
 }
-
 #endif                          /* CFSRVL_H_ */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 2fd06c60ffbb..396e8fc8910e 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -25,6 +25,43 @@
 #include <linux/wireless.h>
 
 
+/**
+ * DOC: Introduction
+ *
+ * cfg80211 is the configuration API for 802.11 devices in Linux. It bridges
+ * userspace and drivers, and offers some utility functionality associated
+ * with 802.11. cfg80211 must, directly or indirectly via mac80211, be used
+ * by all modern wireless drivers in Linux, so that they offer a consistent
+ * API through nl80211. For backward compatibility, cfg80211 also offers
+ * wireless extensions to userspace, but hides them from drivers completely.
+ *
+ * Additionally, cfg80211 contains code to help enforce regulatory spectrum
+ * use restrictions.
+ */
+
+
+/**
+ * DOC: Device registration
+ *
+ * In order for a driver to use cfg80211, it must register the hardware device
+ * with cfg80211. This happens through a number of hardware capability structs
+ * described below.
+ *
+ * The fundamental structure for each device is the 'wiphy', of which each
+ * instance describes a physical wireless device connected to the system. Each
+ * such wiphy can have zero, one, or many virtual interfaces associated with
+ * it, which need to be identified as such by pointing the network interface's
+ * @ieee80211_ptr pointer to a &struct wireless_dev which further describes
+ * the wireless part of the interface, normally this struct is embedded in the
+ * network interface's private data area. Drivers can optionally allow creating
+ * or destroying virtual interfaces on the fly, but without at least one or the
+ * ability to create some the wireless device isn't useful.
+ *
+ * Each wiphy structure contains device capability information, and also has
+ * a pointer to the various operations the driver offers. The definitions and
+ * structures here describe these capabilities in detail.
+ */
+
 /*
  * wireless hardware capability structures
  */
@@ -205,14 +242,25 @@ struct ieee80211_supported_band {
  */
 
 /**
+ * DOC: Actions and configuration
+ *
+ * Each wireless device and each virtual interface offer a set of configuration
+ * operations and other actions that are invoked by userspace. Each of these
+ * actions is described in the operations structure, and the parameters these
+ * operations use are described separately.
+ *
+ * Additionally, some operations are asynchronous and expect to get status
+ * information via some functions that drivers need to call.
+ *
+ * Scanning and BSS list handling with its associated functionality is described
+ * in a separate chapter.
+ */
+
+/**
  * struct vif_params - describes virtual interface parameters
- * @mesh_id: mesh ID to use
- * @mesh_id_len: length of the mesh ID
  * @use_4addr: use 4-address frames
  */
 struct vif_params {
-       u8 *mesh_id;
-       int mesh_id_len;
        int use_4addr;
 };
 
@@ -241,12 +289,24 @@ struct key_params {
  * enum survey_info_flags - survey information flags
  *
  * @SURVEY_INFO_NOISE_DBM: noise (in dBm) was filled in
+ * @SURVEY_INFO_IN_USE: channel is currently being used
+ * @SURVEY_INFO_CHANNEL_TIME: channel active time (in ms) was filled in
+ * @SURVEY_INFO_CHANNEL_TIME_BUSY: channel busy time was filled in
+ * @SURVEY_INFO_CHANNEL_TIME_EXT_BUSY: extension channel busy time was filled in
+ * @SURVEY_INFO_CHANNEL_TIME_RX: channel receive time was filled in
+ * @SURVEY_INFO_CHANNEL_TIME_TX: channel transmit time was filled in
  *
  * Used by the driver to indicate which info in &struct survey_info
  * it has filled in during the get_survey().
  */
 enum survey_info_flags {
         SURVEY_INFO_NOISE_DBM = 1<<0,
+        SURVEY_INFO_IN_USE = 1<<1,
+        SURVEY_INFO_CHANNEL_TIME = 1<<2,
+        SURVEY_INFO_CHANNEL_TIME_BUSY = 1<<3,
+        SURVEY_INFO_CHANNEL_TIME_EXT_BUSY = 1<<4,
+        SURVEY_INFO_CHANNEL_TIME_RX = 1<<5,
+        SURVEY_INFO_CHANNEL_TIME_TX = 1<<6,
 };
 
 /**
@@ -256,6 +316,11 @@ enum survey_info_flags {
  * @filled: bitflag of flags from &enum survey_info_flags
  * @noise: channel noise in dBm. This and all following fields are
  *     optional
+ * @channel_time: amount of time in ms the radio spent on the channel
+ * @channel_time_busy: amount of time the primary channel was sensed busy
+ * @channel_time_ext_busy: amount of time the extension channel was sensed busy
+ * @channel_time_rx: amount of time the radio spent receiving data
+ * @channel_time_tx: amount of time the radio spent transmitting data
  *
  * Used by dump_survey() to report back per-channel survey information.
  *
@@ -264,6 +329,11 @@ enum survey_info_flags {
  */
 struct survey_info {
         struct ieee80211_channel *channel;
+        u64 channel_time;
+        u64 channel_time_busy;
+        u64 channel_time_ext_busy;
+        u64 channel_time_rx;
+        u64 channel_time_tx;
         u32 filled;
         s8 noise;
 };
@@ -317,6 +387,7 @@ enum plink_actions {
  * @listen_interval: listen interval or -1 for no change
  * @aid: AID or zero for no change
  * @plink_action: plink action to take
+ * @plink_state: set the peer link state for a station
  * @ht_capa: HT capabilities of station
  */
 struct station_parameters {
@@ -327,6 +398,7 @@ struct station_parameters {
         u16 aid;
         u8 supported_rates_len;
         u8 plink_action;
+        u8 plink_state;
         struct ieee80211_ht_cap *ht_capa;
 };
 
@@ -343,10 +415,17 @@ struct station_parameters {
  * @STATION_INFO_PLID: @plid filled
  * @STATION_INFO_PLINK_STATE: @plink_state filled
  * @STATION_INFO_SIGNAL: @signal filled
- * @STATION_INFO_TX_BITRATE: @tx_bitrate fields are filled
+ * @STATION_INFO_TX_BITRATE: @txrate fields are filled
  *  (tx_bitrate, tx_bitrate_flags and tx_bitrate_mcs)
  * @STATION_INFO_RX_PACKETS: @rx_packets filled
  * @STATION_INFO_TX_PACKETS: @tx_packets filled
+ * @STATION_INFO_TX_RETRIES: @tx_retries filled
+ * @STATION_INFO_TX_FAILED: @tx_failed filled
+ * @STATION_INFO_RX_DROP_MISC: @rx_dropped_misc filled
+ * @STATION_INFO_SIGNAL_AVG: @signal_avg filled
+ * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
+ * @STATION_INFO_BSS_PARAM: @bss_param filled
+ * @STATION_INFO_CONNECTED_TIME: @connected_time filled
  */
 enum station_info_flags {
         STATION_INFO_INACTIVE_TIME      = 1<<0,
@@ -359,6 +438,13 @@ enum station_info_flags {
         STATION_INFO_TX_BITRATE         = 1<<7,
         STATION_INFO_RX_PACKETS         = 1<<8,
         STATION_INFO_TX_PACKETS         = 1<<9,
+        STATION_INFO_TX_RETRIES         = 1<<10,
+        STATION_INFO_TX_FAILED          = 1<<11,
+        STATION_INFO_RX_DROP_MISC       = 1<<12,
+        STATION_INFO_SIGNAL_AVG         = 1<<13,
+        STATION_INFO_RX_BITRATE         = 1<<14,
+        STATION_INFO_BSS_PARAM          = 1<<15,
+        STATION_INFO_CONNECTED_TIME     = 1<<16
 };
 
 /**
@@ -393,11 +479,43 @@ struct rate_info {
 };
 
 /**
+ * enum station_info_rate_flags - bitrate info flags
+ *
+ * Used by the driver to indicate the specific rate transmission
+ * type for 802.11n transmissions.
+ *
+ * @BSS_PARAM_FLAGS_CTS_PROT: whether CTS protection is enabled
+ * @BSS_PARAM_FLAGS_SHORT_PREAMBLE: whether short preamble is enabled
+ * @BSS_PARAM_FLAGS_SHORT_SLOT_TIME: whether short slot time is enabled
+ */
+enum bss_param_flags {
+        BSS_PARAM_FLAGS_CTS_PROT        = 1<<0,
+        BSS_PARAM_FLAGS_SHORT_PREAMBLE  = 1<<1,
+        BSS_PARAM_FLAGS_SHORT_SLOT_TIME = 1<<2,
+};
+
+/**
+ * struct sta_bss_parameters - BSS parameters for the attached station
+ *
+ * Information about the currently associated BSS
+ *
+ * @flags: bitflag of flags from &enum bss_param_flags
+ * @dtim_period: DTIM period for the BSS
+ * @beacon_interval: beacon interval
+ */
+struct sta_bss_parameters {
+        u8 flags;
+        u8 dtim_period;
+        u16 beacon_interval;
+};
+
+/**
  * struct station_info - station information
  *
  * Station information filled by driver for get_station() and dump_station.
  *
  * @filled: bitflag of flags from &enum station_info_flags
+ * @connected_time: time(in secs) since a station is last connected
  * @inactive_time: time since last station activity (tx/rx) in milliseconds
  * @rx_bytes: bytes received from this station
  * @tx_bytes: bytes transmitted to this station
@@ -405,9 +523,15 @@ struct rate_info {
  * @plid: mesh peer link id
  * @plink_state: mesh peer link state
  * @signal: signal strength of last received packet in dBm
- * @txrate: current unicast bitrate to this station
+ * @signal_avg: signal strength average in dBm
+ * @txrate: current unicast bitrate from this station
+ * @rxrate: current unicast bitrate to this station
  * @rx_packets: packets received from this station
  * @tx_packets: packets transmitted to this station
+ * @tx_retries: cumulative retry counts
+ * @tx_failed: number of failed transmissions (retries exceeded, no ACK)
+ * @rx_dropped_misc:  Dropped for un-specified reason.
+ * @bss_param: current BSS parameters
  * @generation: generation number for nl80211 dumps.
  *      This number should increase every time the list of stations
  *      changes, i.e. when a station is added or removed, so that
@@ -415,6 +539,7 @@ struct rate_info {
  */
 struct station_info {
         u32 filled;
+        u32 connected_time;
         u32 inactive_time;
         u32 rx_bytes;
         u32 tx_bytes;
@@ -422,9 +547,15 @@ struct station_info {
         u16 plid;
         u8 plink_state;
         s8 signal;
+        s8 signal_avg;
         struct rate_info txrate;
+        struct rate_info rxrate;
         u32 rx_packets;
         u32 tx_packets;
+        u32 tx_retries;
+        u32 tx_failed;
+        u32 rx_dropped_misc;
+        struct sta_bss_parameters bss_param;
 
         int generation;
 };
@@ -519,6 +650,8 @@ struct mpath_info {
  *      (or NULL for no change)
  * @basic_rates_len: number of basic rates
  * @ap_isolate: do not forward packets between connected stations
+ * @ht_opmode: HT Operation mode
+ *      (u16 = opmode, -1 = do not change)
  */
 struct bss_parameters {
         int use_cts_prot;
@@ -527,8 +660,14 @@ struct bss_parameters {
         u8 *basic_rates;
         u8 basic_rates_len;
         int ap_isolate;
+        int ht_opmode;
 };
 
+/*
+ * struct mesh_config - 802.11s mesh configuration
+ *
+ * These parameters can be changed while the mesh is active.
+ */
 struct mesh_config {
         /* Timeouts in ms */
         /* Mesh plink management parameters */
@@ -538,6 +677,8 @@ struct mesh_config {
         u16 dot11MeshMaxPeerLinks;
         u8  dot11MeshMaxRetries;
         u8  dot11MeshTTL;
+        /* ttl used in path selection information elements */
+        u8  element_ttl;
         bool auto_open_plinks;
         /* HWMP parameters */
         u8  dot11MeshHWMPmaxPREQretries;
@@ -550,6 +691,30 @@ struct mesh_config {
 };
 
 /**
+ * struct mesh_setup - 802.11s mesh setup configuration
+ * @mesh_id: the mesh ID
+ * @mesh_id_len: length of the mesh ID, at least 1 and at most 32 bytes
+ * @path_sel_proto: which path selection protocol to use
+ * @path_metric: which metric to use
+ * @ie: vendor information elements (optional)
+ * @ie_len: length of vendor information elements
+ * @is_authenticated: this mesh requires authentication
+ * @is_secure: this mesh uses security
+ *
+ * These parameters are fixed when the mesh is created.
+ */
+struct mesh_setup {
+        const u8 *mesh_id;
+        u8 mesh_id_len;
+        u8  path_sel_proto;
+        u8  path_metric;
+        const u8 *ie;
+        u8 ie_len;
+        bool is_authenticated;
+        bool is_secure;
+};
+
+/**
  * struct ieee80211_txq_params - TX queue parameters
  * @queue: TX queue identifier (NL80211_TXQ_Q_*)
  * @txop: Maximum burst time in units of 32 usecs, 0 meaning disabled
@@ -570,8 +735,28 @@ struct ieee80211_txq_params {
 /* from net/wireless.h */
 struct wiphy;
 
-/* from net/ieee80211.h */
-struct ieee80211_channel;
+/**
+ * DOC: Scanning and BSS list handling
+ *
+ * The scanning process itself is fairly simple, but cfg80211 offers quite
+ * a bit of helper functionality. To start a scan, the scan operation will
+ * be invoked with a scan definition. This scan definition contains the
+ * channels to scan, and the SSIDs to send probe requests for (including the
+ * wildcard, if desired). A passive scan is indicated by having no SSIDs to
+ * probe. Additionally, a scan request may contain extra information elements
+ * that should be added to the probe request. The IEs are guaranteed to be
+ * well-formed, and will not exceed the maximum length the driver advertised
+ * in the wiphy structure.
+ *
+ * When scanning finds a BSS, cfg80211 needs to be notified of that, because
+ * it is responsible for maintaining the BSS list; the driver should not
+ * maintain a list itself. For this notification, various functions exist.
+ *
+ * Since drivers do not maintain a BSS list, there are also a number of
+ * functions to search for a BSS and obtain information about it from the
+ * BSS structure cfg80211 maintains. The BSS list is also made available
+ * to userspace.
+ */
 
 /**
  * struct cfg80211_ssid - SSID description
@@ -613,6 +798,35 @@ struct cfg80211_scan_request {
 };
 
 /**
+ * struct cfg80211_sched_scan_request - scheduled scan request description
+ *
+ * @ssids: SSIDs to scan for (passed in the probe_reqs in active scans)
+ * @n_ssids: number of SSIDs
+ * @n_channels: total number of channels to scan
+ * @interval: interval between each scheduled scan cycle
+ * @ie: optional information element(s) to add into Probe Request or %NULL
+ * @ie_len: length of ie in octets
+ * @wiphy: the wiphy this was for
+ * @dev: the interface
+ * @channels: channels to scan
+ */
+struct cfg80211_sched_scan_request {
+        struct cfg80211_ssid *ssids;
+        int n_ssids;
+        u32 n_channels;
+        u32 interval;
+        const u8 *ie;
+        size_t ie_len;
+
+        /* internal */
+        struct wiphy *wiphy;
+        struct net_device *dev;
+
+        /* keep last */
+        struct ieee80211_channel *channels[0];
+};
+
+/**
  * enum cfg80211_signal_type - signal type
  *
  * @CFG80211_SIGNAL_TYPE_NONE: no signal strength information available
@@ -691,6 +905,10 @@ const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
  *      sets/clears %NL80211_STA_FLAG_AUTHORIZED. If true, the driver is
  *      required to assume that the port is unauthorized until authorized by
  *      user space. Otherwise, port is marked authorized by default.
+ * @control_port_ethertype: the control port protocol that should be
+ *      allowed through even on unauthorized ports
+ * @control_port_no_encrypt: TRUE to prevent encryption of control port
+ *      protocol frames.
  */
 struct cfg80211_crypto_settings {
         u32 wpa_versions;
@@ -700,6 +918,8 @@ struct cfg80211_crypto_settings {
         int n_akm_suites;
         u32 akm_suites[NL80211_MAX_NR_AKM_SUITES];
         bool control_port;
+        __be16 control_port_ethertype;
+        bool control_port_no_encrypt;
 };
 
 /**
@@ -811,6 +1031,7 @@ struct cfg80211_disassoc_request {
  * @privacy: this is a protected network, keys will be configured
  *      after joining
  * @basic_rates: bitmap of basic rates to use when creating the IBSS
+ * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
  */
 struct cfg80211_ibss_params {
         u8 *ssid;
@@ -822,6 +1043,7 @@ struct cfg80211_ibss_params {
         u32 basic_rates;
         bool channel_fixed;
         bool privacy;
+        int mcast_rate[IEEE80211_NUM_BANDS];
 };
 
 /**
@@ -900,6 +1122,38 @@ struct cfg80211_pmksa {
 };
 
 /**
+ * struct cfg80211_wowlan_trig_pkt_pattern - packet pattern
+ * @mask: bitmask where to match pattern and where to ignore bytes,
+ *      one bit per byte, in same format as nl80211
+ * @pattern: bytes to match where bitmask is 1
+ * @pattern_len: length of pattern (in bytes)
+ *
+ * Internal note: @mask and @pattern are allocated in one chunk of
+ * memory, free @mask only!
+ */
+struct cfg80211_wowlan_trig_pkt_pattern {
+        u8 *mask, *pattern;
+        int pattern_len;
+};
+
+/**
+ * struct cfg80211_wowlan - Wake on Wireless-LAN support info
+ *
+ * This structure defines the enabled WoWLAN triggers for the device.
+ * @any: wake up on any activity -- special trigger if device continues
+ *      operating as normal during suspend
+ * @disconnect: wake up if getting disconnected
+ * @magic_pkt: wake up on receiving magic packet
+ * @patterns: wake up on receiving packet matching a pattern
+ * @n_patterns: number of patterns
+ */
+struct cfg80211_wowlan {
+        bool any, disconnect, magic_pkt;
+        struct cfg80211_wowlan_trig_pkt_pattern *patterns;
+        int n_patterns;
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -912,12 +1166,15 @@ struct cfg80211_pmksa {
  * wireless extensions but this is subject to reevaluation as soon as this
  * code is used more widely and we have a first user without wext.
  *
- * @suspend: wiphy device needs to be suspended
+ * @suspend: wiphy device needs to be suspended. The variable @wow will
+ *      be %NULL or contain the enabled Wake-on-Wireless triggers that are
+ *      configured for the device.
  * @resume: wiphy device needs to be resumed
  *
  * @add_virtual_intf: create a new virtual interface with the given name,
  *      must set the struct wireless_dev's iftype. Beware: You must create
- *      the new netdev in the wiphy's network namespace!
+ *      the new netdev in the wiphy's network namespace! Returns the netdev,
+ *      or an ERR_PTR.
  *
  * @del_virtual_intf: remove the virtual interface determined by ifindex.
  *
@@ -958,10 +1215,12 @@ struct cfg80211_pmksa {
  * @change_mpath: change a given mesh path
  * @get_mpath: get a mesh path for the given parameters
  * @dump_mpath: dump mesh path callback -- resume dump at index @idx
+ * @join_mesh: join the mesh network with the specified parameters
+ * @leave_mesh: leave the current mesh network
  *
- * @get_mesh_params: Put the current mesh parameters into *params
+ * @get_mesh_config: Get the current mesh configuration
  *
- * @set_mesh_params: Set mesh parameters.
+ * @update_mesh_config: Update mesh parameters on a running mesh.
  *      The mask is a bitfield which tells us which parameters to
  *      set, and which to leave alone.
  *
@@ -1020,7 +1279,9 @@ struct cfg80211_pmksa {
  * @cancel_remain_on_channel: Cancel an on-going remain-on-channel operation.
  *      This allows the operation to be terminated prior to timeout based on
  *      the duration value.
- * @action: Transmit an action frame
+ * @mgmt_tx: Transmit a management frame.
+ * @mgmt_tx_cancel_wait: Cancel the wait time from transmitting a management
+ *      frame on another channel
  *
  * @testmode_cmd: run a test mode command
  *
@@ -1034,15 +1295,35 @@ struct cfg80211_pmksa {
  * @set_power_mgmt: Configure WLAN power management. A timeout value of -1
  *      allows the driver to adjust the dynamic ps timeout value.
  * @set_cqm_rssi_config: Configure connection quality monitor RSSI threshold.
+ * @sched_scan_start: Tell the driver to start a scheduled scan.
+ * @sched_scan_stop: Tell the driver to stop an ongoing scheduled
+ *      scan.  The driver_initiated flag specifies whether the driver
+ *      itself has informed that the scan has stopped.
+ *
+ * @mgmt_frame_register: Notify driver that a management frame type was
+ *      registered. Note that this callback may not sleep, and cannot run
+ *      concurrently with itself.
  *
+ * @set_antenna: Set antenna configuration (tx_ant, rx_ant) on the device.
+ *      Parameters are bitmaps of allowed antennas to use for TX/RX. Drivers may
+ *      reject TX/RX mask combinations they cannot support by returning -EINVAL
+ *      (also see nl80211.h @NL80211_ATTR_WIPHY_ANTENNA_TX).
+ *
+ * @get_antenna: Get current antenna configuration from device (tx_ant, rx_ant).
+ *
+ * @set_ringparam: Set tx and rx ring sizes.
+ *
+ * @get_ringparam: Get tx and rx ring current and maximum sizes.
  */
 struct cfg80211_ops {
-        int     (*suspend)(struct wiphy *wiphy);
+        int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
         int     (*resume)(struct wiphy *wiphy);
 
-        int     (*add_virtual_intf)(struct wiphy *wiphy, char *name,
-                                    enum nl80211_iftype type, u32 *flags,
-                                    struct vif_params *params);
+        struct net_device * (*add_virtual_intf)(struct wiphy *wiphy,
+                                                char *name,
+                                                enum nl80211_iftype type,
+                                                u32 *flags,
+                                                struct vif_params *params);
         int     (*del_virtual_intf)(struct wiphy *wiphy, struct net_device *dev);
         int     (*change_virtual_intf)(struct wiphy *wiphy,
                                        struct net_device *dev,
@@ -1050,16 +1331,17 @@ struct cfg80211_ops {
                                        struct vif_params *params);
 
         int     (*add_key)(struct wiphy *wiphy, struct net_device *netdev,
-                           u8 key_index, const u8 *mac_addr,
+                           u8 key_index, bool pairwise, const u8 *mac_addr,
                            struct key_params *params);
         int     (*get_key)(struct wiphy *wiphy, struct net_device *netdev,
-                           u8 key_index, const u8 *mac_addr, void *cookie,
+                           u8 key_index, bool pairwise, const u8 *mac_addr,
+                           void *cookie,
                            void (*callback)(void *cookie, struct key_params*));
         int     (*del_key)(struct wiphy *wiphy, struct net_device *netdev,
-                           u8 key_index, const u8 *mac_addr);
+                           u8 key_index, bool pairwise, const u8 *mac_addr);
         int     (*set_default_key)(struct wiphy *wiphy,
                                    struct net_device *netdev,
-                                   u8 key_index);
+                                   u8 key_index, bool unicast, bool multicast);
         int     (*set_default_mgmt_key)(struct wiphy *wiphy,
                                         struct net_device *netdev,
                                         u8 key_index);
@@ -1094,12 +1376,17 @@ struct cfg80211_ops {
         int     (*dump_mpath)(struct wiphy *wiphy, struct net_device *dev,
                                int idx, u8 *dst, u8 *next_hop,
                                struct mpath_info *pinfo);
-        int     (*get_mesh_params)(struct wiphy *wiphy,
+        int     (*get_mesh_config)(struct wiphy *wiphy,
                                 struct net_device *dev,
                                 struct mesh_config *conf);
-        int     (*set_mesh_params)(struct wiphy *wiphy,
-                                struct net_device *dev,
-                                const struct mesh_config *nconf, u32 mask);
+        int     (*update_mesh_config)(struct wiphy *wiphy,
+                                      struct net_device *dev, u32 mask,
+                                      const struct mesh_config *nconf);
+        int     (*join_mesh)(struct wiphy *wiphy, struct net_device *dev,
+                             const struct mesh_config *conf,
+                             const struct mesh_setup *setup);
+        int     (*leave_mesh)(struct wiphy *wiphy, struct net_device *dev);
+
         int     (*change_bss)(struct wiphy *wiphy, struct net_device *dev,
                               struct bss_parameters *params);
 
@@ -1140,7 +1427,7 @@ struct cfg80211_ops {
         int     (*get_tx_power)(struct wiphy *wiphy, int *dbm);
 
         int     (*set_wds_peer)(struct wiphy *wiphy, struct net_device *dev,
-                                u8 *addr);
+                                const u8 *addr);
 
         void    (*rfkill_poll)(struct wiphy *wiphy);
 
@@ -1172,11 +1459,14 @@ struct cfg80211_ops {
                                             struct net_device *dev,
                                             u64 cookie);
 
-        int     (*action)(struct wiphy *wiphy, struct net_device *dev,
-                          struct ieee80211_channel *chan,
+        int     (*mgmt_tx)(struct wiphy *wiphy, struct net_device *dev,
+                          struct ieee80211_channel *chan, bool offchan,
                           enum nl80211_channel_type channel_type,
-                          bool channel_type_valid,
+                          bool channel_type_valid, unsigned int wait,
                           const u8 *buf, size_t len, u64 *cookie);
+        int     (*mgmt_tx_cancel_wait)(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       u64 cookie);
 
         int     (*set_power_mgmt)(struct wiphy *wiphy, struct net_device *dev,
                                   bool enabled, int timeout);
@@ -1184,6 +1474,22 @@ struct cfg80211_ops {
         int     (*set_cqm_rssi_config)(struct wiphy *wiphy,
                                        struct net_device *dev,
                                        s32 rssi_thold, u32 rssi_hyst);
+
+        void    (*mgmt_frame_register)(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       u16 frame_type, bool reg);
+
+        int     (*set_antenna)(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant);
+        int     (*get_antenna)(struct wiphy *wiphy, u32 *tx_ant, u32 *rx_ant);
+
+        int     (*set_ringparam)(struct wiphy *wiphy, u32 tx, u32 rx);
+        void    (*get_ringparam)(struct wiphy *wiphy,
+                                 u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max);
+
+        int     (*sched_scan_start)(struct wiphy *wiphy,
+                                struct net_device *dev,
+                                struct cfg80211_sched_scan_request *request);
+        int     (*sched_scan_stop)(struct wiphy *wiphy, struct net_device *dev);
 };
 
 /*
@@ -1201,19 +1507,24 @@ struct cfg80211_ops {
  *      initiator is %REGDOM_SET_BY_CORE).
  * @WIPHY_FLAG_STRICT_REGULATORY: tells us the driver for this device will
  *      ignore regulatory domain settings until it gets its own regulatory
- *      domain via its regulatory_hint(). After its gets its own regulatory
- *      domain it will only allow further regulatory domain settings to
- *      further enhance compliance. For example if channel 13 and 14 are
- *      disabled by this regulatory domain no user regulatory domain can
- *      enable these channels at a later time. This can be used for devices
- *      which do not have calibration information gauranteed for frequencies
- *      or settings outside of its regulatory domain.
+ *      domain via its regulatory_hint() unless the regulatory hint is
+ *      from a country IE. After its gets its own regulatory domain it will
+ *      only allow further regulatory domain settings to further enhance
+ *      compliance. For example if channel 13 and 14 are disabled by this
+ *      regulatory domain no user regulatory domain can enable these channels
+ *      at a later time. This can be used for devices which do not have
+ *      calibration information guaranteed for frequencies or settings
+ *      outside of its regulatory domain.
  * @WIPHY_FLAG_DISABLE_BEACON_HINTS: enable this if your driver needs to ensure
  *      that passive scan flags and beaconing flags may not be lifted by
  *      cfg80211 due to regulatory beacon hints. For more information on beacon
  *      hints read the documenation for regulatory_hint_found_beacon()
  * @WIPHY_FLAG_NETNS_OK: if not set, do not allow changing the netns of this
  *      wiphy at all
+ * @WIPHY_FLAG_ENFORCE_COMBINATIONS: Set this flag to enforce interface
+ *      combinations for this device. This flag is used for backward
+ *      compatibility only until all drivers advertise combinations and
+ *      they will always be enforced.
  * @WIPHY_FLAG_PS_ON_BY_DEFAULT: if set to true, powersave will be enabled
  *      by default -- this flag will be set depending on the kernel's default
  *      on wiphy_new(), but can be changed by the driver if it has a good
@@ -1221,24 +1532,148 @@ struct cfg80211_ops {
  * @WIPHY_FLAG_4ADDR_AP: supports 4addr mode even on AP (with a single station
  *      on a VLAN interface)
  * @WIPHY_FLAG_4ADDR_STATION: supports 4addr mode even as a station
+ * @WIPHY_FLAG_CONTROL_PORT_PROTOCOL: This device supports setting the
+ *      control port protocol ethertype. The device also honours the
+ *      control_port_no_encrypt flag.
+ * @WIPHY_FLAG_IBSS_RSN: The device supports IBSS RSN.
+ * @WIPHY_FLAG_MESH_AUTH: The device supports mesh authentication by routing
+ *      auth frames to userspace. See @NL80211_MESH_SETUP_USERSPACE_AUTH.
+ * @WIPHY_FLAG_SUPPORTS_SCHED_SCAN: The device supports scheduled scans.
  */
 enum wiphy_flags {
-        WIPHY_FLAG_CUSTOM_REGULATORY    = BIT(0),
-        WIPHY_FLAG_STRICT_REGULATORY    = BIT(1),
-        WIPHY_FLAG_DISABLE_BEACON_HINTS = BIT(2),
-        WIPHY_FLAG_NETNS_OK             = BIT(3),
-        WIPHY_FLAG_PS_ON_BY_DEFAULT     = BIT(4),
-        WIPHY_FLAG_4ADDR_AP             = BIT(5),
-        WIPHY_FLAG_4ADDR_STATION        = BIT(6),
+        WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
+        WIPHY_FLAG_STRICT_REGULATORY            = BIT(1),
+        WIPHY_FLAG_DISABLE_BEACON_HINTS         = BIT(2),
+        WIPHY_FLAG_NETNS_OK                     = BIT(3),
+        WIPHY_FLAG_PS_ON_BY_DEFAULT             = BIT(4),
+        WIPHY_FLAG_4ADDR_AP                     = BIT(5),
+        WIPHY_FLAG_4ADDR_STATION                = BIT(6),
+        WIPHY_FLAG_CONTROL_PORT_PROTOCOL        = BIT(7),
+        WIPHY_FLAG_IBSS_RSN                     = BIT(8),
+        WIPHY_FLAG_MESH_AUTH                    = BIT(10),
+        WIPHY_FLAG_SUPPORTS_SCHED_SCAN          = BIT(11),
+        WIPHY_FLAG_ENFORCE_COMBINATIONS         = BIT(12),
+};
+
+/**
+ * struct ieee80211_iface_limit - limit on certain interface types
+ * @max: maximum number of interfaces of these types
+ * @types: interface types (bits)
+ */
+struct ieee80211_iface_limit {
+        u16 max;
+        u16 types;
+};
+
+/**
+ * struct ieee80211_iface_combination - possible interface combination
+ * @limits: limits for the given interface types
+ * @n_limits: number of limitations
+ * @num_different_channels: can use up to this many different channels
+ * @max_interfaces: maximum number of interfaces in total allowed in this
+ *      group
+ * @beacon_int_infra_match: In this combination, the beacon intervals
+ *      between infrastructure and AP types must match. This is required
+ *      only in special cases.
+ *
+ * These examples can be expressed as follows:
+ *
+ * Allow #STA <= 1, #AP <= 1, matching BI, channels = 1, 2 total:
+ *
+ *  struct ieee80211_iface_limit limits1[] = {
+ *      { .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
+ *      { .max = 1, .types = BIT(NL80211_IFTYPE_AP}, },
+ *  };
+ *  struct ieee80211_iface_combination combination1 = {
+ *      .limits = limits1,
+ *      .n_limits = ARRAY_SIZE(limits1),
+ *      .max_interfaces = 2,
+ *      .beacon_int_infra_match = true,
+ *  };
+ *
+ *
+ * Allow #{AP, P2P-GO} <= 8, channels = 1, 8 total:
+ *
+ *  struct ieee80211_iface_limit limits2[] = {
+ *      { .max = 8, .types = BIT(NL80211_IFTYPE_AP) |
+ *                           BIT(NL80211_IFTYPE_P2P_GO), },
+ *  };
+ *  struct ieee80211_iface_combination combination2 = {
+ *      .limits = limits2,
+ *      .n_limits = ARRAY_SIZE(limits2),
+ *      .max_interfaces = 8,
+ *      .num_different_channels = 1,
+ *  };
+ *
+ *
+ * Allow #STA <= 1, #{P2P-client,P2P-GO} <= 3 on two channels, 4 total.
+ * This allows for an infrastructure connection and three P2P connections.
+ *
+ *  struct ieee80211_iface_limit limits3[] = {
+ *      { .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
+ *      { .max = 3, .types = BIT(NL80211_IFTYPE_P2P_GO) |
+ *                           BIT(NL80211_IFTYPE_P2P_CLIENT), },
+ *  };
+ *  struct ieee80211_iface_combination combination3 = {
+ *      .limits = limits3,
+ *      .n_limits = ARRAY_SIZE(limits3),
+ *      .max_interfaces = 4,
+ *      .num_different_channels = 2,
+ *  };
+ */
+struct ieee80211_iface_combination {
+        const struct ieee80211_iface_limit *limits;
+        u32 num_different_channels;
+        u16 max_interfaces;
+        u8 n_limits;
+        bool beacon_int_infra_match;
 };
 
 struct mac_address {
         u8 addr[ETH_ALEN];
 };
 
+struct ieee80211_txrx_stypes {
+        u16 tx, rx;
+};
+
+/**
+ * enum wiphy_wowlan_support_flags - WoWLAN support flags
+ * @WIPHY_WOWLAN_ANY: supports wakeup for the special "any"
+ *      trigger that keeps the device operating as-is and
+ *      wakes up the host on any activity, for example a
+ *      received packet that passed filtering; note that the
+ *      packet should be preserved in that case
+ * @WIPHY_WOWLAN_MAGIC_PKT: supports wakeup on magic packet
+ *      (see nl80211.h)
+ * @WIPHY_WOWLAN_DISCONNECT: supports wakeup on disconnect
+ */
+enum wiphy_wowlan_support_flags {
+        WIPHY_WOWLAN_ANY        = BIT(0),
+        WIPHY_WOWLAN_MAGIC_PKT  = BIT(1),
+        WIPHY_WOWLAN_DISCONNECT = BIT(2),
+};
+
+/**
+ * struct wiphy_wowlan_support - WoWLAN support data
+ * @flags: see &enum wiphy_wowlan_support_flags
+ * @n_patterns: number of supported wakeup patterns
+ *      (see nl80211.h for the pattern definition)
+ * @pattern_max_len: maximum length of each pattern
+ * @pattern_min_len: minimum length of each pattern
+ */
+struct wiphy_wowlan_support {
+        u32 flags;
+        int n_patterns;
+        int pattern_max_len;
+        int pattern_min_len;
+};
+
 /**
  * struct wiphy - wireless hardware description
- * @reg_notifier: the driver's regulatory notification callback
+ * @reg_notifier: the driver's regulatory notification callback,
+ *      note that if your driver uses wiphy_apply_custom_regulatory()
+ *      the reg_notifier's request can be passed as NULL
  * @regd: the driver's regulatory domain, if one was requested via
  *      the regulatory_hint() API. This can be used by the driver
  *      on the reg_notifier() if it chooses to ignore future
@@ -1271,6 +1706,11 @@ struct mac_address {
  * @priv: driver private data (sized according to wiphy_new() parameter)
  * @interface_modes: bitmask of interfaces types valid for this wiphy,
  *      must be set by driver
+ * @iface_combinations: Valid interface combinations array, should not
+ *      list single interface types.
+ * @n_iface_combinations: number of entries in @iface_combinations array.
+ * @software_iftypes: bitmask of software interface types, these are not
+ *      subject to any restrictions since they are purely managed in SW.
  * @flags: wiphy flags, see &enum wiphy_flags
  * @bss_priv_size: each BSS struct has private data allocated with it,
  *      this variable determines its size
@@ -1286,6 +1726,23 @@ struct mac_address {
  * @privid: a pointer that drivers can use to identify if an arbitrary
  *      wiphy is theirs, e.g. in global notifiers
  * @bands: information about bands/channels supported by this device
+ *
+ * @mgmt_stypes: bitmasks of frame subtypes that can be subscribed to or
+ *      transmitted through nl80211, points to an array indexed by interface
+ *      type
+ *
+ * @available_antennas_tx: bitmap of antennas which are available to be
+ *      configured as TX antennas. Antenna configuration commands will be
+ *      rejected unless this or @available_antennas_rx is set.
+ *
+ * @available_antennas_rx: bitmap of antennas which are available to be
+ *      configured as RX antennas. Antenna configuration commands will be
+ *      rejected unless this or @available_antennas_tx is set.
+ *
+ * @max_remain_on_channel_duration: Maximum time a remain-on-channel operation
+ *      may request, if implemented.
+ *
+ * @wowlan: WoWLAN support information
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -1294,9 +1751,16 @@ struct wiphy {
         u8 perm_addr[ETH_ALEN];
         u8 addr_mask[ETH_ALEN];
 
-        u16 n_addresses;
         struct mac_address *addresses;
 
+        const struct ieee80211_txrx_stypes *mgmt_stypes;
+
+        const struct ieee80211_iface_combination *iface_combinations;
+        int n_iface_combinations;
+        u16 software_iftypes;
+
+        u16 n_addresses;
+
         /* Supported interface modes, OR together BIT(NL80211_IFTYPE_...) */
         u16 interface_modes;
 
@@ -1320,8 +1784,15 @@ struct wiphy {
         char fw_version[ETHTOOL_BUSINFO_LEN];
         u32 hw_version;
 
+        struct wiphy_wowlan_support wowlan;
+
+        u16 max_remain_on_channel_duration;
+
         u8 max_num_pmkids;
 
+        u32 available_antennas_tx;
+        u32 available_antennas_rx;
+
         /* If multiple wiphys are registered and you're handed e.g.
          * a regular netdev with assigned ieee80211_ptr, you won't
          * know whether it points to a wiphy your driver has registered
@@ -1487,15 +1958,19 @@ struct cfg80211_cached_keys;
  * @bssid: (private) Used by the internal configuration code
  * @ssid: (private) Used by the internal configuration code
  * @ssid_len: (private) Used by the internal configuration code
+ * @mesh_id_len: (private) Used by the internal configuration code
+ * @mesh_id_up_len: (private) Used by the internal configuration code
  * @wext: (private) Used by the internal wireless extensions compat code
  * @use_4addr: indicates 4addr mode is used on this interface, must be
  *      set by driver (if supported) on add_interface BEFORE registering the
  *      netdev and may otherwise be used by driver read-only, will be update
  *      by cfg80211 on change_interface
- * @action_registrations: list of registrations for action frames
- * @action_registrations_lock: lock for the list
+ * @mgmt_registrations: list of registrations for management frames
+ * @mgmt_registrations_lock: lock for the list
  * @mtx: mutex used to lock data in this struct
  * @cleanup_work: work struct used for cleanup that can't be done directly
+ * @beacon_interval: beacon interval used on this device for transmitting
+ *      beacons, 0 when not valid
  */
 struct wireless_dev {
         struct wiphy *wiphy;
@@ -1505,8 +1980,8 @@ struct wireless_dev {
         struct list_head list;
         struct net_device *netdev;
 
-        struct list_head action_registrations;
-        spinlock_t action_registrations_lock;
+        struct list_head mgmt_registrations;
+        spinlock_t mgmt_registrations_lock;
 
         struct mutex mtx;
 
@@ -1516,7 +1991,7 @@ struct wireless_dev {
 
         /* currently used for IBSS and SME - might be rearranged later */
         u8 ssid[IEEE80211_MAX_SSID_LEN];
-        u8 ssid_len;
+        u8 ssid_len, mesh_id_len, mesh_id_up_len;
         enum {
                 CFG80211_SME_IDLE,
                 CFG80211_SME_CONNECTING,
@@ -1536,6 +2011,8 @@ struct wireless_dev {
         bool ps;
         int ps_timeout;
 
+        int beacon_interval;
+
 #ifdef CONFIG_CFG80211_WEXT
         /* wext data */
         struct {
@@ -1563,15 +2040,18 @@ static inline void *wdev_priv(struct wireless_dev *wdev)
         return wiphy_priv(wdev->wiphy);
 }
 
-/*
- * Utility functions
+/**
+ * DOC: Utility functions
+ *
+ * cfg80211 offers a number of utility functions that can be useful.
  */
 
 /**
  * ieee80211_channel_to_frequency - convert channel number to frequency
  * @chan: channel number
+ * @band: band, necessary due to channel number overlap
  */
-extern int ieee80211_channel_to_frequency(int chan);
+extern int ieee80211_channel_to_frequency(int chan, enum ieee80211_band band);
 
 /**
  * ieee80211_frequency_to_channel - convert frequency to channel number
@@ -1715,7 +2195,15 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
  * ieee80211_hdrlen - get header length in bytes from frame control
  * @fc: frame control field in little-endian format
  */
-unsigned int ieee80211_hdrlen(__le16 fc);
+unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc);
+
+/**
+ * DOC: Data path helpers
+ *
+ * In addition to generic utilities, cfg80211 also offers
+ * functions that help implement the data path for devices
+ * that do not do the 802.11/802.3 conversion on the device.
+ */
 
 /**
  * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3
@@ -1750,10 +2238,12 @@ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
  * @addr: The device MAC address.
  * @iftype: The device interface type.
  * @extra_headroom: The hardware extra headroom for SKBs in the @list.
+ * @has_80211_header: Set it true if SKB is with IEEE 802.11 header.
  */
 void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
                               const u8 *addr, enum nl80211_iftype iftype,
-                              const unsigned int extra_headroom);
+                              const unsigned int extra_headroom,
+                              bool has_80211_header);
 
 /**
  * cfg80211_classify8021d - determine the 802.1p/1d tag for a data frame
@@ -1777,8 +2267,10 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb);
  */
 const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len);
 
-/*
- * Regulatory helper functions for wiphys
+/**
+ * DOC: Regulatory enforcement infrastructure
+ *
+ * TODO
  */
 
 /**
@@ -1971,6 +2463,24 @@ int cfg80211_wext_siwpmksa(struct net_device *dev,
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted);
 
 /**
+ * cfg80211_sched_scan_results - notify that new scan results are available
+ *
+ * @wiphy: the wiphy which got scheduled scan results
+ */
+void cfg80211_sched_scan_results(struct wiphy *wiphy);
+
+/**
+ * cfg80211_sched_scan_stopped - notify that the scheduled scan has stopped
+ *
+ * @wiphy: the wiphy on which the scheduled scan stopped
+ *
+ * The driver can call this function to inform cfg80211 that the
+ * scheduled scan had to be stopped, for whatever reason.  The driver
+ * is then called back via the sched_scan_stop operation when done.
+ */
+void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
+
+/**
  * cfg80211_inform_bss_frame - inform cfg80211 of a received BSS frame
  *
  * @wiphy: the wiphy reporting the BSS
@@ -2148,11 +2658,37 @@ void __cfg80211_send_disassoc(struct net_device *dev, const u8 *buf,
         size_t len);
 
 /**
+ * cfg80211_send_unprot_deauth - notification of unprotected deauthentication
+ * @dev: network device
+ * @buf: deauthentication frame (header + body)
+ * @len: length of the frame data
+ *
+ * This function is called whenever a received Deauthentication frame has been
+ * dropped in station mode because of MFP being used but the Deauthentication
+ * frame was not protected. This function may sleep.
+ */
+void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
+                                 size_t len);
+
+/**
+ * cfg80211_send_unprot_disassoc - notification of unprotected disassociation
+ * @dev: network device
+ * @buf: disassociation frame (header + body)
+ * @len: length of the frame data
+ *
+ * This function is called whenever a received Disassociation frame has been
+ * dropped in station mode because of MFP being used but the Disassociation
+ * frame was not protected. This function may sleep.
+ */
+void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
+                                   size_t len);
+
+/**
  * cfg80211_michael_mic_failure - notification of Michael MIC failure (TKIP)
  * @dev: network device
  * @addr: The source MAC address of the frame
  * @key_type: The key type that the received frame used
- * @key_id: Key identifier (0..3)
+ * @key_id: Key identifier (0..3). Can be -1 if missing.
  * @tsc: The TSC value of the frame that generated the MIC failure (6 octets)
  * @gfp: allocation flags
  *
@@ -2181,6 +2717,36 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
 
 /**
+ * cfg80211_notify_new_candidate - notify cfg80211 of a new mesh peer candidate
+ *
+ * @dev: network device
+ * @macaddr: the MAC address of the new candidate
+ * @ie: information elements advertised by the peer candidate
+ * @ie_len: lenght of the information elements buffer
+ * @gfp: allocation flags
+ *
+ * This function notifies cfg80211 that the mesh peer candidate has been
+ * detected, most likely via a beacon or, less likely, via a probe response.
+ * cfg80211 then sends a notification to userspace.
+ */
+void cfg80211_notify_new_peer_candidate(struct net_device *dev,
+                const u8 *macaddr, const u8 *ie, u8 ie_len, gfp_t gfp);
+
+/**
+ * DOC: RFkill integration
+ *
+ * RFkill integration in cfg80211 is almost invisible to drivers,
+ * as cfg80211 automatically registers an rfkill instance for each
+ * wireless device it knows about. Soft kill is also translated
+ * into disconnecting and turning all interfaces off, drivers are
+ * expected to turn off the device when all interfaces are down.
+ *
+ * However, devices may have a hard RFkill line, in which case they
+ * also need to interact with the rfkill subsystem, via cfg80211.
+ * They can do this with a few helper functions documented here.
+ */
+
+/**
  * wiphy_rfkill_set_hw_state - notify cfg80211 about hw block state
  * @wiphy: the wiphy
  * @blocked: block status
@@ -2201,6 +2767,17 @@ void wiphy_rfkill_stop_polling(struct wiphy *wiphy);
 
 #ifdef CONFIG_NL80211_TESTMODE
 /**
+ * DOC: Test mode
+ *
+ * Test mode is a set of utility functions to allow drivers to
+ * interact with driver-specific tools to aid, for instance,
+ * factory programming.
+ *
+ * This chapter describes how drivers interact with it, for more
+ * information see the nl80211 book's chapter on it.
+ */
+
+/**
  * cfg80211_testmode_alloc_reply_skb - allocate testmode reply
  * @wiphy: the wiphy
  * @approxlen: an upper bound of the length of the data that will
@@ -2302,6 +2879,7 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
  * cfg80211_roamed - notify cfg80211 of roaming
  *
  * @dev: network device
+ * @channel: the channel of the new AP
  * @bssid: the BSSID of the new AP
  * @req_ie: association request IEs (maybe be %NULL)
  * @req_ie_len: association request IEs length
@@ -2312,7 +2890,9 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
  * It should be called by the underlying driver whenever it roamed
  * from one AP to another while connected.
  */
-void cfg80211_roamed(struct net_device *dev, const u8 *bssid,
+void cfg80211_roamed(struct net_device *dev,
+                     struct ieee80211_channel *channel,
+                     const u8 *bssid,
                      const u8 *req_ie, size_t req_ie_len,
                      const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp);
 
@@ -2373,38 +2953,48 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
                       struct station_info *sinfo, gfp_t gfp);
 
 /**
- * cfg80211_rx_action - notification of received, unprocessed Action frame
+ * cfg80211_del_sta - notify userspace about deletion of a station
+ *
+ * @dev: the netdev
+ * @mac_addr: the station's address
+ * @gfp: allocation flags
+ */
+void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
+
+/**
+ * cfg80211_rx_mgmt - notification of received, unprocessed management frame
  * @dev: network device
  * @freq: Frequency on which the frame was received in MHz
- * @buf: Action frame (header + body)
+ * @buf: Management frame (header + body)
  * @len: length of the frame data
  * @gfp: context flags
- * Returns %true if a user space application is responsible for rejecting the
- *      unrecognized Action frame; %false if no such application is registered
- *      (i.e., the driver is responsible for rejecting the unrecognized Action
- *      frame)
+ *
+ * Returns %true if a user space application has registered for this frame.
+ * For action frames, that makes it responsible for rejecting unrecognized
+ * action frames; %false otherwise, in which case for action frames the
+ * driver is responsible for rejecting the frame.
  *
  * This function is called whenever an Action frame is received for a station
  * mode interface, but is not processed in kernel.
  */
-bool cfg80211_rx_action(struct net_device *dev, int freq, const u8 *buf,
-                        size_t len, gfp_t gfp);
+bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
+                      size_t len, gfp_t gfp);
 
 /**
- * cfg80211_action_tx_status - notification of TX status for Action frame
+ * cfg80211_mgmt_tx_status - notification of TX status for management frame
  * @dev: network device
- * @cookie: Cookie returned by cfg80211_ops::action()
- * @buf: Action frame (header + body)
+ * @cookie: Cookie returned by cfg80211_ops::mgmt_tx()
+ * @buf: Management frame (header + body)
  * @len: length of the frame data
  * @ack: Whether frame was acknowledged
  * @gfp: context flags
  *
- * This function is called whenever an Action frame was requested to be
- * transmitted with cfg80211_ops::action() to report the TX status of the
+ * This function is called whenever a management frame was requested to be
+ * transmitted with cfg80211_ops::mgmt_tx() to report the TX status of the
  * transmission attempt.
  */
-void cfg80211_action_tx_status(struct net_device *dev, u64 cookie,
-                               const u8 *buf, size_t len, bool ack, gfp_t gfp);
+void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
+                             const u8 *buf, size_t len, bool ack, gfp_t gfp);
 
 
 /**
@@ -2420,56 +3010,53 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
                               enum nl80211_cqm_rssi_threshold_event rssi_event,
                               gfp_t gfp);
 
-#ifdef __KERNEL__
+/**
+ * cfg80211_cqm_pktloss_notify - notify userspace about packetloss to peer
+ * @dev: network device
+ * @peer: peer's MAC address
+ * @num_packets: how many packets were lost -- should be a fixed threshold
+ *      but probably no less than maybe 50, or maybe a throughput dependent
+ *      threshold (to account for temporary interference)
+ * @gfp: context flags
+ */
+void cfg80211_cqm_pktloss_notify(struct net_device *dev,
+                                 const u8 *peer, u32 num_packets, gfp_t gfp);
 
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
 
 #define wiphy_printk(level, wiphy, format, args...)             \
-        printk(level "%s: " format, wiphy_name(wiphy), ##args)
+        dev_printk(level, &(wiphy)->dev, format, ##args)
 #define wiphy_emerg(wiphy, format, args...)                     \
-        wiphy_printk(KERN_EMERG, wiphy, format, ##args)
+        dev_emerg(&(wiphy)->dev, format, ##args)
 #define wiphy_alert(wiphy, format, args...)                     \
-        wiphy_printk(KERN_ALERT, wiphy, format, ##args)
+        dev_alert(&(wiphy)->dev, format, ##args)
 #define wiphy_crit(wiphy, format, args...)                      \
-        wiphy_printk(KERN_CRIT, wiphy, format, ##args)
+        dev_crit(&(wiphy)->dev, format, ##args)
 #define wiphy_err(wiphy, format, args...)                       \
-        wiphy_printk(KERN_ERR, wiphy, format, ##args)
+        dev_err(&(wiphy)->dev, format, ##args)
 #define wiphy_warn(wiphy, format, args...)                      \
-        wiphy_printk(KERN_WARNING, wiphy, format, ##args)
+        dev_warn(&(wiphy)->dev, format, ##args)
 #define wiphy_notice(wiphy, format, args...)                    \
-        wiphy_printk(KERN_NOTICE, wiphy, format, ##args)
+        dev_notice(&(wiphy)->dev, format, ##args)
 #define wiphy_info(wiphy, format, args...)                      \
-        wiphy_printk(KERN_INFO, wiphy, format, ##args)
-
-int wiphy_debug(const struct wiphy *wiphy, const char *format, ...)
-        __attribute__ ((format (printf, 2, 3)));
+        dev_info(&(wiphy)->dev, format, ##args)
 
-#if defined(DEBUG)
-#define wiphy_dbg(wiphy, format, args...)                       \
+#define wiphy_debug(wiphy, format, args...)                     \
         wiphy_printk(KERN_DEBUG, wiphy, format, ##args)
-#elif defined(CONFIG_DYNAMIC_DEBUG)
+
 #define wiphy_dbg(wiphy, format, args...)                       \
-        dynamic_pr_debug("%s: " format, wiphy_name(wiphy), ##args)
-#else
-#define wiphy_dbg(wiphy, format, args...)                               \
-({                                                                      \
-        if (0)                                                          \
-                wiphy_printk(KERN_DEBUG, wiphy, format, ##args);        \
-        0;                                                              \
-})
-#endif
+        dev_dbg(&(wiphy)->dev, format, ##args)
 
 #if defined(VERBOSE_DEBUG)
 #define wiphy_vdbg      wiphy_dbg
 #else
-
 #define wiphy_vdbg(wiphy, format, args...)                              \
 ({                                                                      \
         if (0)                                                          \
                 wiphy_printk(KERN_DEBUG, wiphy, format, ##args);        \
-                0;                                                      \
+        0;                                                              \
 })
 #endif
 
@@ -2481,6 +3068,4 @@ int wiphy_debug(const struct wiphy *wiphy, const char *format, ...)
 #define wiphy_WARN(wiphy, format, args...)                      \
         WARN(1, "wiphy: %s\n" format, wiphy_name(wiphy), ##args);
 
-#endif
-
 #endif /* __NET_CFG80211_H */
diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
index ef6c24a529e1..a4dc5b027bd9 100644
--- a/include/net/cls_cgroup.h
+++ b/include/net/cls_cgroup.h
@@ -51,7 +51,8 @@ static inline u32 task_cls_classid(struct task_struct *p)
                 return 0;
 
         rcu_read_lock();
-        id = rcu_dereference(net_cls_subsys_id);
+        id = rcu_dereference_index_check(net_cls_subsys_id,
+                                         rcu_read_lock_held());
         if (id >= 0)
                 classid = container_of(task_subsys_state(p, id),
                                        struct cgroup_cls_state, css)->classid;
diff --git a/include/net/compat.h b/include/net/compat.h
index 28d5428ec6a2..9ee75edcc295 100644
--- a/include/net/compat.h
+++ b/include/net/compat.h
@@ -43,6 +43,8 @@ extern int compat_sock_get_timestampns(struct sock *, struct timespec __user *);
 extern int get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *);
 extern int verify_compat_iovec(struct msghdr *, struct iovec *, struct sockaddr *, int);
 extern asmlinkage long compat_sys_sendmsg(int,struct compat_msghdr __user *,unsigned);
+extern asmlinkage long compat_sys_sendmmsg(int, struct compat_mmsghdr __user *,
+                                           unsigned, unsigned);
 extern asmlinkage long compat_sys_recvmsg(int,struct compat_msghdr __user *,unsigned);
 extern asmlinkage long compat_sys_recvmmsg(int, struct compat_mmsghdr __user *,
                                            unsigned, unsigned,
diff --git a/include/net/dcbevent.h b/include/net/dcbevent.h
new file mode 100644
index 000000000000..bc1e7ef40171
--- /dev/null
+++ b/include/net/dcbevent.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2010, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * Author: John Fastabend <john.r.fastabend@intel.com>
+ */
+
+#ifndef _DCB_EVENT_H
+#define _DCB_EVENT_H
+
+enum dcbevent_notif_type {
+        DCB_APP_EVENT = 1,
+};
+
+extern int register_dcbevent_notifier(struct notifier_block *nb);
+extern int unregister_dcbevent_notifier(struct notifier_block *nb);
+extern int call_dcbevent_notifiers(unsigned long val, void *v);
+
+#endif
diff --git a/include/net/dcbnl.h b/include/net/dcbnl.h
index b36ac7e0914d..e5983c9053dc 100644
--- a/include/net/dcbnl.h
+++ b/include/net/dcbnl.h
@@ -20,11 +20,33 @@
 #ifndef __NET_DCBNL_H__
 #define __NET_DCBNL_H__
 
+#include <linux/dcbnl.h>
+
+struct dcb_app_type {
+        char              name[IFNAMSIZ];
+        struct dcb_app    app;
+        struct list_head  list;
+};
+
+u8 dcb_setapp(struct net_device *, struct dcb_app *);
+u8 dcb_getapp(struct net_device *, struct dcb_app *);
+
 /*
  * Ops struct for the netlink callbacks.  Used by DCB-enabled drivers through
  * the netdevice struct.
  */
 struct dcbnl_rtnl_ops {
+        /* IEEE 802.1Qaz std */
+        int (*ieee_getets) (struct net_device *, struct ieee_ets *);
+        int (*ieee_setets) (struct net_device *, struct ieee_ets *);
+        int (*ieee_getpfc) (struct net_device *, struct ieee_pfc *);
+        int (*ieee_setpfc) (struct net_device *, struct ieee_pfc *);
+        int (*ieee_getapp) (struct net_device *, struct dcb_app *);
+        int (*ieee_setapp) (struct net_device *, struct dcb_app *);
+        int (*ieee_peer_getets) (struct net_device *, struct ieee_ets *);
+        int (*ieee_peer_getpfc) (struct net_device *, struct ieee_pfc *);
+
+        /* CEE std */
         u8   (*getstate)(struct net_device *);
         u8   (*setstate)(struct net_device *, u8);
         void (*getpermhwaddr)(struct net_device *, u8 *);
@@ -50,6 +72,21 @@ struct dcbnl_rtnl_ops {
         void (*setbcnrp)(struct net_device *, int, u8);
         u8   (*setapp)(struct net_device *, u8, u16, u8);
         u8   (*getapp)(struct net_device *, u8, u16);
+        u8   (*getfeatcfg)(struct net_device *, int, u8 *);
+        u8   (*setfeatcfg)(struct net_device *, int, u8);
+
+        /* DCBX configuration */
+        u8   (*getdcbx)(struct net_device *);
+        u8   (*setdcbx)(struct net_device *, u8);
+
+        /* peer apps */
+        int (*peer_getappinfo)(struct net_device *, struct dcb_peer_app_info *,
+                               u16 *);
+        int (*peer_getapptable)(struct net_device *, struct dcb_app *);
+
+        /* CEE peer */
+        int (*cee_peer_getpg) (struct net_device *, struct cee_pg *);
+        int (*cee_peer_getpfc) (struct net_device *, struct cee_pfc *);
 };
 
 #endif /* __NET_DCBNL_H__ */
diff --git a/include/net/dn.h b/include/net/dn.h
index e5469f7b67a3..298521e0d8a2 100644
--- a/include/net/dn.h
+++ b/include/net/dn.h
@@ -192,10 +192,10 @@ static inline void dn_dn2eth(unsigned char *ethaddr, __le16 addr)
         ethaddr[5] = (__u8)(a >> 8);
 }
 
-static inline void dn_sk_ports_copy(struct flowi *fl, struct dn_scp *scp)
+static inline void dn_sk_ports_copy(struct flowidn *fld, struct dn_scp *scp)
 {
-        fl->uli_u.dnports.sport = scp->addrloc;
-        fl->uli_u.dnports.dport = scp->addrrem;
+        fld->fld_sport = scp->addrloc;
+        fld->fld_dport = scp->addrrem;
 }
 
 extern unsigned dn_mss_from_pmtu(struct net_device *dev, int mtu);
@@ -225,7 +225,7 @@ extern int decnet_di_count;
 extern int decnet_dr_count;
 extern int decnet_no_fc_max_cwnd;
 
-extern int sysctl_decnet_mem[3];
+extern long sysctl_decnet_mem[3];
 extern int sysctl_decnet_wmem[3];
 extern int sysctl_decnet_rmem[3];
 
diff --git a/include/net/dn_dev.h b/include/net/dn_dev.h
index 0916bbf3bdff..b9e32db03f20 100644
--- a/include/net/dn_dev.h
+++ b/include/net/dn_dev.h
@@ -5,13 +5,14 @@
 struct dn_dev;
 
 struct dn_ifaddr {
-        struct dn_ifaddr *ifa_next;
+        struct dn_ifaddr __rcu *ifa_next;
         struct dn_dev    *ifa_dev;
         __le16            ifa_local;
         __le16            ifa_address;
         __u8              ifa_flags;
         __u8              ifa_scope;
         char              ifa_label[IFNAMSIZ];
+        struct rcu_head   rcu;
 };
 
 #define DN_DEV_S_RU  0 /* Run - working normally   */
@@ -83,7 +84,7 @@ struct dn_dev_parms {
 
 
 struct dn_dev {
-        struct dn_ifaddr *ifa_list;
+        struct dn_ifaddr __rcu *ifa_list;
         struct net_device *dev;
         struct dn_dev_parms parms;
         char use_long;
@@ -171,19 +172,27 @@ extern int unregister_dnaddr_notifier(struct notifier_block *nb);
 
 static inline int dn_dev_islocal(struct net_device *dev, __le16 addr)
 {
-        struct dn_dev *dn_db = dev->dn_ptr;
+        struct dn_dev *dn_db;
         struct dn_ifaddr *ifa;
+        int res = 0;
 
+        rcu_read_lock();
+        dn_db = rcu_dereference(dev->dn_ptr);
         if (dn_db == NULL) {
                 printk(KERN_DEBUG "dn_dev_islocal: Called for non DECnet device\n");
-                return 0;
+                goto out;
         }
 
-        for(ifa = dn_db->ifa_list; ifa; ifa = ifa->ifa_next)
-                if ((addr ^ ifa->ifa_local) == 0)
-                        return 1;
-
-        return 0;
+        for (ifa = rcu_dereference(dn_db->ifa_list);
+             ifa != NULL;
+             ifa = rcu_dereference(ifa->ifa_next))
+                if ((addr ^ ifa->ifa_local) == 0) {
+                        res = 1;
+                        break;
+                }
+out:
+        rcu_read_unlock();
+        return res;
 }
 
 #endif /* _NET_DN_DEV_H */
diff --git a/include/net/dn_fib.h b/include/net/dn_fib.h
index bbcde3238e58..782ef7cb4930 100644
--- a/include/net/dn_fib.h
+++ b/include/net/dn_fib.h
@@ -98,7 +98,7 @@ struct dn_fib_table {
         int (*delete)(struct dn_fib_table *t, struct rtmsg *r,
                         struct dn_kern_rta *rta, struct nlmsghdr *n,
                         struct netlink_skb_parms *req);
-        int (*lookup)(struct dn_fib_table *t, const struct flowi *fl,
+        int (*lookup)(struct dn_fib_table *t, const struct flowidn *fld,
                         struct dn_fib_res *res);
         int (*flush)(struct dn_fib_table *t);
         int (*dump)(struct dn_fib_table *t, struct sk_buff *skb, struct netlink_callback *cb);
@@ -119,12 +119,12 @@ extern struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r,
                                 struct dn_kern_rta *rta, 
                                 const struct nlmsghdr *nlh, int *errp);
 extern int dn_fib_semantic_match(int type, struct dn_fib_info *fi, 
-                        const struct flowi *fl,
+                        const struct flowidn *fld,
                         struct dn_fib_res *res);
 extern void dn_fib_release_info(struct dn_fib_info *fi);
 extern __le16 dn_fib_get_attr16(struct rtattr *attr, int attrlen, int type);
 extern void dn_fib_flush(void);
-extern void dn_fib_select_multipath(const struct flowi *fl,
+extern void dn_fib_select_multipath(const struct flowidn *fld,
                                         struct dn_fib_res *res);
 
 /*
@@ -141,7 +141,7 @@ extern void dn_fib_table_cleanup(void);
 extern void dn_fib_rules_init(void);
 extern void dn_fib_rules_cleanup(void);
 extern unsigned dnet_addr_type(__le16 addr);
-extern int dn_fib_lookup(struct flowi *fl, struct dn_fib_res *res);
+extern int dn_fib_lookup(struct flowidn *fld, struct dn_fib_res *res);
 
 extern int dn_fib_dump(struct sk_buff *skb, struct netlink_callback *cb);
 
diff --git a/include/net/dn_route.h b/include/net/dn_route.h
index ccadab3aa3f6..81712cfa1ddf 100644
--- a/include/net/dn_route.h
+++ b/include/net/dn_route.h
@@ -16,7 +16,7 @@
 *******************************************************************************/
 
 extern struct sk_buff *dn_alloc_skb(struct sock *sk, int size, gfp_t pri);
-extern int dn_route_output_sock(struct dst_entry **pprt, struct flowi *, struct sock *sk, int flags);
+extern int dn_route_output_sock(struct dst_entry **pprt, struct flowidn *, struct sock *sk, int flags);
 extern int dn_cache_dump(struct sk_buff *skb, struct netlink_callback *cb);
 extern void dn_rt_cache_flush(int delay);
 
@@ -67,7 +67,7 @@ extern void dn_rt_cache_flush(int delay);
 struct dn_route {
         struct dst_entry dst;
 
-        struct flowi fl;
+        struct flowidn fld;
 
         __le16 rt_saddr;
         __le16 rt_daddr;
@@ -80,6 +80,16 @@ struct dn_route {
         unsigned rt_type;
 };
 
+static inline bool dn_is_input_route(struct dn_route *rt)
+{
+        return rt->fld.flowidn_iif != 0;
+}
+
+static inline bool dn_is_output_route(struct dn_route *rt)
+{
+        return rt->fld.flowidn_iif == 0;
+}
+
 extern void dn_route_init(void);
 extern void dn_route_cleanup(void);
 
diff --git a/include/net/dst.h b/include/net/dst.h
index 02386505033d..e12ddfb9eb16 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -16,13 +16,6 @@
 #include <net/neighbour.h>
 #include <asm/processor.h>
 
-/*
- * 0 - no debugging messages
- * 1 - rare events and bugs (default)
- * 2 - trace mode.
- */
-#define RT_CACHE_DEBUG          0
-
 #define DST_GC_MIN      (HZ/10)
 #define DST_GC_INC      (HZ/2)
 #define DST_GC_MAX      (120*HZ)
@@ -40,23 +33,10 @@ struct dst_entry {
         struct rcu_head         rcu_head;
         struct dst_entry        *child;
         struct net_device       *dev;
-        short                   error;
-        short                   obsolete;
-        int                     flags;
-#define DST_HOST                1
-#define DST_NOXFRM              2
-#define DST_NOPOLICY            4
-#define DST_NOHASH              8
+        struct  dst_ops         *ops;
+        unsigned long           _metrics;
         unsigned long           expires;
-
-        unsigned short          header_len;     /* more space at head required */
-        unsigned short          trailer_len;    /* space to reserve at tail */
-
-        unsigned int            rate_tokens;
-        unsigned long           rate_last;      /* rate limiting for ICMP */
-
         struct dst_entry        *path;
-
         struct neighbour        *neighbour;
         struct hh_cache         *hh;
 #ifdef CONFIG_XFRM
@@ -67,17 +47,16 @@ struct dst_entry {
         int                     (*input)(struct sk_buff*);
         int                     (*output)(struct sk_buff*);
 
-        struct  dst_ops         *ops;
-
-        u32                     metrics[RTAX_MAX];
-
-#ifdef CONFIG_NET_CLS_ROUTE
+        short                   error;
+        short                   obsolete;
+        unsigned short          header_len;     /* more space at head required */
+        unsigned short          trailer_len;    /* space to reserve at tail */
+#ifdef CONFIG_IP_ROUTE_CLASSID
         __u32                   tclassid;
 #else
         __u32                   __pad2;
 #endif
 
-
         /*
          * Align __refcnt to a 64 bytes alignment
          * (L1_CACHE_SIZE would be too much)
@@ -92,20 +71,115 @@ struct dst_entry {
         atomic_t                __refcnt;       /* client references    */
         int                     __use;
         unsigned long           lastuse;
+        int                     flags;
+#define DST_HOST                0x0001
+#define DST_NOXFRM              0x0002
+#define DST_NOPOLICY            0x0004
+#define DST_NOHASH              0x0008
+#define DST_NOCACHE             0x0010
+#define DST_NOCOUNT             0x0020
         union {
-                struct dst_entry *next;
-                struct rtable    *rt_next;
-                struct rt6_info   *rt6_next;
-                struct dn_route  *dn_next;
+                struct dst_entry        *next;
+                struct rtable __rcu     *rt_next;
+                struct rt6_info         *rt6_next;
+                struct dn_route __rcu   *dn_next;
         };
 };
 
-#ifdef __KERNEL__
+extern u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
+extern const u32 dst_default_metrics[RTAX_MAX];
+
+#define DST_METRICS_READ_ONLY   0x1UL
+#define __DST_METRICS_PTR(Y)    \
+        ((u32 *)((Y) & ~DST_METRICS_READ_ONLY))
+#define DST_METRICS_PTR(X)      __DST_METRICS_PTR((X)->_metrics)
+
+static inline bool dst_metrics_read_only(const struct dst_entry *dst)
+{
+        return dst->_metrics & DST_METRICS_READ_ONLY;
+}
+
+extern void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old);
+
+static inline void dst_destroy_metrics_generic(struct dst_entry *dst)
+{
+        unsigned long val = dst->_metrics;
+        if (!(val & DST_METRICS_READ_ONLY))
+                __dst_destroy_metrics_generic(dst, val);
+}
+
+static inline u32 *dst_metrics_write_ptr(struct dst_entry *dst)
+{
+        unsigned long p = dst->_metrics;
+
+        BUG_ON(!p);
+
+        if (p & DST_METRICS_READ_ONLY)
+                return dst->ops->cow_metrics(dst, p);
+        return __DST_METRICS_PTR(p);
+}
+
+/* This may only be invoked before the entry has reached global
+ * visibility.
+ */
+static inline void dst_init_metrics(struct dst_entry *dst,
+                                    const u32 *src_metrics,
+                                    bool read_only)
+{
+        dst->_metrics = ((unsigned long) src_metrics) |
+                (read_only ? DST_METRICS_READ_ONLY : 0);
+}
+
+static inline void dst_copy_metrics(struct dst_entry *dest, const struct dst_entry *src)
+{
+        u32 *dst_metrics = dst_metrics_write_ptr(dest);
+
+        if (dst_metrics) {
+                u32 *src_metrics = DST_METRICS_PTR(src);
+
+                memcpy(dst_metrics, src_metrics, RTAX_MAX * sizeof(u32));
+        }
+}
+
+static inline u32 *dst_metrics_ptr(struct dst_entry *dst)
+{
+        return DST_METRICS_PTR(dst);
+}
+
+static inline u32
+dst_metric_raw(const struct dst_entry *dst, const int metric)
+{
+        u32 *p = DST_METRICS_PTR(dst);
+
+        return p[metric-1];
+}
+
+static inline u32
+dst_metric(const struct dst_entry *dst, const int metric)
+{
+        WARN_ON_ONCE(metric == RTAX_HOPLIMIT ||
+                     metric == RTAX_ADVMSS ||
+                     metric == RTAX_MTU);
+        return dst_metric_raw(dst, metric);
+}
 
 static inline u32
-dst_metric(const struct dst_entry *dst, int metric)
+dst_metric_advmss(const struct dst_entry *dst)
 {
-        return dst->metrics[metric-1];
+        u32 advmss = dst_metric_raw(dst, RTAX_ADVMSS);
+
+        if (!advmss)
+                advmss = dst->ops->default_advmss(dst);
+
+        return advmss;
+}
+
+static inline void dst_metric_set(struct dst_entry *dst, int metric, u32 val)
+{
+        u32 *p = dst_metrics_write_ptr(dst);
+
+        if (p)
+                p[metric-1] = val;
 }
 
 static inline u32
@@ -116,11 +190,11 @@ dst_feature(const struct dst_entry *dst, u32 feature)
 
 static inline u32 dst_mtu(const struct dst_entry *dst)
 {
-        u32 mtu = dst_metric(dst, RTAX_MTU);
-        /*
-         * Alexey put it here, so ask him about it :)
-         */
-        barrier();
+        u32 mtu = dst_metric_raw(dst, RTAX_MTU);
+
+        if (!mtu)
+                mtu = dst->ops->default_mtu(dst);
+
         return mtu;
 }
 
@@ -133,20 +207,18 @@ static inline unsigned long dst_metric_rtt(const struct dst_entry *dst, int metr
 static inline void set_dst_metric_rtt(struct dst_entry *dst, int metric,
                                       unsigned long rtt)
 {
-        dst->metrics[metric-1] = jiffies_to_msecs(rtt);
+        dst_metric_set(dst, metric, jiffies_to_msecs(rtt));
 }
 
 static inline u32
 dst_allfrag(const struct dst_entry *dst)
 {
         int ret = dst_feature(dst,  RTAX_FEATURE_ALLFRAG);
-        /* Yes, _exactly_. This is paranoia. */
-        barrier();
         return ret;
 }
 
 static inline int
-dst_metric_locked(struct dst_entry *dst, int metric)
+dst_metric_locked(const struct dst_entry *dst, int metric)
 {
         return dst_metric(dst, RTAX_LOCK) & (1<<metric);
 }
@@ -228,23 +300,37 @@ static inline void skb_dst_force(struct sk_buff *skb)
 
 
 /**
+ *      __skb_tunnel_rx - prepare skb for rx reinsert
+ *      @skb: buffer
+ *      @dev: tunnel device
+ *
+ *      After decapsulation, packet is going to re-enter (netif_rx()) our stack,
+ *      so make some cleanups. (no accounting done)
+ */
+static inline void __skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
+{
+        skb->dev = dev;
+        skb->rxhash = 0;
+        skb_set_queue_mapping(skb, 0);
+        skb_dst_drop(skb);
+        nf_reset(skb);
+}
+
+/**
  *      skb_tunnel_rx - prepare skb for rx reinsert
  *      @skb: buffer
  *      @dev: tunnel device
  *
  *      After decapsulation, packet is going to re-enter (netif_rx()) our stack,
  *      so make some cleanups, and perform accounting.
+ *      Note: this accounting is not SMP safe.
  */
 static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
 {
-        skb->dev = dev;
         /* TODO : stats should be SMP safe */
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += skb->len;
-        skb->rxhash = 0;
-        skb_set_queue_mapping(skb, 0);
-        skb_dst_drop(skb);
-        nf_reset(skb);
+        __skb_tunnel_rx(skb, dev);
 }
 
 /* Children define the path of the packet through the
@@ -253,14 +339,15 @@ static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
 
 static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
 {
-        struct dst_entry *child = skb_dst(skb)->child;
+        struct dst_entry *child = dst_clone(skb_dst(skb)->child);
 
         skb_dst_drop(skb);
         return child;
 }
 
 extern int dst_discard(struct sk_buff *skb);
-extern void * dst_alloc(struct dst_ops * ops);
+extern void *dst_alloc(struct dst_ops * ops, struct net_device *dev,
+                       int initial_ref, int initial_obsolete, int flags);
 extern void __dst_free(struct dst_entry * dst);
 extern struct dst_entry *dst_destroy(struct dst_entry * dst);
 
@@ -329,28 +416,22 @@ extern void		dst_init(void);
 
 /* Flags for xfrm_lookup flags argument. */
 enum {
-        XFRM_LOOKUP_WAIT = 1 << 0,
-        XFRM_LOOKUP_ICMP = 1 << 1,
+        XFRM_LOOKUP_ICMP = 1 << 0,
 };
 
 struct flowi;
 #ifndef CONFIG_XFRM
-static inline int xfrm_lookup(struct net *net, struct dst_entry **dst_p,
-                              struct flowi *fl, struct sock *sk, int flags)
+static inline struct dst_entry *xfrm_lookup(struct net *net,
+                                            struct dst_entry *dst_orig,
+                                            const struct flowi *fl, struct sock *sk,
+                                            int flags)
 {
-        return 0;
+        return dst_orig;
 } 
-static inline int __xfrm_lookup(struct net *net, struct dst_entry **dst_p,
-                                struct flowi *fl, struct sock *sk, int flags)
-{
-        return 0;
-}
 #else
-extern int xfrm_lookup(struct net *net, struct dst_entry **dst_p,
-                       struct flowi *fl, struct sock *sk, int flags);
-extern int __xfrm_lookup(struct net *net, struct dst_entry **dst_p,
-                         struct flowi *fl, struct sock *sk, int flags);
-#endif
+extern struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
+                                     const struct flowi *fl, struct sock *sk,
+                                     int flags);
 #endif
 
 #endif /* _NET_DST_H */
diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
index d1ff9b7e99b8..dc0746328947 100644
--- a/include/net/dst_ops.h
+++ b/include/net/dst_ops.h
@@ -1,6 +1,8 @@
 #ifndef _NET_DST_OPS_H
 #define _NET_DST_OPS_H
 #include <linux/types.h>
+#include <linux/percpu_counter.h>
+#include <linux/cache.h>
 
 struct dst_entry;
 struct kmem_cachep;
@@ -14,6 +16,9 @@ struct dst_ops {
 
         int                     (*gc)(struct dst_ops *ops);
         struct dst_entry *      (*check)(struct dst_entry *, __u32 cookie);
+        unsigned int            (*default_advmss)(const struct dst_entry *);
+        unsigned int            (*default_mtu)(const struct dst_entry *);
+        u32 *                   (*cow_metrics)(struct dst_entry *, unsigned long);
         void                    (*destroy)(struct dst_entry *);
         void                    (*ifdown)(struct dst_entry *,
                                           struct net_device *dev, int how);
@@ -22,7 +27,41 @@ struct dst_ops {
         void                    (*update_pmtu)(struct dst_entry *dst, u32 mtu);
         int                     (*local_out)(struct sk_buff *skb);
 
-        atomic_t                entries;
         struct kmem_cache       *kmem_cachep;
+
+        struct percpu_counter   pcpuc_entries ____cacheline_aligned_in_smp;
 };
+
+static inline int dst_entries_get_fast(struct dst_ops *dst)
+{
+        return percpu_counter_read_positive(&dst->pcpuc_entries);
+}
+
+static inline int dst_entries_get_slow(struct dst_ops *dst)
+{
+        int res;
+
+        local_bh_disable();
+        res = percpu_counter_sum_positive(&dst->pcpuc_entries);
+        local_bh_enable();
+        return res;
+}
+
+static inline void dst_entries_add(struct dst_ops *dst, int val)
+{
+        local_bh_disable();
+        percpu_counter_add(&dst->pcpuc_entries, val);
+        local_bh_enable();
+}
+
+static inline int dst_entries_init(struct dst_ops *dst)
+{
+        return percpu_counter_init(&dst->pcpuc_entries, 0);
+}
+
+static inline void dst_entries_destroy(struct dst_ops *dst)
+{
+        percpu_counter_destroy(&dst->pcpuc_entries);
+}
+
 #endif
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index e8923bc20f9f..075f1e3a0fed 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -20,7 +20,7 @@ struct fib_rule {
         u32                     table;
         u8                      action;
         u32                     target;
-        struct fib_rule *       ctarget;
+        struct fib_rule __rcu   *ctarget;
         char                    iifname[IFNAMSIZ];
         char                    oifname[IFNAMSIZ];
         struct rcu_head         rcu;
@@ -31,6 +31,8 @@ struct fib_lookup_arg {
         void                    *lookup_ptr;
         void                    *result;
         struct fib_rule         *rule;
+        int                     flags;
+#define FIB_LOOKUP_NOREF        1
 };
 
 struct fib_rules_ops {
@@ -106,7 +108,6 @@ static inline u32 frh_get_table(struct fib_rule_hdr *frh, struct nlattr **nla)
 
 extern struct fib_rules_ops *fib_rules_register(const struct fib_rules_ops *, struct net *);
 extern void fib_rules_unregister(struct fib_rules_ops *);
-extern void                     fib_rules_cleanup_ops(struct fib_rules_ops *);
 
 extern int                      fib_rules_lookup(struct fib_rules_ops *,
                                                  struct flowi *, int flags,
diff --git a/include/net/flow.h b/include/net/flow.h
index bb08692a20b0..c6d5fe5ec1bf 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -10,76 +10,157 @@
 #include <linux/in6.h>
 #include <asm/atomic.h>
 
-struct flowi {
-        int     oif;
-        int     iif;
-        __u32   mark;
+struct flowi_common {
+        int     flowic_oif;
+        int     flowic_iif;
+        __u32   flowic_mark;
+        __u8    flowic_tos;
+        __u8    flowic_scope;
+        __u8    flowic_proto;
+        __u8    flowic_flags;
+#define FLOWI_FLAG_ANYSRC               0x01
+#define FLOWI_FLAG_PRECOW_METRICS       0x02
+#define FLOWI_FLAG_CAN_SLEEP            0x04
+        __u32   flowic_secid;
+};
 
+union flowi_uli {
+        struct {
+                __be16  dport;
+                __be16  sport;
+        } ports;
+
+        struct {
+                __u8    type;
+                __u8    code;
+        } icmpt;
+
+        struct {
+                __le16  dport;
+                __le16  sport;
+        } dnports;
+
+        __be32          spi;
+        __be32          gre_key;
+
+        struct {
+                __u8    type;
+        } mht;
+};
+
+struct flowi4 {
+        struct flowi_common     __fl_common;
+#define flowi4_oif              __fl_common.flowic_oif
+#define flowi4_iif              __fl_common.flowic_iif
+#define flowi4_mark             __fl_common.flowic_mark
+#define flowi4_tos              __fl_common.flowic_tos
+#define flowi4_scope            __fl_common.flowic_scope
+#define flowi4_proto            __fl_common.flowic_proto
+#define flowi4_flags            __fl_common.flowic_flags
+#define flowi4_secid            __fl_common.flowic_secid
+        __be32                  daddr;
+        __be32                  saddr;
+        union flowi_uli         uli;
+#define fl4_sport               uli.ports.sport
+#define fl4_dport               uli.ports.dport
+#define fl4_icmp_type           uli.icmpt.type
+#define fl4_icmp_code           uli.icmpt.code
+#define fl4_ipsec_spi           uli.spi
+#define fl4_mh_type             uli.mht.type
+#define fl4_gre_key             uli.gre_key
+};
+
+static inline void flowi4_init_output(struct flowi4 *fl4, int oif,
+                                      __u32 mark, __u8 tos, __u8 scope,
+                                      __u8 proto, __u8 flags,
+                                      __be32 daddr, __be32 saddr,
+                                      __be16 dport, __be32 sport)
+{
+        fl4->flowi4_oif = oif;
+        fl4->flowi4_iif = 0;
+        fl4->flowi4_mark = mark;
+        fl4->flowi4_tos = tos;
+        fl4->flowi4_scope = scope;
+        fl4->flowi4_proto = proto;
+        fl4->flowi4_flags = flags;
+        fl4->flowi4_secid = 0;
+        fl4->daddr = daddr;
+        fl4->saddr = saddr;
+        fl4->fl4_dport = dport;
+        fl4->fl4_sport = sport;
+}
+                                      
+
+struct flowi6 {
+        struct flowi_common     __fl_common;
+#define flowi6_oif              __fl_common.flowic_oif
+#define flowi6_iif              __fl_common.flowic_iif
+#define flowi6_mark             __fl_common.flowic_mark
+#define flowi6_tos              __fl_common.flowic_tos
+#define flowi6_scope            __fl_common.flowic_scope
+#define flowi6_proto            __fl_common.flowic_proto
+#define flowi6_flags            __fl_common.flowic_flags
+#define flowi6_secid            __fl_common.flowic_secid
+        struct in6_addr         daddr;
+        struct in6_addr         saddr;
+        __be32                  flowlabel;
+        union flowi_uli         uli;
+#define fl6_sport               uli.ports.sport
+#define fl6_dport               uli.ports.dport
+#define fl6_icmp_type           uli.icmpt.type
+#define fl6_icmp_code           uli.icmpt.code
+#define fl6_ipsec_spi           uli.spi
+#define fl6_mh_type             uli.mht.type
+#define fl6_gre_key             uli.gre_key
+};
+
+struct flowidn {
+        struct flowi_common     __fl_common;
+#define flowidn_oif             __fl_common.flowic_oif
+#define flowidn_iif             __fl_common.flowic_iif
+#define flowidn_mark            __fl_common.flowic_mark
+#define flowidn_scope           __fl_common.flowic_scope
+#define flowidn_proto           __fl_common.flowic_proto
+#define flowidn_flags           __fl_common.flowic_flags
+        __le16                  daddr;
+        __le16                  saddr;
+        union flowi_uli         uli;
+#define fld_sport               uli.ports.sport
+#define fld_dport               uli.ports.dport
+};
+
+struct flowi {
         union {
-                struct {
-                        __be32                  daddr;
-                        __be32                  saddr;
-                        __u8                    tos;
-                        __u8                    scope;
-                } ip4_u;
-                
-                struct {
-                        struct in6_addr         daddr;
-                        struct in6_addr         saddr;
-                        __be32                  flowlabel;
-                } ip6_u;
-
-                struct {
-                        __le16                  daddr;
-                        __le16                  saddr;
-                        __u8                    scope;
-                } dn_u;
-        } nl_u;
-#define fld_dst         nl_u.dn_u.daddr
-#define fld_src         nl_u.dn_u.saddr
-#define fld_scope       nl_u.dn_u.scope
-#define fl6_dst         nl_u.ip6_u.daddr
-#define fl6_src         nl_u.ip6_u.saddr
-#define fl6_flowlabel   nl_u.ip6_u.flowlabel
-#define fl4_dst         nl_u.ip4_u.daddr
-#define fl4_src         nl_u.ip4_u.saddr
-#define fl4_tos         nl_u.ip4_u.tos
-#define fl4_scope       nl_u.ip4_u.scope
-
-        __u8    proto;
-        __u8    flags;
-#define FLOWI_FLAG_ANYSRC 0x01
-        union {
-                struct {
-                        __be16  sport;
-                        __be16  dport;
-                } ports;
-
-                struct {
-                        __u8    type;
-                        __u8    code;
-                } icmpt;
-
-                struct {
-                        __le16  sport;
-                        __le16  dport;
-                } dnports;
-
-                __be32          spi;
-
-                struct {
-                        __u8    type;
-                } mht;
-        } uli_u;
-#define fl_ip_sport     uli_u.ports.sport
-#define fl_ip_dport     uli_u.ports.dport
-#define fl_icmp_type    uli_u.icmpt.type
-#define fl_icmp_code    uli_u.icmpt.code
-#define fl_ipsec_spi    uli_u.spi
-#define fl_mh_type      uli_u.mht.type
-        __u32           secid;  /* used by xfrm; see secid.txt */
+                struct flowi_common     __fl_common;
+                struct flowi4           ip4;
+                struct flowi6           ip6;
+                struct flowidn          dn;
+        } u;
+#define flowi_oif       u.__fl_common.flowic_oif
+#define flowi_iif       u.__fl_common.flowic_iif
+#define flowi_mark      u.__fl_common.flowic_mark
+#define flowi_tos       u.__fl_common.flowic_tos
+#define flowi_scope     u.__fl_common.flowic_scope
+#define flowi_proto     u.__fl_common.flowic_proto
+#define flowi_flags     u.__fl_common.flowic_flags
+#define flowi_secid     u.__fl_common.flowic_secid
 } __attribute__((__aligned__(BITS_PER_LONG/8)));
 
+static inline struct flowi *flowi4_to_flowi(struct flowi4 *fl4)
+{
+        return container_of(fl4, struct flowi, u.ip4);
+}
+
+static inline struct flowi *flowi6_to_flowi(struct flowi6 *fl6)
+{
+        return container_of(fl6, struct flowi, u.ip6);
+}
+
+static inline struct flowi *flowidn_to_flowi(struct flowidn *fldn)
+{
+        return container_of(fldn, struct flowi, u.dn);
+}
+
 #define FLOW_DIR_IN     0
 #define FLOW_DIR_OUT    1
 #define FLOW_DIR_FWD    2
@@ -99,20 +180,14 @@ struct flow_cache_ops {
 };
 
 typedef struct flow_cache_object *(*flow_resolve_t)(
-                struct net *net, struct flowi *key, u16 family,
+                struct net *net, const struct flowi *key, u16 family,
                 u8 dir, struct flow_cache_object *oldobj, void *ctx);
 
 extern struct flow_cache_object *flow_cache_lookup(
-                struct net *net, struct flowi *key, u16 family,
+                struct net *net, const struct flowi *key, u16 family,
                 u8 dir, flow_resolve_t resolver, void *ctx);
 
 extern void flow_cache_flush(void);
 extern atomic_t flow_cache_genid;
 
-static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
-{
-        return (fl1->proto == fl2->proto &&
-                !memcmp(&fl1->uli_u, &fl2->uli_u, sizeof(fl1->uli_u)));
-}
-
 #endif
diff --git a/include/net/garp.h b/include/net/garp.h
index 825f172caba9..834d8add9e5f 100644
--- a/include/net/garp.h
+++ b/include/net/garp.h
@@ -104,10 +104,12 @@ struct garp_applicant {
         struct sk_buff_head     queue;
         struct sk_buff          *pdu;
         struct rb_root          gid;
+        struct rcu_head         rcu;
 };
 
 struct garp_port {
-        struct garp_applicant   *applicants[GARP_APPLICATION_MAX + 1];
+        struct garp_applicant __rcu     *applicants[GARP_APPLICATION_MAX + 1];
+        struct rcu_head                 rcu;
 };
 
 extern int      garp_register_application(struct garp_application *app);
diff --git a/include/net/gen_stats.h b/include/net/gen_stats.h
index fa157712e982..a79b6cfb02a8 100644
--- a/include/net/gen_stats.h
+++ b/include/net/gen_stats.h
@@ -11,7 +11,7 @@ struct gnet_dump {
         struct sk_buff *  skb;
         struct nlattr *   tail;
 
-        /* Backward compatability */
+        /* Backward compatibility */
         int               compat_tc_stats;
         int               compat_xstats;
         void *            xstats;
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index f7dcd2c70412..d420f28b6d60 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -20,6 +20,9 @@ struct genl_multicast_group {
         u32                     id;
 };
 
+struct genl_ops;
+struct genl_info;
+
 /**
  * struct genl_family - generic netlink family
  * @id: protocol family idenfitier
@@ -29,6 +32,10 @@ struct genl_multicast_group {
  * @maxattr: maximum number of attributes supported
  * @netnsok: set to true if the family can handle network
  *      namespaces and should be presented in all of them
+ * @pre_doit: called before an operation's doit callback, it may
+ *      do additional, common, filtering and return an error
+ * @post_doit: called after an operation's doit callback, it may
+ *      undo operations done by pre_doit, for example release locks
  * @attrbuf: buffer to store parsed attributes
  * @ops_list: list of all assigned operations
  * @family_list: family list
@@ -41,6 +48,12 @@ struct genl_family {
         unsigned int            version;
         unsigned int            maxattr;
         bool                    netnsok;
+        int                     (*pre_doit)(struct genl_ops *ops,
+                                            struct sk_buff *skb,
+                                            struct genl_info *info);
+        void                    (*post_doit)(struct genl_ops *ops,
+                                             struct sk_buff *skb,
+                                             struct genl_info *info);
         struct nlattr **        attrbuf;        /* private */
         struct list_head        ops_list;       /* private */
         struct list_head        family_list;    /* private */
@@ -55,6 +68,8 @@ struct genl_family {
  * @genlhdr: generic netlink message header
  * @userhdr: user specific header
  * @attrs: netlink attributes
+ * @_net: network namespace
+ * @user_ptr: user pointers
  */
 struct genl_info {
         u32                     snd_seq;
@@ -66,6 +81,7 @@ struct genl_info {
 #ifdef CONFIG_NET_NS
         struct net *            _net;
 #endif
+        void *                  user_ptr[2];
 };
 
 static inline struct net *genl_info_net(struct genl_info *info)
@@ -81,6 +97,7 @@ static inline void genl_info_net_set(struct genl_info *info, struct net *net)
 /**
  * struct genl_ops - generic netlink operations
  * @cmd: command identifier
+ * @internal_flags: flags used by the family
  * @flags: flags
  * @policy: attribute validation policy
  * @doit: standard command callback
@@ -90,6 +107,7 @@ static inline void genl_info_net_set(struct genl_info *info, struct net *net)
  */
 struct genl_ops {
         u8                      cmd;
+        u8                      internal_flags;
         unsigned int            flags;
         const struct nla_policy *policy;
         int                    (*doit)(struct sk_buff *skb,
@@ -177,7 +195,8 @@ static inline int genlmsg_end(struct sk_buff *skb, void *hdr)
  */
 static inline void genlmsg_cancel(struct sk_buff *skb, void *hdr)
 {
-        nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
+        if (hdr)
+                nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
 }
 
 /**
@@ -241,7 +260,7 @@ static inline int genlmsg_reply(struct sk_buff *skb, struct genl_info *info)
 
 /**
  * gennlmsg_data - head of message payload
- * @gnlh: genetlink messsage header
+ * @gnlh: genetlink message header
  */
 static inline void *genlmsg_data(const struct genlmsghdr *gnlh)
 {
diff --git a/include/net/gre.h b/include/net/gre.h
new file mode 100644
index 000000000000..82665474bcb7
--- /dev/null
+++ b/include/net/gre.h
@@ -0,0 +1,18 @@
+#ifndef __LINUX_GRE_H
+#define __LINUX_GRE_H
+
+#include <linux/skbuff.h>
+
+#define GREPROTO_CISCO          0
+#define GREPROTO_PPTP           1
+#define GREPROTO_MAX            2
+
+struct gre_protocol {
+        int  (*handler)(struct sk_buff *skb);
+        void (*err_handler)(struct sk_buff *skb, u32 info);
+};
+
+int gre_add_protocol(const struct gre_protocol *proto, u8 version);
+int gre_del_protocol(const struct gre_protocol *proto, u8 version);
+
+#endif
diff --git a/include/net/icmp.h b/include/net/icmp.h
index 6e991e0d0d6f..f0698b955b73 100644
--- a/include/net/icmp.h
+++ b/include/net/icmp.h
@@ -45,7 +45,4 @@ extern int	icmp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 extern int      icmp_init(void);
 extern void     icmp_out_count(struct net *net, unsigned char type);
 
-/* Move into dst.h ? */
-extern int      xrlim_allow(struct dst_entry *dst, int timeout);
-
 #endif  /* _ICMP_H */
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index af49f8ab7f81..b0be5fb9de19 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -178,6 +178,11 @@ struct ieee80211_radiotap_header {
  *
  *     Number of unicast retries a transmitted frame used.
  *
+ * IEEE80211_RADIOTAP_MCS       u8, u8, u8              unitless
+ *
+ *     Contains a bitmap of known fields/flags, the flags, and
+ *     the MCS index.
+ *
  */
 enum ieee80211_radiotap_type {
         IEEE80211_RADIOTAP_TSFT = 0,
@@ -199,6 +204,8 @@ enum ieee80211_radiotap_type {
         IEEE80211_RADIOTAP_RTS_RETRIES = 16,
         IEEE80211_RADIOTAP_DATA_RETRIES = 17,
 
+        IEEE80211_RADIOTAP_MCS = 19,
+
         /* valid in every it_present bitmap, even vendor namespaces */
         IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE = 29,
         IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30,
@@ -245,6 +252,24 @@ enum ieee80211_radiotap_type {
 #define IEEE80211_RADIOTAP_F_TX_CTS     0x0002  /* used cts 'protection' */
 #define IEEE80211_RADIOTAP_F_TX_RTS     0x0004  /* used rts/cts handshake */
 
+
+/* For IEEE80211_RADIOTAP_MCS */
+#define IEEE80211_RADIOTAP_MCS_HAVE_BW          0x01
+#define IEEE80211_RADIOTAP_MCS_HAVE_MCS         0x02
+#define IEEE80211_RADIOTAP_MCS_HAVE_GI          0x04
+#define IEEE80211_RADIOTAP_MCS_HAVE_FMT         0x08
+#define IEEE80211_RADIOTAP_MCS_HAVE_FEC         0x10
+
+#define IEEE80211_RADIOTAP_MCS_BW_MASK          0x03
+#define         IEEE80211_RADIOTAP_MCS_BW_20    0
+#define         IEEE80211_RADIOTAP_MCS_BW_40    1
+#define         IEEE80211_RADIOTAP_MCS_BW_20L   2
+#define         IEEE80211_RADIOTAP_MCS_BW_20U   3
+#define IEEE80211_RADIOTAP_MCS_SGI              0x04
+#define IEEE80211_RADIOTAP_MCS_FMT_GF           0x08
+#define IEEE80211_RADIOTAP_MCS_FEC_LDPC         0x10
+
+
 /* Ugly macro to convert literal channel numbers into their mhz equivalents
  * There are certianly some conditions that will break this (like feeding it '30')
  * but they shouldn't arise since nothing talks on channel 30. */
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index f95ff8d9aa47..11cf373970a9 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -30,8 +30,6 @@
 #define IF_PREFIX_ONLINK        0x01
 #define IF_PREFIX_AUTOCONF      0x02
 
-#ifdef __KERNEL__
-
 enum {
         INET6_IFADDR_STATE_DAD,
         INET6_IFADDR_STATE_POSTDAD,
@@ -89,10 +87,11 @@ struct ip6_sf_socklist {
 struct ipv6_mc_socklist {
         struct in6_addr         addr;
         int                     ifindex;
-        struct ipv6_mc_socklist *next;
+        struct ipv6_mc_socklist __rcu *next;
         rwlock_t                sflock;
         unsigned int            sfmode;         /* MCAST_{INCLUDE,EXCLUDE} */
         struct ip6_sf_socklist  *sflist;
+        struct rcu_head         rcu;
 };
 
 struct ip6_sf_list {
@@ -155,8 +154,8 @@ struct ifacaddr6 {
 struct ipv6_devstat {
         struct proc_dir_entry   *proc_dir_entry;
         DEFINE_SNMP_STAT(struct ipstats_mib, ipv6);
-        DEFINE_SNMP_STAT(struct icmpv6_mib, icmpv6);
-        DEFINE_SNMP_STAT(struct icmpv6msg_mib, icmpv6msg);
+        DEFINE_SNMP_STAT_ATOMIC(struct icmpv6_mib_device, icmpv6dev);
+        DEFINE_SNMP_STAT_ATOMIC(struct icmpv6msg_mib_device, icmpv6msgdev);
 };
 
 struct inet6_dev {
@@ -195,7 +194,7 @@ struct inet6_dev {
         struct rcu_head         rcu;
 };
 
-static inline void ipv6_eth_mc_map(struct in6_addr *addr, char *buf)
+static inline void ipv6_eth_mc_map(const struct in6_addr *addr, char *buf)
 {
         /*
          *      +-------+-------+-------+-------+-------+-------+
@@ -209,7 +208,7 @@ static inline void ipv6_eth_mc_map(struct in6_addr *addr, char *buf)
         memcpy(buf + 2, &addr->s6_addr32[3], sizeof(__u32));
 }
 
-static inline void ipv6_tr_mc_map(struct in6_addr *addr, char *buf)
+static inline void ipv6_tr_mc_map(const struct in6_addr *addr, char *buf)
 {
         /* All nodes FF01::1, FF02::1, FF02::1:FFxx:xxxx */
 
@@ -285,5 +284,20 @@ static inline void ipv6_ib_mc_map(const struct in6_addr *addr,
         buf[9]  = broadcast[9];
         memcpy(buf + 10, addr->s6_addr + 6, 10);
 }
-#endif
+
+static inline int ipv6_ipgre_mc_map(const struct in6_addr *addr,
+                                    const unsigned char *broadcast, char *buf)
+{
+        if ((broadcast[0] | broadcast[1] | broadcast[2] | broadcast[3]) != 0) {
+                memcpy(buf, broadcast, 4);
+        } else {
+                /* v4mapped? */
+                if ((addr->s6_addr32[0] | addr->s6_addr32[1] |
+                     (addr->s6_addr32[2] ^ htonl(0x0000ffff))) != 0)
+                        return -EINVAL;
+                memcpy(buf, &addr->s6_addr32[3], 4);
+        }
+        return 0;
+}
+
 #endif
diff --git a/include/net/inet6_connection_sock.h b/include/net/inet6_connection_sock.h
index aae08f686633..3207e58ee019 100644
--- a/include/net/inet6_connection_sock.h
+++ b/include/net/inet6_connection_sock.h
@@ -25,6 +25,9 @@ struct sockaddr;
 extern int inet6_csk_bind_conflict(const struct sock *sk,
                                    const struct inet_bind_bucket *tb);
 
+extern struct dst_entry* inet6_csk_route_req(struct sock *sk,
+                                             const struct request_sock *req);
+
 extern struct request_sock *inet6_csk_search_req(const struct sock *sk,
                                                  struct request_sock ***prevp,
                                                  const __be16 rport,
@@ -38,5 +41,5 @@ extern void inet6_csk_reqsk_queue_hash_add(struct sock *sk,
 
 extern void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr);
 
-extern int inet6_csk_xmit(struct sk_buff *skb);
+extern int inet6_csk_xmit(struct sk_buff *skb, struct flowi *fl);
 #endif /* _INET6_CONNECTION_SOCK_H */
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index b6d3b55da19b..e6db62e756dc 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -36,14 +36,14 @@ struct tcp_congestion_ops;
  * (i.e. things that depend on the address family)
  */
 struct inet_connection_sock_af_ops {
-        int         (*queue_xmit)(struct sk_buff *skb);
+        int         (*queue_xmit)(struct sk_buff *skb, struct flowi *fl);
         void        (*send_check)(struct sock *sk, struct sk_buff *skb);
         int         (*rebuild_header)(struct sock *sk);
         int         (*conn_request)(struct sock *sk, struct sk_buff *skb);
         struct sock *(*syn_recv_sock)(struct sock *sk, struct sk_buff *skb,
                                       struct request_sock *req,
                                       struct dst_entry *dst);
-        int         (*remember_stamp)(struct sock *sk);
+        struct inet_peer *(*get_peer)(struct sock *sk, bool *release_it);
         u16         net_header_len;
         u16         sockaddr_len;
         int         (*setsockopt)(struct sock *sk, int level, int optname, 
@@ -125,13 +125,13 @@ struct inet_connection_sock {
                 int               probe_size;
         } icsk_mtup;
         u32                       icsk_ca_priv[16];
+        u32                       icsk_user_timeout;
 #define ICSK_CA_PRIV_SIZE       (16 * sizeof(u32))
 };
 
 #define ICSK_TIME_RETRANS       1       /* Retransmit timer */
 #define ICSK_TIME_DACK          2       /* Delayed ack timer */
 #define ICSK_TIME_PROBE0        3       /* Zero window probe timer */
-#define ICSK_TIME_KEEPOPEN      4       /* Keepalive timer */
 
 static inline struct inet_connection_sock *inet_csk(const struct sock *sk)
 {
@@ -249,7 +249,11 @@ extern int inet_csk_bind_conflict(const struct sock *sk,
 extern int inet_csk_get_port(struct sock *sk, unsigned short snum);
 
 extern struct dst_entry* inet_csk_route_req(struct sock *sk,
+                                            struct flowi4 *fl4,
                                             const struct request_sock *req);
+extern struct dst_entry* inet_csk_route_child_sock(struct sock *sk,
+                                                   struct sock *newsk,
+                                                   const struct request_sock *req);
 
 static inline void inet_csk_reqsk_queue_add(struct sock *sk,
                                             struct request_sock *req,
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index 9b5d08f4f6e8..2fa8d1341a0a 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -27,7 +27,7 @@ static inline int INET_ECN_is_not_ect(__u8 dsfield)
 
 static inline int INET_ECN_is_capable(__u8 dsfield)
 {
-        return (dsfield & INET_ECN_ECT_0);
+        return dsfield & INET_ECN_ECT_0;
 }
 
 static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
@@ -38,9 +38,19 @@ static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
         return outer;
 }
 
-#define INET_ECN_xmit(sk) do { inet_sk(sk)->tos |= INET_ECN_ECT_0; } while (0)
-#define INET_ECN_dontxmit(sk) \
-        do { inet_sk(sk)->tos &= ~INET_ECN_MASK; } while (0)
+static inline void INET_ECN_xmit(struct sock *sk)
+{
+        inet_sk(sk)->tos |= INET_ECN_ECT_0;
+        if (inet6_sk(sk) != NULL)
+                inet6_sk(sk)->tclass |= INET_ECN_ECT_0;
+}
+
+static inline void INET_ECN_dontxmit(struct sock *sk)
+{
+        inet_sk(sk)->tos &= ~INET_ECN_MASK;
+        if (inet6_sk(sk) != NULL)
+                inet6_sk(sk)->tclass &= ~INET_ECN_MASK;
+}
 
 #define IP6_ECN_flow_init(label) do {           \
       (label) &= ~htonl(INET_ECN_MASK << 20);   \
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 74358d1b3f43..e9c2ed8af864 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -245,7 +245,7 @@ static inline int inet_sk_listen_hashfn(const struct sock *sk)
 }
 
 /* Caller must disable local BH processing. */
-extern void __inet_inherit_port(struct sock *sk, struct sock *child);
+extern int __inet_inherit_port(struct sock *sk, struct sock *child);
 
 extern void inet_put_port(struct sock *sk);
 
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 1989cfd7405f..caaff5f5f39f 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -57,7 +57,15 @@ struct ip_options {
         unsigned char   __data[0];
 };
 
-#define optlength(opt) (sizeof(struct ip_options) + opt->optlen)
+struct ip_options_rcu {
+        struct rcu_head rcu;
+        struct ip_options opt;
+};
+
+struct ip_options_data {
+        struct ip_options_rcu   opt;
+        char                    data[40];
+};
 
 struct inet_request_sock {
         struct request_sock     req;
@@ -78,7 +86,7 @@ struct inet_request_sock {
                                 acked      : 1,
                                 no_srccheck: 1;
         kmemcheck_bitfield_end(flags);
-        struct ip_options       *opt;
+        struct ip_options_rcu   *opt;
 };
 
 static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk)
@@ -86,6 +94,23 @@ static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk)
         return (struct inet_request_sock *)sk;
 }
 
+struct inet_cork {
+        unsigned int            flags;
+        __be32                  addr;
+        struct ip_options       *opt;
+        unsigned int            fragsize;
+        struct dst_entry        *dst;
+        int                     length; /* Total length of all frames */
+        struct page             *page;
+        u32                     off;
+        u8                      tx_flags;
+};
+
+struct inet_cork_full {
+        struct inet_cork        base;
+        struct flowi            fl;
+};
+
 struct ip_mc_socklist;
 struct ipv6_pinfo;
 struct rtable;
@@ -116,8 +141,9 @@ struct inet_sock {
         struct ipv6_pinfo       *pinet6;
 #endif
         /* Socket demultiplex comparisons on incoming packets. */
-        __be32                  inet_daddr;
-        __be32                  inet_rcv_saddr;
+#define inet_daddr              sk.__sk_common.skc_daddr
+#define inet_rcv_saddr          sk.__sk_common.skc_rcv_saddr
+
         __be16                  inet_dport;
         __u16                   inet_num;
         __be32                  inet_saddr;
@@ -126,7 +152,7 @@ struct inet_sock {
         __be16                  inet_sport;
         __u16                   inet_id;
 
-        struct ip_options       *opt;
+        struct ip_options_rcu __rcu     *inet_opt;
         __u8                    tos;
         __u8                    min_ttl;
         __u8                    mc_ttl;
@@ -141,16 +167,8 @@ struct inet_sock {
                                 nodefrag:1;
         int                     mc_index;
         __be32                  mc_addr;
-        struct ip_mc_socklist   *mc_list;
-        struct {
-                unsigned int            flags;
-                unsigned int            fragsize;
-                struct ip_options       *opt;
-                struct dst_entry        *dst;
-                int                     length; /* Total length of all frames */
-                __be32                  addr;
-                struct flowi            fl;
-        } cork;
+        struct ip_mc_socklist __rcu     *mc_list;
+        struct inet_cork_full   cork;
 };
 
 #define IPCORK_OPT      1       /* ip-options has been held in ipcork.opt */
@@ -218,7 +236,13 @@ static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops
 
 static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
 {
-        return inet_sk(sk)->transparent ? FLOWI_FLAG_ANYSRC : 0;
+        __u8 flags = 0;
+
+        if (inet_sk(sk)->transparent)
+                flags |= FLOWI_FLAG_ANYSRC;
+        if (sk->sk_protocol == IPPROTO_TCP)
+                flags |= FLOWI_FLAG_PRECOW_METRICS;
+        return flags;
 }
 
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index a066fdd50da6..17404b5388a7 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -88,12 +88,6 @@ extern void inet_twdr_hangman(unsigned long data);
 extern void inet_twdr_twkill_work(struct work_struct *work);
 extern void inet_twdr_twcal_tick(unsigned long data);
 
-#if (BITS_PER_LONG == 64)
-#define INET_TIMEWAIT_ADDRCMP_ALIGN_BYTES 8
-#else
-#define INET_TIMEWAIT_ADDRCMP_ALIGN_BYTES 4
-#endif
-
 struct inet_bind_bucket;
 
 /*
@@ -117,15 +111,15 @@ struct inet_timewait_sock {
 #define tw_hash                 __tw_common.skc_hash
 #define tw_prot                 __tw_common.skc_prot
 #define tw_net                  __tw_common.skc_net
+#define tw_daddr                __tw_common.skc_daddr
+#define tw_rcv_saddr            __tw_common.skc_rcv_saddr
         int                     tw_timeout;
         volatile unsigned char  tw_substate;
-        /* 3 bits hole, try to pack */
         unsigned char           tw_rcv_wscale;
+
         /* Socket demultiplex comparisons on incoming packets. */
-        /* these five are in inet_sock */
+        /* these three are in inet_sock */
         __be16                  tw_sport;
-        __be32                  tw_daddr __attribute__((aligned(INET_TIMEWAIT_ADDRCMP_ALIGN_BYTES)));
-        __be32                  tw_rcv_saddr;
         __be16                  tw_dport;
         __u16                   tw_num;
         kmemcheck_bitfield_begin(flags);
@@ -191,10 +185,10 @@ static inline struct inet_timewait_sock *inet_twsk(const struct sock *sk)
         return (struct inet_timewait_sock *)sk;
 }
 
-static inline __be32 inet_rcv_saddr(const struct sock *sk)
+static inline __be32 sk_rcv_saddr(const struct sock *sk)
 {
-        return likely(sk->sk_state != TCP_TIME_WAIT) ?
-                inet_sk(sk)->inet_rcv_saddr : inet_twsk(sk)->tw_rcv_saddr;
+/* both inet_sk() and inet_twsk() store rcv_saddr in skc_rcv_saddr */
+        return sk->__sk_common.skc_rcv_saddr;
 }
 
 extern void inet_twsk_put(struct inet_timewait_sock *tw);
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 417d0c894f29..8a159cc3d68b 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -11,12 +11,26 @@
 #include <linux/init.h>
 #include <linux/jiffies.h>
 #include <linux/spinlock.h>
+#include <linux/rtnetlink.h>
+#include <net/ipv6.h>
 #include <asm/atomic.h>
 
+struct inetpeer_addr_base {
+        union {
+                __be32                  a4;
+                __be32                  a6[4];
+        };
+};
+
+struct inetpeer_addr {
+        struct inetpeer_addr_base       addr;
+        __u16                           family;
+};
+
 struct inet_peer {
         /* group together avl_left,avl_right,v4daddr to speedup lookups */
-        struct inet_peer        *avl_left, *avl_right;
-        __be32                  v4daddr;        /* peer's address */
+        struct inet_peer __rcu  *avl_left, *avl_right;
+        struct inetpeer_addr    daddr;
         __u32                   avl_height;
         struct list_head        unused;
         __u32                   dtime;          /* the time of last use of not
@@ -24,16 +38,22 @@ struct inet_peer {
         atomic_t                refcnt;
         /*
          * Once inet_peer is queued for deletion (refcnt == -1), following fields
-         * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
-         * We can share memory with rcu_head to keep inet_peer small
-         * (less then 64 bytes)
+         * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp, metrics
+         * We can share memory with rcu_head to help keep inet_peer small.
          */
         union {
                 struct {
-                        atomic_t        rid;            /* Frag reception counter */
-                        atomic_t        ip_id_count;    /* IP ID for the next packet */
-                        __u32           tcp_ts;
-                        __u32           tcp_ts_stamp;
+                        atomic_t                        rid;            /* Frag reception counter */
+                        atomic_t                        ip_id_count;    /* IP ID for the next packet */
+                        __u32                           tcp_ts;
+                        __u32                           tcp_ts_stamp;
+                        u32                             metrics[RTAX_MAX];
+                        u32                             rate_tokens;    /* rate limiting for ICMP */
+                        unsigned long                   rate_last;
+                        unsigned long                   pmtu_expires;
+                        u32                             pmtu_orig;
+                        u32                             pmtu_learned;
+                        struct inetpeer_addr_base       redirect_learned;
                 };
                 struct rcu_head         rcu;
         };
@@ -41,11 +61,37 @@ struct inet_peer {
 
 void                    inet_initpeers(void) __init;
 
+#define INETPEER_METRICS_NEW    (~(u32) 0)
+
+static inline bool inet_metrics_new(const struct inet_peer *p)
+{
+        return p->metrics[RTAX_LOCK-1] == INETPEER_METRICS_NEW;
+}
+
 /* can be called with or without local BH being disabled */
-struct inet_peer        *inet_getpeer(__be32 daddr, int create);
+struct inet_peer        *inet_getpeer(struct inetpeer_addr *daddr, int create);
+
+static inline struct inet_peer *inet_getpeer_v4(__be32 v4daddr, int create)
+{
+        struct inetpeer_addr daddr;
+
+        daddr.addr.a4 = v4daddr;
+        daddr.family = AF_INET;
+        return inet_getpeer(&daddr, create);
+}
+
+static inline struct inet_peer *inet_getpeer_v6(const struct in6_addr *v6daddr, int create)
+{
+        struct inetpeer_addr daddr;
+
+        ipv6_addr_copy((struct in6_addr *)daddr.addr.a6, v6daddr);
+        daddr.family = AF_INET6;
+        return inet_getpeer(&daddr, create);
+}
 
 /* can be called from BH context or outside */
 extern void inet_putpeer(struct inet_peer *p);
+extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
 
 /*
  * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
diff --git a/include/net/ip.h b/include/net/ip.h
index 890f9725d681..66dd49149208 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -52,14 +52,14 @@ static inline unsigned int ip_hdrlen(const struct sk_buff *skb)
 struct ipcm_cookie {
         __be32                  addr;
         int                     oif;
-        struct ip_options       *opt;
-        union skb_shared_tx     shtx;
+        struct ip_options_rcu   *opt;
+        __u8                    tx_flags;
 };
 
 #define IPCB(skb) ((struct inet_skb_parm*)((skb)->cb))
 
 struct ip_ra_chain {
-        struct ip_ra_chain      *next;
+        struct ip_ra_chain __rcu *next;
         struct sock             *sk;
         union {
                 void                    (*destructor)(struct sock *);
@@ -68,7 +68,7 @@ struct ip_ra_chain {
         struct rcu_head         rcu;
 };
 
-extern struct ip_ra_chain *ip_ra_chain;
+extern struct ip_ra_chain __rcu *ip_ra_chain;
 
 /* IP flags. */
 #define IP_CE           0x8000          /* Flag: "Congestion"           */
@@ -92,7 +92,7 @@ extern int		igmp_mc_proc_init(void);
 
 extern int              ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
                                               __be32 saddr, __be32 daddr,
-                                              struct ip_options *opt);
+                                              struct ip_options_rcu *opt);
 extern int              ip_rcv(struct sk_buff *skb, struct net_device *dev,
                                struct packet_type *pt, struct net_device *orig_dev);
 extern int              ip_local_deliver(struct sk_buff *skb);
@@ -104,9 +104,9 @@ extern int		ip_do_nat(struct sk_buff *skb);
 extern void             ip_send_check(struct iphdr *ip);
 extern int              __ip_local_out(struct sk_buff *skb);
 extern int              ip_local_out(struct sk_buff *skb);
-extern int              ip_queue_xmit(struct sk_buff *skb);
+extern int              ip_queue_xmit(struct sk_buff *skb, struct flowi *fl);
 extern void             ip_init(void);
-extern int              ip_append_data(struct sock *sk,
+extern int              ip_append_data(struct sock *sk, struct flowi4 *fl4,
                                        int getfrag(void *from, char *to, int offset, int len,
                                                    int odd, struct sk_buff *skb),
                                 void *from, int len, int protolen,
@@ -114,10 +114,28 @@ extern int		ip_append_data(struct sock *sk,
                                 struct rtable **rt,
                                 unsigned int flags);
 extern int              ip_generic_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb);
-extern ssize_t          ip_append_page(struct sock *sk, struct page *page,
+extern ssize_t          ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                                 int offset, size_t size, int flags);
-extern int              ip_push_pending_frames(struct sock *sk);
+extern struct sk_buff  *__ip_make_skb(struct sock *sk,
+                                      struct flowi4 *fl4,
+                                      struct sk_buff_head *queue,
+                                      struct inet_cork *cork);
+extern int              ip_send_skb(struct sk_buff *skb);
+extern int              ip_push_pending_frames(struct sock *sk, struct flowi4 *fl4);
 extern void             ip_flush_pending_frames(struct sock *sk);
+extern struct sk_buff  *ip_make_skb(struct sock *sk,
+                                    struct flowi4 *fl4,
+                                    int getfrag(void *from, char *to, int offset, int len,
+                                                int odd, struct sk_buff *skb),
+                                    void *from, int length, int transhdrlen,
+                                    struct ipcm_cookie *ipc,
+                                    struct rtable **rtp,
+                                    unsigned int flags);
+
+static inline struct sk_buff *ip_finish_skb(struct sock *sk, struct flowi4 *fl4)
+{
+        return __ip_make_skb(sk, fl4, &sk->sk_write_queue, &inet_sk(sk)->cork.base);
+}
 
 /* datagram.c */
 extern int              ip4_datagram_connect(struct sock *sk, 
@@ -156,8 +174,8 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
         return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
 }
 
-void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *arg,
-                   unsigned int len); 
+void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
+                   struct ip_reply_arg *arg, unsigned int len);
 
 struct ipv4_config {
         int     log_martians;
@@ -201,7 +219,6 @@ static inline int inet_is_reserved_local_port(int port)
         return test_bit(port, sysctl_local_reserved_ports);
 }
 
-extern int sysctl_ip_default_ttl;
 extern int sysctl_ip_nonlocal_bind;
 
 extern struct ctl_path net_core_path[];
@@ -238,9 +255,9 @@ int ip_decrease_ttl(struct iphdr *iph)
 static inline
 int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
 {
-        return (inet_sk(sk)->pmtudisc == IP_PMTUDISC_DO ||
+        return  inet_sk(sk)->pmtudisc == IP_PMTUDISC_DO ||
                 (inet_sk(sk)->pmtudisc == IP_PMTUDISC_WANT &&
-                 !(dst_metric_locked(dst, RTAX_MTU))));
+                 !(dst_metric_locked(dst, RTAX_MTU)));
 }
 
 extern void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more);
@@ -324,6 +341,14 @@ static inline void ip_ib_mc_map(__be32 naddr, const unsigned char *broadcast, ch
         buf[16] = addr & 0x0f;
 }
 
+static inline void ip_ipgre_mc_map(__be32 naddr, const unsigned char *broadcast, char *buf)
+{
+        if ((broadcast[0] | broadcast[1] | broadcast[2] | broadcast[3]) != 0)
+                memcpy(buf, broadcast, 4);
+        else
+                memcpy(buf, &naddr, sizeof(naddr));
+}
+
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <linux/ipv6.h>
 #endif
@@ -393,14 +418,15 @@ extern int ip_forward(struct sk_buff *skb);
  *      Functions provided by ip_options.c
  */
  
-extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt, __be32 daddr, struct rtable *rt, int is_frag);
+extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
+                             __be32 daddr, struct rtable *rt, int is_frag);
 extern int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb);
 extern void ip_options_fragment(struct sk_buff *skb);
 extern int ip_options_compile(struct net *net,
                               struct ip_options *opt, struct sk_buff *skb);
-extern int ip_options_get(struct net *net, struct ip_options **optp,
+extern int ip_options_get(struct net *net, struct ip_options_rcu **optp,
                           unsigned char *data, int optlen);
-extern int ip_options_get_from_user(struct net *net, struct ip_options **optp,
+extern int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
                                     unsigned char __user *data, int optlen);
 extern void ip_options_undo(struct ip_options * opt);
 extern void ip_forward_options(struct sk_buff *skb);
@@ -428,15 +454,6 @@ extern void	ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
 extern void     ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,
                                u32 info);
 
-/* sysctl helpers - any sysctl which holds a value that ends up being
- * fed into the routing cache should use these handlers.
- */
-int ipv4_doint_and_flush(ctl_table *ctl, int write,
-                         void __user *buffer,
-                         size_t *lenp, loff_t *ppos);
-int ipv4_doint_and_flush_strategy(ctl_table *table,
-                                  void __user *oldval, size_t __user *oldlenp,
-                                  void __user *newval, size_t newlen);
 #ifdef CONFIG_PROC_FS
 extern int ip_misc_proc_init(void);
 #endif
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 062a823d311c..477ef75f3873 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -13,14 +13,13 @@
 #ifndef _IP6_FIB_H
 #define _IP6_FIB_H
 
-#ifdef __KERNEL__
-
 #include <linux/ipv6_route.h>
 #include <linux/rtnetlink.h>
 #include <linux/spinlock.h>
 #include <net/dst.h>
 #include <net/flow.h>
 #include <net/netlink.h>
+#include <net/inetpeer.h>
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 #define FIB6_TABLE_HASHSZ 256
@@ -41,6 +40,7 @@ struct fib6_config {
 
         struct in6_addr fc_dst;
         struct in6_addr fc_src;
+        struct in6_addr fc_prefsrc;
         struct in6_addr fc_gateway;
 
         unsigned long   fc_expires;
@@ -106,9 +106,12 @@ struct rt6_info {
         struct rt6key                   rt6i_dst ____cacheline_aligned_in_smp;
         u32                             rt6i_flags;
         struct rt6key                   rt6i_src;
+        struct rt6key                   rt6i_prefsrc;
         u32                             rt6i_metric;
+        u32                             rt6i_peer_genid;
 
         struct inet6_dev                *rt6i_idev;
+        struct inet_peer                *rt6i_peer;
 
 #ifdef CONFIG_XFRM
         u32                             rt6i_flow_cache_genid;
@@ -180,7 +183,7 @@ struct fib6_table {
 
 typedef struct rt6_info *(*pol_lookup_t)(struct net *,
                                          struct fib6_table *,
-                                         struct flowi *, int);
+                                         struct flowi6 *, int);
 
 /*
  *      exported functions
@@ -189,16 +192,16 @@ typedef struct rt6_info *(*pol_lookup_t)(struct net *,
 extern struct fib6_table        *fib6_get_table(struct net *net, u32 id);
 extern struct fib6_table        *fib6_new_table(struct net *net, u32 id);
 extern struct dst_entry         *fib6_rule_lookup(struct net *net,
-                                                  struct flowi *fl, int flags,
+                                                  struct flowi6 *fl6, int flags,
                                                   pol_lookup_t lookup);
 
 extern struct fib6_node         *fib6_lookup(struct fib6_node *root,
-                                             struct in6_addr *daddr,
-                                             struct in6_addr *saddr);
+                                             const struct in6_addr *daddr,
+                                             const struct in6_addr *saddr);
 
 struct fib6_node                *fib6_locate(struct fib6_node *root,
-                                             struct in6_addr *daddr, int dst_len,
-                                             struct in6_addr *saddr, int src_len);
+                                             const struct in6_addr *daddr, int dst_len,
+                                             const struct in6_addr *saddr, int src_len);
 
 extern void                     fib6_clean_all(struct net *net,
                                                int (*func)(struct rt6_info *, void *arg),
@@ -235,4 +238,3 @@ static inline void              fib6_rules_cleanup(void)
 }
 #endif
 #endif
-#endif
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 278312c95f96..5e91b72fc718 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -3,7 +3,6 @@
 
 #define IP6_RT_PRIO_USER        1024
 #define IP6_RT_PRIO_ADDRCONF    256
-#define IP6_RT_PRIO_KERN        512
 
 struct route_info {
         __u8                    type;
@@ -22,8 +21,6 @@ struct route_info {
         __u8                    prefix[0];      /* 0,8 or 16 */
 };
 
-#ifdef __KERNEL__
-
 #include <net/flow.h>
 #include <net/ip6_fib.h>
 #include <net/sock.h>
@@ -56,11 +53,23 @@ static inline unsigned int rt6_flags2srcprefs(int flags)
         return (flags >> 3) & 7;
 }
 
+extern void                     rt6_bind_peer(struct rt6_info *rt,
+                                              int create);
+
+static inline struct inet_peer *rt6_get_peer(struct rt6_info *rt)
+{
+        if (rt->rt6i_peer)
+                return rt->rt6i_peer;
+
+        rt6_bind_peer(rt, 0);
+        return rt->rt6i_peer;
+}
+
 extern void                     ip6_route_input(struct sk_buff *skb);
 
 extern struct dst_entry *       ip6_route_output(struct net *net,
-                                                 struct sock *sk,
-                                                 struct flowi *fl);
+                                                 const struct sock *sk,
+                                                 struct flowi6 *fl6);
 
 extern int                      ip6_route_init(void);
 extern void                     ip6_route_cleanup(void);
@@ -73,6 +82,12 @@ extern int			ip6_route_add(struct fib6_config *cfg);
 extern int                      ip6_ins_rt(struct rt6_info *);
 extern int                      ip6_del_rt(struct rt6_info *);
 
+extern int                      ip6_route_get_saddr(struct net *net,
+                                                    struct rt6_info *rt,
+                                                    const struct in6_addr *daddr,
+                                                    unsigned int prefs,
+                                                    struct in6_addr *saddr);
+
 extern struct rt6_info          *rt6_lookup(struct net *net,
                                             const struct in6_addr *daddr,
                                             const struct in6_addr *saddr,
@@ -95,9 +110,9 @@ extern int			ip6_dst_hoplimit(struct dst_entry *dst);
  *      support functions for ND
  *
  */
-extern struct rt6_info *        rt6_get_dflt_router(struct in6_addr *addr,
+extern struct rt6_info *        rt6_get_dflt_router(const struct in6_addr *addr,
                                                     struct net_device *dev);
-extern struct rt6_info *        rt6_add_dflt_router(struct in6_addr *gwaddr,
+extern struct rt6_info *        rt6_add_dflt_router(const struct in6_addr *gwaddr,
                                                     struct net_device *dev,
                                                     unsigned int pref);
 
@@ -105,17 +120,17 @@ extern void			rt6_purge_dflt_routers(struct net *net);
 
 extern int                      rt6_route_rcv(struct net_device *dev,
                                               u8 *opt, int len,
-                                              struct in6_addr *gwaddr);
+                                              const struct in6_addr *gwaddr);
 
-extern void                     rt6_redirect(struct in6_addr *dest,
-                                             struct in6_addr *src,
-                                             struct in6_addr *saddr,
+extern void                     rt6_redirect(const struct in6_addr *dest,
+                                             const struct in6_addr *src,
+                                             const struct in6_addr *saddr,
                                              struct neighbour *neigh,
                                              u8 *lladdr,
                                              int on_link);
 
-extern void                     rt6_pmtu_discovery(struct in6_addr *daddr,
-                                                   struct in6_addr *saddr,
+extern void                     rt6_pmtu_discovery(const struct in6_addr *daddr,
+                                                   const struct in6_addr *saddr,
                                                    struct net_device *dev,
                                                    u32 pmtu);
 
@@ -130,6 +145,7 @@ struct rt6_rtnl_dump_arg {
 extern int rt6_dump_route(struct rt6_info *rt, void *p_arg);
 extern void rt6_ifdown(struct net *net, struct net_device *dev);
 extern void rt6_mtu_change(struct net_device *dev, unsigned mtu);
+extern void rt6_remove_prefsrc(struct inet6_ifaddr *ifp);
 
 
 /*
@@ -164,5 +180,14 @@ static inline int ipv6_unicast_destination(struct sk_buff *skb)
         return rt->rt6i_flags & RTF_LOCAL;
 }
 
-#endif
+int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+
+static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
+{
+        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+
+        return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
+               skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
+}
+
 #endif
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index fc94ec568a50..fc73e667b50e 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -13,7 +13,7 @@
 /* IPv6 tunnel */
 
 struct ip6_tnl {
-        struct ip6_tnl *next;   /* next tunnel in list */
+        struct ip6_tnl __rcu *next;     /* next tunnel in list */
         struct net_device *dev; /* virtual device associated with tunnel */
         struct ip6_tnl_parm parms;      /* tunnel configuration parameters */
         struct flowi fl;        /* flowi template for xmit */
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index c93f94edc610..10422ef14e28 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -55,11 +55,13 @@ struct fib_nh {
         int                     nh_weight;
         int                     nh_power;
 #endif
-#ifdef CONFIG_NET_CLS_ROUTE
+#ifdef CONFIG_IP_ROUTE_CLASSID
         __u32                   nh_tclassid;
 #endif
         int                     nh_oif;
         __be32                  nh_gw;
+        __be32                  nh_saddr;
+        int                     nh_saddr_genid;
 };
 
 /*
@@ -72,12 +74,13 @@ struct fib_info {
         struct net              *fib_net;
         int                     fib_treeref;
         atomic_t                fib_clntref;
-        int                     fib_dead;
         unsigned                fib_flags;
-        int                     fib_protocol;
+        unsigned char           fib_dead;
+        unsigned char           fib_protocol;
+        unsigned char           fib_scope;
         __be32                  fib_prefsrc;
         u32                     fib_priority;
-        u32                     fib_metrics[RTAX_MAX];
+        u32                     *fib_metrics;
 #define fib_mtu fib_metrics[RTAX_MTU-1]
 #define fib_window fib_metrics[RTAX_WINDOW-1]
 #define fib_rtt fib_metrics[RTAX_RTT-1]
@@ -86,6 +89,7 @@ struct fib_info {
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         int                     fib_power;
 #endif
+        struct rcu_head         rcu;
         struct fib_nh           fib_nh[0];
 #define fib_dev         fib_nh[0].nh_dev
 };
@@ -95,12 +99,15 @@ struct fib_info {
 struct fib_rule;
 #endif
 
+struct fib_table;
 struct fib_result {
         unsigned char   prefixlen;
         unsigned char   nh_sel;
         unsigned char   type;
         unsigned char   scope;
         struct fib_info *fi;
+        struct fib_table *table;
+        struct list_head *fa_head;
 #ifdef CONFIG_IP_MULTIPLE_TABLES
         struct fib_rule *r;
 #endif
@@ -135,28 +142,37 @@ struct fib_result_nl {
 
 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
 
-#define FIB_RES_PREFSRC(res)            ((res).fi->fib_prefsrc ? : __fib_res_prefsrc(&res))
+extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
+
+#define FIB_RES_SADDR(net, res)                         \
+        ((FIB_RES_NH(res).nh_saddr_genid ==             \
+          atomic_read(&(net)->ipv4.dev_addr_genid)) ?   \
+         FIB_RES_NH(res).nh_saddr :                     \
+         fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
 #define FIB_RES_GW(res)                 (FIB_RES_NH(res).nh_gw)
 #define FIB_RES_DEV(res)                (FIB_RES_NH(res).nh_dev)
 #define FIB_RES_OIF(res)                (FIB_RES_NH(res).nh_oif)
 
+#define FIB_RES_PREFSRC(net, res)       ((res).fi->fib_prefsrc ? : \
+                                         FIB_RES_SADDR(net, res))
+
 struct fib_table {
         struct hlist_node tb_hlist;
         u32             tb_id;
         int             tb_default;
-        unsigned char   tb_data[0];
+        int             tb_num_default;
+        unsigned long   tb_data[0];
 };
 
-extern int fib_table_lookup(struct fib_table *tb, const struct flowi *flp,
-                            struct fib_result *res);
+extern int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp,
+                            struct fib_result *res, int fib_flags);
 extern int fib_table_insert(struct fib_table *, struct fib_config *);
 extern int fib_table_delete(struct fib_table *, struct fib_config *);
 extern int fib_table_dump(struct fib_table *table, struct sk_buff *skb,
                           struct netlink_callback *cb);
 extern int fib_table_flush(struct fib_table *table);
-extern void fib_table_select_default(struct fib_table *table,
-                                     const struct flowi *flp,
-                                     struct fib_result *res);
+extern void fib_free_table(struct fib_table *tb);
+
 
 
 #ifndef CONFIG_IP_MULTIPLE_TABLES
@@ -179,17 +195,17 @@ static inline struct fib_table *fib_new_table(struct net *net, u32 id)
         return fib_get_table(net, id);
 }
 
-static inline int fib_lookup(struct net *net, const struct flowi *flp,
+static inline int fib_lookup(struct net *net, const struct flowi4 *flp,
                              struct fib_result *res)
 {
         struct fib_table *table;
 
         table = fib_get_table(net, RT_TABLE_LOCAL);
-        if (!fib_table_lookup(table, flp, res))
+        if (!fib_table_lookup(table, flp, res, FIB_LOOKUP_NOREF))
                 return 0;
 
         table = fib_get_table(net, RT_TABLE_MAIN);
-        if (!fib_table_lookup(table, flp, res))
+        if (!fib_table_lookup(table, flp, res, FIB_LOOKUP_NOREF))
                 return 0;
         return -ENETUNREACH;
 }
@@ -198,11 +214,11 @@ static inline int fib_lookup(struct net *net, const struct flowi *flp,
 extern int __net_init fib4_rules_init(struct net *net);
 extern void __net_exit fib4_rules_exit(struct net *net);
 
-#ifdef CONFIG_NET_CLS_ROUTE
-extern u32 fib_rules_tclass(struct fib_result *res);
+#ifdef CONFIG_IP_ROUTE_CLASSID
+extern u32 fib_rules_tclass(const struct fib_result *res);
 #endif
 
-extern int fib_lookup(struct net *n, struct flowi *flp, struct fib_result *res);
+extern int fib_lookup(struct net *n, struct flowi4 *flp, struct fib_result *res);
 
 extern struct fib_table *fib_new_table(struct net *net, u32 id);
 extern struct fib_table *fib_get_table(struct net *net, u32 id);
@@ -212,27 +228,26 @@ extern struct fib_table *fib_get_table(struct net *net, u32 id);
 /* Exported by fib_frontend.c */
 extern const struct nla_policy rtm_ipv4_policy[];
 extern void             ip_fib_init(void);
-extern int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
-                               struct net_device *dev, __be32 *spec_dst,
-                               u32 *itag, u32 mark);
-extern void fib_select_default(struct net *net, const struct flowi *flp,
-                               struct fib_result *res);
+extern int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
+                               u8 tos, int oif, struct net_device *dev,
+                               __be32 *spec_dst, u32 *itag);
+extern void fib_select_default(struct fib_result *res);
 
 /* Exported by fib_semantics.c */
 extern int ip_fib_check_default(__be32 gw, struct net_device *dev);
 extern int fib_sync_down_dev(struct net_device *dev, int force);
 extern int fib_sync_down_addr(struct net *net, __be32 local);
+extern void fib_update_nh_saddrs(struct net_device *dev);
 extern int fib_sync_up(struct net_device *dev);
-extern __be32  __fib_res_prefsrc(struct fib_result *res);
-extern void fib_select_multipath(const struct flowi *flp, struct fib_result *res);
+extern void fib_select_multipath(struct fib_result *res);
 
-/* Exported by fib_{hash|trie}.c */
-extern void fib_hash_init(void);
-extern struct fib_table *fib_hash_table(u32 id);
+/* Exported by fib_trie.c */
+extern void fib_trie_init(void);
+extern struct fib_table *fib_trie_table(u32 id);
 
-static inline void fib_combine_itag(u32 *itag, struct fib_result *res)
+static inline void fib_combine_itag(u32 *itag, const struct fib_result *res)
 {
-#ifdef CONFIG_NET_CLS_ROUTE
+#ifdef CONFIG_IP_ROUTE_CLASSID
 #ifdef CONFIG_IP_MULTIPLE_TABLES
         u32 rtag;
 #endif
@@ -254,16 +269,6 @@ static inline void fib_info_put(struct fib_info *fi)
                 free_fib_info(fi);
 }
 
-static inline void fib_res_put(struct fib_result *res)
-{
-        if (res->fi)
-                fib_info_put(res->fi);
-#ifdef CONFIG_IP_MULTIPLE_TABLES
-        if (res->r)
-                fib_rule_put(res->r);
-#endif
-}
-
 #ifdef CONFIG_PROC_FS
 extern int __net_init  fib_proc_init(struct net *net);
 extern void __net_exit fib_proc_exit(struct net *net);
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index f976885f686f..481f856c650f 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -8,9 +8,6 @@
 
 #include <linux/ip_vs.h>                /* definitions shared with userland */
 
-/* old ipvsadm versions still include this file directly */
-#ifdef __KERNEL__
-
 #include <asm/types.h>                  /* for __uXX types */
 
 #include <linux/sysctl.h>               /* for ctl_path */
@@ -25,7 +22,83 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>                 /* for struct ipv6hdr */
 #include <net/ipv6.h>                   /* for ipv6_addr_copy */
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#include <net/netfilter/nf_conntrack.h>
+#endif
+#include <net/net_namespace.h>          /* Netw namespace */
 
+/*
+ * Generic access of ipvs struct
+ */
+static inline struct netns_ipvs *net_ipvs(struct net* net)
+{
+        return net->ipvs;
+}
+/*
+ * Get net ptr from skb in traffic cases
+ * use skb_sknet when call is from userland (ioctl or netlink)
+ */
+static inline struct net *skb_net(const struct sk_buff *skb)
+{
+#ifdef CONFIG_NET_NS
+#ifdef CONFIG_IP_VS_DEBUG
+        /*
+         * This is used for debug only.
+         * Start with the most likely hit
+         * End with BUG
+         */
+        if (likely(skb->dev && skb->dev->nd_net))
+                return dev_net(skb->dev);
+        if (skb_dst(skb) && skb_dst(skb)->dev)
+                return dev_net(skb_dst(skb)->dev);
+        WARN(skb->sk, "Maybe skb_sknet should be used in %s() at line:%d\n",
+                      __func__, __LINE__);
+        if (likely(skb->sk && skb->sk->sk_net))
+                return sock_net(skb->sk);
+        pr_err("There is no net ptr to find in the skb in %s() line:%d\n",
+                __func__, __LINE__);
+        BUG();
+#else
+        return dev_net(skb->dev ? : skb_dst(skb)->dev);
+#endif
+#else
+        return &init_net;
+#endif
+}
+
+static inline struct net *skb_sknet(const struct sk_buff *skb)
+{
+#ifdef CONFIG_NET_NS
+#ifdef CONFIG_IP_VS_DEBUG
+        /* Start with the most likely hit */
+        if (likely(skb->sk && skb->sk->sk_net))
+                return sock_net(skb->sk);
+        WARN(skb->dev, "Maybe skb_net should be used instead in %s() line:%d\n",
+                       __func__, __LINE__);
+        if (likely(skb->dev && skb->dev->nd_net))
+                return dev_net(skb->dev);
+        pr_err("There is no net ptr to find in the skb in %s() line:%d\n",
+                __func__, __LINE__);
+        BUG();
+#else
+        return sock_net(skb->sk);
+#endif
+#else
+        return &init_net;
+#endif
+}
+/*
+ * This one needed for single_open_net since net is stored directly in
+ * private not as a struct i.e. seq_file_net can't be used.
+ */
+static inline struct net *seq_file_single_net(struct seq_file *seq)
+{
+#ifdef CONFIG_NET_NS
+        return (struct net *)seq->private;
+#else
+        return &init_net;
+#endif
+}
 
 /* Connections' size value needed by ip_vs_ctl.c */
 extern int ip_vs_conn_tab_size;
@@ -134,24 +207,24 @@ static inline const char *ip_vs_dbg_addr(int af, char *buf, size_t buf_len,
                 if (net_ratelimit())                                    \
                         printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__);  \
         } while (0)
-#define IP_VS_DBG_PKT(level, pp, skb, ofs, msg)                         \
+#define IP_VS_DBG_PKT(level, af, pp, skb, ofs, msg)                     \
         do {                                                            \
                 if (level <= ip_vs_get_debug_level())                   \
-                        pp->debug_packet(pp, skb, ofs, msg);            \
+                        pp->debug_packet(af, pp, skb, ofs, msg);        \
         } while (0)
-#define IP_VS_DBG_RL_PKT(level, pp, skb, ofs, msg)                      \
+#define IP_VS_DBG_RL_PKT(level, af, pp, skb, ofs, msg)                  \
         do {                                                            \
                 if (level <= ip_vs_get_debug_level() &&                 \
                     net_ratelimit())                                    \
-                        pp->debug_packet(pp, skb, ofs, msg);            \
+                        pp->debug_packet(af, pp, skb, ofs, msg);        \
         } while (0)
 #else   /* NO DEBUGGING at ALL */
 #define IP_VS_DBG_BUF(level, msg...)  do {} while (0)
 #define IP_VS_ERR_BUF(msg...)  do {} while (0)
 #define IP_VS_DBG(level, msg...)  do {} while (0)
 #define IP_VS_DBG_RL(msg...)  do {} while (0)
-#define IP_VS_DBG_PKT(level, pp, skb, ofs, msg)         do {} while (0)
-#define IP_VS_DBG_RL_PKT(level, pp, skb, ofs, msg)      do {} while (0)
+#define IP_VS_DBG_PKT(level, af, pp, skb, ofs, msg)     do {} while (0)
+#define IP_VS_DBG_RL_PKT(level, af, pp, skb, ofs, msg)  do {} while (0)
 #endif
 
 #define IP_VS_BUG() BUG()
@@ -256,6 +329,23 @@ struct ip_vs_seq {
                                                    before last resized pkt */
 };
 
+/*
+ * counters per cpu
+ */
+struct ip_vs_counters {
+        __u32           conns;          /* connections scheduled */
+        __u32           inpkts;         /* incoming packets */
+        __u32           outpkts;        /* outgoing packets */
+        __u64           inbytes;        /* incoming bytes */
+        __u64           outbytes;       /* outgoing bytes */
+};
+/*
+ * Stats per cpu
+ */
+struct ip_vs_cpu_stats {
+        struct ip_vs_counters   ustats;
+        struct u64_stats_sync   syncp;
+};
 
 /*
  *      IPVS statistics objects
@@ -277,10 +367,11 @@ struct ip_vs_estimator {
 };
 
 struct ip_vs_stats {
-        struct ip_vs_stats_user ustats;         /* statistics */
+        struct ip_vs_stats_user ustats;         /* statistics */
         struct ip_vs_estimator  est;            /* estimator */
-
-        spinlock_t              lock;           /* spin lock */
+        struct ip_vs_cpu_stats  *cpustats;      /* per cpu counters */
+        spinlock_t              lock;           /* spin lock */
+        struct ip_vs_stats_user ustats0;        /* reset values */
 };
 
 struct dst_entry;
@@ -288,6 +379,7 @@ struct iphdr;
 struct ip_vs_conn;
 struct ip_vs_app;
 struct sk_buff;
+struct ip_vs_proto_data;
 
 struct ip_vs_protocol {
         struct ip_vs_protocol   *next;
@@ -295,21 +387,22 @@ struct ip_vs_protocol {
         u16                     protocol;
         u16                     num_states;
         int                     dont_defrag;
-        atomic_t                appcnt;         /* counter of proto app incs */
-        int                     *timeout_table; /* protocol timeout table */
 
         void (*init)(struct ip_vs_protocol *pp);
 
         void (*exit)(struct ip_vs_protocol *pp);
 
+        void (*init_netns)(struct net *net, struct ip_vs_proto_data *pd);
+
+        void (*exit_netns)(struct net *net, struct ip_vs_proto_data *pd);
+
         int (*conn_schedule)(int af, struct sk_buff *skb,
-                             struct ip_vs_protocol *pp,
+                             struct ip_vs_proto_data *pd,
                              int *verdict, struct ip_vs_conn **cpp);
 
         struct ip_vs_conn *
         (*conn_in_get)(int af,
                        const struct sk_buff *skb,
-                       struct ip_vs_protocol *pp,
                        const struct ip_vs_iphdr *iph,
                        unsigned int proto_off,
                        int inverse);
@@ -317,7 +410,6 @@ struct ip_vs_protocol {
         struct ip_vs_conn *
         (*conn_out_get)(int af,
                         const struct sk_buff *skb,
-                        struct ip_vs_protocol *pp,
                         const struct ip_vs_iphdr *iph,
                         unsigned int proto_off,
                         int inverse);
@@ -335,40 +427,69 @@ struct ip_vs_protocol {
 
         int (*state_transition)(struct ip_vs_conn *cp, int direction,
                                 const struct sk_buff *skb,
-                                struct ip_vs_protocol *pp);
+                                struct ip_vs_proto_data *pd);
 
-        int (*register_app)(struct ip_vs_app *inc);
+        int (*register_app)(struct net *net, struct ip_vs_app *inc);
 
-        void (*unregister_app)(struct ip_vs_app *inc);
+        void (*unregister_app)(struct net *net, struct ip_vs_app *inc);
 
         int (*app_conn_bind)(struct ip_vs_conn *cp);
 
-        void (*debug_packet)(struct ip_vs_protocol *pp,
+        void (*debug_packet)(int af, struct ip_vs_protocol *pp,
                              const struct sk_buff *skb,
                              int offset,
                              const char *msg);
 
-        void (*timeout_change)(struct ip_vs_protocol *pp, int flags);
+        void (*timeout_change)(struct ip_vs_proto_data *pd, int flags);
+};
 
-        int (*set_state_timeout)(struct ip_vs_protocol *pp, char *sname, int to);
+/*
+ * protocol data per netns
+ */
+struct ip_vs_proto_data {
+        struct ip_vs_proto_data *next;
+        struct ip_vs_protocol   *pp;
+        int                     *timeout_table; /* protocol timeout table */
+        atomic_t                appcnt;         /* counter of proto app incs. */
+        struct tcp_states_t     *tcp_state_table;
 };
 
-extern struct ip_vs_protocol * ip_vs_proto_get(unsigned short proto);
+extern struct ip_vs_protocol   *ip_vs_proto_get(unsigned short proto);
+extern struct ip_vs_proto_data *ip_vs_proto_data_get(struct net *net,
+                                                     unsigned short proto);
+
+struct ip_vs_conn_param {
+        struct net                      *net;
+        const union nf_inet_addr        *caddr;
+        const union nf_inet_addr        *vaddr;
+        __be16                          cport;
+        __be16                          vport;
+        __u16                           protocol;
+        u16                             af;
+
+        const struct ip_vs_pe           *pe;
+        char                            *pe_data;
+        __u8                            pe_data_len;
+};
 
 /*
  *      IP_VS structure allocated for each dynamically scheduled connection
  */
 struct ip_vs_conn {
-        struct list_head        c_list;         /* hashed list heads */
-
+        struct hlist_node       c_list;         /* hashed list heads */
+#ifdef CONFIG_NET_NS
+        struct net              *net;           /* Name space */
+#endif
         /* Protocol, addresses and port numbers */
-        u16                      af;            /* address family */
-        union nf_inet_addr       caddr;          /* client address */
-        union nf_inet_addr       vaddr;          /* virtual address */
-        union nf_inet_addr       daddr;          /* destination address */
-        __be16                   cport;
-        __be16                   vport;
-        __be16                   dport;
+        u16                     af;             /* address family */
+        __be16                  cport;
+        __be16                  vport;
+        __be16                  dport;
+        __u32                   fwmark;         /* Fire wall mark from skb */
+        union nf_inet_addr      caddr;          /* client address */
+        union nf_inet_addr      vaddr;          /* virtual address */
+        union nf_inet_addr      daddr;          /* destination address */
+        volatile __u32          flags;          /* status flags */
         __u16                   protocol;       /* Which protocol (TCP/UDP) */
 
         /* counter and timer */
@@ -378,7 +499,6 @@ struct ip_vs_conn {
 
         /* Flags and state transition */
         spinlock_t              lock;           /* lock for state transition */
-        volatile __u16          flags;          /* status flags */
         volatile __u16          state;          /* state info */
         volatile __u16          old_state;      /* old state, to be used for
                                                  * state transition triggerd
@@ -394,6 +514,7 @@ struct ip_vs_conn {
         /* packet transmitter for different forwarding methods.  If it
            mangles the packet, it must return NF_DROP or better NF_STOLEN,
            otherwise this must be changed to a sk_buff **.
+           NF_ACCEPT can be returned when destination is local.
          */
         int (*packet_xmit)(struct sk_buff *skb, struct ip_vs_conn *cp,
                            struct ip_vs_protocol *pp);
@@ -405,8 +526,39 @@ struct ip_vs_conn {
         void                    *app_data;      /* Application private data */
         struct ip_vs_seq        in_seq;         /* incoming seq. struct */
         struct ip_vs_seq        out_seq;        /* outgoing seq. struct */
+
+        const struct ip_vs_pe   *pe;
+        char                    *pe_data;
+        __u8                    pe_data_len;
 };
 
+/*
+ *  To save some memory in conn table when name space is disabled.
+ */
+static inline struct net *ip_vs_conn_net(const struct ip_vs_conn *cp)
+{
+#ifdef CONFIG_NET_NS
+        return cp->net;
+#else
+        return &init_net;
+#endif
+}
+static inline void ip_vs_conn_net_set(struct ip_vs_conn *cp, struct net *net)
+{
+#ifdef CONFIG_NET_NS
+        cp->net = net;
+#endif
+}
+
+static inline int ip_vs_conn_net_eq(const struct ip_vs_conn *cp,
+                                    struct net *net)
+{
+#ifdef CONFIG_NET_NS
+        return cp->net == net;
+#else
+        return 1;
+#endif
+}
 
 /*
  *      Extended internal versions of struct ip_vs_service_user and
@@ -426,6 +578,7 @@ struct ip_vs_service_user_kern {
 
         /* virtual service options */
         char                    *sched_name;
+        char                    *pe_name;
         unsigned                flags;          /* virtual service flags */
         unsigned                timeout;        /* persistent timeout in sec */
         u32                     netmask;        /* persistent netmask */
@@ -465,6 +618,7 @@ struct ip_vs_service {
         unsigned                flags;    /* service status flags */
         unsigned                timeout;  /* persistent timeout in ticks */
         __be32                  netmask;  /* grouping granularity */
+        struct net              *net;
 
         struct list_head        destinations;  /* real server d-linked list */
         __u32                   num_dests;     /* number of servers */
@@ -475,6 +629,9 @@ struct ip_vs_service {
         struct ip_vs_scheduler  *scheduler;    /* bound scheduler object */
         rwlock_t                sched_lock;    /* lock sched_data */
         void                    *sched_data;   /* scheduler application data */
+
+        /* alternate persistence engine */
+        struct ip_vs_pe         *pe;
 };
 
 
@@ -487,8 +644,8 @@ struct ip_vs_dest {
         struct list_head        d_list;   /* for table with all the dests */
 
         u16                     af;             /* address family */
-        union nf_inet_addr      addr;           /* IP address of the server */
         __be16                  port;           /* port number of the server */
+        union nf_inet_addr      addr;           /* IP address of the server */
         volatile unsigned       flags;          /* dest status flags */
         atomic_t                conn_flags;     /* flags to copy to conn */
         atomic_t                weight;         /* server weight */
@@ -507,12 +664,14 @@ struct ip_vs_dest {
         spinlock_t              dst_lock;       /* lock of dst_cache */
         struct dst_entry        *dst_cache;     /* destination cache entry */
         u32                     dst_rtos;       /* RT_TOS(tos) for dst */
+        u32                     dst_cookie;
+        union nf_inet_addr      dst_saddr;
 
         /* for virtual service */
         struct ip_vs_service    *svc;           /* service it belongs to */
         __u16                   protocol;       /* which protocol (TCP/UDP) */
-        union nf_inet_addr      vaddr;          /* virtual IP address */
         __be16                  vport;          /* virtual port number */
+        union nf_inet_addr      vaddr;          /* virtual IP address */
         __u32                   vfwmark;        /* firewall mark of service */
 };
 
@@ -538,6 +697,21 @@ struct ip_vs_scheduler {
                                        const struct sk_buff *skb);
 };
 
+/* The persistence engine object */
+struct ip_vs_pe {
+        struct list_head        n_list;         /* d-linked list head */
+        char                    *name;          /* scheduler name */
+        atomic_t                refcnt;         /* reference counter */
+        struct module           *module;        /* THIS_MODULE/NULL */
+
+        /* get the connection template, if any */
+        int (*fill_param)(struct ip_vs_conn_param *p, struct sk_buff *skb);
+        bool (*ct_match)(const struct ip_vs_conn_param *p,
+                         struct ip_vs_conn *ct);
+        u32 (*hashkey_raw)(const struct ip_vs_conn_param *p, u32 initval,
+                           bool inverse);
+        int (*show_pe_data)(const struct ip_vs_conn *cp, char *buf);
+};
 
 /*
  *      The application module object (a.k.a. app incarnation)
@@ -556,11 +730,19 @@ struct ip_vs_app {
         __be16                  port;           /* port number in net order */
         atomic_t                usecnt;         /* usage counter */
 
-        /* output hook: return false if can't linearize. diff set for TCP.  */
+        /*
+         * output hook: Process packet in inout direction, diff set for TCP.
+         * Return: 0=Error, 1=Payload Not Mangled/Mangled but checksum is ok,
+         *         2=Mangled but checksum was not updated
+         */
         int (*pkt_out)(struct ip_vs_app *, struct ip_vs_conn *,
                        struct sk_buff *, int *diff);
 
-        /* input hook: return false if can't linearize. diff set for TCP. */
+        /*
+         * input hook: Process packet in outin direction, diff set for TCP.
+         * Return: 0=Error, 1=Payload Not Mangled/Mangled but checksum is ok,
+         *         2=Mangled but checksum was not updated
+         */
         int (*pkt_in)(struct ip_vs_app *, struct ip_vs_conn *,
                       struct sk_buff *, int *diff);
 
@@ -601,6 +783,171 @@ struct ip_vs_app {
         void (*timeout_change)(struct ip_vs_app *app, int flags);
 };
 
+/* IPVS in network namespace */
+struct netns_ipvs {
+        int                     gen;            /* Generation */
+        int                     enable;         /* enable like nf_hooks do */
+        /*
+         *      Hash table: for real service lookups
+         */
+        #define IP_VS_RTAB_BITS 4
+        #define IP_VS_RTAB_SIZE (1 << IP_VS_RTAB_BITS)
+        #define IP_VS_RTAB_MASK (IP_VS_RTAB_SIZE - 1)
+
+        struct list_head        rs_table[IP_VS_RTAB_SIZE];
+        /* ip_vs_app */
+        struct list_head        app_list;
+        /* ip_vs_ftp */
+        struct ip_vs_app        *ftp_app;
+        /* ip_vs_proto */
+        #define IP_VS_PROTO_TAB_SIZE    32      /* must be power of 2 */
+        struct ip_vs_proto_data *proto_data_table[IP_VS_PROTO_TAB_SIZE];
+        /* ip_vs_proto_tcp */
+#ifdef CONFIG_IP_VS_PROTO_TCP
+        #define TCP_APP_TAB_BITS        4
+        #define TCP_APP_TAB_SIZE        (1 << TCP_APP_TAB_BITS)
+        #define TCP_APP_TAB_MASK        (TCP_APP_TAB_SIZE - 1)
+        struct list_head        tcp_apps[TCP_APP_TAB_SIZE];
+        spinlock_t              tcp_app_lock;
+#endif
+        /* ip_vs_proto_udp */
+#ifdef CONFIG_IP_VS_PROTO_UDP
+        #define UDP_APP_TAB_BITS        4
+        #define UDP_APP_TAB_SIZE        (1 << UDP_APP_TAB_BITS)
+        #define UDP_APP_TAB_MASK        (UDP_APP_TAB_SIZE - 1)
+        struct list_head        udp_apps[UDP_APP_TAB_SIZE];
+        spinlock_t              udp_app_lock;
+#endif
+        /* ip_vs_proto_sctp */
+#ifdef CONFIG_IP_VS_PROTO_SCTP
+        #define SCTP_APP_TAB_BITS       4
+        #define SCTP_APP_TAB_SIZE       (1 << SCTP_APP_TAB_BITS)
+        #define SCTP_APP_TAB_MASK       (SCTP_APP_TAB_SIZE - 1)
+        /* Hash table for SCTP application incarnations  */
+        struct list_head        sctp_apps[SCTP_APP_TAB_SIZE];
+        spinlock_t              sctp_app_lock;
+#endif
+        /* ip_vs_conn */
+        atomic_t                conn_count;      /*  connection counter */
+
+        /* ip_vs_ctl */
+        struct ip_vs_stats              tot_stats;  /* Statistics & est. */
+
+        int                     num_services;    /* no of virtual services */
+
+        rwlock_t                rs_lock;         /* real services table */
+        /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
+        struct lock_class_key   ctl_key;        /* ctl_mutex debuging */
+        /* Trash for destinations */
+        struct list_head        dest_trash;
+        /* Service counters */
+        atomic_t                ftpsvc_counter;
+        atomic_t                nullsvc_counter;
+
+#ifdef CONFIG_SYSCTL
+        /* 1/rate drop and drop-entry variables */
+        struct delayed_work     defense_work;   /* Work handler */
+        int                     drop_rate;
+        int                     drop_counter;
+        atomic_t                dropentry;
+        /* locks in ctl.c */
+        spinlock_t              dropentry_lock;  /* drop entry handling */
+        spinlock_t              droppacket_lock; /* drop packet handling */
+        spinlock_t              securetcp_lock;  /* state and timeout tables */
+
+        /* sys-ctl struct */
+        struct ctl_table_header *sysctl_hdr;
+        struct ctl_table        *sysctl_tbl;
+#endif
+
+        /* sysctl variables */
+        int                     sysctl_amemthresh;
+        int                     sysctl_am_droprate;
+        int                     sysctl_drop_entry;
+        int                     sysctl_drop_packet;
+        int                     sysctl_secure_tcp;
+#ifdef CONFIG_IP_VS_NFCT
+        int                     sysctl_conntrack;
+#endif
+        int                     sysctl_snat_reroute;
+        int                     sysctl_sync_ver;
+        int                     sysctl_cache_bypass;
+        int                     sysctl_expire_nodest_conn;
+        int                     sysctl_expire_quiescent_template;
+        int                     sysctl_sync_threshold[2];
+        int                     sysctl_nat_icmp_send;
+
+        /* ip_vs_lblc */
+        int                     sysctl_lblc_expiration;
+        struct ctl_table_header *lblc_ctl_header;
+        struct ctl_table        *lblc_ctl_table;
+        /* ip_vs_lblcr */
+        int                     sysctl_lblcr_expiration;
+        struct ctl_table_header *lblcr_ctl_header;
+        struct ctl_table        *lblcr_ctl_table;
+        /* ip_vs_est */
+        struct list_head        est_list;       /* estimator list */
+        spinlock_t              est_lock;
+        struct timer_list       est_timer;      /* Estimation timer */
+        /* ip_vs_sync */
+        struct list_head        sync_queue;
+        spinlock_t              sync_lock;
+        struct ip_vs_sync_buff  *sync_buff;
+        spinlock_t              sync_buff_lock;
+        struct sockaddr_in      sync_mcast_addr;
+        struct task_struct      *master_thread;
+        struct task_struct      *backup_thread;
+        int                     send_mesg_maxlen;
+        int                     recv_mesg_maxlen;
+        volatile int            sync_state;
+        volatile int            master_syncid;
+        volatile int            backup_syncid;
+        /* multicast interface name */
+        char                    master_mcast_ifn[IP_VS_IFNAME_MAXLEN];
+        char                    backup_mcast_ifn[IP_VS_IFNAME_MAXLEN];
+        /* net name space ptr */
+        struct net              *net;            /* Needed by timer routines */
+};
+
+#define DEFAULT_SYNC_THRESHOLD  3
+#define DEFAULT_SYNC_PERIOD     50
+#define DEFAULT_SYNC_VER        1
+
+#ifdef CONFIG_SYSCTL
+
+static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sync_threshold[0];
+}
+
+static inline int sysctl_sync_period(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sync_threshold[1];
+}
+
+static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sync_ver;
+}
+
+#else
+
+static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs)
+{
+        return DEFAULT_SYNC_THRESHOLD;
+}
+
+static inline int sysctl_sync_period(struct netns_ipvs *ipvs)
+{
+        return DEFAULT_SYNC_PERIOD;
+}
+
+static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
+{
+        return DEFAULT_SYNC_VER;
+}
+
+#endif
 
 /*
  *      IPVS core functions
@@ -624,26 +971,35 @@ enum {
         IP_VS_DIR_LAST,
 };
 
-extern struct ip_vs_conn *ip_vs_conn_in_get
-(int af, int protocol, const union nf_inet_addr *s_addr, __be16 s_port,
- const union nf_inet_addr *d_addr, __be16 d_port);
+static inline void ip_vs_conn_fill_param(struct net *net, int af, int protocol,
+                                         const union nf_inet_addr *caddr,
+                                         __be16 cport,
+                                         const union nf_inet_addr *vaddr,
+                                         __be16 vport,
+                                         struct ip_vs_conn_param *p)
+{
+        p->net = net;
+        p->af = af;
+        p->protocol = protocol;
+        p->caddr = caddr;
+        p->cport = cport;
+        p->vaddr = vaddr;
+        p->vport = vport;
+        p->pe = NULL;
+        p->pe_data = NULL;
+}
 
-extern struct ip_vs_conn *ip_vs_ct_in_get
-(int af, int protocol, const union nf_inet_addr *s_addr, __be16 s_port,
- const union nf_inet_addr *d_addr, __be16 d_port);
+struct ip_vs_conn *ip_vs_conn_in_get(const struct ip_vs_conn_param *p);
+struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p);
 
 struct ip_vs_conn * ip_vs_conn_in_get_proto(int af, const struct sk_buff *skb,
-                                            struct ip_vs_protocol *pp,
                                             const struct ip_vs_iphdr *iph,
                                             unsigned int proto_off,
                                             int inverse);
 
-extern struct ip_vs_conn *ip_vs_conn_out_get
-(int af, int protocol, const union nf_inet_addr *s_addr, __be16 s_port,
- const union nf_inet_addr *d_addr, __be16 d_port);
+struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p);
 
 struct ip_vs_conn * ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,
-                                             struct ip_vs_protocol *pp,
                                              const struct ip_vs_iphdr *iph,
                                              unsigned int proto_off,
                                              int inverse);
@@ -656,18 +1012,17 @@ static inline void __ip_vs_conn_put(struct ip_vs_conn *cp)
 extern void ip_vs_conn_put(struct ip_vs_conn *cp);
 extern void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport);
 
-extern struct ip_vs_conn *
-ip_vs_conn_new(int af, int proto, const union nf_inet_addr *caddr, __be16 cport,
-               const union nf_inet_addr *vaddr, __be16 vport,
-               const union nf_inet_addr *daddr, __be16 dport, unsigned flags,
-               struct ip_vs_dest *dest);
+struct ip_vs_conn *ip_vs_conn_new(const struct ip_vs_conn_param *p,
+                                  const union nf_inet_addr *daddr,
+                                  __be16 dport, unsigned flags,
+                                  struct ip_vs_dest *dest, __u32 fwmark);
 extern void ip_vs_conn_expire_now(struct ip_vs_conn *cp);
 
 extern const char * ip_vs_state_name(__u16 proto, int state);
 
-extern void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp);
+extern void ip_vs_tcp_conn_listen(struct net *net, struct ip_vs_conn *cp);
 extern int ip_vs_check_template(struct ip_vs_conn *ct);
-extern void ip_vs_random_dropentry(void);
+extern void ip_vs_random_dropentry(struct net *net);
 extern int ip_vs_conn_init(void);
 extern void ip_vs_conn_cleanup(void);
 
@@ -731,18 +1086,34 @@ ip_vs_control_add(struct ip_vs_conn *cp, struct ip_vs_conn *ctl_cp)
         atomic_inc(&ctl_cp->n_control);
 }
 
+/*
+ * IPVS netns init & cleanup functions
+ */
+extern int __ip_vs_estimator_init(struct net *net);
+extern int __ip_vs_control_init(struct net *net);
+extern int __ip_vs_protocol_init(struct net *net);
+extern int __ip_vs_app_init(struct net *net);
+extern int __ip_vs_conn_init(struct net *net);
+extern int __ip_vs_sync_init(struct net *net);
+extern void __ip_vs_conn_cleanup(struct net *net);
+extern void __ip_vs_app_cleanup(struct net *net);
+extern void __ip_vs_protocol_cleanup(struct net *net);
+extern void __ip_vs_control_cleanup(struct net *net);
+extern void __ip_vs_estimator_cleanup(struct net *net);
+extern void __ip_vs_sync_cleanup(struct net *net);
+extern void __ip_vs_service_cleanup(struct net *net);
 
 /*
  *      IPVS application functions
  *      (from ip_vs_app.c)
  */
 #define IP_VS_APP_MAX_PORTS  8
-extern int register_ip_vs_app(struct ip_vs_app *app);
-extern void unregister_ip_vs_app(struct ip_vs_app *app);
+extern int register_ip_vs_app(struct net *net, struct ip_vs_app *app);
+extern void unregister_ip_vs_app(struct net *net, struct ip_vs_app *app);
 extern int ip_vs_bind_app(struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
 extern void ip_vs_unbind_app(struct ip_vs_conn *cp);
-extern int
-register_ip_vs_app_inc(struct ip_vs_app *app, __u16 proto, __u16 port);
+extern int register_ip_vs_app_inc(struct net *net, struct ip_vs_app *app,
+                                  __u16 proto, __u16 port);
 extern int ip_vs_app_inc_get(struct ip_vs_app *inc);
 extern void ip_vs_app_inc_put(struct ip_vs_app *inc);
 
@@ -751,19 +1122,38 @@ extern int ip_vs_app_pkt_in(struct ip_vs_conn *, struct sk_buff *skb);
 extern int ip_vs_app_init(void);
 extern void ip_vs_app_cleanup(void);
 
+void ip_vs_bind_pe(struct ip_vs_service *svc, struct ip_vs_pe *pe);
+void ip_vs_unbind_pe(struct ip_vs_service *svc);
+int register_ip_vs_pe(struct ip_vs_pe *pe);
+int unregister_ip_vs_pe(struct ip_vs_pe *pe);
+struct ip_vs_pe *ip_vs_pe_getbyname(const char *name);
+struct ip_vs_pe *__ip_vs_pe_getbyname(const char *pe_name);
+
+static inline void ip_vs_pe_get(const struct ip_vs_pe *pe)
+{
+        if (pe && pe->module)
+                __module_get(pe->module);
+}
+
+static inline void ip_vs_pe_put(const struct ip_vs_pe *pe)
+{
+        if (pe && pe->module)
+                module_put(pe->module);
+}
 
 /*
  *      IPVS protocol functions (from ip_vs_proto.c)
  */
 extern int ip_vs_protocol_init(void);
 extern void ip_vs_protocol_cleanup(void);
-extern void ip_vs_protocol_timeout_change(int flags);
+extern void ip_vs_protocol_timeout_change(struct netns_ipvs *ipvs, int flags);
 extern int *ip_vs_create_timeout_table(int *table, int size);
 extern int
 ip_vs_set_state_timeout(int *table, int num, const char *const *names,
                         const char *name, int to);
 extern void
-ip_vs_tcpudp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
+ip_vs_tcpudp_debug_packet(int af, struct ip_vs_protocol *pp,
+                          const struct sk_buff *skb,
                           int offset, const char *msg);
 
 extern struct ip_vs_protocol ip_vs_protocol_tcp;
@@ -785,24 +1175,24 @@ extern int ip_vs_unbind_scheduler(struct ip_vs_service *svc);
 extern struct ip_vs_scheduler *ip_vs_scheduler_get(const char *sched_name);
 extern void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler);
 extern struct ip_vs_conn *
-ip_vs_schedule(struct ip_vs_service *svc, const struct sk_buff *skb);
+ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,
+               struct ip_vs_proto_data *pd, int *ignored);
 extern int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
-                        struct ip_vs_protocol *pp);
+                        struct ip_vs_proto_data *pd);
+
+extern void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg);
 
 
 /*
  *      IPVS control data and functions (from ip_vs_ctl.c)
  */
-extern int sysctl_ip_vs_cache_bypass;
-extern int sysctl_ip_vs_expire_nodest_conn;
-extern int sysctl_ip_vs_expire_quiescent_template;
-extern int sysctl_ip_vs_sync_threshold[2];
-extern int sysctl_ip_vs_nat_icmp_send;
 extern struct ip_vs_stats ip_vs_stats;
 extern const struct ctl_path net_vs_ctl_path[];
+extern int sysctl_ip_vs_sync_ver;
 
+extern void ip_vs_sync_switch_mode(struct net *net, int mode);
 extern struct ip_vs_service *
-ip_vs_service_get(int af, __u32 fwmark, __u16 protocol,
+ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
                   const union nf_inet_addr *vaddr, __be16 vport);
 
 static inline void ip_vs_service_put(struct ip_vs_service *svc)
@@ -811,7 +1201,7 @@ static inline void ip_vs_service_put(struct ip_vs_service *svc)
 }
 
 extern struct ip_vs_dest *
-ip_vs_lookup_real_service(int af, __u16 protocol,
+ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
                           const union nf_inet_addr *daddr, __be16 dport);
 
 extern int ip_vs_use_count_inc(void);
@@ -819,8 +1209,9 @@ extern void ip_vs_use_count_dec(void);
 extern int ip_vs_control_init(void);
 extern void ip_vs_control_cleanup(void);
 extern struct ip_vs_dest *
-ip_vs_find_dest(int af, const union nf_inet_addr *daddr, __be16 dport,
-                const union nf_inet_addr *vaddr, __be16 vport, __u16 protocol);
+ip_vs_find_dest(struct net *net, int af, const union nf_inet_addr *daddr,
+                __be16 dport, const union nf_inet_addr *vaddr, __be16 vport,
+                __u16 protocol, __u32 fwmark);
 extern struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp);
 
 
@@ -828,14 +1219,12 @@ extern struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp);
  *      IPVS sync daemon data and function prototypes
  *      (from ip_vs_sync.c)
  */
-extern volatile int ip_vs_sync_state;
-extern volatile int ip_vs_master_syncid;
-extern volatile int ip_vs_backup_syncid;
-extern char ip_vs_master_mcast_ifn[IP_VS_IFNAME_MAXLEN];
-extern char ip_vs_backup_mcast_ifn[IP_VS_IFNAME_MAXLEN];
-extern int start_sync_thread(int state, char *mcast_ifn, __u8 syncid);
-extern int stop_sync_thread(int state);
-extern void ip_vs_sync_conn(struct ip_vs_conn *cp);
+extern int start_sync_thread(struct net *net, int state, char *mcast_ifn,
+                             __u8 syncid);
+extern int stop_sync_thread(struct net *net, int state);
+extern void ip_vs_sync_conn(struct net *net, struct ip_vs_conn *cp);
+extern int ip_vs_sync_init(void);
+extern void ip_vs_sync_cleanup(void);
 
 
 /*
@@ -843,9 +1232,11 @@ extern void ip_vs_sync_conn(struct ip_vs_conn *cp);
  */
 extern int ip_vs_estimator_init(void);
 extern void ip_vs_estimator_cleanup(void);
-extern void ip_vs_new_estimator(struct ip_vs_stats *stats);
-extern void ip_vs_kill_estimator(struct ip_vs_stats *stats);
+extern void ip_vs_start_estimator(struct net *net, struct ip_vs_stats *stats);
+extern void ip_vs_stop_estimator(struct net *net, struct ip_vs_stats *stats);
 extern void ip_vs_zero_estimator(struct ip_vs_stats *stats);
+extern void ip_vs_read_estimator(struct ip_vs_stats_user *dst,
+                                 struct ip_vs_stats *stats);
 
 /*
  *      Various IPVS packet transmitters (from ip_vs_xmit.c)
@@ -861,7 +1252,8 @@ extern int ip_vs_tunnel_xmit
 extern int ip_vs_dr_xmit
 (struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
 extern int ip_vs_icmp_xmit
-(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp, int offset);
+(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,
+ int offset, unsigned int hooknum);
 extern void ip_vs_dst_reset(struct ip_vs_dest *dest);
 
 #ifdef CONFIG_IP_VS_IPV6
@@ -875,24 +1267,28 @@ extern int ip_vs_dr_xmit_v6
 (struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
 extern int ip_vs_icmp_xmit_v6
 (struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,
- int offset);
+ int offset, unsigned int hooknum);
 #endif
 
+#ifdef CONFIG_SYSCTL
 /*
  *      This is a simple mechanism to ignore packets when
  *      we are loaded. Just set ip_vs_drop_rate to 'n' and
  *      we start to drop 1/rate of the packets
  */
-extern int ip_vs_drop_rate;
-extern int ip_vs_drop_counter;
 
-static __inline__ int ip_vs_todrop(void)
+static inline int ip_vs_todrop(struct netns_ipvs *ipvs)
 {
-        if (!ip_vs_drop_rate) return 0;
-        if (--ip_vs_drop_counter > 0) return 0;
-        ip_vs_drop_counter = ip_vs_drop_rate;
+        if (!ipvs->drop_rate)
+                return 0;
+        if (--ipvs->drop_counter > 0)
+                return 0;
+        ipvs->drop_counter = ipvs->drop_rate;
         return 1;
 }
+#else
+static inline int ip_vs_todrop(struct netns_ipvs *ipvs) { return 0; }
+#endif
 
 /*
  *      ip_vs_fwd_tag returns the forwarding tag of the connection
@@ -955,9 +1351,82 @@ static inline __wsum ip_vs_check_diff2(__be16 old, __be16 new, __wsum oldsum)
         return csum_partial(diff, sizeof(diff), oldsum);
 }
 
+/*
+ * Forget current conntrack (unconfirmed) and attach notrack entry
+ */
+static inline void ip_vs_notrack(struct sk_buff *skb)
+{
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+
+        if (!ct || !nf_ct_is_untracked(ct)) {
+                nf_reset(skb);
+                skb->nfct = &nf_ct_untracked_get()->ct_general;
+                skb->nfctinfo = IP_CT_NEW;
+                nf_conntrack_get(skb->nfct);
+        }
+#endif
+}
+
+#ifdef CONFIG_IP_VS_NFCT
+/*
+ *      Netfilter connection tracking
+ *      (from ip_vs_nfct.c)
+ */
+static inline int ip_vs_conntrack_enabled(struct netns_ipvs *ipvs)
+{
+#ifdef CONFIG_SYSCTL
+        return ipvs->sysctl_conntrack;
+#else
+        return 0;
+#endif
+}
+
 extern void ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp,
                                    int outin);
+extern int ip_vs_confirm_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp);
+extern void ip_vs_nfct_expect_related(struct sk_buff *skb, struct nf_conn *ct,
+                                      struct ip_vs_conn *cp, u_int8_t proto,
+                                      const __be16 port, int from_rs);
+extern void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp);
+
+#else
+
+static inline int ip_vs_conntrack_enabled(struct netns_ipvs *ipvs)
+{
+        return 0;
+}
 
-#endif /* __KERNEL__ */
+static inline void ip_vs_update_conntrack(struct sk_buff *skb,
+                                          struct ip_vs_conn *cp, int outin)
+{
+}
+
+static inline int ip_vs_confirm_conntrack(struct sk_buff *skb,
+                                          struct ip_vs_conn *cp)
+{
+        return NF_ACCEPT;
+}
+
+static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp)
+{
+}
+/* CONFIG_IP_VS_NFCT */
+#endif
+
+static inline unsigned int
+ip_vs_dest_conn_overhead(struct ip_vs_dest *dest)
+{
+        /*
+         * We think the overhead of processing active connections is 256
+         * times higher than that of inactive connections in average. (This
+         * 256 times might not be accurate, we will change it later) We
+         * use the following formula to estimate the overhead now:
+         *                dest->activeconns*256 + dest->inactconns
+         */
+        return (atomic_read(&dest->activeconns) << 8) +
+                atomic_read(&dest->inactconns);
+}
 
 #endif  /* _NET_IP_VS_H */
diff --git a/include/net/ipip.h b/include/net/ipip.h
index 65caea8b414f..a32654d52730 100644
--- a/include/net/ipip.h
+++ b/include/net/ipip.h
@@ -16,7 +16,7 @@ struct ip_tunnel_6rd_parm {
 };
 
 struct ip_tunnel {
-        struct ip_tunnel        *next;
+        struct ip_tunnel __rcu  *next;
         struct net_device       *dev;
 
         int                     err_count;      /* Number of arrived ICMP errors */
@@ -34,18 +34,18 @@ struct ip_tunnel {
 #ifdef CONFIG_IPV6_SIT_6RD
         struct ip_tunnel_6rd_parm       ip6rd;
 #endif
-        struct ip_tunnel_prl_entry      *prl;           /* potential router list */
+        struct ip_tunnel_prl_entry __rcu *prl;          /* potential router list */
         unsigned int                    prl_count;      /* # of entries in PRL */
 };
 
 struct ip_tunnel_prl_entry {
-        struct ip_tunnel_prl_entry      *next;
+        struct ip_tunnel_prl_entry __rcu *next;
         __be32                          addr;
         u16                             flags;
         struct rcu_head                 rcu_head;
 };
 
-#define IPTUNNEL_XMIT() do {                                            \
+#define __IPTUNNEL_XMIT(stats1, stats2) do {                            \
         int err;                                                        \
         int pkt_len = skb->len - skb_transport_offset(skb);             \
                                                                         \
@@ -54,12 +54,14 @@ struct ip_tunnel_prl_entry {
                                                                         \
         err = ip_local_out(skb);                                        \
         if (likely(net_xmit_eval(err) == 0)) {                          \
-                txq->tx_bytes += pkt_len;                               \
-                txq->tx_packets++;                                      \
+                (stats1)->tx_bytes += pkt_len;                          \
+                (stats1)->tx_packets++;                                 \
         } else {                                                        \
-                stats->tx_errors++;                                     \
-                stats->tx_aborted_errors++;                             \
+                (stats2)->tx_errors++;                                  \
+                (stats2)->tx_aborted_errors++;                          \
         }                                                               \
 } while (0)
 
+#define IPTUNNEL_XMIT() __IPTUNNEL_XMIT(txq, stats)
+
 #endif
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 1f8412410998..c033ed00df7d 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -77,11 +77,9 @@
 /*
  *      Addr scopes
  */
-#ifdef __KERNEL__
 #define IPV6_ADDR_MC_SCOPE(a)   \
         ((a)->s6_addr[1] & 0x0f)        /* nonstandard */
 #define __IPV6_ADDR_SCOPE_INVALID       -1
-#endif
 #define IPV6_ADDR_SCOPE_NODELOCAL       0x01
 #define IPV6_ADDR_SCOPE_LINKLOCAL       0x02
 #define IPV6_ADDR_SCOPE_SITELOCAL       0x05
@@ -89,6 +87,16 @@
 #define IPV6_ADDR_SCOPE_GLOBAL          0x0e
 
 /*
+ *      Addr flags
+ */
+#define IPV6_ADDR_MC_FLAG_TRANSIENT(a)  \
+        ((a)->s6_addr[1] & 0x10)
+#define IPV6_ADDR_MC_FLAG_PREFIX(a)     \
+        ((a)->s6_addr[1] & 0x20)
+#define IPV6_ADDR_MC_FLAG_RENDEZVOUS(a) \
+        ((a)->s6_addr[1] & 0x40)
+
+/*
  *      fragmentation header
  */
 
@@ -101,8 +109,6 @@ struct frag_hdr {
 
 #define IP6_MF  0x0001
 
-#ifdef __KERNEL__
-
 #include <net/sock.h>
 
 /* sysctls */
@@ -117,6 +123,15 @@ extern struct ctl_path net_ipv6_ctl_path[];
         SNMP_INC_STATS##modifier((net)->mib.statname##_statistics, (field));\
 })
 
+/* per device counters are atomic_long_t */
+#define _DEVINCATOMIC(net, statname, modifier, idev, field)             \
+({                                                                      \
+        struct inet6_dev *_idev = (idev);                               \
+        if (likely(_idev != NULL))                                      \
+                SNMP_INC_STATS_ATOMIC_LONG((_idev)->stats.statname##dev, (field)); \
+        SNMP_INC_STATS##modifier((net)->mib.statname##_statistics, (field));\
+})
+
 #define _DEVADD(net, statname, modifier, idev, field, val)              \
 ({                                                                      \
         struct inet6_dev *_idev = (idev);                               \
@@ -148,16 +163,16 @@ extern struct ctl_path net_ipv6_ctl_path[];
 #define IP6_UPD_PO_STATS_BH(net, idev,field,val)   \
                 _DEVUPD(net, ipv6, 64_BH, idev, field, val)
 #define ICMP6_INC_STATS(net, idev, field)       \
-                _DEVINC(net, icmpv6, , idev, field)
+                _DEVINCATOMIC(net, icmpv6, , idev, field)
 #define ICMP6_INC_STATS_BH(net, idev, field)    \
-                _DEVINC(net, icmpv6, _BH, idev, field)
+                _DEVINCATOMIC(net, icmpv6, _BH, idev, field)
 
 #define ICMP6MSGOUT_INC_STATS(net, idev, field)         \
-        _DEVINC(net, icmpv6msg, , idev, field +256)
+        _DEVINCATOMIC(net, icmpv6msg, , idev, field +256)
 #define ICMP6MSGOUT_INC_STATS_BH(net, idev, field)      \
-        _DEVINC(net, icmpv6msg, _BH, idev, field +256)
+        _DEVINCATOMIC(net, icmpv6msg, _BH, idev, field +256)
 #define ICMP6MSGIN_INC_STATS_BH(net, idev, field)       \
-        _DEVINC(net, icmpv6msg, _BH, idev, field)
+        _DEVINCATOMIC(net, icmpv6msg, _BH, idev, field)
 
 struct ip6_ra_chain {
         struct ip6_ra_chain     *next;
@@ -262,7 +277,7 @@ static inline int ipv6_addr_scope(const struct in6_addr *addr)
 
 static inline int __ipv6_addr_src_scope(int type)
 {
-        return (type == IPV6_ADDR_ANY ? __IPV6_ADDR_SCOPE_INVALID : (type >> 16));
+        return (type == IPV6_ADDR_ANY) ? __IPV6_ADDR_SCOPE_INVALID : (type >> 16);
 }
 
 static inline int ipv6_addr_src_scope(const struct in6_addr *addr)
@@ -279,10 +294,10 @@ static inline int
 ipv6_masked_addr_cmp(const struct in6_addr *a1, const struct in6_addr *m,
                      const struct in6_addr *a2)
 {
-        return (!!(((a1->s6_addr32[0] ^ a2->s6_addr32[0]) & m->s6_addr32[0]) |
-                   ((a1->s6_addr32[1] ^ a2->s6_addr32[1]) & m->s6_addr32[1]) |
-                   ((a1->s6_addr32[2] ^ a2->s6_addr32[2]) & m->s6_addr32[2]) |
-                   ((a1->s6_addr32[3] ^ a2->s6_addr32[3]) & m->s6_addr32[3])));
+        return !!(((a1->s6_addr32[0] ^ a2->s6_addr32[0]) & m->s6_addr32[0]) |
+                  ((a1->s6_addr32[1] ^ a2->s6_addr32[1]) & m->s6_addr32[1]) |
+                  ((a1->s6_addr32[2] ^ a2->s6_addr32[2]) & m->s6_addr32[2]) |
+                  ((a1->s6_addr32[3] ^ a2->s6_addr32[3]) & m->s6_addr32[3]));
 }
 
 static inline void ipv6_addr_copy(struct in6_addr *a1, const struct in6_addr *a2)
@@ -317,10 +332,10 @@ static inline void ipv6_addr_set(struct in6_addr *addr,
 static inline int ipv6_addr_equal(const struct in6_addr *a1,
                                   const struct in6_addr *a2)
 {
-        return (((a1->s6_addr32[0] ^ a2->s6_addr32[0]) |
-                 (a1->s6_addr32[1] ^ a2->s6_addr32[1]) |
-                 (a1->s6_addr32[2] ^ a2->s6_addr32[2]) |
-                 (a1->s6_addr32[3] ^ a2->s6_addr32[3])) == 0);
+        return ((a1->s6_addr32[0] ^ a2->s6_addr32[0]) |
+                (a1->s6_addr32[1] ^ a2->s6_addr32[1]) |
+                (a1->s6_addr32[2] ^ a2->s6_addr32[2]) |
+                (a1->s6_addr32[3] ^ a2->s6_addr32[3])) == 0;
 }
 
 static inline int __ipv6_prefix_equal(const __be32 *a1, const __be32 *a2,
@@ -364,8 +379,8 @@ enum ip6_defrag_users {
 struct ip6_create_arg {
         __be32 id;
         u32 user;
-        struct in6_addr *src;
-        struct in6_addr *dst;
+        const struct in6_addr *src;
+        const struct in6_addr *dst;
 };
 
 void ip6_frag_init(struct inet_frag_queue *q, void *a);
@@ -373,20 +388,20 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a);
 
 static inline int ipv6_addr_any(const struct in6_addr *a)
 {
-        return ((a->s6_addr32[0] | a->s6_addr32[1] | 
-                 a->s6_addr32[2] | a->s6_addr32[3] ) == 0); 
+        return (a->s6_addr32[0] | a->s6_addr32[1] |
+                a->s6_addr32[2] | a->s6_addr32[3]) == 0;
 }
 
 static inline int ipv6_addr_loopback(const struct in6_addr *a)
 {
-        return ((a->s6_addr32[0] | a->s6_addr32[1] |
-                 a->s6_addr32[2] | (a->s6_addr32[3] ^ htonl(1))) == 0);
+        return (a->s6_addr32[0] | a->s6_addr32[1] |
+                a->s6_addr32[2] | (a->s6_addr32[3] ^ htonl(1))) == 0;
 }
 
 static inline int ipv6_addr_v4mapped(const struct in6_addr *a)
 {
-        return ((a->s6_addr32[0] | a->s6_addr32[1] |
-                 (a->s6_addr32[2] ^ htonl(0x0000ffff))) == 0);
+        return (a->s6_addr32[0] | a->s6_addr32[1] |
+                 (a->s6_addr32[2] ^ htonl(0x0000ffff))) == 0;
 }
 
 /*
@@ -395,8 +410,7 @@ static inline int ipv6_addr_v4mapped(const struct in6_addr *a)
  */
 static inline int ipv6_addr_orchid(const struct in6_addr *a)
 {
-        return ((a->s6_addr32[0] & htonl(0xfffffff0))
-                == htonl(0x20010010));
+        return (a->s6_addr32[0] & htonl(0xfffffff0)) == htonl(0x20010010);
 }
 
 static inline void ipv6_addr_set_v4mapped(const __be32 addr,
@@ -441,7 +455,7 @@ static inline int __ipv6_addr_diff(const void *token1, const void *token2, int a
          *      if returned value is greater than prefix length.
          *                                      --ANK (980803)
          */
-        return (addrlen << 5);
+        return addrlen << 5;
 }
 
 static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_addr *a2)
@@ -481,7 +495,7 @@ extern int			ip6_rcv_finish(struct sk_buff *skb);
  */
 extern int                      ip6_xmit(struct sock *sk,
                                          struct sk_buff *skb,
-                                         struct flowi *fl,
+                                         struct flowi6 *fl6,
                                          struct ipv6_txoptions *opt);
 
 extern int                      ip6_nd_hdr(struct sock *sk,
@@ -501,7 +515,7 @@ extern int			ip6_append_data(struct sock *sk,
                                                 int hlimit,
                                                 int tclass,
                                                 struct ipv6_txoptions *opt,
-                                                struct flowi *fl,
+                                                struct flowi6 *fl6,
                                                 struct rt6_info *rt,
                                                 unsigned int flags,
                                                 int dontfrag);
@@ -512,13 +526,17 @@ extern void			ip6_flush_pending_frames(struct sock *sk);
 
 extern int                      ip6_dst_lookup(struct sock *sk,
                                                struct dst_entry **dst,
-                                               struct flowi *fl);
-extern int                      ip6_dst_blackhole(struct sock *sk,
-                                                  struct dst_entry **dst,
-                                                  struct flowi *fl);
-extern int                      ip6_sk_dst_lookup(struct sock *sk,
-                                                  struct dst_entry **dst,
-                                                  struct flowi *fl);
+                                               struct flowi6 *fl6);
+extern struct dst_entry *       ip6_dst_lookup_flow(struct sock *sk,
+                                                    struct flowi6 *fl6,
+                                                    const struct in6_addr *final_dst,
+                                                    bool can_sleep);
+extern struct dst_entry *       ip6_sk_dst_lookup_flow(struct sock *sk,
+                                                       struct flowi6 *fl6,
+                                                       const struct in6_addr *final_dst,
+                                                       bool can_sleep);
+extern struct dst_entry *       ip6_blackhole_route(struct net *net,
+                                                    struct dst_entry *orig_dst);
 
 /*
  *      skb processing functions
@@ -551,7 +569,7 @@ extern int 			ipv6_ext_hdr(u8 nexthdr);
 
 extern int ipv6_find_tlv(struct sk_buff *skb, int offset, int type);
 
-extern struct in6_addr *fl6_update_dst(struct flowi *fl,
+extern struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
                                        const struct ipv6_txoptions *opt,
                                        struct in6_addr *orig);
 
@@ -585,8 +603,8 @@ extern int 			ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len);
 extern int                      ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len);
 extern void                     ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
                                                 u32 info, u8 *payload);
-extern void                     ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info);
-extern void                     ipv6_local_rxpmtu(struct sock *sk, struct flowi *fl, u32 mtu);
+extern void                     ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info);
+extern void                     ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu);
 
 extern int inet6_release(struct socket *sock);
 extern int inet6_bind(struct socket *sock, struct sockaddr *uaddr, 
@@ -652,5 +670,4 @@ extern int ipv6_static_sysctl_register(void);
 extern void ipv6_static_sysctl_unregister(void);
 #endif
 
-#endif /* __KERNEL__ */
 #endif /* _NET_IPV6_H */
diff --git a/include/net/ipx.h b/include/net/ipx.h
index 05d7e4a88b49..c1fec6b464cc 100644
--- a/include/net/ipx.h
+++ b/include/net/ipx.h
@@ -80,7 +80,6 @@ struct ipx_route {
         atomic_t                refcnt;
 };
 
-#ifdef __KERNEL__
 struct ipx_cb {
         u8      ipx_tctrl;
         __be32  ipx_dest_net;
@@ -116,7 +115,6 @@ static inline struct ipx_sock *ipx_sk(struct sock *sk)
 }
 
 #define IPX_SKB_CB(__skb) ((struct ipx_cb *)&((__skb)->cb[0]))
-#endif
 
 #define IPX_MIN_EPHEMERAL_SOCKET        0x4000
 #define IPX_MAX_EPHEMERAL_SOCKET        0x7fff
diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
index eea2e6152389..59ba38bc400f 100644
--- a/include/net/irda/ircomm_tty.h
+++ b/include/net/irda/ircomm_tty.h
@@ -120,10 +120,10 @@ struct ircomm_tty_cb {
 void ircomm_tty_start(struct tty_struct *tty);
 void ircomm_tty_check_modem_status(struct ircomm_tty_cb *self);
 
-extern int ircomm_tty_tiocmget(struct tty_struct *tty, struct file *file);
-extern int ircomm_tty_tiocmset(struct tty_struct *tty, struct file *file,
+extern int ircomm_tty_tiocmget(struct tty_struct *tty);
+extern int ircomm_tty_tiocmset(struct tty_struct *tty,
                                unsigned int set, unsigned int clear);
-extern int ircomm_tty_ioctl(struct tty_struct *tty, struct file *file, 
+extern int ircomm_tty_ioctl(struct tty_struct *tty, 
                             unsigned int cmd, unsigned long arg);
 extern void ircomm_tty_set_termios(struct tty_struct *tty, 
                                    struct ktermios *old_termios);
diff --git a/include/net/irda/irlan_common.h b/include/net/irda/irlan_common.h
index 73cacb3ac16c..0af8b8dfbc22 100644
--- a/include/net/irda/irlan_common.h
+++ b/include/net/irda/irlan_common.h
@@ -171,7 +171,6 @@ struct irlan_cb {
         int    magic;
         struct list_head  dev_list;
         struct net_device *dev;        /* Ethernet device structure*/
-        struct net_device_stats stats;
 
         __u32 saddr;               /* Source device address */
         __u32 daddr;               /* Destination device address */
diff --git a/include/net/irda/irlan_event.h b/include/net/irda/irlan_event.h
index 6d9539f05806..018b5a77e610 100644
--- a/include/net/irda/irlan_event.h
+++ b/include/net/irda/irlan_event.h
@@ -67,7 +67,7 @@ typedef enum {
         IRLAN_WATCHDOG_TIMEOUT,
 } IRLAN_EVENT;
 
-extern char *irlan_state[];
+extern const char * const irlan_state[];
 
 void irlan_do_client_event(struct irlan_cb *self, IRLAN_EVENT event, 
                            struct sk_buff *skb);
diff --git a/include/net/irda/irlap.h b/include/net/irda/irlap.h
index 9d0c78ea92f5..fb4b76d5d7f1 100644
--- a/include/net/irda/irlap.h
+++ b/include/net/irda/irlap.h
@@ -204,7 +204,7 @@ struct irlap_cb {
 
         notify_t notify; /* Callbacks to IrLMP */
 
-        int    mtt_required;  /* Minumum turnaround time required */
+        int    mtt_required;  /* Minimum turnaround time required */
         int    xbofs_delay;   /* Nr of XBOF's used to MTT */
         int    bofs_count;    /* Negotiated extra BOFs */
         int    next_bofs;     /* Negotiated extra BOFs after next frame */
@@ -282,7 +282,7 @@ static inline int irlap_is_primary(struct irlap_cb *self)
         default:
                 ret = -1;
         }
-        return(ret);
+        return ret;
 }
 
 /* Clear a pending IrLAP disconnect. - Jean II */
diff --git a/include/net/irda/irlmp.h b/include/net/irda/irlmp.h
index 3ffc1d0f93d6..fff11b7fe8a4 100644
--- a/include/net/irda/irlmp.h
+++ b/include/net/irda/irlmp.h
@@ -274,7 +274,7 @@ static inline int irlmp_lap_tx_queue_full(struct lsap_cb *self)
         if (self->lap->irlap == NULL)
                 return 0;
 
-        return(IRLAP_GET_TX_QUEUE_LEN(self->lap->irlap) >= LAP_HIGH_THRESHOLD);
+        return IRLAP_GET_TX_QUEUE_LEN(self->lap->irlap) >= LAP_HIGH_THRESHOLD;
 }
 
 /* After doing a irlmp_dup(), this get one of the two socket back into
diff --git a/include/net/irda/irttp.h b/include/net/irda/irttp.h
index 11aee7a2972a..af4b87721d13 100644
--- a/include/net/irda/irttp.h
+++ b/include/net/irda/irttp.h
@@ -204,7 +204,7 @@ static inline int irttp_is_primary(struct tsap_cb *self)
             (self->lsap->lap == NULL) ||
             (self->lsap->lap->irlap == NULL))
                 return -2;
-        return(irlap_is_primary(self->lsap->lap->irlap));
+        return irlap_is_primary(self->lsap->lap->irlap);
 }
 
 #endif /* IRTTP_H */
diff --git a/include/net/irda/wrapper.h b/include/net/irda/wrapper.h
index 2942ad6ab932..eef53ebe3d76 100644
--- a/include/net/irda/wrapper.h
+++ b/include/net/irda/wrapper.h
@@ -42,7 +42,7 @@
 
 #define IRDA_TRANS 0x20    /* Asynchronous transparency modifier */       
 
-/* States for receving a frame in async mode */
+/* States for receiving a frame in async mode */
 enum {
         OUTSIDE_FRAME, 
         BEGIN_FRAME, 
diff --git a/include/net/iucv/iucv.h b/include/net/iucv/iucv.h
index 205a3360156e..1121baa9f695 100644
--- a/include/net/iucv/iucv.h
+++ b/include/net/iucv/iucv.h
@@ -173,7 +173,7 @@ struct iucv_handler {
         /*
          * The message_pending function is called after an icuv interrupt
          * type 0x06 or type 0x07 has been received. A new message is
-         * availabe and can be received with iucv_message_receive.
+         * available and can be received with iucv_message_receive.
          */
         void (*message_pending)(struct iucv_path *, struct iucv_message *);
         /*
diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index 3afdb21cc31d..5d5a6a4732ef 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -91,7 +91,7 @@
  * --------------------
  * The implementation goals were as follow :
  *      o Obvious : you should not need a PhD to understand what's happening,
- *              the benefit is easier maintainance.
+ *              the benefit is easier maintenance.
  *      o Flexible : it should accommodate a wide variety of driver
  *              implementations and be as flexible as the old API.
  *      o Lean : it should be efficient memory wise to minimise the impact
@@ -129,7 +129,7 @@
  *
  * Functions prototype uses union iwreq_data
  * -----------------------------------------
- * Some would have prefered functions defined this way :
+ * Some would have preferred functions defined this way :
  *      static int mydriver_ioctl_setrate(struct net_device *dev, 
  *                                        long rate, int auto)
  * 1) The kernel code doesn't "validate" the content of iwreq_data, and
diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
index 75b8e2968c9b..f57e7d46a453 100644
--- a/include/net/llc_pdu.h
+++ b/include/net/llc_pdu.h
@@ -199,7 +199,7 @@ struct llc_pdu_sn {
         u8 ssap;
         u8 ctrl_1;
         u8 ctrl_2;
-};
+} __packed;
 
 static inline struct llc_pdu_sn *llc_pdu_sn_hdr(struct sk_buff *skb)
 {
@@ -211,7 +211,7 @@ struct llc_pdu_un {
         u8 dsap;
         u8 ssap;
         u8 ctrl_1;
-};
+} __packed;
 
 static inline struct llc_pdu_un *llc_pdu_un_hdr(struct sk_buff *skb)
 {
@@ -359,7 +359,7 @@ struct llc_xid_info {
         u8 fmt_id;      /* always 0x81 for LLC */
         u8 type;        /* different if NULL/non-NULL LSAP */
         u8 rw;          /* sender receive window */
-};
+} __packed;
 
 /**
  *      llc_pdu_init_as_xid_cmd - sets bytes 3, 4 & 5 of LLC header as XID
@@ -415,7 +415,7 @@ struct llc_frmr_info {
         u8  curr_ssv;           /* current send state variable val */
         u8  curr_rsv;           /* current receive state variable */
         u8  ind_bits;           /* indicator bits set with macro */
-};
+} __packed;
 
 extern void llc_pdu_set_cmd_rsp(struct sk_buff *skb, u8 type);
 extern void llc_pdu_set_pf_bit(struct sk_buff *skb, u8 bit_value);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index b0787a1dea90..e6d6a66a8f71 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -97,6 +97,20 @@ enum ieee80211_max_queues {
 };
 
 /**
+ * enum ieee80211_ac_numbers - AC numbers as used in mac80211
+ * @IEEE80211_AC_VO: voice
+ * @IEEE80211_AC_VI: video
+ * @IEEE80211_AC_BE: best effort
+ * @IEEE80211_AC_BK: background
+ */
+enum ieee80211_ac_numbers {
+        IEEE80211_AC_VO         = 0,
+        IEEE80211_AC_VI         = 1,
+        IEEE80211_AC_BE         = 2,
+        IEEE80211_AC_BK         = 3,
+};
+
+/**
  * struct ieee80211_tx_queue_params - transmit queue configuration
  *
  * The information provided in this structure is required for QoS
@@ -149,6 +163,7 @@ struct ieee80211_low_level_stats {
  * @BSS_CHANGED_ARP_FILTER: Hardware ARP filter address list or state changed.
  * @BSS_CHANGED_QOS: QoS for this association was enabled/disabled. Note
  *      that it is only ever disabled for station mode.
+ * @BSS_CHANGED_IDLE: Idle changed for this BSS/interface.
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
@@ -165,6 +180,7 @@ enum ieee80211_bss_change {
         BSS_CHANGED_IBSS                = 1<<11,
         BSS_CHANGED_ARP_FILTER          = 1<<12,
         BSS_CHANGED_QOS                 = 1<<13,
+        BSS_CHANGED_IDLE                = 1<<14,
 
         /* when adding here, make sure to change ieee80211_reconfig */
 };
@@ -203,6 +219,7 @@ enum ieee80211_bss_change {
  * @basic_rates: bitmap of basic rates, each bit stands for an
  *      index into the rate table configured by the driver in
  *      the current band.
+ * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
  * @bssid: The BSSID for this BSS
  * @enable_beacon: whether beaconing should be enabled or not
  * @channel_type: Channel type for this BSS -- the hardware might be
@@ -223,6 +240,9 @@ enum ieee80211_bss_change {
  *      hardware must not perform any ARP filtering. Note, that the filter will
  *      be enabled also in promiscuous mode.
  * @qos: This is a QoS-enabled BSS.
+ * @idle: This interface is idle. There's also a global idle flag in the
+ *      hardware config which may be more appropriate depending on what
+ *      your driver/device needs to do.
  */
 struct ieee80211_bss_conf {
         const u8 *bssid;
@@ -239,6 +259,7 @@ struct ieee80211_bss_conf {
         u16 assoc_capability;
         u64 timestamp;
         u32 basic_rates;
+        int mcast_rate[IEEE80211_NUM_BANDS];
         u16 ht_operation_mode;
         s32 cqm_rssi_thold;
         u32 cqm_rssi_hyst;
@@ -247,6 +268,7 @@ struct ieee80211_bss_conf {
         u8 arp_addr_cnt;
         bool arp_filter_enabled;
         bool qos;
+        bool idle;
 };
 
 /**
@@ -315,6 +337,16 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_LDPC: tells the driver to use LDPC for this frame
  * @IEEE80211_TX_CTL_STBC: Enables Space-Time Block Coding (STBC) for this
  *      frame and selects the maximum number of streams that it can use.
+ * @IEEE80211_TX_CTL_TX_OFFCHAN: Marks this packet to be transmitted on
+ *      the off-channel channel when a remain-on-channel offload is done
+ *      in hardware -- normal packets still flow and are expected to be
+ *      handled properly by the device.
+ * @IEEE80211_TX_INTFL_TKIP_MIC_FAILURE: Marks this packet to be used for TKIP
+ *      testing. It will be sent out with incorrect Michael MIC key to allow
+ *      TKIP countermeasures to be tested.
+ *
+ * Note: If you have to add new flags to the enumeration, then don't
+ *       forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -340,10 +372,25 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_INTFL_NL80211_FRAME_TX     = BIT(21),
         IEEE80211_TX_CTL_LDPC                   = BIT(22),
         IEEE80211_TX_CTL_STBC                   = BIT(23) | BIT(24),
+        IEEE80211_TX_CTL_TX_OFFCHAN             = BIT(25),
+        IEEE80211_TX_INTFL_TKIP_MIC_FAILURE     = BIT(26),
 };
 
 #define IEEE80211_TX_CTL_STBC_SHIFT             23
 
+/*
+ * This definition is used as a mask to clear all temporary flags, which are
+ * set by the tx handlers for each transmission attempt by the mac80211 stack.
+ */
+#define IEEE80211_TX_TEMPORARY_FLAGS (IEEE80211_TX_CTL_NO_ACK |               \
+        IEEE80211_TX_CTL_CLEAR_PS_FILT | IEEE80211_TX_CTL_FIRST_FRAGMENT |    \
+        IEEE80211_TX_CTL_SEND_AFTER_DTIM | IEEE80211_TX_CTL_AMPDU |           \
+        IEEE80211_TX_STAT_TX_FILTERED | IEEE80211_TX_STAT_ACK |               \
+        IEEE80211_TX_STAT_AMPDU | IEEE80211_TX_STAT_AMPDU_NO_BACK |           \
+        IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_PSPOLL_RESPONSE | \
+        IEEE80211_TX_CTL_MORE_FRAMES | IEEE80211_TX_CTL_LDPC |                \
+        IEEE80211_TX_CTL_STBC)
+
 /**
  * enum mac80211_rate_control_flags - per-rate flags set by the
  *      Rate Control algorithm.
@@ -490,6 +537,21 @@ struct ieee80211_tx_info {
         };
 };
 
+/**
+ * struct ieee80211_sched_scan_ies - scheduled scan IEs
+ *
+ * This structure is used to pass the appropriate IEs to be used in scheduled
+ * scans for all bands.  It contains both the IEs passed from the userspace
+ * and the ones generated by mac80211.
+ *
+ * @ie: array with the IEs for each supported band
+ * @len: array with the total length of the IEs for each band
+ */
+struct ieee80211_sched_scan_ies {
+        u8 *ie[IEEE80211_NUM_BANDS];
+        size_t len[IEEE80211_NUM_BANDS];
+};
+
 static inline struct ieee80211_tx_info *IEEE80211_SKB_CB(struct sk_buff *skb)
 {
         return (struct ieee80211_tx_info *)skb->cb;
@@ -552,16 +614,14 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  *      the frame.
  * @RX_FLAG_FAILED_PLCP_CRC: Set this flag if the PCLP check failed on
  *      the frame.
- * @RX_FLAG_TSFT: The timestamp passed in the RX status (@mactime field)
- *      is valid. This is useful in monitor mode and necessary for beacon frames
- *      to enable IBSS merging.
+ * @RX_FLAG_MACTIME_MPDU: The timestamp passed in the RX status (@mactime
+ *      field) is valid and contains the time the first symbol of the MPDU
+ *      was received. This is useful in monitor mode and for proper IBSS
+ *      merging.
  * @RX_FLAG_SHORTPRE: Short preamble was used for this frame
  * @RX_FLAG_HT: HT MCS was used and rate_idx is MCS index
  * @RX_FLAG_40MHZ: HT40 (40 MHz) was used
  * @RX_FLAG_SHORT_GI: Short guard interval was used
- * @RX_FLAG_INTERNAL_CMTR: set internally after frame was reported
- *      on cooked monitor to avoid double-reporting it for multiple
- *      virtual interfaces
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR      = 1<<0,
@@ -570,12 +630,11 @@ enum mac80211_rx_flags {
         RX_FLAG_IV_STRIPPED     = 1<<4,
         RX_FLAG_FAILED_FCS_CRC  = 1<<5,
         RX_FLAG_FAILED_PLCP_CRC = 1<<6,
-        RX_FLAG_TSFT            = 1<<7,
+        RX_FLAG_MACTIME_MPDU    = 1<<7,
         RX_FLAG_SHORTPRE        = 1<<8,
         RX_FLAG_HT              = 1<<9,
         RX_FLAG_40MHZ           = 1<<10,
         RX_FLAG_SHORT_GI        = 1<<11,
-        RX_FLAG_INTERNAL_CMTR   = 1<<12,
 };
 
 /**
@@ -596,6 +655,7 @@ enum mac80211_rx_flags {
  * @rate_idx: index of data rate into band's supported rates or MCS index if
  *      HT rates are use (RX_FLAG_HT)
  * @flag: %RX_FLAG_*
+ * @rx_flags: internal RX flags for mac80211
  */
 struct ieee80211_rx_status {
         u64 mactime;
@@ -605,6 +665,7 @@ struct ieee80211_rx_status {
         int antenna;
         int rate_idx;
         int flag;
+        unsigned int rx_flags;
 };
 
 /**
@@ -763,6 +824,8 @@ struct ieee80211_channel_switch {
  * @bss_conf: BSS configuration for this interface, either our own
  *      or the BSS we're associated to
  * @addr: address of this interface
+ * @p2p: indicates whether this AP or STA interface is a p2p
+ *      interface, i.e. a GO or p2p-sta respectively
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *).
  */
@@ -770,6 +833,7 @@ struct ieee80211_vif {
         enum nl80211_iftype type;
         struct ieee80211_bss_conf bss_conf;
         u8 addr[ETH_ALEN];
+        bool p2p;
         /* must be last */
         u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
 };
@@ -783,20 +847,6 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
 }
 
 /**
- * enum ieee80211_key_alg - key algorithm
- * @ALG_WEP: WEP40 or WEP104
- * @ALG_TKIP: TKIP
- * @ALG_CCMP: CCMP (AES)
- * @ALG_AES_CMAC: AES-128-CMAC
- */
-enum ieee80211_key_alg {
-        ALG_WEP,
-        ALG_TKIP,
-        ALG_CCMP,
-        ALG_AES_CMAC,
-};
-
-/**
  * enum ieee80211_key_flags - key flags
  *
  * These flags are used for communication about keys between the driver
@@ -833,7 +883,7 @@ enum ieee80211_key_flags {
  * @hw_key_idx: To be set by the driver, this is the key index the driver
  *      wants to be given when a frame is transmitted and needs to be
  *      encrypted in hardware.
- * @alg: The key algorithm.
+ * @cipher: The key's cipher suite selector.
  * @flags: key flags, see &enum ieee80211_key_flags.
  * @keyidx: the key index (0-3)
  * @keylen: key material length
@@ -846,7 +896,7 @@ enum ieee80211_key_flags {
  * @iv_len: The IV length for this key type
  */
 struct ieee80211_key_conf {
-        enum ieee80211_key_alg alg;
+        u32 cipher;
         u8 icv_len;
         u8 iv_len;
         u8 hw_key_idx;
@@ -1032,6 +1082,20 @@ enum ieee80211_tkip_key_type {
  * @IEEE80211_HW_NEED_DTIM_PERIOD:
  *      This device needs to know the DTIM period for the BSS before
  *      associating.
+ *
+ * @IEEE80211_HW_SUPPORTS_PER_STA_GTK: The device's crypto engine supports
+ *      per-station GTKs as used by IBSS RSN or during fast transition. If
+ *      the device doesn't support per-station GTKs, but can be asked not
+ *      to decrypt group addressed frames, then IBSS RSN support is still
+ *      possible but software crypto will be used. Advertise the wiphy flag
+ *      only in that case.
+ *
+ * @IEEE80211_HW_AP_LINK_PS: When operating in AP mode the device
+ *      autonomously manages the PS status of connected stations. When
+ *      this flag is set mac80211 will not trigger PS mode for connected
+ *      stations based on the PM bit of incoming frames.
+ *      Use ieee80211_start_ps()/ieee8021_end_ps() to manually configure
+ *      the PS mode of connected stations.
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1055,6 +1119,8 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_REPORTS_TX_ACK_STATUS              = 1<<18,
         IEEE80211_HW_CONNECTION_MONITOR                 = 1<<19,
         IEEE80211_HW_SUPPORTS_CQM_RSSI                  = 1<<20,
+        IEEE80211_HW_SUPPORTS_PER_STA_GTK               = 1<<21,
+        IEEE80211_HW_AP_LINK_PS                         = 1<<22,
 };
 
 /**
@@ -1100,8 +1166,26 @@ enum ieee80211_hw_flags {
  * @sta_data_size: size (in bytes) of the drv_priv data area
  *      within &struct ieee80211_sta.
  *
- * @max_rates: maximum number of alternate rate retry stages
+ * @max_rates: maximum number of alternate rate retry stages the hw
+ *      can handle.
+ * @max_report_rates: maximum number of alternate rate retry stages
+ *      the hw can report back.
  * @max_rate_tries: maximum number of tries for each stage
+ *
+ * @napi_weight: weight used for NAPI polling.  You must specify an
+ *      appropriate value here if a napi_poll operation is provided
+ *      by your driver.
+ *
+ * @max_rx_aggregation_subframes: maximum buffer size (number of
+ *      sub-frames) to be used for A-MPDU block ack receiver
+ *      aggregation.
+ *      This is only relevant if the device has restrictions on the
+ *      number of subframes, if it relies on mac80211 to do reordering
+ *      it shouldn't be set.
+ *
+ * @max_tx_aggregation_subframes: maximum number of subframes in an
+ *      aggregate an HT driver will transmit, used by the peer as a
+ *      hint to size its reorder buffer.
  */
 struct ieee80211_hw {
         struct ieee80211_conf conf;
@@ -1113,11 +1197,15 @@ struct ieee80211_hw {
         int channel_change_time;
         int vif_data_size;
         int sta_data_size;
+        int napi_weight;
         u16 queues;
         u16 max_listen_interval;
         s8 max_signal;
         u8 max_rates;
+        u8 max_report_rates;
         u8 max_rate_tries;
+        u8 max_rx_aggregation_subframes;
+        u8 max_tx_aggregation_subframes;
 };
 
 /**
@@ -1221,7 +1309,7 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * acceleration (i.e. iwlwifi). Those drivers should provide update_tkip_key
  * handler.
  * The update_tkip_key() call updates the driver with the new phase 1 key.
- * This happens everytime the iv16 wraps around (every 65536 packets). The
+ * This happens every time the iv16 wraps around (every 65536 packets). The
  * set_key() call will happen only once for each key (unless the AP did
  * rekeying), it will not include a valid phase 1 key. The valid phase 1 key is
  * provided by update_tkip_key only. The trigger that makes mac80211 call this
@@ -1245,8 +1333,8 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * %IEEE80211_CONF_PS flag enabled means that the powersave mode defined in
  * IEEE 802.11-2007 section 11.2 is enabled. This is not to be confused
  * with hardware wakeup and sleep states. Driver is responsible for waking
- * up the hardware before issueing commands to the hardware and putting it
- * back to sleep at approriate times.
+ * up the hardware before issuing commands to the hardware and putting it
+ * back to sleep at appropriate times.
  *
  * When PS is enabled, hardware needs to wakeup for beacons and receive the
  * buffered multicast/broadcast frames after the beacon. Also it must be
@@ -1267,7 +1355,7 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * there's data traffic and still saving significantly power in idle
  * periods.
  *
- * Dynamic powersave is supported by simply mac80211 enabling and disabling
+ * Dynamic powersave is simply supported by mac80211 enabling and disabling
  * PS based on traffic. Driver needs to only set %IEEE80211_HW_SUPPORTS_PS
  * flag and mac80211 will handle everything automatically. Additionally,
  * hardware having support for the dynamic PS feature may set the
@@ -1452,12 +1540,14 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  *      honour this flag if possible.
  *
  * @FIF_CONTROL: pass control frames (except for PS Poll), if PROMISC_IN_BSS
- *  is not set then only those addressed to this station.
+ *      is not set then only those addressed to this station.
  *
  * @FIF_OTHER_BSS: pass frames destined to other BSSes
  *
- * @FIF_PSPOLL: pass PS Poll frames, if PROMISC_IN_BSS  is not set then only
- *  those addressed to this station.
+ * @FIF_PSPOLL: pass PS Poll frames, if PROMISC_IN_BSS is not set then only
+ *      those addressed to this station.
+ *
+ * @FIF_PROBE_REQ: pass probe request frames
  */
 enum ieee80211_filter_flags {
         FIF_PROMISC_IN_BSS      = 1<<0,
@@ -1468,6 +1558,7 @@ enum ieee80211_filter_flags {
         FIF_CONTROL             = 1<<5,
         FIF_OTHER_BSS           = 1<<6,
         FIF_PSPOLL              = 1<<7,
+        FIF_PROBE_REQ           = 1<<8,
 };
 
 /**
@@ -1530,6 +1621,18 @@ enum ieee80211_ampdu_mlme_action {
  *      you should ensure to cancel it on this callback.
  *      Must be implemented and can sleep.
  *
+ * @suspend: Suspend the device; mac80211 itself will quiesce before and
+ *      stop transmitting and doing any other configuration, and then
+ *      ask the device to suspend. This is only invoked when WoWLAN is
+ *      configured, otherwise the device is deconfigured completely and
+ *      reconfigured at resume time.
+ *
+ * @resume: If WoWLAN was configured, this indicates that mac80211 is
+ *      now resuming its operation, after this the device must be fully
+ *      functional again. If this returns an error, the only way out is
+ *      to also unregister the device. If it returns 1, then mac80211
+ *      will also go through the regular complete restart on resume.
+ *
  * @add_interface: Called when a netdevice attached to the hardware is
  *      enabled. Because it is not called for monitor mode devices, @start
  *      and @stop must be implemented.
@@ -1540,6 +1643,12 @@ enum ieee80211_ampdu_mlme_action {
  *      negative error code (which will be seen in userspace.)
  *      Must be implemented and can sleep.
  *
+ * @change_interface: Called when a netdevice changes type. This callback
+ *      is optional, but only if it is supported can interface types be
+ *      switched while the interface is UP. The callback may sleep.
+ *      Note that while an interface is being switched, it will not be
+ *      found by the interface iteration callbacks.
+ *
  * @remove_interface: Notifies a driver that an interface is going down.
  *      The @stop callback is called after this if it is the last interface
  *      and no monitor interfaces are present.
@@ -1599,6 +1708,13 @@ enum ieee80211_ampdu_mlme_action {
  *      any error unless this callback returned a negative error code.
  *      The callback can sleep.
  *
+ * @sched_scan_start: Ask the hardware to start scanning repeatedly at
+ *      specific intervals.  The driver must call the
+ *      ieee80211_sched_scan_results() function whenever it finds results.
+ *      This process will continue until sched_scan_stop is called.
+ *
+ * @sched_scan_stop: Tell the hardware to stop an ongoing scheduled scan.
+ *
  * @sw_scan_start: Notifier function that is called just before a software scan
  *      is started. Can be NULL, if the driver doesn't need this notification.
  *      The callback can sleep.
@@ -1617,6 +1733,11 @@ enum ieee80211_ampdu_mlme_action {
  *      and IV16) for the given key from hardware.
  *      The callback must be atomic.
  *
+ * @set_frag_threshold: Configuration of fragmentation threshold. Assign this
+ *      if the device does fragmentation by itself; if this callback is
+ *      implemented then the stack will not do fragmentation.
+ *      The callback can sleep.
+ *
  * @set_rts_threshold: Configuration of RTS threshold (if device needs it)
  *      The callback can sleep.
  *
@@ -1627,7 +1748,9 @@ enum ieee80211_ampdu_mlme_action {
  *      station, AP, IBSS/WDS/mesh peer etc. This callback can sleep.
  *
  * @sta_notify: Notifies low level driver about power state transition of an
- *      associated station, AP,  IBSS/WDS/mesh peer etc. Must be atomic.
+ *      associated station, AP,  IBSS/WDS/mesh peer etc. For a VIF operating
+ *      in AP mode, this callback will not be called when the flag
+ *      %IEEE80211_HW_AP_LINK_PS is set. Must be atomic.
  *
  * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
  *      bursting) for a hardware TX queue.
@@ -1662,6 +1785,21 @@ enum ieee80211_ampdu_mlme_action {
  *      ieee80211_ampdu_mlme_action. Starting sequence number (@ssn)
  *      is the first frame we expect to perform the action on. Notice
  *      that TX/RX_STOP can pass NULL for this parameter.
+ *      The @buf_size parameter is only valid when the action is set to
+ *      %IEEE80211_AMPDU_TX_OPERATIONAL and indicates the peer's reorder
+ *      buffer size (number of subframes) for this session -- the driver
+ *      may neither send aggregates containing more subframes than this
+ *      nor send aggregates in a way that lost frames would exceed the
+ *      buffer size. If just limiting the aggregate size, this would be
+ *      possible with a buf_size of 8:
+ *       - TX: 1.....7
+ *       - RX:  2....7 (lost frame #1)
+ *       - TX:        8..1...
+ *      which is invalid since #1 was now re-transmitted well past the
+ *      buffer size of 8. Correct ways to retransmit #1 would be:
+ *       - TX:       1 or 18 or 81
+ *      Even "189" would be wrong since 1 could be lost again.
+ *
  *      Returns a negative error code on failure.
  *      The callback can sleep.
  *
@@ -1687,13 +1825,55 @@ enum ieee80211_ampdu_mlme_action {
  *      switch operation for CSAs received from the AP may implement this
  *      callback. They must then call ieee80211_chswitch_done() to indicate
  *      completion of the channel switch.
+ *
+ * @napi_poll: Poll Rx queue for incoming data frames.
+ *
+ * @set_antenna: Set antenna configuration (tx_ant, rx_ant) on the device.
+ *      Parameters are bitmaps of allowed antennas to use for TX/RX. Drivers may
+ *      reject TX/RX mask combinations they cannot support by returning -EINVAL
+ *      (also see nl80211.h @NL80211_ATTR_WIPHY_ANTENNA_TX).
+ *
+ * @get_antenna: Get current antenna configuration from device (tx_ant, rx_ant).
+ *
+ * @remain_on_channel: Starts an off-channel period on the given channel, must
+ *      call back to ieee80211_ready_on_channel() when on that channel. Note
+ *      that normal channel traffic is not stopped as this is intended for hw
+ *      offload. Frames to transmit on the off-channel channel are transmitted
+ *      normally except for the %IEEE80211_TX_CTL_TX_OFFCHAN flag. When the
+ *      duration (which will always be non-zero) expires, the driver must call
+ *      ieee80211_remain_on_channel_expired(). This callback may sleep.
+ * @cancel_remain_on_channel: Requests that an ongoing off-channel period is
+ *      aborted before it expires. This callback may sleep.
+ * @offchannel_tx: Transmit frame on another channel, wait for a response
+ *      and return. Reliable TX status must be reported for the frame. If the
+ *      return value is 1, then the @remain_on_channel will be used with a
+ *      regular transmission (if supported.)
+ * @offchannel_tx_cancel_wait: cancel wait associated with offchannel TX
+ *
+ * @set_ringparam: Set tx and rx ring sizes.
+ *
+ * @get_ringparam: Get tx and rx ring current and maximum sizes.
+ *
+ * @tx_frames_pending: Check if there is any pending frame in the hardware
+ *      queues before entering power save.
+ *
+ * @set_bitrate_mask: Set a mask of rates to be used for rate control selection
+ *      when transmitting a frame. Currently only legacy rates are handled.
+ *      The callback can sleep.
  */
 struct ieee80211_ops {
-        int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
+        void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
         int (*start)(struct ieee80211_hw *hw);
         void (*stop)(struct ieee80211_hw *hw);
+#ifdef CONFIG_PM
+        int (*suspend)(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan);
+        int (*resume)(struct ieee80211_hw *hw);
+#endif
         int (*add_interface)(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif);
+        int (*change_interface)(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                enum nl80211_iftype new_type, bool p2p);
         void (*remove_interface)(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif);
         int (*config)(struct ieee80211_hw *hw, u32 changed);
@@ -1719,12 +1899,19 @@ struct ieee80211_ops {
                                 u32 iv32, u16 *phase1key);
         int (*hw_scan)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct cfg80211_scan_request *req);
+        int (*sched_scan_start)(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct cfg80211_sched_scan_request *req,
+                                struct ieee80211_sched_scan_ies *ies);
+        void (*sched_scan_stop)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif);
         void (*sw_scan_start)(struct ieee80211_hw *hw);
         void (*sw_scan_complete)(struct ieee80211_hw *hw);
         int (*get_stats)(struct ieee80211_hw *hw,
                          struct ieee80211_low_level_stats *stats);
         void (*get_tkip_seq)(struct ieee80211_hw *hw, u8 hw_key_idx,
                              u32 *iv32, u16 *iv16);
+        int (*set_frag_threshold)(struct ieee80211_hw *hw, u32 value);
         int (*set_rts_threshold)(struct ieee80211_hw *hw, u32 value);
         int (*sta_add)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta);
@@ -1741,7 +1928,8 @@ struct ieee80211_ops {
         int (*ampdu_action)(struct ieee80211_hw *hw,
                             struct ieee80211_vif *vif,
                             enum ieee80211_ampdu_mlme_action action,
-                            struct ieee80211_sta *sta, u16 tid, u16 *ssn);
+                            struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                            u8 buf_size);
         int (*get_survey)(struct ieee80211_hw *hw, int idx,
                 struct survey_info *survey);
         void (*rfkill_poll)(struct ieee80211_hw *hw);
@@ -1752,6 +1940,26 @@ struct ieee80211_ops {
         void (*flush)(struct ieee80211_hw *hw, bool drop);
         void (*channel_switch)(struct ieee80211_hw *hw,
                                struct ieee80211_channel_switch *ch_switch);
+        int (*napi_poll)(struct ieee80211_hw *hw, int budget);
+        int (*set_antenna)(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant);
+        int (*get_antenna)(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant);
+
+        int (*remain_on_channel)(struct ieee80211_hw *hw,
+                                 struct ieee80211_channel *chan,
+                                 enum nl80211_channel_type channel_type,
+                                 int duration);
+        int (*cancel_remain_on_channel)(struct ieee80211_hw *hw);
+        int (*offchannel_tx)(struct ieee80211_hw *hw, struct sk_buff *skb,
+                             struct ieee80211_channel *chan,
+                             enum nl80211_channel_type channel_type,
+                             unsigned int wait);
+        int (*offchannel_tx_cancel_wait)(struct ieee80211_hw *hw);
+        int (*set_ringparam)(struct ieee80211_hw *hw, u32 tx, u32 rx);
+        void (*get_ringparam)(struct ieee80211_hw *hw,
+                              u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max);
+        bool (*tx_frames_pending)(struct ieee80211_hw *hw);
+        int (*set_bitrate_mask)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                                const struct cfg80211_bitrate_mask *mask);
 };
 
 /**
@@ -1780,11 +1988,39 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
  */
 int ieee80211_register_hw(struct ieee80211_hw *hw);
 
+/**
+ * struct ieee80211_tpt_blink - throughput blink description
+ * @throughput: throughput in Kbit/sec
+ * @blink_time: blink time in milliseconds
+ *      (full cycle, ie. one off + one on period)
+ */
+struct ieee80211_tpt_blink {
+        int throughput;
+        int blink_time;
+};
+
+/**
+ * enum ieee80211_tpt_led_trigger_flags - throughput trigger flags
+ * @IEEE80211_TPT_LEDTRIG_FL_RADIO: enable blinking with radio
+ * @IEEE80211_TPT_LEDTRIG_FL_WORK: enable blinking when working
+ * @IEEE80211_TPT_LEDTRIG_FL_CONNECTED: enable blinking when at least one
+ *      interface is connected in some way, including being an AP
+ */
+enum ieee80211_tpt_led_trigger_flags {
+        IEEE80211_TPT_LEDTRIG_FL_RADIO          = BIT(0),
+        IEEE80211_TPT_LEDTRIG_FL_WORK           = BIT(1),
+        IEEE80211_TPT_LEDTRIG_FL_CONNECTED      = BIT(2),
+};
+
 #ifdef CONFIG_MAC80211_LEDS
 extern char *__ieee80211_get_tx_led_name(struct ieee80211_hw *hw);
 extern char *__ieee80211_get_rx_led_name(struct ieee80211_hw *hw);
 extern char *__ieee80211_get_assoc_led_name(struct ieee80211_hw *hw);
 extern char *__ieee80211_get_radio_led_name(struct ieee80211_hw *hw);
+extern char *__ieee80211_create_tpt_led_trigger(
+                                struct ieee80211_hw *hw, unsigned int flags,
+                                const struct ieee80211_tpt_blink *blink_table,
+                                unsigned int blink_table_len);
 #endif
 /**
  * ieee80211_get_tx_led_name - get name of TX LED
@@ -1863,6 +2099,30 @@ static inline char *ieee80211_get_radio_led_name(struct ieee80211_hw *hw)
 }
 
 /**
+ * ieee80211_create_tpt_led_trigger - create throughput LED trigger
+ * @hw: the hardware to create the trigger for
+ * @flags: trigger flags, see &enum ieee80211_tpt_led_trigger_flags
+ * @blink_table: the blink table -- needs to be ordered by throughput
+ * @blink_table_len: size of the blink table
+ *
+ * This function returns %NULL (in case of error, or if no LED
+ * triggers are configured) or the name of the new trigger.
+ * This function must be called before ieee80211_register_hw().
+ */
+static inline char *
+ieee80211_create_tpt_led_trigger(struct ieee80211_hw *hw, unsigned int flags,
+                                 const struct ieee80211_tpt_blink *blink_table,
+                                 unsigned int blink_table_len)
+{
+#ifdef CONFIG_MAC80211_LEDS
+        return __ieee80211_create_tpt_led_trigger(hw, flags, blink_table,
+                                                  blink_table_len);
+#else
+        return NULL;
+#endif
+}
+
+/**
  * ieee80211_unregister_hw - Unregister a hardware device
  *
  * This function instructs mac80211 to free allocated resources
@@ -1897,6 +2157,22 @@ void ieee80211_free_hw(struct ieee80211_hw *hw);
  */
 void ieee80211_restart_hw(struct ieee80211_hw *hw);
 
+/** ieee80211_napi_schedule - schedule NAPI poll
+ *
+ * Use this function to schedule NAPI polling on a device.
+ *
+ * @hw: the hardware to start polling
+ */
+void ieee80211_napi_schedule(struct ieee80211_hw *hw);
+
+/** ieee80211_napi_complete - complete NAPI polling
+ *
+ * Use this function to finish NAPI polling on a device.
+ *
+ * @hw: the hardware to stop polling
+ */
+void ieee80211_napi_complete(struct ieee80211_hw *hw);
+
 /**
  * ieee80211_rx - receive frame
  *
@@ -1952,6 +2228,48 @@ static inline void ieee80211_rx_ni(struct ieee80211_hw *hw,
         local_bh_enable();
 }
 
+/**
+ * ieee80211_sta_ps_transition - PS transition for connected sta
+ *
+ * When operating in AP mode with the %IEEE80211_HW_AP_LINK_PS
+ * flag set, use this function to inform mac80211 about a connected station
+ * entering/leaving PS mode.
+ *
+ * This function may not be called in IRQ context or with softirqs enabled.
+ *
+ * Calls to this function for a single hardware must be synchronized against
+ * each other.
+ *
+ * The function returns -EINVAL when the requested PS mode is already set.
+ *
+ * @sta: currently connected sta
+ * @start: start or stop PS
+ */
+int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start);
+
+/**
+ * ieee80211_sta_ps_transition_ni - PS transition for connected sta
+ *                                  (in process context)
+ *
+ * Like ieee80211_sta_ps_transition() but can be called in process context
+ * (internally disables bottom halves). Concurrent call restriction still
+ * applies.
+ *
+ * @sta: currently connected sta
+ * @start: start or stop PS
+ */
+static inline int ieee80211_sta_ps_transition_ni(struct ieee80211_sta *sta,
+                                                  bool start)
+{
+        int ret;
+
+        local_bh_disable();
+        ret = ieee80211_sta_ps_transition(sta, start);
+        local_bh_enable();
+
+        return ret;
+}
+
 /*
  * The TX headroom reserved by mac80211 for its own tx_status functions.
  * This is enough for the radiotap header.
@@ -1959,6 +2277,19 @@ static inline void ieee80211_rx_ni(struct ieee80211_hw *hw,
 #define IEEE80211_TX_STATUS_HEADROOM    13
 
 /**
+ * ieee80211_sta_set_tim - set the TIM bit for a sleeping station
+ * @sta: &struct ieee80211_sta pointer for the sleeping station
+ *
+ * If a driver buffers frames for a powersave station instead of passing
+ * them back to mac80211 for retransmission, the station needs to be told
+ * to wake up using the TIM bitmap in the beacon.
+ *
+ * This function sets the station's TIM bit - it will be cleared when the
+ * station wakes up.
+ */
+void ieee80211_sta_set_tim(struct ieee80211_sta *sta);
+
+/**
  * ieee80211_tx_status - transmit status callback
  *
  * Call this function for all transmitted frames after they have been
@@ -1967,8 +2298,8 @@ static inline void ieee80211_rx_ni(struct ieee80211_hw *hw,
  *
  * This function may not be called in IRQ context. Calls to this function
  * for a single hardware must be synchronized against each other. Calls
- * to this function and ieee80211_tx_status_irqsafe() may not be mixed
- * for a single hardware.
+ * to this function, ieee80211_tx_status_ni() and ieee80211_tx_status_irqsafe()
+ * may not be mixed for a single hardware.
  *
  * @hw: the hardware the frame was transmitted by
  * @skb: the frame that was transmitted, owned by mac80211 after this call
@@ -1977,13 +2308,33 @@ void ieee80211_tx_status(struct ieee80211_hw *hw,
                          struct sk_buff *skb);
 
 /**
+ * ieee80211_tx_status_ni - transmit status callback (in process context)
+ *
+ * Like ieee80211_tx_status() but can be called in process context.
+ *
+ * Calls to this function, ieee80211_tx_status() and
+ * ieee80211_tx_status_irqsafe() may not be mixed
+ * for a single hardware.
+ *
+ * @hw: the hardware the frame was transmitted by
+ * @skb: the frame that was transmitted, owned by mac80211 after this call
+ */
+static inline void ieee80211_tx_status_ni(struct ieee80211_hw *hw,
+                                          struct sk_buff *skb)
+{
+        local_bh_disable();
+        ieee80211_tx_status(hw, skb);
+        local_bh_enable();
+}
+
+/**
  * ieee80211_tx_status_irqsafe - IRQ-safe transmit status callback
  *
  * Like ieee80211_tx_status() but can be called in IRQ context
  * (internally defers to a tasklet.)
  *
- * Calls to this function and ieee80211_tx_status() may not be mixed for a
- * single hardware.
+ * Calls to this function, ieee80211_tx_status() and
+ * ieee80211_tx_status_ni() may not be mixed for a single hardware.
  *
  * @hw: the hardware the frame was transmitted by
  * @skb: the frame that was transmitted, owned by mac80211 after this call
@@ -1992,6 +2343,17 @@ void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
                                  struct sk_buff *skb);
 
 /**
+ * ieee80211_report_low_ack - report non-responding station
+ *
+ * When operating in AP-mode, call this function to report a non-responding
+ * connected STA.
+ *
+ * @sta: the non-responding connected sta
+ * @num_packets: number of packets sent to @sta without a response
+ */
+void ieee80211_report_low_ack(struct ieee80211_sta *sta, u32 num_packets);
+
+/**
  * ieee80211_beacon_get_tim - beacon generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
@@ -2252,7 +2614,8 @@ void ieee80211_wake_queues(struct ieee80211_hw *hw);
  *
  * When hardware scan offload is used (i.e. the hw_scan() callback is
  * assigned) this function needs to be called by the driver to notify
- * mac80211 that the scan finished.
+ * mac80211 that the scan finished. This function can be called from
+ * any context, including hardirq context.
  *
  * @hw: the hardware that finished the scan
  * @aborted: set to true if scan was aborted
@@ -2260,6 +2623,28 @@ void ieee80211_wake_queues(struct ieee80211_hw *hw);
 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted);
 
 /**
+ * ieee80211_sched_scan_results - got results from scheduled scan
+ *
+ * When a scheduled scan is running, this function needs to be called by the
+ * driver whenever there are new scan results available.
+ *
+ * @hw: the hardware that is performing scheduled scans
+ */
+void ieee80211_sched_scan_results(struct ieee80211_hw *hw);
+
+/**
+ * ieee80211_sched_scan_stopped - inform that the scheduled scan has stopped
+ *
+ * When a scheduled scan is running, this function can be called by
+ * the driver if it needs to stop the scan to perform another task.
+ * Usual scenarios are drivers that cannot continue the scheduled scan
+ * while associating, for instance.
+ *
+ * @hw: the hardware that is performing scheduled scans
+ */
+void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw);
+
+/**
  * ieee80211_iterate_active_interfaces - iterate active interfaces
  *
  * This function iterates over the interfaces associated with a given
@@ -2267,6 +2652,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted);
  * This function allows the iterator function to sleep, when the iterator
  * function is atomic @ieee80211_iterate_active_interfaces_atomic can
  * be used.
+ * Does not iterate over a new interface during add_interface()
  *
  * @hw: the hardware struct of which the interfaces should be iterated over
  * @iterator: the iterator function to call
@@ -2284,6 +2670,7 @@ void ieee80211_iterate_active_interfaces(struct ieee80211_hw *hw,
  * hardware that are currently active and calls the callback for them.
  * This function requires the iterator callback function to be atomic,
  * if that is not desired, use @ieee80211_iterate_active_interfaces instead.
+ * Does not iterate over a new interface during add_interface()
  *
  * @hw: the hardware struct of which the interfaces should be iterated over
  * @iterator: the iterator function to call, cannot sleep
@@ -2324,6 +2711,7 @@ void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
  * ieee80211_start_tx_ba_session - Start a tx Block Ack session.
  * @sta: the station for which to start a BA session
  * @tid: the TID to BA on.
+ * @timeout: session timeout value (in TUs)
  *
  * Return: success if addBA request was sent, failure otherwise
  *
@@ -2331,7 +2719,8 @@ void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
  * the need to start aggregation on a certain RA/TID, the session level
  * will be managed by the mac80211.
  */
-int ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, u16 tid);
+int ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, u16 tid,
+                                  u16 timeout);
 
 /**
  * ieee80211_start_tx_ba_cb_irqsafe - low level driver ready to aggregate.
@@ -2385,25 +2774,28 @@ struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
                                          const u8 *addr);
 
 /**
- * ieee80211_find_sta_by_hw - find a station on hardware
+ * ieee80211_find_sta_by_ifaddr - find a station on hardware
  *
  * @hw: pointer as obtained from ieee80211_alloc_hw()
- * @addr: station's address
+ * @addr: remote station's address
+ * @localaddr: local address (vif->sdata->vif.addr). Use NULL for 'any'.
  *
  * This function must be called under RCU lock and the
  * resulting pointer is only valid under RCU lock as well.
  *
- * NOTE: This function should not be used! When mac80211 is converted
- *       internally to properly keep track of stations on multiple
- *       virtual interfaces, it will not always know which station to
- *       return here since a single address might be used by multiple
- *       logical stations (e.g. consider a station connecting to another
- *       BSSID on the same AP hardware without disconnecting first).
+ * NOTE: You may pass NULL for localaddr, but then you will just get
+ *      the first STA that matches the remote address 'addr'.
+ *      We can have multiple STA associated with multiple
+ *      logical stations (e.g. consider a station connecting to another
+ *      BSSID on the same AP hardware without disconnecting first).
+ *      In this case, the result of this method with localaddr NULL
+ *      is not reliable.
  *
- * DO NOT USE THIS FUNCTION.
+ * DO NOT USE THIS FUNCTION with localaddr NULL if at all possible.
  */
-struct ieee80211_sta *ieee80211_find_sta_by_hw(struct ieee80211_hw *hw,
-                                               const u8 *addr);
+struct ieee80211_sta *ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
+                                               const u8 *addr,
+                                               const u8 *localaddr);
 
 /**
  * ieee80211_sta_block_awake - block station from waking up
@@ -2438,11 +2830,26 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
                                struct ieee80211_sta *pubsta, bool block);
 
 /**
+ * ieee80211_ap_probereq_get - retrieve a Probe Request template
+ * @hw: pointer obtained from ieee80211_alloc_hw().
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * Creates a Probe Request template which can, for example, be uploaded to
+ * hardware. The template is filled with bssid, ssid and supported rate
+ * information. This function must only be called from within the
+ * .bss_info_changed callback function and only in managed mode. The function
+ * is only useful when the interface is associated, otherwise it will return
+ * NULL.
+ */
+struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif);
+
+/**
  * ieee80211_beacon_loss - inform hardware does not receive beacons
  *
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
- * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTERING and
+ * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTER and
  * %IEEE80211_CONF_PS is set, the driver needs to inform whenever the
  * hardware is not receiving beacons with this function.
  */
@@ -2453,7 +2860,7 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif);
  *
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
- * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTERING, and
+ * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTER, and
  * %IEEE80211_CONF_PS and %IEEE80211_HW_CONNECTION_MONITOR are set, the driver
  * needs to inform if the connection to the AP has been lost.
  *
@@ -2518,6 +2925,46 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
  */
 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success);
 
+/**
+ * ieee80211_request_smps - request SM PS transition
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @smps_mode: new SM PS mode
+ *
+ * This allows the driver to request an SM PS transition in managed
+ * mode. This is useful when the driver has more information than
+ * the stack about possible interference, for example by bluetooth.
+ */
+void ieee80211_request_smps(struct ieee80211_vif *vif,
+                            enum ieee80211_smps_mode smps_mode);
+
+/**
+ * ieee80211_key_removed - disable hw acceleration for key
+ * @key_conf: The key hw acceleration should be disabled for
+ *
+ * This allows drivers to indicate that the given key has been
+ * removed from hardware acceleration, due to a new key that
+ * was added. Don't use this if the key can continue to be used
+ * for TX, if the key restriction is on RX only it is permitted
+ * to keep the key for TX only and not call this function.
+ *
+ * Due to locking constraints, it may only be called during
+ * @set_key. This function must be allowed to sleep, and the
+ * key it tries to disable may still be used until it returns.
+ */
+void ieee80211_key_removed(struct ieee80211_key_conf *key_conf);
+
+/**
+ * ieee80211_ready_on_channel - notification of remain-on-channel start
+ * @hw: pointer as obtained from ieee80211_alloc_hw()
+ */
+void ieee80211_ready_on_channel(struct ieee80211_hw *hw);
+
+/**
+ * ieee80211_remain_on_channel_expired - remain_on_channel duration expired
+ * @hw: pointer as obtained from ieee80211_alloc_hw()
+ */
+void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw);
+
 /* Rate control API */
 
 /**
@@ -2549,7 +2996,7 @@ enum rate_control_changed {
  * @rate_idx_mask: user-requested rate mask (not MCS for now)
  * @skb: the skb that will be transmitted, the control information in it needs
  *      to be filled in
- * @ap: whether this frame is sent out in AP mode
+ * @bss: whether this frame is sent out in AP or IBSS mode
  */
 struct ieee80211_tx_rate_control {
         struct ieee80211_hw *hw;
@@ -2560,7 +3007,7 @@ struct ieee80211_tx_rate_control {
         bool rts, short_preamble;
         u8 max_rate_idx;
         u32 rate_idx_mask;
-        bool ap;
+        bool bss;
 };
 
 struct rate_control_ops {
@@ -2681,4 +3128,26 @@ conf_is_ht(struct ieee80211_conf *conf)
         return conf->channel_type != NL80211_CHAN_NO_HT;
 }
 
+static inline enum nl80211_iftype
+ieee80211_iftype_p2p(enum nl80211_iftype type, bool p2p)
+{
+        if (p2p) {
+                switch (type) {
+                case NL80211_IFTYPE_STATION:
+                        return NL80211_IFTYPE_P2P_CLIENT;
+                case NL80211_IFTYPE_AP:
+                        return NL80211_IFTYPE_P2P_GO;
+                default:
+                        break;
+                }
+        }
+        return type;
+}
+
+static inline enum nl80211_iftype
+ieee80211_vif_type_p2p(struct ieee80211_vif *vif)
+{
+        return ieee80211_iftype_p2p(vif->type, vif->p2p);
+}
+
 #endif /* MAC80211_H */
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 895997bc2ead..62beeb97c4b1 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -42,11 +42,6 @@ enum {
 #define ND_REACHABLE_TIME               (30*HZ)
 #define ND_RETRANS_TIMER                HZ
 
-#define ND_MIN_RANDOM_FACTOR            (1/2)
-#define ND_MAX_RANDOM_FACTOR            (3/2)
-
-#ifdef __KERNEL__
-
 #include <linux/compiler.h>
 #include <linux/icmpv6.h>
 #include <linux/in6.h>
@@ -105,7 +100,8 @@ extern void			ndisc_send_redirect(struct sk_buff *skb,
                                                     struct neighbour *neigh,
                                                     const struct in6_addr *target);
 
-extern int                      ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int dir);
+extern int                      ndisc_mc_map(const struct in6_addr *addr, char *buf,
+                                             struct net_device *dev, int dir);
 
 extern struct sk_buff           *ndisc_build_skb(struct net_device *dev,
                                                  const struct in6_addr *daddr,
@@ -158,8 +154,4 @@ static inline struct neighbour * ndisc_get_neigh(struct net_device *dev, const s
         return ERR_PTR(-ENODEV);
 }
 
-
-#endif /* __KERNEL__ */
-
-
 #endif
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 242879b6c4df..4014b623880c 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -91,26 +91,28 @@ struct neigh_statistics {
 #define NEIGH_CACHE_STAT_INC(tbl, field) this_cpu_inc((tbl)->stats->field)
 
 struct neighbour {
-        struct neighbour        *next;
+        struct neighbour __rcu  *next;
         struct neigh_table      *tbl;
         struct neigh_parms      *parms;
-        struct net_device               *dev;
-        unsigned long           used;
         unsigned long           confirmed;
         unsigned long           updated;
+        rwlock_t                lock;
+        atomic_t                refcnt;
+        struct sk_buff_head     arp_queue;
+        struct timer_list       timer;
+        unsigned long           used;
+        atomic_t                probes;
         __u8                    flags;
         __u8                    nud_state;
         __u8                    type;
         __u8                    dead;
-        atomic_t                probes;
-        rwlock_t                lock;
+        seqlock_t               ha_lock;
         unsigned char           ha[ALIGN(MAX_ADDR_LEN, sizeof(unsigned long))];
         struct hh_cache         *hh;
-        atomic_t                refcnt;
         int                     (*output)(struct sk_buff *skb);
-        struct sk_buff_head     arp_queue;
-        struct timer_list       timer;
         const struct neigh_ops  *ops;
+        struct rcu_head         rcu;
+        struct net_device       *dev;
         u8                      primary_key[0];
 };
 
@@ -138,13 +140,22 @@ struct pneigh_entry {
  *      neighbour table manipulation
  */
 
+struct neigh_hash_table {
+        struct neighbour __rcu  **hash_buckets;
+        unsigned int            hash_mask;
+        __u32                   hash_rnd;
+        struct rcu_head         rcu;
+};
+
 
 struct neigh_table {
         struct neigh_table      *next;
         int                     family;
         int                     entry_size;
         int                     key_len;
-        __u32                   (*hash)(const void *pkey, const struct net_device *);
+        __u32                   (*hash)(const void *pkey,
+                                        const struct net_device *dev,
+                                        __u32 hash_rnd);
         int                     (*constructor)(struct neighbour *);
         int                     (*pconstructor)(struct pneigh_entry *);
         void                    (*pdestructor)(struct pneigh_entry *);
@@ -163,11 +174,9 @@ struct neigh_table {
         atomic_t                entries;
         rwlock_t                lock;
         unsigned long           last_rand;
-        struct kmem_cache               *kmem_cachep;
+        struct kmem_cache       *kmem_cachep;
         struct neigh_statistics __percpu *stats;
-        struct neighbour        **hash_buckets;
-        unsigned int            hash_mask;
-        __u32                   hash_rnd;
+        struct neigh_hash_table __rcu *nht;
         struct pneigh_entry     **phash_buckets;
 };
 
@@ -237,6 +246,7 @@ extern void pneigh_for_each(struct neigh_table *tbl, void (*cb)(struct pneigh_en
 struct neigh_seq_state {
         struct seq_net_private p;
         struct neigh_table *tbl;
+        struct neigh_hash_table *nht;
         void *(*neigh_sub_iter)(struct neigh_seq_state *state,
                                 struct neighbour *n, loff_t *pos);
         unsigned int bucket;
@@ -293,7 +303,10 @@ static inline void neigh_confirm(struct neighbour *neigh)
 
 static inline int neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 {
-        neigh->used = jiffies;
+        unsigned long now = jiffies;
+        
+        if (neigh->used != now)
+                neigh->used = now;
         if (!(neigh->nud_state&(NUD_CONNECTED|NUD_DELAY|NUD_PROBE)))
                 return __neigh_event_send(neigh, skb);
         return 0;
@@ -364,4 +377,14 @@ struct neighbour_cb {
 
 #define NEIGH_CB(skb)   ((struct neighbour_cb *)(skb)->cb)
 
+static inline void neigh_ha_snapshot(char *dst, const struct neighbour *n,
+                                     const struct net_device *dev)
+{
+        unsigned int seq;
+
+        do {
+                seq = read_seqbegin(&n->ha_lock);
+                memcpy(dst, n->ha, dev->addr_len);
+        } while (read_seqretry(&n->ha_lock, seq));
+}
 #endif
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index bd10a7908993..aef430d779bd 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -7,6 +7,7 @@
 #include <asm/atomic.h>
 #include <linux/workqueue.h>
 #include <linux/list.h>
+#include <linux/sysctl.h>
 
 #include <net/netns/core.h>
 #include <net/netns/mib.h>
@@ -27,20 +28,26 @@ struct sock;
 struct ctl_table_header;
 struct net_generic;
 struct sock;
+struct netns_ipvs;
 
 
 #define NETDEV_HASHBITS    8
 #define NETDEV_HASHENTRIES (1 << NETDEV_HASHBITS)
 
 struct net {
+        atomic_t                passive;        /* To decided when the network
+                                                 * namespace should be freed.
+                                                 */
         atomic_t                count;          /* To decided when the network
-                                                 *  namespace should be freed.
+                                                 *  namespace should be shut down.
                                                  */
 #ifdef NETNS_REFCNT_DEBUG
         atomic_t                use_count;      /* To track references we
                                                  * destroy on demand
                                                  */
 #endif
+        spinlock_t              rules_mod_lock;
+
         struct list_head        list;           /* list of network namespaces */
         struct list_head        cleanup_list;   /* namespaces on death row */
         struct list_head        exit_list;      /* Use only net_mutex */
@@ -52,7 +59,8 @@ struct net {
         struct ctl_table_set    sysctls;
 #endif
 
-        struct net_device       *loopback_dev;          /* The loopback */
+        struct sock             *rtnl;                  /* rtnetlink socket */
+        struct sock             *genl_sock;
 
         struct list_head        dev_base_head;
         struct hlist_head       *dev_name_head;
@@ -60,11 +68,9 @@ struct net {
 
         /* core fib_rules */
         struct list_head        rules_ops;
-        spinlock_t              rules_mod_lock;
 
-        struct sock             *rtnl;                  /* rtnetlink socket */
-        struct sock             *genl_sock;
 
+        struct net_device       *loopback_dev;          /* The loopback */
         struct netns_core       core;
         struct netns_mib        mib;
         struct netns_packet     packet;
@@ -84,13 +90,16 @@ struct net {
         struct sock             *nfnl;
         struct sock             *nfnl_stash;
 #endif
-#ifdef CONFIG_XFRM
-        struct netns_xfrm       xfrm;
-#endif
 #ifdef CONFIG_WEXT_CORE
         struct sk_buff_head     wext_nlevents;
 #endif
-        struct net_generic      *gen;
+        struct net_generic __rcu        *gen;
+
+        /* Note : following structs are cache line aligned */
+#ifdef CONFIG_XFRM
+        struct netns_xfrm       xfrm;
+#endif
+        struct netns_ipvs       *ipvs;
 };
 
 
@@ -114,6 +123,7 @@ static inline struct net *copy_net_ns(unsigned long flags, struct net *net_ns)
 extern struct list_head net_namespace_list;
 
 extern struct net *get_net_ns_by_pid(pid_t pid);
+extern struct net *get_net_ns_by_fd(int pid);
 
 #ifdef CONFIG_NET_NS
 extern void __put_net(struct net *net);
@@ -147,6 +157,9 @@ int net_eq(const struct net *net1, const struct net *net2)
 {
         return net1 == net2;
 }
+
+extern void net_drop_ns(void *);
+
 #else
 
 static inline struct net *get_net(struct net *net)
@@ -168,6 +181,8 @@ int net_eq(const struct net *net1, const struct net *net2)
 {
         return 1;
 }
+
+#define net_drop_ns NULL
 #endif
 
 
diff --git a/include/net/net_ratelimit.h b/include/net/net_ratelimit.h
new file mode 100644
index 000000000000..7727b4247daf
--- /dev/null
+++ b/include/net/net_ratelimit.h
@@ -0,0 +1,8 @@
+#ifndef _LINUX_NET_RATELIMIT_H
+#define _LINUX_NET_RATELIMIT_H
+
+#include <linux/ratelimit.h>
+
+extern struct ratelimit_state net_ratelimit_state;
+
+#endif  /* _LINUX_NET_RATELIMIT_H */
diff --git a/include/net/netevent.h b/include/net/netevent.h
index e82b7bab3ff3..086f8a5b59dc 100644
--- a/include/net/netevent.h
+++ b/include/net/netevent.h
@@ -10,7 +10,6 @@
  *
  *      Changes:
  */
-#ifdef __KERNEL__
 
 struct dst_entry;
 
@@ -21,7 +20,6 @@ struct netevent_redirect {
 
 enum netevent_notif_type {
         NETEVENT_NEIGH_UPDATE = 1, /* arg is struct neighbour ptr */
-        NETEVENT_PMTU_UPDATE,      /* arg is struct dst_entry ptr */
         NETEVENT_REDIRECT,         /* arg is struct netevent_redirect ptr */
 };
 
@@ -30,4 +28,3 @@ extern int unregister_netevent_notifier(struct notifier_block *nb);
 extern int call_netevent_notifiers(unsigned long val, void *v);
 
 #endif
-#endif
diff --git a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
index 1ee717eb5b09..a4c993685795 100644
--- a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
+++ b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
@@ -7,16 +7,6 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6;
 extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6;
 
-extern int nf_ct_frag6_init(void);
-extern void nf_ct_frag6_cleanup(void);
-extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user);
-extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
-                               struct net_device *in,
-                               struct net_device *out,
-                               int (*okfn)(struct sk_buff *));
-
-struct inet_frags_ctl;
-
 #include <linux/sysctl.h>
 extern struct ctl_table nf_ct_ipv6_sysctl_table[];
 
diff --git a/include/net/netfilter/ipv6/nf_defrag_ipv6.h b/include/net/netfilter/ipv6/nf_defrag_ipv6.h
new file mode 100644
index 000000000000..fd79c9a1779d
--- /dev/null
+++ b/include/net/netfilter/ipv6/nf_defrag_ipv6.h
@@ -0,0 +1,16 @@
+#ifndef _NF_DEFRAG_IPV6_H
+#define _NF_DEFRAG_IPV6_H
+
+extern void nf_defrag_ipv6_enable(void);
+
+extern int nf_ct_frag6_init(void);
+extern void nf_ct_frag6_cleanup(void);
+extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user);
+extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
+                               struct net_device *in,
+                               struct net_device *out,
+                               int (*okfn)(struct sk_buff *));
+
+struct inet_frags_ctl;
+
+#endif /* _NF_DEFRAG_IPV6_H */
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index e624dae54fa4..5d4f8e586e32 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -14,7 +14,6 @@
 
 #include <linux/netfilter/nf_conntrack_common.h>
 
-#ifdef __KERNEL__
 #include <linux/bitops.h>
 #include <linux/compiler.h>
 #include <asm/atomic.h>
@@ -50,11 +49,24 @@ union nf_conntrack_expect_proto {
 /* per conntrack: application helper private data */
 union nf_conntrack_help {
         /* insert conntrack helper private data (master) here */
+#if defined(CONFIG_NF_CONNTRACK_FTP) || defined(CONFIG_NF_CONNTRACK_FTP_MODULE)
         struct nf_ct_ftp_master ct_ftp_info;
+#endif
+#if defined(CONFIG_NF_CONNTRACK_PPTP) || \
+    defined(CONFIG_NF_CONNTRACK_PPTP_MODULE)
         struct nf_ct_pptp_master ct_pptp_info;
+#endif
+#if defined(CONFIG_NF_CONNTRACK_H323) || \
+    defined(CONFIG_NF_CONNTRACK_H323_MODULE)
         struct nf_ct_h323_master ct_h323_info;
+#endif
+#if defined(CONFIG_NF_CONNTRACK_SANE) || \
+    defined(CONFIG_NF_CONNTRACK_SANE_MODULE)
         struct nf_ct_sane_master ct_sane_info;
+#endif
+#if defined(CONFIG_NF_CONNTRACK_SIP) || defined(CONFIG_NF_CONNTRACK_SIP_MODULE)
         struct nf_ct_sip_master ct_sip_info;
+#endif
 };
 
 #include <linux/types.h>
@@ -75,7 +87,7 @@ struct nf_conntrack_helper;
 /* nf_conn feature for connections that have a helper */
 struct nf_conn_help {
         /* Helper. if any */
-        struct nf_conntrack_helper *helper;
+        struct nf_conntrack_helper __rcu *helper;
 
         union nf_conntrack_help help;
 
@@ -116,14 +128,14 @@ struct nf_conn {
         u_int32_t secmark;
 #endif
 
-        /* Storage reserved for other modules: */
-        union nf_conntrack_proto proto;
-
         /* Extensions */
         struct nf_ct_ext *ext;
 #ifdef CONFIG_NET_NS
         struct net *ct_net;
 #endif
+
+        /* Storage reserved for other modules, must be the last member */
+        union nf_conntrack_proto proto;
 };
 
 static inline struct nf_conn *
@@ -189,9 +201,9 @@ extern void nf_ct_l3proto_module_put(unsigned short l3proto);
  * Allocate a hashtable of hlist_head (if nulls == 0),
  * or hlist_nulls_head (if nulls == 1)
  */
-extern void *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced, int nulls);
+extern void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls);
 
-extern void nf_ct_free_hashtable(void *hash, int vmalloced, unsigned int size);
+extern void nf_ct_free_hashtable(void *hash, unsigned int size);
 
 extern struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, u16 zone,
@@ -295,9 +307,17 @@ static inline int nf_ct_is_untracked(const struct nf_conn *ct)
         return test_bit(IPS_UNTRACKED_BIT, &ct->status);
 }
 
+/* Packet is received from loopback */
+static inline bool nf_is_loopback_packet(const struct sk_buff *skb)
+{
+        return skb->dev && skb->skb_iif && skb->dev->flags & IFF_LOOPBACK;
+}
+
 extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);
 extern unsigned int nf_conntrack_htable_size;
 extern unsigned int nf_conntrack_max;
+extern unsigned int nf_conntrack_hash_rnd;
+void init_nf_conntrack_hash_rnd(void);
 
 #define NF_CT_STAT_INC(net, count)      \
         __this_cpu_inc((net)->ct.stat->count)
@@ -311,5 +331,4 @@ do {							\
 #define MODULE_ALIAS_NFCT_HELPER(helper) \
         MODULE_ALIAS("nfct-helper-" helper)
 
-#endif /* __KERNEL__ */
 #endif /* _NF_CONNTRACK_H */
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index 96ba5f7dcab6..4283508b3e18 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -23,12 +23,17 @@ struct nf_conntrack_ecache {
 static inline struct nf_conntrack_ecache *
 nf_ct_ecache_find(const struct nf_conn *ct)
 {
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
         return nf_ct_ext_find(ct, NF_CT_EXT_ECACHE);
+#else
+        return NULL;
+#endif
 }
 
 static inline struct nf_conntrack_ecache *
 nf_ct_ecache_ext_add(struct nf_conn *ct, u16 ctmask, u16 expmask, gfp_t gfp)
 {
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
         struct net *net = nf_ct_net(ct);
         struct nf_conntrack_ecache *e;
 
@@ -45,6 +50,9 @@ nf_ct_ecache_ext_add(struct nf_conn *ct, u16 ctmask, u16 expmask, gfp_t gfp)
                 e->expmask = expmask;
         }
         return e;
+#else
+        return NULL;
+#endif
 };
 
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
@@ -59,7 +67,7 @@ struct nf_ct_event_notifier {
         int (*fcn)(unsigned int events, struct nf_ct_event *item);
 };
 
-extern struct nf_ct_event_notifier *nf_conntrack_event_cb;
+extern struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb;
 extern int nf_conntrack_register_notifier(struct nf_ct_event_notifier *nb);
 extern void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *nb);
 
@@ -77,9 +85,6 @@ nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
         if (e == NULL)
                 return;
 
-        if (!(e->ctmask & (1 << event)))
-                return;
-
         set_bit(event, &e->cache);
 }
 
@@ -159,7 +164,7 @@ struct nf_exp_event_notifier {
         int (*fcn)(unsigned int events, struct nf_exp_event *item);
 };
 
-extern struct nf_exp_event_notifier *nf_expect_event_cb;
+extern struct nf_exp_event_notifier __rcu *nf_expect_event_cb;
 extern int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *nb);
 extern void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *nb);
 
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index 11e815084fcf..0f8a8c587532 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -67,9 +67,6 @@ struct nf_conntrack_expect_policy {
 
 #define NF_CT_EXPECT_CLASS_DEFAULT      0
 
-#define NF_CT_EXPECT_PERMANENT  0x1
-#define NF_CT_EXPECT_INACTIVE   0x2
-
 int nf_conntrack_expect_init(struct net *net);
 void nf_conntrack_expect_fini(struct net *net);
 
@@ -85,9 +82,16 @@ struct nf_conntrack_expect *
 nf_ct_find_expectation(struct net *net, u16 zone,
                        const struct nf_conntrack_tuple *tuple);
 
-void nf_ct_unlink_expect(struct nf_conntrack_expect *exp);
+void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
+                                u32 pid, int report);
+static inline void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
+{
+        nf_ct_unlink_expect_report(exp, 0, 0);
+}
+
 void nf_ct_remove_expectations(struct nf_conn *ct);
 void nf_ct_unexpect_related(struct nf_conntrack_expect *exp);
+void nf_ct_remove_userspace_expectations(void);
 
 /* Allocate space for an expectation: this is mandatory before calling
    nf_ct_expect_related.  You will have to call put afterwards. */
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index 0772d296dfdb..2dcf31703acb 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -7,10 +7,19 @@
 
 enum nf_ct_ext_id {
         NF_CT_EXT_HELPER,
+#if defined(CONFIG_NF_NAT) || defined(CONFIG_NF_NAT_MODULE)
         NF_CT_EXT_NAT,
+#endif
         NF_CT_EXT_ACCT,
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
         NF_CT_EXT_ECACHE,
+#endif
+#ifdef CONFIG_NF_CONNTRACK_ZONES
         NF_CT_EXT_ZONE,
+#endif
+#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
+        NF_CT_EXT_TSTAMP,
+#endif
         NF_CT_EXT_NUM,
 };
 
@@ -19,6 +28,7 @@ enum nf_ct_ext_id {
 #define NF_CT_EXT_ACCT_TYPE struct nf_conn_counter
 #define NF_CT_EXT_ECACHE_TYPE struct nf_conntrack_ecache
 #define NF_CT_EXT_ZONE_TYPE struct nf_conntrack_zone
+#define NF_CT_EXT_TSTAMP_TYPE struct nf_conn_tstamp
 
 /* Extensions: optional stuff which isn't permanently in struct. */
 struct nf_ct_ext {
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index 32c305dbdab6..f1c1311adc2c 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -63,4 +63,10 @@ static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
 extern int nf_conntrack_helper_init(void);
 extern void nf_conntrack_helper_fini(void);
 
+extern int nf_conntrack_broadcast_help(struct sk_buff *skb,
+                                       unsigned int protoff,
+                                       struct nf_conn *ct,
+                                       enum ip_conntrack_info ctinfo,
+                                       unsigned int timeout);
+
 #endif /*_NF_CONNTRACK_HELPER_H*/
diff --git a/include/net/netfilter/nf_conntrack_l3proto.h b/include/net/netfilter/nf_conntrack_l3proto.h
index a7547611e8f1..e8010f445ae1 100644
--- a/include/net/netfilter/nf_conntrack_l3proto.h
+++ b/include/net/netfilter/nf_conntrack_l3proto.h
@@ -73,7 +73,7 @@ struct nf_conntrack_l3proto {
         struct module *me;
 };
 
-extern struct nf_conntrack_l3proto *nf_ct_l3protos[AF_MAX];
+extern struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX];
 
 /* Protocol registration. */
 extern int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto);
diff --git a/include/net/netfilter/nf_conntrack_timestamp.h b/include/net/netfilter/nf_conntrack_timestamp.h
new file mode 100644
index 000000000000..fc9c82b1f06b
--- /dev/null
+++ b/include/net/netfilter/nf_conntrack_timestamp.h
@@ -0,0 +1,65 @@
+#ifndef _NF_CONNTRACK_TSTAMP_H
+#define _NF_CONNTRACK_TSTAMP_H
+
+#include <net/net_namespace.h>
+#include <linux/netfilter/nf_conntrack_common.h>
+#include <linux/netfilter/nf_conntrack_tuple_common.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_extend.h>
+
+struct nf_conn_tstamp {
+        u_int64_t start;
+        u_int64_t stop;
+};
+
+static inline
+struct nf_conn_tstamp *nf_conn_tstamp_find(const struct nf_conn *ct)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
+        return nf_ct_ext_find(ct, NF_CT_EXT_TSTAMP);
+#else
+        return NULL;
+#endif
+}
+
+static inline
+struct nf_conn_tstamp *nf_ct_tstamp_ext_add(struct nf_conn *ct, gfp_t gfp)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
+        struct net *net = nf_ct_net(ct);
+
+        if (!net->ct.sysctl_tstamp)
+                return NULL;
+
+        return nf_ct_ext_add(ct, NF_CT_EXT_TSTAMP, gfp);
+#else
+        return NULL;
+#endif
+};
+
+static inline bool nf_ct_tstamp_enabled(struct net *net)
+{
+        return net->ct.sysctl_tstamp != 0;
+}
+
+static inline void nf_ct_set_tstamp(struct net *net, bool enable)
+{
+        net->ct.sysctl_tstamp = enable;
+}
+
+#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
+extern int nf_conntrack_tstamp_init(struct net *net);
+extern void nf_conntrack_tstamp_fini(struct net *net);
+#else
+static inline int nf_conntrack_tstamp_init(struct net *net)
+{
+        return 0;
+}
+
+static inline void nf_conntrack_tstamp_fini(struct net *net)
+{
+        return;
+}
+#endif /* CONFIG_NF_CONNTRACK_TIMESTAMP */
+
+#endif /* _NF_CONNTRACK_TSTAMP_H */
diff --git a/include/net/netfilter/nf_conntrack_tuple.h b/include/net/netfilter/nf_conntrack_tuple.h
index 4ee44c84a304..7ca6bdd5bae6 100644
--- a/include/net/netfilter/nf_conntrack_tuple.h
+++ b/include/net/netfilter/nf_conntrack_tuple.h
@@ -104,8 +104,6 @@ struct nf_conntrack_tuple_mask {
         } src;
 };
 
-#ifdef __KERNEL__
-
 static inline void nf_ct_dump_tuple_ip(const struct nf_conntrack_tuple *t)
 {
 #ifdef DEBUG
@@ -148,8 +146,6 @@ struct nf_conntrack_tuple_hash {
         struct nf_conntrack_tuple tuple;
 };
 
-#endif /* __KERNEL__ */
-
 static inline bool __nf_ct_tuple_src_equal(const struct nf_conntrack_tuple *t1,
                                            const struct nf_conntrack_tuple *t2)
 { 
diff --git a/include/net/netfilter/nf_nat.h b/include/net/netfilter/nf_nat.h
index f5f09f032a90..0346b0070864 100644
--- a/include/net/netfilter/nf_nat.h
+++ b/include/net/netfilter/nf_nat.h
@@ -48,7 +48,6 @@ struct nf_nat_multi_range_compat {
         struct nf_nat_range range[1];
 };
 
-#ifdef __KERNEL__
 #include <linux/list.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 #include <net/netfilter/nf_conntrack_extend.h>
@@ -56,7 +55,9 @@ struct nf_nat_multi_range_compat {
 /* per conntrack: nat application helper private data */
 union nf_conntrack_nat_help {
         /* insert nat helper private data here */
+#if defined(CONFIG_NF_NAT_PPTP) || defined(CONFIG_NF_NAT_PPTP_MODULE)
         struct nf_nat_pptp nat_pptp_info;
+#endif
 };
 
 struct nf_conn;
@@ -84,10 +85,11 @@ extern int nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,
 
 static inline struct nf_conn_nat *nfct_nat(const struct nf_conn *ct)
 {
+#if defined(CONFIG_NF_NAT) || defined(CONFIG_NF_NAT_MODULE)
         return nf_ct_ext_find(ct, NF_CT_EXT_NAT);
+#else
+        return NULL;
+#endif
 }
 
-#else  /* !__KERNEL__: iptables wants this to compile. */
-#define nf_nat_multi_range nf_nat_multi_range_compat
-#endif /*__KERNEL__*/
 #endif
diff --git a/include/net/netfilter/nf_nat_core.h b/include/net/netfilter/nf_nat_core.h
index 33602ab66190..3dc7b98effeb 100644
--- a/include/net/netfilter/nf_nat_core.h
+++ b/include/net/netfilter/nf_nat_core.h
@@ -21,9 +21,9 @@ static inline int nf_nat_initialized(struct nf_conn *ct,
                                      enum nf_nat_manip_type manip)
 {
         if (manip == IP_NAT_MANIP_SRC)
-                return test_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
+                return ct->status & IPS_SRC_NAT_DONE;
         else
-                return test_bit(IPS_DST_NAT_DONE_BIT, &ct->status);
+                return ct->status & IPS_DST_NAT_DONE;
 }
 
 struct nlattr;
diff --git a/include/net/netfilter/nf_nat_protocol.h b/include/net/netfilter/nf_nat_protocol.h
index df17bac46bf5..93cc90d28e66 100644
--- a/include/net/netfilter/nf_nat_protocol.h
+++ b/include/net/netfilter/nf_nat_protocol.h
@@ -45,9 +45,6 @@ struct nf_nat_protocol {
 extern int nf_nat_protocol_register(const struct nf_nat_protocol *proto);
 extern void nf_nat_protocol_unregister(const struct nf_nat_protocol *proto);
 
-extern const struct nf_nat_protocol *nf_nat_proto_find_get(u_int8_t protocol);
-extern void nf_nat_proto_put(const struct nf_nat_protocol *proto);
-
 /* Built-in protocols. */
 extern const struct nf_nat_protocol nf_nat_protocol_tcp;
 extern const struct nf_nat_protocol nf_nat_protocol_udp;
diff --git a/include/net/netfilter/nf_tproxy_core.h b/include/net/netfilter/nf_tproxy_core.h
index 208b46f4d6d2..e505358d8999 100644
--- a/include/net/netfilter/nf_tproxy_core.h
+++ b/include/net/netfilter/nf_tproxy_core.h
@@ -5,28 +5,204 @@
 #include <linux/in.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/inet_sock.h>
+#include <net/inet_hashtables.h>
+#include <net/inet6_hashtables.h>
 #include <net/tcp.h>
 
+#define NFT_LOOKUP_ANY         0
+#define NFT_LOOKUP_LISTENER    1
+#define NFT_LOOKUP_ESTABLISHED 2
+
 /* look up and get a reference to a matching socket */
-extern struct sock *
+
+
+/* This function is used by the 'TPROXY' target and the 'socket'
+ * match. The following lookups are supported:
+ *
+ * Explicit TProxy target rule
+ * ===========================
+ *
+ * This is used when the user wants to intercept a connection matching
+ * an explicit iptables rule. In this case the sockets are assumed
+ * matching in preference order:
+ *
+ *   - match: if there's a fully established connection matching the
+ *     _packet_ tuple, it is returned, assuming the redirection
+ *     already took place and we process a packet belonging to an
+ *     established connection
+ *
+ *   - match: if there's a listening socket matching the redirection
+ *     (e.g. on-port & on-ip of the connection), it is returned,
+ *     regardless if it was bound to 0.0.0.0 or an explicit
+ *     address. The reasoning is that if there's an explicit rule, it
+ *     does not really matter if the listener is bound to an interface
+ *     or to 0. The user already stated that he wants redirection
+ *     (since he added the rule).
+ *
+ * "socket" match based redirection (no specific rule)
+ * ===================================================
+ *
+ * There are connections with dynamic endpoints (e.g. FTP data
+ * connection) that the user is unable to add explicit rules
+ * for. These are taken care of by a generic "socket" rule. It is
+ * assumed that the proxy application is trusted to open such
+ * connections without explicit iptables rule (except of course the
+ * generic 'socket' rule). In this case the following sockets are
+ * matched in preference order:
+ *
+ *   - match: if there's a fully established connection matching the
+ *     _packet_ tuple
+ *
+ *   - match: if there's a non-zero bound listener (possibly with a
+ *     non-local address) We don't accept zero-bound listeners, since
+ *     then local services could intercept traffic going through the
+ *     box.
+ *
+ * Please note that there's an overlap between what a TPROXY target
+ * and a socket match will match. Normally if you have both rules the
+ * "socket" match will be the first one, effectively all packets
+ * belonging to established connections going through that one.
+ */
+static inline struct sock *
 nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
                       const __be32 saddr, const __be32 daddr,
                       const __be16 sport, const __be16 dport,
-                      const struct net_device *in, bool listening);
+                      const struct net_device *in, int lookup_type)
+{
+        struct sock *sk;
+
+        /* look up socket */
+        switch (protocol) {
+        case IPPROTO_TCP:
+                switch (lookup_type) {
+                case NFT_LOOKUP_ANY:
+                        sk = __inet_lookup(net, &tcp_hashinfo,
+                                           saddr, sport, daddr, dport,
+                                           in->ifindex);
+                        break;
+                case NFT_LOOKUP_LISTENER:
+                        sk = inet_lookup_listener(net, &tcp_hashinfo,
+                                                    daddr, dport,
+                                                    in->ifindex);
 
-static inline void
-nf_tproxy_put_sock(struct sock *sk)
+                        /* NOTE: we return listeners even if bound to
+                         * 0.0.0.0, those are filtered out in
+                         * xt_socket, since xt_TPROXY needs 0 bound
+                         * listeners too */
+
+                        break;
+                case NFT_LOOKUP_ESTABLISHED:
+                        sk = inet_lookup_established(net, &tcp_hashinfo,
+                                                    saddr, sport, daddr, dport,
+                                                    in->ifindex);
+                        break;
+                default:
+                        WARN_ON(1);
+                        sk = NULL;
+                        break;
+                }
+                break;
+        case IPPROTO_UDP:
+                sk = udp4_lib_lookup(net, saddr, sport, daddr, dport,
+                                     in->ifindex);
+                if (sk && lookup_type != NFT_LOOKUP_ANY) {
+                        int connected = (sk->sk_state == TCP_ESTABLISHED);
+                        int wildcard = (inet_sk(sk)->inet_rcv_saddr == 0);
+
+                        /* NOTE: we return listeners even if bound to
+                         * 0.0.0.0, those are filtered out in
+                         * xt_socket, since xt_TPROXY needs 0 bound
+                         * listeners too */
+                        if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
+                            (lookup_type == NFT_LOOKUP_LISTENER && connected)) {
+                                sock_put(sk);
+                                sk = NULL;
+                        }
+                }
+                break;
+        default:
+                WARN_ON(1);
+                sk = NULL;
+        }
+
+        pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n",
+                 protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk);
+
+        return sk;
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static inline struct sock *
+nf_tproxy_get_sock_v6(struct net *net, const u8 protocol,
+                      const struct in6_addr *saddr, const struct in6_addr *daddr,
+                      const __be16 sport, const __be16 dport,
+                      const struct net_device *in, int lookup_type)
 {
-        /* TIME_WAIT inet sockets have to be handled differently */
-        if ((sk->sk_protocol == IPPROTO_TCP) && (sk->sk_state == TCP_TIME_WAIT))
-                inet_twsk_put(inet_twsk(sk));
-        else
-                sock_put(sk);
+        struct sock *sk;
+
+        /* look up socket */
+        switch (protocol) {
+        case IPPROTO_TCP:
+                switch (lookup_type) {
+                case NFT_LOOKUP_ANY:
+                        sk = inet6_lookup(net, &tcp_hashinfo,
+                                          saddr, sport, daddr, dport,
+                                          in->ifindex);
+                        break;
+                case NFT_LOOKUP_LISTENER:
+                        sk = inet6_lookup_listener(net, &tcp_hashinfo,
+                                                   daddr, ntohs(dport),
+                                                   in->ifindex);
+
+                        /* NOTE: we return listeners even if bound to
+                         * 0.0.0.0, those are filtered out in
+                         * xt_socket, since xt_TPROXY needs 0 bound
+                         * listeners too */
+
+                        break;
+                case NFT_LOOKUP_ESTABLISHED:
+                        sk = __inet6_lookup_established(net, &tcp_hashinfo,
+                                                        saddr, sport, daddr, ntohs(dport),
+                                                        in->ifindex);
+                        break;
+                default:
+                        WARN_ON(1);
+                        sk = NULL;
+                        break;
+                }
+                break;
+        case IPPROTO_UDP:
+                sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
+                                     in->ifindex);
+                if (sk && lookup_type != NFT_LOOKUP_ANY) {
+                        int connected = (sk->sk_state == TCP_ESTABLISHED);
+                        int wildcard = ipv6_addr_any(&inet6_sk(sk)->rcv_saddr);
+
+                        /* NOTE: we return listeners even if bound to
+                         * 0.0.0.0, those are filtered out in
+                         * xt_socket, since xt_TPROXY needs 0 bound
+                         * listeners too */
+                        if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
+                            (lookup_type == NFT_LOOKUP_LISTENER && connected)) {
+                                sock_put(sk);
+                                sk = NULL;
+                        }
+                }
+                break;
+        default:
+                WARN_ON(1);
+                sk = NULL;
+        }
+
+        pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
+                 protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
+
+        return sk;
 }
+#endif
 
 /* assign a socket to the skb -- consumes sk */
-int
+void
 nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk);
 
 #endif
diff --git a/include/net/netfilter/xt_log.h b/include/net/netfilter/xt_log.h
new file mode 100644
index 000000000000..0dfb34a5b53c
--- /dev/null
+++ b/include/net/netfilter/xt_log.h
@@ -0,0 +1,54 @@
+#define S_SIZE (1024 - (sizeof(unsigned int) + 1))
+
+struct sbuff {
+        unsigned int    count;
+        char            buf[S_SIZE + 1];
+};
+static struct sbuff emergency, *emergency_ptr = &emergency;
+
+static int sb_add(struct sbuff *m, const char *f, ...)
+{
+        va_list args;
+        int len;
+
+        if (likely(m->count < S_SIZE)) {
+                va_start(args, f);
+                len = vsnprintf(m->buf + m->count, S_SIZE - m->count, f, args);
+                va_end(args);
+                if (likely(m->count + len < S_SIZE)) {
+                        m->count += len;
+                        return 0;
+                }
+        }
+        m->count = S_SIZE;
+        printk_once(KERN_ERR KBUILD_MODNAME " please increase S_SIZE\n");
+        return -1;
+}
+
+static struct sbuff *sb_open(void)
+{
+        struct sbuff *m = kmalloc(sizeof(*m), GFP_ATOMIC);
+
+        if (unlikely(!m)) {
+                local_bh_disable();
+                do {
+                        m = xchg(&emergency_ptr, NULL);
+                } while (!m);
+        }
+        m->count = 0;
+        return m;
+}
+
+static void sb_close(struct sbuff *m)
+{
+        m->buf[m->count] = 0;
+        printk("%s\n", m->buf);
+
+        if (likely(m != &emergency))
+                kfree(m);
+        else {
+                xchg(&emergency_ptr, m);
+                local_bh_enable();
+        }
+}
+
diff --git a/include/net/netlink.h b/include/net/netlink.h
index f3b201d335b3..02740a94f108 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -225,13 +225,15 @@ extern int		nlmsg_notify(struct sock *sk, struct sk_buff *skb,
                                      u32 pid, unsigned int group, int report,
                                      gfp_t flags);
 
-extern int              nla_validate(struct nlattr *head, int len, int maxtype,
+extern int              nla_validate(const struct nlattr *head,
+                                     int len, int maxtype,
                                      const struct nla_policy *policy);
-extern int              nla_parse(struct nlattr *tb[], int maxtype,
-                                  struct nlattr *head, int len,
+extern int              nla_parse(struct nlattr **tb, int maxtype,
+                                  const struct nlattr *head, int len,
                                   const struct nla_policy *policy);
 extern int              nla_policy_len(const struct nla_policy *, int);
-extern struct nlattr *  nla_find(struct nlattr *head, int len, int attrtype);
+extern struct nlattr *  nla_find(const struct nlattr *head,
+                                 int len, int attrtype);
 extern size_t           nla_strlcpy(char *dst, const struct nlattr *nla,
                                     size_t dstsize);
 extern int              nla_memcpy(void *dest, const struct nlattr *src, int count);
@@ -288,7 +290,7 @@ static inline int nlmsg_padlen(int payload)
 
 /**
  * nlmsg_data - head of message payload
- * @nlh: netlink messsage header
+ * @nlh: netlink message header
  */
 static inline void *nlmsg_data(const struct nlmsghdr *nlh)
 {
@@ -346,7 +348,8 @@ static inline int nlmsg_ok(const struct nlmsghdr *nlh, int remaining)
  * Returns the next netlink message in the message stream and
  * decrements remaining by the size of the current message.
  */
-static inline struct nlmsghdr *nlmsg_next(struct nlmsghdr *nlh, int *remaining)
+static inline struct nlmsghdr *
+nlmsg_next(const struct nlmsghdr *nlh, int *remaining)
 {
         int totlen = NLMSG_ALIGN(nlh->nlmsg_len);
 
@@ -384,7 +387,7 @@ static inline int nlmsg_parse(const struct nlmsghdr *nlh, int hdrlen,
  *
  * Returns the first attribute which matches the specified type.
  */
-static inline struct nlattr *nlmsg_find_attr(struct nlmsghdr *nlh,
+static inline struct nlattr *nlmsg_find_attr(const struct nlmsghdr *nlh,
                                              int hdrlen, int attrtype)
 {
         return nla_find(nlmsg_attrdata(nlh, hdrlen),
@@ -398,7 +401,8 @@ static inline struct nlattr *nlmsg_find_attr(struct nlmsghdr *nlh,
  * @maxtype: maximum attribute type to be expected
  * @policy: validation policy
  */
-static inline int nlmsg_validate(struct nlmsghdr *nlh, int hdrlen, int maxtype,
+static inline int nlmsg_validate(const struct nlmsghdr *nlh,
+                                 int hdrlen, int maxtype,
                                  const struct nla_policy *policy)
 {
         if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
@@ -727,7 +731,8 @@ static inline struct nlattr *nla_next(const struct nlattr *nla, int *remaining)
  *
  * Returns the first attribute which matches the specified type.
  */
-static inline struct nlattr *nla_find_nested(struct nlattr *nla, int attrtype)
+static inline struct nlattr *
+nla_find_nested(const struct nlattr *nla, int attrtype)
 {
         return nla_find(nla_data(nla), nla_len(nla), attrtype);
 }
@@ -851,18 +856,27 @@ static inline int nla_put_msecs(struct sk_buff *skb, int attrtype,
 #define NLA_PUT_BE16(skb, attrtype, value) \
         NLA_PUT_TYPE(skb, __be16, attrtype, value)
 
+#define NLA_PUT_NET16(skb, attrtype, value) \
+        NLA_PUT_BE16(skb, attrtype | NLA_F_NET_BYTEORDER, value)
+
 #define NLA_PUT_U32(skb, attrtype, value) \
         NLA_PUT_TYPE(skb, u32, attrtype, value)
 
 #define NLA_PUT_BE32(skb, attrtype, value) \
         NLA_PUT_TYPE(skb, __be32, attrtype, value)
 
+#define NLA_PUT_NET32(skb, attrtype, value) \
+        NLA_PUT_BE32(skb, attrtype | NLA_F_NET_BYTEORDER, value)
+
 #define NLA_PUT_U64(skb, attrtype, value) \
         NLA_PUT_TYPE(skb, u64, attrtype, value)
 
 #define NLA_PUT_BE64(skb, attrtype, value) \
         NLA_PUT_TYPE(skb, __be64, attrtype, value)
 
+#define NLA_PUT_NET64(skb, attrtype, value) \
+        NLA_PUT_BE64(skb, attrtype | NLA_F_NET_BYTEORDER, value)
+
 #define NLA_PUT_STRING(skb, attrtype, value) \
         NLA_PUT(skb, attrtype, strlen(value) + 1, value)
 
@@ -1032,7 +1046,7 @@ static inline void nla_nest_cancel(struct sk_buff *skb, struct nlattr *start)
  *
  * Returns 0 on success or a negative error code.
  */
-static inline int nla_validate_nested(struct nlattr *start, int maxtype,
+static inline int nla_validate_nested(const struct nlattr *start, int maxtype,
                                       const struct nla_policy *policy)
 {
         return nla_validate(nla_data(start), nla_len(start), maxtype, policy);
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index d4958d4c6574..341eb089349e 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -21,15 +21,15 @@ struct netns_ct {
         int                     sysctl_events;
         unsigned int            sysctl_events_retry_timeout;
         int                     sysctl_acct;
+        int                     sysctl_tstamp;
         int                     sysctl_checksum;
         unsigned int            sysctl_log_invalid; /* Log invalid packets */
 #ifdef CONFIG_SYSCTL
         struct ctl_table_header *sysctl_header;
         struct ctl_table_header *acct_sysctl_header;
+        struct ctl_table_header *tstamp_sysctl_header;
         struct ctl_table_header *event_sysctl_header;
 #endif
-        int                     hash_vmalloc;
-        int                     expect_vmalloc;
         char                    *slabname;
 };
 #endif
diff --git a/include/net/netns/generic.h b/include/net/netns/generic.h
index 81a31c0db3e7..3419bf5cd154 100644
--- a/include/net/netns/generic.h
+++ b/include/net/netns/generic.h
@@ -30,7 +30,7 @@ struct net_generic {
         void *ptr[0];
 };
 
-static inline void *net_generic(struct net *net, int id)
+static inline void *net_generic(const struct net *net, int id)
 {
         struct net_generic *ng;
         void *ptr;
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index d68c3f121774..d786b4fc02a4 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -43,7 +43,6 @@ struct netns_ipv4 {
         struct xt_table         *nat_table;
         struct hlist_head       *nat_bysource;
         unsigned int            nat_htable_size;
-        int                     nat_vmalloced;
 #endif
 
         int sysctl_icmp_echo_ignore_all;
@@ -55,7 +54,10 @@ struct netns_ipv4 {
         int sysctl_rt_cache_rebuild_count;
         int current_rt_cache_rebuild_count;
 
+        unsigned int sysctl_ping_group_range[2];
+
         atomic_t rt_genid;
+        atomic_t dev_addr_genid;
 
 #ifdef CONFIG_IP_MROUTE
 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
index 74f119a2829a..748f91f87cd5 100644
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -43,10 +43,6 @@ struct netns_xfrm {
         unsigned int            policy_count[XFRM_POLICY_MAX * 2];
         struct work_struct      policy_hash_work;
 
-        struct dst_ops          xfrm4_dst_ops;
-#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-        struct dst_ops          xfrm6_dst_ops;
-#endif
 
         struct sock             *nlsk;
         struct sock             *nlsk_stash;
@@ -58,6 +54,11 @@ struct netns_xfrm {
 #ifdef CONFIG_SYSCTL
         struct ctl_table_header *sysctl_hdr;
 #endif
+
+        struct dst_ops          xfrm4_dst_ops;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        struct dst_ops          xfrm6_dst_ops;
+#endif
 };
 
 #endif
diff --git a/include/net/phonet/pep.h b/include/net/phonet/pep.h
index 35672b1cf44a..b669fe6dbc3b 100644
--- a/include/net/phonet/pep.h
+++ b/include/net/phonet/pep.h
@@ -28,7 +28,6 @@ struct pep_sock {
 
         /* XXX: union-ify listening vs connected stuff ? */
         /* Listening socket stuff: */
-        struct hlist_head       ackq;
         struct hlist_head       hlist;
 
         /* Connected socket stuff: */
@@ -77,6 +76,11 @@ static inline struct pnpipehdr *pnp_hdr(struct sk_buff *skb)
 #define MAX_PNPIPE_HEADER (MAX_PHONET_HEADER + 4)
 
 enum {
+        PNS_PIPE_CREATE_REQ = 0x00,
+        PNS_PIPE_CREATE_RESP,
+        PNS_PIPE_REMOVE_REQ,
+        PNS_PIPE_REMOVE_RESP,
+
         PNS_PIPE_DATA = 0x20,
         PNS_PIPE_ALIGNED_DATA,
 
@@ -149,6 +153,7 @@ enum {
         PN_LEGACY_FLOW_CONTROL,
         PN_ONE_CREDIT_FLOW_CONTROL,
         PN_MULTI_CREDIT_FLOW_CONTROL,
+        PN_MAX_FLOW_CONTROL,
 };
 
 #define pn_flow_safe(fc) ((fc) >> 1)
diff --git a/include/net/phonet/phonet.h b/include/net/phonet/phonet.h
index 7b114079a51b..68e509750caa 100644
--- a/include/net/phonet/phonet.h
+++ b/include/net/phonet/phonet.h
@@ -36,6 +36,7 @@
 struct pn_sock {
         struct sock     sk;
         u16             sobject;
+        u16             dobject;
         u8              resource;
 };
 
@@ -54,6 +55,11 @@ void pn_sock_hash(struct sock *sk);
 void pn_sock_unhash(struct sock *sk);
 int pn_sock_get_port(struct sock *sk, unsigned short sport);
 
+struct sock *pn_find_sock_by_res(struct net *net, u8 res);
+int pn_sock_bind_res(struct sock *sock, u8 res);
+int pn_sock_unbind_res(struct sock *sk, u8 res);
+void pn_sock_unbind_all_res(struct sock *sk);
+
 int pn_skb_send(struct sock *sk, struct sk_buff *skb,
                 const struct sockaddr_pn *target);
 
@@ -102,8 +108,8 @@ struct phonet_protocol {
         int                     sock_type;
 };
 
-int phonet_proto_register(int protocol, struct phonet_protocol *pp);
-void phonet_proto_unregister(int protocol, struct phonet_protocol *pp);
+int phonet_proto_register(unsigned int protocol, struct phonet_protocol *pp);
+void phonet_proto_unregister(unsigned int protocol, struct phonet_protocol *pp);
 
 int phonet_sysctl_init(void);
 void phonet_sysctl_exit(void);
diff --git a/include/net/phonet/pn_dev.h b/include/net/phonet/pn_dev.h
index 2d16783d5e20..8639de5750f6 100644
--- a/include/net/phonet/pn_dev.h
+++ b/include/net/phonet/pn_dev.h
@@ -51,11 +51,12 @@ void phonet_address_notify(int event, struct net_device *dev, u8 addr);
 int phonet_route_add(struct net_device *dev, u8 daddr);
 int phonet_route_del(struct net_device *dev, u8 daddr);
 void rtm_phonet_notify(int event, struct net_device *dev, u8 dst);
-struct net_device *phonet_route_get(struct net *net, u8 daddr);
+struct net_device *phonet_route_get_rcu(struct net *net, u8 daddr);
 struct net_device *phonet_route_output(struct net *net, u8 daddr);
 
 #define PN_NO_ADDR      0xff
 
 extern const struct file_operations pn_sock_seq_fops;
+extern const struct file_operations pn_res_seq_fops;
 
 #endif
diff --git a/include/net/ping.h b/include/net/ping.h
new file mode 100644
index 000000000000..682b5ae9af51
--- /dev/null
+++ b/include/net/ping.h
@@ -0,0 +1,55 @@
+/*
+ * INET         An implementation of the TCP/IP protocol suite for the LINUX
+ *              operating system.  INET is implemented using the  BSD Socket
+ *              interface as the means of communication with the user level.
+ *
+ *              Definitions for the "ping" module.
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ */
+#ifndef _PING_H
+#define _PING_H
+
+#include <net/netns/hash.h>
+
+/* PING_HTABLE_SIZE must be power of 2 */
+#define PING_HTABLE_SIZE        64
+#define PING_HTABLE_MASK        (PING_HTABLE_SIZE-1)
+
+#define ping_portaddr_for_each_entry(__sk, node, list) \
+        hlist_nulls_for_each_entry(__sk, node, list, sk_nulls_node)
+
+/*
+ * gid_t is either uint or ushort.  We want to pass it to
+ * proc_dointvec_minmax(), so it must not be larger than MAX_INT
+ */
+#define GID_T_MAX (((gid_t)~0U) >> 1)
+
+struct ping_table {
+        struct hlist_nulls_head hash[PING_HTABLE_SIZE];
+        rwlock_t                lock;
+};
+
+struct ping_iter_state {
+        struct seq_net_private  p;
+        int                     bucket;
+};
+
+extern struct proto ping_prot;
+
+
+extern void ping_rcv(struct sk_buff *);
+extern void ping_err(struct sk_buff *, u32 info);
+
+#ifdef CONFIG_PROC_FS
+extern int __init ping_proc_init(void);
+extern void ping_proc_exit(void);
+#endif
+
+void __init ping_init(void);
+
+
+#endif /* _PING_H */
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index dd3031aed9d5..9fcc680ab6b9 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -323,7 +323,9 @@ static inline unsigned char * tcf_get_base_ptr(struct sk_buff *skb, int layer)
 static inline int tcf_valid_offset(const struct sk_buff *skb,
                                    const unsigned char *ptr, const int len)
 {
-        return unlikely((ptr + len) < skb_tail_pointer(skb) && ptr > skb->head);
+        return likely((ptr + len) <= skb_tail_pointer(skb) &&
+                      ptr >= skb->head &&
+                      (ptr <= (ptr + len)));
 }
 
 #ifdef CONFIG_NET_CLS_IND
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index d9549af6929a..65afc4966204 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -32,7 +32,7 @@ static inline void *qdisc_priv(struct Qdisc *q)
    
    The result: [34]86 is not good choice for QoS router :-(
 
-   The things are not so bad, because we may use artifical
+   The things are not so bad, because we may use artificial
    clock evaluated by integration of network data flow
    in the most critical places.
  */
diff --git a/include/net/protocol.h b/include/net/protocol.h
index f1effdd3c265..6f7eb800974a 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -38,7 +38,7 @@ struct net_protocol {
         void                    (*err_handler)(struct sk_buff *skb, u32 info);
         int                     (*gso_send_check)(struct sk_buff *skb);
         struct sk_buff         *(*gso_segment)(struct sk_buff *skb,
-                                               int features);
+                                               u32 features);
         struct sk_buff        **(*gro_receive)(struct sk_buff **head,
                                                struct sk_buff *skb);
         int                     (*gro_complete)(struct sk_buff *skb);
@@ -57,7 +57,7 @@ struct inet6_protocol {
 
         int     (*gso_send_check)(struct sk_buff *skb);
         struct sk_buff *(*gso_segment)(struct sk_buff *skb,
-                                       int features);
+                                       u32 features);
         struct sk_buff **(*gro_receive)(struct sk_buff **head,
                                         struct sk_buff *skb);
         int     (*gro_complete)(struct sk_buff *skb);
@@ -89,10 +89,10 @@ struct inet_protosw {
 #define INET_PROTOSW_PERMANENT 0x02  /* Permanent protocols are unremovable. */
 #define INET_PROTOSW_ICSK      0x04  /* Is this an inet_connection_sock? */
 
-extern const struct net_protocol *inet_protos[MAX_INET_PROTOS];
+extern const struct net_protocol __rcu *inet_protos[MAX_INET_PROTOS];
 
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
-extern const struct inet6_protocol *inet6_protos[MAX_INET_PROTOS];
+extern const struct inet6_protocol __rcu *inet6_protos[MAX_INET_PROTOS];
 #endif
 
 extern int      inet_add_protocol(const struct net_protocol *prot, unsigned char num);
diff --git a/include/net/raw.h b/include/net/raw.h
index 43c57502659b..42ce6fe7a2d5 100644
--- a/include/net/raw.h
+++ b/include/net/raw.h
@@ -45,7 +45,10 @@ struct raw_iter_state {
         struct raw_hashinfo *h;
 };
 
-#define raw_seq_private(seq) ((struct raw_iter_state *)(seq)->private)
+static inline struct raw_iter_state *raw_seq_private(struct seq_file *seq)
+{
+        return seq->private;
+}
 void *raw_seq_start(struct seq_file *seq, loff_t *pos);
 void *raw_seq_next(struct seq_file *seq, void *v, loff_t *pos);
 void raw_seq_stop(struct seq_file *seq, void *v);
diff --git a/include/net/rawv6.h b/include/net/rawv6.h
index f6b9b830df8c..cf7577234457 100644
--- a/include/net/rawv6.h
+++ b/include/net/rawv6.h
@@ -1,8 +1,6 @@
 #ifndef _NET_RAWV6_H
 #define _NET_RAWV6_H
 
-#ifdef __KERNEL__
-
 #include <net/protocol.h>
 
 void raw6_icmp_error(struct sk_buff *, int nexthdr,
@@ -20,5 +18,3 @@ int rawv6_mh_filter_unregister(int (*filter)(struct sock *sock,
 #endif
 
 #endif
-
-#endif
diff --git a/include/net/red.h b/include/net/red.h
index 995108e54d9f..3319f16b3beb 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -97,7 +97,6 @@ struct red_stats {
         u32             forced_mark;    /* Forced marks, qavg > max_thresh */
         u32             pdrop;          /* Drops due to queue limits */
         u32             other;          /* Drops due to drop() calls */
-        u32             backlog;
 };
 
 struct red_parms {
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 9e103a4e91ee..356d6e3dc20a 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -43,6 +43,12 @@ enum environment_cap {
  * @intersect: indicates whether the wireless core should intersect
  *      the requested regulatory domain with the presently set regulatory
  *      domain.
+ * @processed: indicates whether or not this requests has already been
+ *      processed. When the last request is processed it means that the
+ *      currently regulatory domain set on cfg80211 is updated from
+ *      CRDA and can be used by other regulatory requests. When a
+ *      the last request is not yet processed we must yield until it
+ *      is processed before processing any new requests.
  * @country_ie_checksum: checksum of the last processed and accepted
  *      country IE
  * @country_ie_env: lets us know if the AP is telling us we are outdoor,
@@ -54,6 +60,7 @@ struct regulatory_request {
         enum nl80211_reg_initiator initiator;
         char alpha2[2];
         bool intersect;
+        bool processed;
         enum environment_cap country_ie_env;
         struct list_head list;
 };
diff --git a/include/net/rose.h b/include/net/rose.h
index 5ba9f02731eb..555dd198aab7 100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -14,6 +14,12 @@
 
 #define ROSE_MIN_LEN                    3
 
+#define ROSE_CALL_REQ_ADDR_LEN_OFF      3
+#define ROSE_CALL_REQ_ADDR_LEN_VAL      0xAA    /* each address is 10 digits */
+#define ROSE_CALL_REQ_DEST_ADDR_OFF     4
+#define ROSE_CALL_REQ_SRC_ADDR_OFF      9
+#define ROSE_CALL_REQ_FACILITIES_OFF    14
+
 #define ROSE_GFI                        0x10
 #define ROSE_Q_BIT                      0x80
 #define ROSE_D_BIT                      0x40
@@ -214,7 +220,7 @@ extern void rose_requeue_frames(struct sock *);
 extern int  rose_validate_nr(struct sock *, unsigned short);
 extern void rose_write_internal(struct sock *, int);
 extern int  rose_decode(struct sk_buff *, int *, int *, int *, int *, int *);
-extern int  rose_parse_facilities(unsigned char *, struct rose_facilities_struct *);
+extern int  rose_parse_facilities(unsigned char *, unsigned int, struct rose_facilities_struct *);
 extern void rose_disconnect(struct sock *, int, int, int);
 
 /* rose_timer.c */
diff --git a/include/net/route.h b/include/net/route.h
index 7e5e73bfa4de..db7b3432f07c 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -35,44 +35,52 @@
 #include <linux/cache.h>
 #include <linux/security.h>
 
-#ifndef __KERNEL__
-#warning This file is not supposed to be used outside of kernel.
-#endif
-
 #define RTO_ONLINK      0x01
 
-#define RTO_CONN        0
-/* RTO_CONN is not used (being alias for 0), but preserved not to break
- * some modules referring to it. */
-
 #define RT_CONN_FLAGS(sk)   (RT_TOS(inet_sk(sk)->tos) | sock_flag(sk, SOCK_LOCALROUTE))
 
 struct fib_nh;
 struct inet_peer;
+struct fib_info;
 struct rtable {
         struct dst_entry        dst;
 
-        /* Cache lookup keys */
-        struct flowi            fl;
+        /* Lookup key. */
+        __be32                  rt_key_dst;
+        __be32                  rt_key_src;
 
-        struct in_device        *idev;
-        
         int                     rt_genid;
         unsigned                rt_flags;
         __u16                   rt_type;
+        __u8                    rt_key_tos;
 
         __be32                  rt_dst; /* Path destination     */
         __be32                  rt_src; /* Path source          */
+        int                     rt_route_iif;
         int                     rt_iif;
+        int                     rt_oif;
+        __u32                   rt_mark;
 
         /* Info on neighbour */
         __be32                  rt_gateway;
 
         /* Miscellaneous cached information */
         __be32                  rt_spec_dst; /* RFC1122 specific destination */
+        u32                     rt_peer_genid;
         struct inet_peer        *peer; /* long-living peer info */
+        struct fib_info         *fi; /* for client ref to shared metrics */
 };
 
+static inline bool rt_is_input_route(struct rtable *rt)
+{
+        return rt->rt_route_iif != 0;
+}
+
+static inline bool rt_is_output_route(struct rtable *rt)
+{
+        return rt->rt_route_iif == 0;
+}
+
 struct ip_rt_acct {
         __u32   o_bytes;
         __u32   o_packets;
@@ -106,10 +114,57 @@ extern int		ip_rt_init(void);
 extern void             ip_rt_redirect(__be32 old_gw, __be32 dst, __be32 new_gw,
                                        __be32 src, struct net_device *dev);
 extern void             rt_cache_flush(struct net *net, int how);
-extern void             rt_cache_flush_batch(void);
-extern int              __ip_route_output_key(struct net *, struct rtable **, const struct flowi *flp);
-extern int              ip_route_output_key(struct net *, struct rtable **, struct flowi *flp);
-extern int              ip_route_output_flow(struct net *, struct rtable **rp, struct flowi *flp, struct sock *sk, int flags);
+extern void             rt_cache_flush_batch(struct net *net);
+extern struct rtable *__ip_route_output_key(struct net *, struct flowi4 *flp);
+extern struct rtable *ip_route_output_flow(struct net *, struct flowi4 *flp,
+                                           struct sock *sk);
+extern struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig);
+
+static inline struct rtable *ip_route_output_key(struct net *net, struct flowi4 *flp)
+{
+        return ip_route_output_flow(net, flp, NULL);
+}
+
+static inline struct rtable *ip_route_output(struct net *net, __be32 daddr,
+                                             __be32 saddr, u8 tos, int oif)
+{
+        struct flowi4 fl4 = {
+                .flowi4_oif = oif,
+                .daddr = daddr,
+                .saddr = saddr,
+                .flowi4_tos = tos,
+        };
+        return ip_route_output_key(net, &fl4);
+}
+
+static inline struct rtable *ip_route_output_ports(struct net *net, struct flowi4 *fl4,
+                                                   struct sock *sk,
+                                                   __be32 daddr, __be32 saddr,
+                                                   __be16 dport, __be16 sport,
+                                                   __u8 proto, __u8 tos, int oif)
+{
+        flowi4_init_output(fl4, oif, sk ? sk->sk_mark : 0, tos,
+                           RT_SCOPE_UNIVERSE, proto,
+                           sk ? inet_sk_flowi_flags(sk) : 0,
+                           daddr, saddr, dport, sport);
+        if (sk)
+                security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+        return ip_route_output_flow(net, fl4, sk);
+}
+
+static inline struct rtable *ip_route_output_gre(struct net *net, struct flowi4 *fl4,
+                                                 __be32 daddr, __be32 saddr,
+                                                 __be32 gre_key, __u8 tos, int oif)
+{
+        memset(fl4, 0, sizeof(*fl4));
+        fl4->flowi4_oif = oif;
+        fl4->daddr = daddr;
+        fl4->saddr = saddr;
+        fl4->flowi4_tos = tos;
+        fl4->flowi4_proto = IPPROTO_GRE;
+        fl4->fl4_gre_key = gre_key;
+        return ip_route_output_key(net, fl4);
+}
 
 extern int ip_route_input_common(struct sk_buff *skb, __be32 dst, __be32 src,
                                  u8 tos, struct net_device *devin, bool noref);
@@ -126,18 +181,20 @@ static inline int ip_route_input_noref(struct sk_buff *skb, __be32 dst, __be32 s
         return ip_route_input_common(skb, dst, src, tos, devin, true);
 }
 
-extern unsigned short   ip_rt_frag_needed(struct net *net, struct iphdr *iph, unsigned short new_mtu, struct net_device *dev);
+extern unsigned short   ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
+                                          unsigned short new_mtu, struct net_device *dev);
 extern void             ip_rt_send_redirect(struct sk_buff *skb);
 
 extern unsigned         inet_addr_type(struct net *net, __be32 addr);
 extern unsigned         inet_dev_addr_type(struct net *net, const struct net_device *dev, __be32 addr);
 extern void             ip_rt_multicast_event(struct in_device *);
 extern int              ip_rt_ioctl(struct net *, unsigned int cmd, void __user *arg);
-extern void             ip_rt_get_source(u8 *src, struct rtable *rt);
+extern void             ip_rt_get_source(u8 *src, struct sk_buff *skb, struct rtable *rt);
 extern int              ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb);
 
 struct in_ifaddr;
 extern void fib_add_ifaddr(struct in_ifaddr *);
+extern void fib_del_ifaddr(struct in_ifaddr *, struct in_ifaddr *);
 
 static inline void ip_rt_put(struct rtable * rt)
 {
@@ -154,69 +211,93 @@ static inline char rt_tos2priority(u8 tos)
         return ip_tos2prio[IPTOS_TOS(tos)>>1];
 }
 
-static inline int ip_route_connect(struct rtable **rp, __be32 dst,
-                                   __be32 src, u32 tos, int oif, u8 protocol,
-                                   __be16 sport, __be16 dport, struct sock *sk,
-                                   int flags)
+/* ip_route_connect() and ip_route_newports() work in tandem whilst
+ * binding a socket for a new outgoing connection.
+ *
+ * In order to use IPSEC properly, we must, in the end, have a
+ * route that was looked up using all available keys including source
+ * and destination ports.
+ *
+ * However, if a source port needs to be allocated (the user specified
+ * a wildcard source port) we need to obtain addressing information
+ * in order to perform that allocation.
+ *
+ * So ip_route_connect() looks up a route using wildcarded source and
+ * destination ports in the key, simply so that we can get a pair of
+ * addresses to use for port allocation.
+ *
+ * Later, once the ports are allocated, ip_route_newports() will make
+ * another route lookup if needed to make sure we catch any IPSEC
+ * rules keyed on the port information.
+ *
+ * The callers allocate the flow key on their stack, and must pass in
+ * the same flowi4 object to both the ip_route_connect() and the
+ * ip_route_newports() calls.
+ */
+
+static inline void ip_route_connect_init(struct flowi4 *fl4, __be32 dst, __be32 src,
+                                         u32 tos, int oif, u8 protocol,
+                                         __be16 sport, __be16 dport,
+                                         struct sock *sk, bool can_sleep)
 {
-        struct flowi fl = { .oif = oif,
-                            .mark = sk->sk_mark,
-                            .nl_u = { .ip4_u = { .daddr = dst,
-                                                 .saddr = src,
-                                                 .tos   = tos } },
-                            .proto = protocol,
-                            .uli_u = { .ports =
-                                       { .sport = sport,
-                                         .dport = dport } } };
+        __u8 flow_flags = 0;
+
+        if (inet_sk(sk)->transparent)
+                flow_flags |= FLOWI_FLAG_ANYSRC;
+        if (protocol == IPPROTO_TCP)
+                flow_flags |= FLOWI_FLAG_PRECOW_METRICS;
+        if (can_sleep)
+                flow_flags |= FLOWI_FLAG_CAN_SLEEP;
+
+        flowi4_init_output(fl4, oif, sk->sk_mark, tos, RT_SCOPE_UNIVERSE,
+                           protocol, flow_flags, dst, src, dport, sport);
+}
 
-        int err;
+static inline struct rtable *ip_route_connect(struct flowi4 *fl4,
+                                              __be32 dst, __be32 src, u32 tos,
+                                              int oif, u8 protocol,
+                                              __be16 sport, __be16 dport,
+                                              struct sock *sk, bool can_sleep)
+{
         struct net *net = sock_net(sk);
+        struct rtable *rt;
 
-        if (inet_sk(sk)->transparent)
-                fl.flags |= FLOWI_FLAG_ANYSRC;
+        ip_route_connect_init(fl4, dst, src, tos, oif, protocol,
+                              sport, dport, sk, can_sleep);
 
         if (!dst || !src) {
-                err = __ip_route_output_key(net, rp, &fl);
-                if (err)
-                        return err;
-                fl.fl4_dst = (*rp)->rt_dst;
-                fl.fl4_src = (*rp)->rt_src;
-                ip_rt_put(*rp);
-                *rp = NULL;
+                rt = __ip_route_output_key(net, fl4);
+                if (IS_ERR(rt))
+                        return rt;
+                ip_rt_put(rt);
         }
-        security_sk_classify_flow(sk, &fl);
-        return ip_route_output_flow(net, rp, &fl, sk, flags);
-}
-
-static inline int ip_route_newports(struct rtable **rp, u8 protocol,
-                                    __be16 sport, __be16 dport, struct sock *sk)
-{
-        if (sport != (*rp)->fl.fl_ip_sport ||
-            dport != (*rp)->fl.fl_ip_dport) {
-                struct flowi fl;
-
-                memcpy(&fl, &(*rp)->fl, sizeof(fl));
-                fl.fl_ip_sport = sport;
-                fl.fl_ip_dport = dport;
-                fl.proto = protocol;
-                if (inet_sk(sk)->transparent)
-                        fl.flags |= FLOWI_FLAG_ANYSRC;
-                ip_rt_put(*rp);
-                *rp = NULL;
-                security_sk_classify_flow(sk, &fl);
-                return ip_route_output_flow(sock_net(sk), rp, &fl, sk, 0);
+        security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+        return ip_route_output_flow(net, fl4, sk);
+}
+
+static inline struct rtable *ip_route_newports(struct flowi4 *fl4, struct rtable *rt,
+                                               __be16 orig_sport, __be16 orig_dport,
+                                               __be16 sport, __be16 dport,
+                                               struct sock *sk)
+{
+        if (sport != orig_sport || dport != orig_dport) {
+                fl4->fl4_dport = dport;
+                fl4->fl4_sport = sport;
+                ip_rt_put(rt);
+                security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+                return ip_route_output_flow(sock_net(sk), fl4, sk);
         }
-        return 0;
+        return rt;
 }
 
-extern void rt_bind_peer(struct rtable *rt, int create);
+extern void rt_bind_peer(struct rtable *rt, __be32 daddr, int create);
 
-static inline struct inet_peer *rt_get_peer(struct rtable *rt)
+static inline struct inet_peer *rt_get_peer(struct rtable *rt, __be32 daddr)
 {
         if (rt->peer)
                 return rt->peer;
 
-        rt_bind_peer(rt, 0);
+        rt_bind_peer(rt, daddr, 0);
         return rt->peer;
 }
 
@@ -225,4 +306,15 @@ static inline int inet_iif(const struct sk_buff *skb)
         return skb_rtable(skb)->rt_iif;
 }
 
+extern int sysctl_ip_default_ttl;
+
+static inline int ip4_dst_hoplimit(const struct dst_entry *dst)
+{
+        int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT);
+
+        if (hoplimit == 0)
+                hoplimit = sysctl_ip_default_ttl;
+        return hoplimit;
+}
+
 #endif  /* _ROUTE_H */
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index af60fd050844..4093ca78cf60 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -79,11 +79,45 @@ struct rtnl_link_ops {
 
 extern int      __rtnl_link_register(struct rtnl_link_ops *ops);
 extern void     __rtnl_link_unregister(struct rtnl_link_ops *ops);
-extern void     rtnl_kill_links(struct net *net, struct rtnl_link_ops *ops);
 
 extern int      rtnl_link_register(struct rtnl_link_ops *ops);
 extern void     rtnl_link_unregister(struct rtnl_link_ops *ops);
 
+/**
+ *      struct rtnl_af_ops - rtnetlink address family operations
+ *
+ *      @list: Used internally
+ *      @family: Address family
+ *      @fill_link_af: Function to fill IFLA_AF_SPEC with address family
+ *                     specific netlink attributes.
+ *      @get_link_af_size: Function to calculate size of address family specific
+ *                         netlink attributes exlusive the container attribute.
+ *      @validate_link_af: Validate a IFLA_AF_SPEC attribute, must check attr
+ *                         for invalid configuration settings.
+ *      @set_link_af: Function to parse a IFLA_AF_SPEC attribute and modify
+ *                    net_device accordingly.
+ */
+struct rtnl_af_ops {
+        struct list_head        list;
+        int                     family;
+
+        int                     (*fill_link_af)(struct sk_buff *skb,
+                                                const struct net_device *dev);
+        size_t                  (*get_link_af_size)(const struct net_device *dev);
+
+        int                     (*validate_link_af)(const struct net_device *dev,
+                                                    const struct nlattr *attr);
+        int                     (*set_link_af)(struct net_device *dev,
+                                               const struct nlattr *attr);
+};
+
+extern int      __rtnl_af_register(struct rtnl_af_ops *ops);
+extern void     __rtnl_af_unregister(struct rtnl_af_ops *ops);
+
+extern int      rtnl_af_register(struct rtnl_af_ops *ops);
+extern void     rtnl_af_unregister(struct rtnl_af_ops *ops);
+
+
 extern struct net *rtnl_link_get_net(struct net *src_net, struct nlattr *tb[]);
 extern struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
         char *ifname, const struct rtnl_link_ops *ops, struct nlattr *tb[]);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 3c8728aaab4e..b931f021d7ab 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -25,16 +25,18 @@ struct qdisc_rate_table {
 enum qdisc_state_t {
         __QDISC_STATE_SCHED,
         __QDISC_STATE_DEACTIVATED,
+        __QDISC_STATE_THROTTLED,
 };
 
 /*
  * following bits are only changed while qdisc lock is held
  */
 enum qdisc___state_t {
-        __QDISC___STATE_RUNNING,
+        __QDISC___STATE_RUNNING = 1,
 };
 
 struct qdisc_size_table {
+        struct rcu_head         rcu;
         struct list_head        list;
         struct tc_sizespec      szopts;
         int                     refcnt;
@@ -46,14 +48,13 @@ struct Qdisc {
         struct sk_buff *        (*dequeue)(struct Qdisc *dev);
         unsigned                flags;
 #define TCQ_F_BUILTIN           1
-#define TCQ_F_THROTTLED         2
-#define TCQ_F_INGRESS           4
-#define TCQ_F_CAN_BYPASS        8
-#define TCQ_F_MQROOT            16
+#define TCQ_F_INGRESS           2
+#define TCQ_F_CAN_BYPASS        4
+#define TCQ_F_MQROOT            8
 #define TCQ_F_WARN_NONWC        (1 << 16)
         int                     padded;
         struct Qdisc_ops        *ops;
-        struct qdisc_size_table *stab;
+        struct qdisc_size_table __rcu *stab;
         struct list_head        list;
         u32                     handle;
         u32                     parent;
@@ -78,25 +79,44 @@ struct Qdisc {
         unsigned long           state;
         struct sk_buff_head     q;
         struct gnet_stats_basic_packed bstats;
-        unsigned long           __state;
+        unsigned int            __state;
         struct gnet_stats_queue qstats;
         struct rcu_head         rcu_head;
         spinlock_t              busylock;
+        u32                     limit;
 };
 
-static inline bool qdisc_is_running(struct Qdisc *qdisc)
+static inline bool qdisc_is_running(const struct Qdisc *qdisc)
 {
-        return test_bit(__QDISC___STATE_RUNNING, &qdisc->__state);
+        return (qdisc->__state & __QDISC___STATE_RUNNING) ? true : false;
 }
 
 static inline bool qdisc_run_begin(struct Qdisc *qdisc)
 {
-        return !__test_and_set_bit(__QDISC___STATE_RUNNING, &qdisc->__state);
+        if (qdisc_is_running(qdisc))
+                return false;
+        qdisc->__state |= __QDISC___STATE_RUNNING;
+        return true;
 }
 
 static inline void qdisc_run_end(struct Qdisc *qdisc)
 {
-        __clear_bit(__QDISC___STATE_RUNNING, &qdisc->__state);
+        qdisc->__state &= ~__QDISC___STATE_RUNNING;
+}
+
+static inline bool qdisc_is_throttled(const struct Qdisc *qdisc)
+{
+        return test_bit(__QDISC_STATE_THROTTLED, &qdisc->state) ? true : false;
+}
+
+static inline void qdisc_throttled(struct Qdisc *qdisc)
+{
+        set_bit(__QDISC_STATE_THROTTLED, &qdisc->state);
+}
+
+static inline void qdisc_unthrottled(struct Qdisc *qdisc)
+{
+        clear_bit(__QDISC_STATE_THROTTLED, &qdisc->state);
 }
 
 struct Qdisc_class_ops {
@@ -199,7 +219,7 @@ struct tcf_proto {
 
 struct qdisc_skb_cb {
         unsigned int            pkt_len;
-        char                    data[];
+        long                    data[];
 };
 
 static inline int qdisc_qlen(struct Qdisc *q)
@@ -207,7 +227,7 @@ static inline int qdisc_qlen(struct Qdisc *q)
         return q->q.qlen;
 }
 
-static inline struct qdisc_skb_cb *qdisc_skb_cb(struct sk_buff *skb)
+static inline struct qdisc_skb_cb *qdisc_skb_cb(const struct sk_buff *skb)
 {
         return (struct qdisc_skb_cb *)skb->cb;
 }
@@ -321,6 +341,7 @@ extern void dev_init_scheduler(struct net_device *dev);
 extern void dev_shutdown(struct net_device *dev);
 extern void dev_activate(struct net_device *dev);
 extern void dev_deactivate(struct net_device *dev);
+extern void dev_deactivate_many(struct list_head *head);
 extern struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
                                      struct Qdisc *qdisc);
 extern void qdisc_reset(struct Qdisc *qdisc);
@@ -328,11 +349,10 @@ extern void qdisc_destroy(struct Qdisc *qdisc);
 extern void qdisc_tree_decrease_qlen(struct Qdisc *qdisc, unsigned int n);
 extern struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
                                  struct Qdisc_ops *ops);
-extern struct Qdisc *qdisc_create_dflt(struct net_device *dev,
-                                       struct netdev_queue *dev_queue,
+extern struct Qdisc *qdisc_create_dflt(struct netdev_queue *dev_queue,
                                        struct Qdisc_ops *ops, u32 parentid);
-extern void qdisc_calculate_pkt_len(struct sk_buff *skb,
-                                   struct qdisc_size_table *stab);
+extern void __qdisc_calculate_pkt_len(struct sk_buff *skb,
+                                      const struct qdisc_size_table *stab);
 extern void tcf_destroy(struct tcf_proto *tp);
 extern void tcf_destroy_chain(struct tcf_proto **fl);
 
@@ -394,7 +414,7 @@ static inline bool qdisc_tx_is_noop(const struct net_device *dev)
         return true;
 }
 
-static inline unsigned int qdisc_pkt_len(struct sk_buff *skb)
+static inline unsigned int qdisc_pkt_len(const struct sk_buff *skb)
 {
         return qdisc_skb_cb(skb)->pkt_len;
 }
@@ -411,12 +431,20 @@ enum net_xmit_qdisc_t {
 #define net_xmit_drop_count(e)  (1)
 #endif
 
-static inline int qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+static inline void qdisc_calculate_pkt_len(struct sk_buff *skb,
+                                           const struct Qdisc *sch)
 {
 #ifdef CONFIG_NET_SCHED
-        if (sch->stab)
-                qdisc_calculate_pkt_len(skb, sch->stab);
+        struct qdisc_size_table *stab = rcu_dereference_bh(sch->stab);
+
+        if (stab)
+                __qdisc_calculate_pkt_len(skb, stab);
 #endif
+}
+
+static inline int qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        qdisc_calculate_pkt_len(skb, sch);
         return sch->enqueue(skb, sch);
 }
 
@@ -426,10 +454,18 @@ static inline int qdisc_enqueue_root(struct sk_buff *skb, struct Qdisc *sch)
         return qdisc_enqueue(skb, sch) & NET_XMIT_MASK;
 }
 
-static inline void __qdisc_update_bstats(struct Qdisc *sch, unsigned int len)
+
+static inline void bstats_update(struct gnet_stats_basic_packed *bstats,
+                                 const struct sk_buff *skb)
+{
+        bstats->bytes += qdisc_pkt_len(skb);
+        bstats->packets += skb_is_gso(skb) ? skb_shinfo(skb)->gso_segs : 1;
+}
+
+static inline void qdisc_bstats_update(struct Qdisc *sch,
+                                       const struct sk_buff *skb)
 {
-        sch->bstats.bytes += len;
-        sch->bstats.packets++;
+        bstats_update(&sch->bstats, skb);
 }
 
 static inline int __qdisc_enqueue_tail(struct sk_buff *skb, struct Qdisc *sch,
@@ -437,7 +473,6 @@ static inline int __qdisc_enqueue_tail(struct sk_buff *skb, struct Qdisc *sch,
 {
         __skb_queue_tail(list, skb);
         sch->qstats.backlog += qdisc_pkt_len(skb);
-        __qdisc_update_bstats(sch, qdisc_pkt_len(skb));
 
         return NET_XMIT_SUCCESS;
 }
@@ -452,8 +487,10 @@ static inline struct sk_buff *__qdisc_dequeue_head(struct Qdisc *sch,
 {
         struct sk_buff *skb = __skb_dequeue(list);
 
-        if (likely(skb != NULL))
+        if (likely(skb != NULL)) {
                 sch->qstats.backlog -= qdisc_pkt_len(skb);
+                qdisc_bstats_update(sch, skb);
+        }
 
         return skb;
 }
@@ -466,10 +503,11 @@ static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch)
 static inline unsigned int __qdisc_queue_drop_head(struct Qdisc *sch,
                                               struct sk_buff_head *list)
 {
-        struct sk_buff *skb = __qdisc_dequeue_head(sch, list);
+        struct sk_buff *skb = __skb_dequeue(list);
 
         if (likely(skb != NULL)) {
                 unsigned int len = qdisc_pkt_len(skb);
+                sch->qstats.backlog -= len;
                 kfree_skb(skb);
                 return len;
         }
@@ -601,7 +639,7 @@ static inline u32 qdisc_l2t(struct qdisc_rate_table* rtab, unsigned int pktlen)
                 slot = 0;
         slot >>= rtab->rate.cell_log;
         if (slot > 255)
-                return (rtab->data[255]*(slot >> 8) + rtab->data[slot & 0xFF]);
+                return rtab->data[255]*(slot >> 8) + rtab->data[slot & 0xFF];
         return rtab->data[slot];
 }
 
@@ -611,11 +649,7 @@ static inline struct sk_buff *skb_act_clone(struct sk_buff *skb, gfp_t gfp_mask,
 {
         struct sk_buff *n;
 
-        if ((action == TC_ACT_STOLEN || action == TC_ACT_QUEUED) &&
-            !skb_shared(skb))
-                n = skb_get(skb);
-        else
-                n = skb_clone(skb, gfp_mask);
+        n = skb_clone(skb, gfp_mask);
 
         if (n) {
                 n->tc_verd = SET_TC_VERD(n->tc_verd, 0);
diff --git a/include/net/scm.h b/include/net/scm.h
index 31656506d967..745460fa2f02 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -10,11 +10,12 @@
 /* Well, we should have at least one descriptor open
  * to accept passed FDs 8)
  */
-#define SCM_MAX_FD      255
+#define SCM_MAX_FD      253
 
 struct scm_fp_list {
         struct list_head        list;
-        int                     count;
+        short                   count;
+        short                   max;
         struct file             *fp[SCM_MAX_FD];
 };
 
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 2c55a7ea20af..6506458ccd33 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -63,6 +63,7 @@ typedef enum {
         SCTP_CMD_ECN_ECNE,      /* Do delayed ECNE processing. */
         SCTP_CMD_ECN_CWR,       /* Do delayed CWR processing.  */
         SCTP_CMD_TIMER_START,   /* Start a timer.  */
+        SCTP_CMD_TIMER_START_ONCE, /* Start a timer once */
         SCTP_CMD_TIMER_RESTART, /* Restart a timer. */
         SCTP_CMD_TIMER_STOP,    /* Stop a timer. */
         SCTP_CMD_INIT_CHOOSE_TRANSPORT, /* Choose transport for an INIT. */
@@ -73,7 +74,6 @@ typedef enum {
         SCTP_CMD_INIT_FAILED,   /* High level, do init failure work. */
         SCTP_CMD_REPORT_DUP,    /* Report a duplicate TSN.  */
         SCTP_CMD_STRIKE,        /* Mark a strike against a transport.  */
-        SCTP_CMD_TRANSMIT,      /* Transmit the outqueue. */
         SCTP_CMD_HB_TIMERS_START,    /* Start the heartbeat timers. */
         SCTP_CMD_HB_TIMER_UPDATE,    /* Update a heartbeat timers.  */
         SCTP_CMD_HB_TIMERS_STOP,     /* Stop the heartbeat timers.  */
@@ -108,12 +108,10 @@ typedef enum {
         SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
         SCTP_CMD_SEND_MSG,       /* Send the whole use message */
         SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */
+        SCTP_CMD_PURGE_ASCONF_QUEUE, /* Purge all asconf queues.*/
         SCTP_CMD_LAST
 } sctp_verb_t;
 
-#define SCTP_CMD_MAX            (SCTP_CMD_LAST - 1)
-#define SCTP_CMD_NUM_VERBS      (SCTP_CMD_MAX + 1)
-
 /* How many commands can you put in an sctp_cmd_seq_t?
  * This is a rather arbitrary number, ideally derived from a careful
  * analysis of the state functions, but in reality just taken from
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index 63908840eef0..942b864f6135 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -61,7 +61,6 @@ enum { SCTP_DEFAULT_INSTREAMS = SCTP_MAX_STREAM };
  * symbols.  CIDs are dense through SCTP_CID_BASE_MAX.
  */
 #define SCTP_CID_BASE_MAX               SCTP_CID_SHUTDOWN_COMPLETE
-#define SCTP_CID_MAX                    SCTP_CID_ASCONF_ACK
 
 #define SCTP_NUM_BASE_CHUNK_TYPES       (SCTP_CID_BASE_MAX + 1)
 
@@ -86,9 +85,6 @@ typedef enum {
 
 } sctp_event_t;
 
-#define SCTP_EVENT_T_MAX SCTP_EVENT_T_PRIMITIVE
-#define SCTP_EVENT_T_NUM (SCTP_EVENT_T_MAX + 1)
-
 /* As a convenience for the state machine, we append SCTP_EVENT_* and
  * SCTP_ULP_* to the list of possible chunks.
  */
@@ -154,7 +150,6 @@ SCTP_SUBTYPE_CONSTRUCTOR(OTHER,		sctp_event_other_t,	other)
 SCTP_SUBTYPE_CONSTRUCTOR(PRIMITIVE,     sctp_event_primitive_t, primitive)
 
 
-#define sctp_chunk_is_control(a) (a->chunk_hdr->type != SCTP_CID_DATA)
 #define sctp_chunk_is_data(a) (a->chunk_hdr->type == SCTP_CID_DATA)
 
 /* Calculate the actual data size in a data chunk */
@@ -162,9 +157,6 @@ SCTP_SUBTYPE_CONSTRUCTOR(PRIMITIVE,	sctp_event_primitive_t,	primitive)
                                 - (unsigned long)(c->chunk_hdr)\
                                 - sizeof(sctp_data_chunk_t)))
 
-#define SCTP_MAX_ERROR_CAUSE  SCTP_ERROR_NONEXIST_IP
-#define SCTP_NUM_ERROR_CAUSE  10
-
 /* Internal error codes */
 typedef enum {
 
@@ -195,15 +187,14 @@ typedef enum {
 /* SCTP state defines for internal state machine */
 typedef enum {
 
-        SCTP_STATE_EMPTY                = 0,
-        SCTP_STATE_CLOSED               = 1,
-        SCTP_STATE_COOKIE_WAIT          = 2,
-        SCTP_STATE_COOKIE_ECHOED        = 3,
-        SCTP_STATE_ESTABLISHED          = 4,
-        SCTP_STATE_SHUTDOWN_PENDING     = 5,
-        SCTP_STATE_SHUTDOWN_SENT        = 6,
-        SCTP_STATE_SHUTDOWN_RECEIVED    = 7,
-        SCTP_STATE_SHUTDOWN_ACK_SENT    = 8,
+        SCTP_STATE_CLOSED               = 0,
+        SCTP_STATE_COOKIE_WAIT          = 1,
+        SCTP_STATE_COOKIE_ECHOED        = 2,
+        SCTP_STATE_ESTABLISHED          = 3,
+        SCTP_STATE_SHUTDOWN_PENDING     = 4,
+        SCTP_STATE_SHUTDOWN_SENT        = 5,
+        SCTP_STATE_SHUTDOWN_RECEIVED    = 6,
+        SCTP_STATE_SHUTDOWN_ACK_SENT    = 7,
 
 } sctp_state_t;
 
@@ -266,7 +257,6 @@ enum { SCTP_ARBITRARY_COOKIE_ECHO_LEN = 200 };
 #define SCTP_TSN_MAP_INITIAL BITS_PER_LONG
 #define SCTP_TSN_MAP_INCREMENT SCTP_TSN_MAP_INITIAL
 #define SCTP_TSN_MAP_SIZE 4096
-#define SCTP_TSN_MAX_GAP  65535
 
 /* We will not record more than this many duplicate TSNs between two
  * SACKs.  The minimum PMTU is 576.  Remove all the headers and there
@@ -301,9 +291,6 @@ enum { SCTP_MAX_GABS = 16 };
 
 #define SCTP_CLOCK_GRANULARITY  1       /* 1 jiffy */
 
-#define SCTP_DEF_MAX_INIT 6
-#define SCTP_DEF_MAX_SEND 10
-
 #define SCTP_DEFAULT_COOKIE_LIFE        (60 * 1000) /* 60 seconds */
 
 #define SCTP_DEFAULT_MINWINDOW  1500    /* default minimum rwnd size */
@@ -317,9 +304,6 @@ enum { SCTP_MAX_GABS = 16 };
                                          */
 #define SCTP_DEFAULT_MINSEGMENT 512     /* MTU size ... if no mtu disc */
 #define SCTP_HOW_MANY_SECRETS 2         /* How many secrets I keep */
-#define SCTP_HOW_LONG_COOKIE_LIVE 3600  /* How many seconds the current
-                                         * secret will live?
-                                         */
 #define SCTP_SECRET_SIZE 32             /* Number of octets in a 256 bits. */
 
 #define SCTP_SIGNATURE_SIZE 20          /* size of a SLA-1 signature */
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 65946bc43d00..b2c2366676a7 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -115,7 +115,6 @@
  * sctp/protocol.c
  */
 extern struct sock *sctp_get_ctl_sock(void);
-extern void sctp_local_addr_free(struct rcu_head *head);
 extern int sctp_copy_local_addr_list(struct sctp_bind_addr *,
                                      sctp_scope_t, gfp_t gfp,
                                      int flags);
@@ -275,24 +274,35 @@ struct sctp_mib {
 /* Print debugging messages.  */
 #if SCTP_DEBUG
 extern int sctp_debug_flag;
-#define SCTP_DEBUG_PRINTK(whatever...) \
-        ((void) (sctp_debug_flag && printk(KERN_DEBUG whatever)))
-#define SCTP_DEBUG_PRINTK_IPADDR(lead, trail, leadparm, saddr, otherparms...) \
-        if (sctp_debug_flag) { \
-                if (saddr->sa.sa_family == AF_INET6) { \
-                        printk(KERN_DEBUG \
-                               lead "%pI6" trail, \
-                               leadparm, \
-                               &saddr->v6.sin6_addr, \
-                               otherparms); \
-                } else { \
-                        printk(KERN_DEBUG \
-                               lead "%pI4" trail, \
-                               leadparm, \
-                               &saddr->v4.sin_addr.s_addr, \
-                               otherparms); \
-                } \
-        }
+#define SCTP_DEBUG_PRINTK(fmt, args...)                 \
+do {                                                    \
+        if (sctp_debug_flag)                            \
+                printk(KERN_DEBUG pr_fmt(fmt), ##args); \
+} while (0)
+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)            \
+do {                                                    \
+        if (sctp_debug_flag)                            \
+                pr_cont(fmt, ##args);                   \
+} while (0)
+#define SCTP_DEBUG_PRINTK_IPADDR(fmt_lead, fmt_trail,                   \
+                                 args_lead, saddr, args_trail...)       \
+do {                                                                    \
+        if (sctp_debug_flag) {                                          \
+                if (saddr->sa.sa_family == AF_INET6) {                  \
+                        printk(KERN_DEBUG                               \
+                               pr_fmt(fmt_lead "%pI6" fmt_trail),       \
+                               args_lead,                               \
+                               &saddr->v6.sin6_addr,                    \
+                               args_trail);                             \
+                } else {                                                \
+                        printk(KERN_DEBUG                               \
+                               pr_fmt(fmt_lead "%pI4" fmt_trail),       \
+                               args_lead,                               \
+                               &saddr->v4.sin_addr.s_addr,              \
+                               args_trail);                             \
+                }                                                       \
+        }                                                               \
+} while (0)
 #define SCTP_ENABLE_DEBUG { sctp_debug_flag = 1; }
 #define SCTP_DISABLE_DEBUG { sctp_debug_flag = 0; }
 
@@ -306,6 +316,7 @@ extern int sctp_debug_flag;
 #else   /* SCTP_DEBUG */
 
 #define SCTP_DEBUG_PRINTK(whatever...)
+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
 #define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
 #define SCTP_ENABLE_DEBUG
 #define SCTP_DISABLE_DEBUG
@@ -393,7 +404,7 @@ static inline void sctp_v6_del_protocol(void) { return; }
 /* Map an association to an assoc_id. */
 static inline sctp_assoc_t sctp_assoc2id(const struct sctp_association *asoc)
 {
-        return (asoc?asoc->assoc_id:0);
+        return asoc ? asoc->assoc_id : 0;
 }
 
 /* Look up the association by its id.  */
@@ -461,7 +472,7 @@ static inline void sctp_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
 /* Tests if the list has one and only one entry. */
 static inline int sctp_list_single_entry(struct list_head *head)
 {
-        return ((head->next != head) && (head->next == head->prev));
+        return (head->next != head) && (head->next == head->prev);
 }
 
 /* Generate a random jitter in the range of -50% ~ +50% of input RTO. */
@@ -519,7 +530,6 @@ _sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)
 
 #define _sctp_walk_params(pos, chunk, end, member)\
 for (pos.v = chunk->member;\
-     pos.v <= (void *)chunk + end - sizeof(sctp_paramhdr_t) &&\
      pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
      ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
      pos.v += WORD_ROUND(ntohs(pos.p->length)))
@@ -530,7 +540,6 @@ _sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length))
 #define _sctp_walk_errors(err, chunk_hdr, end)\
 for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
             sizeof(sctp_chunkhdr_t));\
-     (void *)err <= (void *)chunk_hdr + end - sizeof(sctp_errhdr_t) &&\
      (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
      ntohs(err->length) >= sizeof(sctp_errhdr_t); \
      err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length))))
@@ -619,13 +628,13 @@ static inline int sctp_sanity_check(void)
 /* This is the hash function for the SCTP port hash table. */
 static inline int sctp_phashfn(__u16 lport)
 {
-        return (lport & (sctp_port_hashsize - 1));
+        return lport & (sctp_port_hashsize - 1);
 }
 
 /* This is the hash function for the endpoint hash table. */
 static inline int sctp_ep_hashfn(__u16 lport)
 {
-        return (lport & (sctp_ep_hashsize - 1));
+        return lport & (sctp_ep_hashsize - 1);
 }
 
 /* This is the hash function for the association hash table. */
@@ -633,7 +642,7 @@ static inline int sctp_assoc_hashfn(__u16 lport, __u16 rport)
 {
         int h = (lport << 16) + rport;
         h ^= h>>8;
-        return (h & (sctp_assoc_hashsize - 1));
+        return h & (sctp_assoc_hashsize - 1);
 }
 
 /* This is the hash function for the association hash table.  This is
@@ -644,7 +653,7 @@ static inline int sctp_vtag_hashfn(__u16 lport, __u16 rport, __u32 vtag)
 {
         int h = (lport << 16) + rport;
         h ^= vtag;
-        return (h & (sctp_assoc_hashsize-1));
+        return h & (sctp_assoc_hashsize - 1);
 }
 
 #define sctp_for_each_hentry(epb, node, head) \
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 4088c89a9055..9148632b8204 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -165,6 +165,7 @@ sctp_state_fn_t sctp_sf_do_prm_requestheartbeat;
 sctp_state_fn_t sctp_sf_do_prm_asconf;
 
 /* Prototypes for other event state functions.  */
+sctp_state_fn_t sctp_sf_do_no_pending_tsn;
 sctp_state_fn_t sctp_sf_do_9_2_start_shutdown;
 sctp_state_fn_t sctp_sf_do_9_2_shutdown_ack;
 sctp_state_fn_t sctp_sf_ignore_other;
@@ -232,9 +233,7 @@ struct sctp_chunk *sctp_make_violation_paramlen(const struct sctp_association *,
                                    const struct sctp_chunk *,
                                    struct sctp_paramhdr *);
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *,
-                                  const struct sctp_transport *,
-                                  const void *payload,
-                                  const size_t paylen);
+                                  const struct sctp_transport *);
 struct sctp_chunk *sctp_make_heartbeat_ack(const struct sctp_association *,
                                       const struct sctp_chunk *,
                                       const void *payload,
@@ -345,12 +344,12 @@ enum {
 
 static inline int TSN_lt(__u32 s, __u32 t)
 {
-        return (((s) - (t)) & TSN_SIGN_BIT);
+        return ((s) - (t)) & TSN_SIGN_BIT;
 }
 
 static inline int TSN_lte(__u32 s, __u32 t)
 {
-        return (((s) == (t)) || (((s) - (t)) & TSN_SIGN_BIT));
+        return ((s) == (t)) || (((s) - (t)) & TSN_SIGN_BIT);
 }
 
 /* Compare two SSNs */
@@ -369,12 +368,12 @@ enum {
 
 static inline int SSN_lt(__u16 s, __u16 t)
 {
-        return (((s) - (t)) & SSN_SIGN_BIT);
+        return ((s) - (t)) & SSN_SIGN_BIT;
 }
 
 static inline int SSN_lte(__u16 s, __u16 t)
 {
-        return (((s) == (t)) || (((s) - (t)) & SSN_SIGN_BIT));
+        return ((s) == (t)) || (((s) - (t)) & SSN_SIGN_BIT);
 }
 
 /*
@@ -388,7 +387,7 @@ enum {
 
 static inline int ADDIP_SERIAL_gte(__u16 s, __u16 t)
 {
-        return (((s) == (t)) || (((t) - (s)) & ADDIP_SERIAL_SIGN_BIT));
+        return ((s) == (t)) || (((t) - (s)) & ADDIP_SERIAL_SIGN_BIT);
 }
 
 /* Check VTAG of the packet matches the sender's own tag. */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index f9e7473613bd..7df327a6d564 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -261,8 +261,6 @@ extern struct sctp_globals {
 #define sctp_assoc_hashsize             (sctp_globals.assoc_hashsize)
 #define sctp_assoc_hashtable            (sctp_globals.assoc_hashtable)
 #define sctp_port_hashsize              (sctp_globals.port_hashsize)
-#define sctp_port_rover                 (sctp_globals.port_rover)
-#define sctp_port_alloc_lock            (sctp_globals.port_alloc_lock)
 #define sctp_port_hashtable             (sctp_globals.port_hashtable)
 #define sctp_local_addr_list            (sctp_globals.local_addr_list)
 #define sctp_local_addr_lock            (sctp_globals.addr_list_lock)
@@ -424,7 +422,7 @@ struct sctp_cookie {
         __u32 adaptation_ind;
 
         __u8 auth_random[sizeof(sctp_paramhdr_t) + SCTP_AUTH_RANDOM_LENGTH];
-        __u8 auth_hmacs[SCTP_AUTH_NUM_HMACS + 2];
+        __u8 auth_hmacs[SCTP_AUTH_NUM_HMACS * sizeof(__u16) + 2];
         __u8 auth_chunks[sizeof(sctp_paramhdr_t) + SCTP_AUTH_MAX_CHUNKS];
 
         /* This is a shim for my peer's INIT packet, followed by
@@ -566,19 +564,15 @@ struct sctp_af {
                                          int optname,
                                          char __user *optval,
                                          int __user *optlen);
-        struct dst_entry *(*get_dst)    (struct sctp_association *asoc,
-                                         union sctp_addr *daddr,
-                                         union sctp_addr *saddr);
+        void            (*get_dst)      (struct sctp_transport *t,
+                                         union sctp_addr *saddr,
+                                         struct flowi *fl,
+                                         struct sock *sk);
         void            (*get_saddr)    (struct sctp_sock *sk,
-                                         struct sctp_association *asoc,
-                                         struct dst_entry *dst,
-                                         union sctp_addr *daddr,
-                                         union sctp_addr *saddr);
+                                         struct sctp_transport *t,
+                                         struct flowi *fl);
         void            (*copy_addrlist) (struct list_head *,
                                           struct net_device *);
-        void            (*dst_saddr)    (union sctp_addr *saddr,
-                                         struct dst_entry *dst,
-                                         __be16 port);
         int             (*cmp_addr)     (const union sctp_addr *addr1,
                                          const union sctp_addr *addr2);
         void            (*addr_copy)    (union sctp_addr *dst,
@@ -847,7 +841,7 @@ void sctp_packet_free(struct sctp_packet *);
 
 static inline int sctp_packet_empty(struct sctp_packet *packet)
 {
-        return (packet->size == packet->overhead);
+        return packet->size == packet->overhead;
 }
 
 /* This represents a remote transport address.
@@ -900,6 +894,7 @@ struct sctp_transport {
                 /* Is this structure kfree()able? */
                 malloced:1;
 
+        struct flowi fl;
 
         /* This is the peer's IP address and port. */
         union sctp_addr ipaddr;
@@ -1063,7 +1058,7 @@ void sctp_transport_set_owner(struct sctp_transport *,
                               struct sctp_association *);
 void sctp_transport_route(struct sctp_transport *, union sctp_addr *,
                           struct sctp_sock *);
-void sctp_transport_pmtu(struct sctp_transport *);
+void sctp_transport_pmtu(struct sctp_transport *, struct sock *sk);
 void sctp_transport_free(struct sctp_transport *);
 void sctp_transport_reset_timers(struct sctp_transport *);
 void sctp_transport_hold(struct sctp_transport *);
@@ -1402,7 +1397,7 @@ int sctp_has_association(const union sctp_addr *laddr,
 int sctp_verify_init(const struct sctp_association *asoc, sctp_cid_t,
                      sctp_init_chunk_t *peer_init, struct sctp_chunk *chunk,
                      struct sctp_chunk **err_chunk);
-int sctp_process_init(struct sctp_association *, sctp_cid_t cid,
+int sctp_process_init(struct sctp_association *, struct sctp_chunk *chunk,
                       const union sctp_addr *peer,
                       sctp_init_chunk_t *init, gfp_t gfp);
 __u32 sctp_generate_tag(const struct sctp_endpoint *);
@@ -1998,7 +1993,7 @@ void sctp_assoc_clean_asconf_ack_cache(const struct sctp_association *asoc);
 struct sctp_chunk *sctp_assoc_lookup_asconf_ack(
                                         const struct sctp_association *asoc,
                                         __be32 serial);
-
+void sctp_asconf_queue_teardown(struct sctp_association *asoc);
 
 int sctp_cmp_addr_exact(const union sctp_addr *ss1,
                         const union sctp_addr *ss2);
diff --git a/include/net/sctp/tsnmap.h b/include/net/sctp/tsnmap.h
index 4aabc5a96cf6..e7728bc14ccf 100644
--- a/include/net/sctp/tsnmap.h
+++ b/include/net/sctp/tsnmap.h
@@ -157,7 +157,7 @@ __u16 sctp_tsnmap_pending(struct sctp_tsnmap *map);
 /* Is there a gap in the TSN map?  */
 static inline int sctp_tsnmap_has_gap(const struct sctp_tsnmap *map)
 {
-        return (map->cumulative_tsn_ack_point != map->max_tsn_seen);
+        return map->cumulative_tsn_ack_point != map->max_tsn_seen;
 }
 
 /* Mark a duplicate TSN.  Note:  limit the storage of duplicate TSN
diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h
index 7ea12e8e6676..ca4693b4e09e 100644
--- a/include/net/sctp/ulpevent.h
+++ b/include/net/sctp/ulpevent.h
@@ -80,7 +80,7 @@ static inline struct sctp_ulpevent *sctp_skb2event(struct sk_buff *skb)
 
 void sctp_ulpevent_free(struct sctp_ulpevent *);
 int sctp_ulpevent_is_notification(const struct sctp_ulpevent *);
-void sctp_queue_purge_ulpevents(struct sk_buff_head *list);
+unsigned int sctp_queue_purge_ulpevents(struct sk_buff_head *list);
 
 struct sctp_ulpevent *sctp_ulpevent_make_assoc_change(
         const struct sctp_association *asoc,
@@ -132,6 +132,9 @@ struct sctp_ulpevent *sctp_ulpevent_make_authkey(
         const struct sctp_association *asoc, __u16 key_id,
         __u32 indication, gfp_t gfp);
 
+struct sctp_ulpevent *sctp_ulpevent_make_sender_dry_event(
+        const struct sctp_association *asoc, gfp_t gfp);
+
 void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event,
         struct msghdr *);
 __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event);
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 2b2769c5ca9f..32fd51274037 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -78,6 +78,7 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_GET_PEER_ADDR_INFO 15
 #define SCTP_DELAYED_ACK_TIME   16
 #define SCTP_DELAYED_ACK SCTP_DELAYED_ACK_TIME
+#define SCTP_DELAYED_SACK SCTP_DELAYED_ACK_TIME
 #define SCTP_CONTEXT    17
 #define SCTP_FRAGMENT_INTERLEAVE        18
 #define SCTP_PARTIAL_DELIVERY_POINT     19 /* Set/Get partial delivery point */
@@ -90,6 +91,7 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_PEER_AUTH_CHUNKS   26      /* Read only */
 #define SCTP_LOCAL_AUTH_CHUNKS  27      /* Read only */
 #define SCTP_GET_ASSOC_NUMBER   28      /* Read only */
+#define SCTP_GET_ASSOC_ID_LIST  29      /* Read only */
 
 /* Internal Socket Options. Some of the sctp library functions are
  * implemented using these socket options.
@@ -99,8 +101,8 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_SOCKOPT_PEELOFF    102     /* peel off association. */
 /* Options 104-106 are deprecated and removed. Do not use this space */
 #define SCTP_SOCKOPT_CONNECTX_OLD       107     /* CONNECTX old requests. */
-#define SCTP_GET_PEER_ADDRS     108             /* Get all peer addresss. */
-#define SCTP_GET_LOCAL_ADDRS    109             /* Get all local addresss. */
+#define SCTP_GET_PEER_ADDRS     108             /* Get all peer address. */
+#define SCTP_GET_LOCAL_ADDRS    109             /* Get all local address. */
 #define SCTP_SOCKOPT_CONNECTX   110             /* CONNECTX requests. */
 #define SCTP_SOCKOPT_CONNECTX3  111     /* CONNECTX requests (updated) */
 
@@ -352,6 +354,20 @@ struct sctp_authkey_event {
 
 enum { SCTP_AUTH_NEWKEY = 0, };
 
+/*
+ * 6.1.9. SCTP_SENDER_DRY_EVENT
+ *
+ * When the SCTP stack has no more user data to send or retransmit, this
+ * notification is given to the user. Also, at the time when a user app
+ * subscribes to this event, if there is no data to be sent or
+ * retransmit, the stack will immediately send up this notification.
+ */
+struct sctp_sender_dry_event {
+        __u16 sender_dry_type;
+        __u16 sender_dry_flags;
+        __u32 sender_dry_length;
+        sctp_assoc_t sender_dry_assoc_id;
+};
 
 /*
  * Described in Section 7.3
@@ -367,6 +383,7 @@ struct sctp_event_subscribe {
         __u8 sctp_partial_delivery_event;
         __u8 sctp_adaptation_layer_event;
         __u8 sctp_authentication_event;
+        __u8 sctp_sender_dry_event;
 };
 
 /*
@@ -390,6 +407,7 @@ union sctp_notification {
         struct sctp_adaptation_event sn_adaptation_event;
         struct sctp_pdapi_event sn_pdapi_event;
         struct sctp_authkey_event sn_authkey_event;
+        struct sctp_sender_dry_event sn_sender_dry_event;
 };
 
 /* Section 5.3.1
@@ -406,7 +424,9 @@ enum sctp_sn_type {
         SCTP_SHUTDOWN_EVENT,
         SCTP_PARTIAL_DELIVERY_EVENT,
         SCTP_ADAPTATION_INDICATION,
-        SCTP_AUTHENTICATION_INDICATION,
+        SCTP_AUTHENTICATION_EVENT,
+#define SCTP_AUTHENTICATION_INDICATION  SCTP_AUTHENTICATION_EVENT
+        SCTP_SENDER_DRY_EVENT,
 };
 
 /* Notification error codes used to fill up the error fields in some
@@ -668,6 +688,18 @@ struct sctp_authchunks {
 };
 
 /*
+ * 8.2.6. Get the Current Identifiers of Associations
+ *        (SCTP_GET_ASSOC_ID_LIST)
+ *
+ * This option gets the current list of SCTP association identifiers of
+ * the SCTP associations handled by a one-to-many style socket.
+ */
+struct sctp_assoc_ids {
+        __u32           gaids_number_of_ids;
+        sctp_assoc_t    gaids_assoc_id[];
+};
+
+/*
  * 8.3, 8.5 get all peer/local addresses in an association.
  * This parameter struct is used by SCTP_GET_PEER_ADDRS and 
  * SCTP_GET_LOCAL_ADDRS socket options used internally to implement
diff --git a/include/net/snmp.h b/include/net/snmp.h
index a0e61806d480..479083a78b0c 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -60,9 +60,7 @@ struct ipstats_mib {
 };
 
 /* ICMP */
-#define ICMP_MIB_DUMMY  __ICMP_MIB_MAX
-#define ICMP_MIB_MAX    (__ICMP_MIB_MAX + 1)
-
+#define ICMP_MIB_MAX    __ICMP_MIB_MAX
 struct icmp_mib {
         unsigned long   mibs[ICMP_MIB_MAX];
 };
@@ -74,14 +72,24 @@ struct icmpmsg_mib {
 
 /* ICMP6 (IPv6-ICMP) */
 #define ICMP6_MIB_MAX   __ICMP6_MIB_MAX
+/* per network ns counters */
 struct icmpv6_mib {
         unsigned long   mibs[ICMP6_MIB_MAX];
 };
+/* per device counters, (shared on all cpus) */
+struct icmpv6_mib_device {
+        atomic_long_t   mibs[ICMP6_MIB_MAX];
+};
 
 #define ICMP6MSG_MIB_MAX  __ICMP6MSG_MIB_MAX
+/* per network ns counters */
 struct icmpv6msg_mib {
         unsigned long   mibs[ICMP6MSG_MIB_MAX];
 };
+/* per device counters, (shared on all cpus) */
+struct icmpv6msg_mib_device {
+        atomic_long_t   mibs[ICMP6MSG_MIB_MAX];
+};
 
 
 /* TCP */
@@ -116,6 +124,8 @@ struct linux_xfrm_mib {
  */ 
 #define DEFINE_SNMP_STAT(type, name)    \
         __typeof__(type) __percpu *name[2]
+#define DEFINE_SNMP_STAT_ATOMIC(type, name)     \
+        __typeof__(type) *name
 #define DECLARE_SNMP_STAT(type, name)   \
         extern __typeof__(type) __percpu *name[2]
 
@@ -126,6 +136,8 @@ struct linux_xfrm_mib {
                         __this_cpu_inc(mib[0]->mibs[field])
 #define SNMP_INC_STATS_USER(mib, field) \
                         this_cpu_inc(mib[1]->mibs[field])
+#define SNMP_INC_STATS_ATOMIC_LONG(mib, field)  \
+                        atomic_long_inc(&mib->mibs[field])
 #define SNMP_INC_STATS(mib, field)      \
                         this_cpu_inc(mib[!in_softirq()]->mibs[field])
 #define SNMP_DEC_STATS(mib, field)      \
@@ -152,7 +164,7 @@ struct linux_xfrm_mib {
 #define SNMP_UPD_PO_STATS_BH(mib, basefield, addend)    \
         do { \
                 __typeof__(*mib[0]) *ptr = \
-                        __this_cpu_ptr((mib)[!in_softirq()]); \
+                        __this_cpu_ptr((mib)[0]); \
                 ptr->mibs[basefield##PKTS]++; \
                 ptr->mibs[basefield##OCTETS] += addend;\
         } while (0)
@@ -204,7 +216,7 @@ struct linux_xfrm_mib {
 #define SNMP_UPD_PO_STATS64_BH(mib, basefield, addend)                  \
         do {                                                            \
                 __typeof__(*mib[0]) *ptr;                               \
-                ptr = __this_cpu_ptr((mib)[!in_softirq()]);             \
+                ptr = __this_cpu_ptr((mib)[0]);                         \
                 u64_stats_update_begin(&ptr->syncp);                    \
                 ptr->mibs[basefield##PKTS]++;                           \
                 ptr->mibs[basefield##OCTETS] += addend;                 \
diff --git a/include/net/sock.h b/include/net/sock.h
index adab9dc58183..c0b938cb4b1a 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -52,12 +52,13 @@
 #include <linux/mm.h>
 #include <linux/security.h>
 #include <linux/slab.h>
+#include <linux/uaccess.h>
 
 #include <linux/filter.h>
 #include <linux/rculist_nulls.h>
 #include <linux/poll.h>
 
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <net/dst.h>
 #include <net/checksum.h>
 
@@ -105,10 +106,8 @@ struct net;
 
 /**
  *      struct sock_common - minimal network layer representation of sockets
- *      @skc_node: main hash linkage for various protocol lookup tables
- *      @skc_nulls_node: main hash linkage for TCP/UDP/UDP-Lite protocol
- *      @skc_refcnt: reference count
- *      @skc_tx_queue_mapping: tx queue number for this connection
+ *      @skc_daddr: Foreign IPv4 addr
+ *      @skc_rcv_saddr: Bound local IPv4 addr
  *      @skc_hash: hash value used with various protocol lookup tables
  *      @skc_u16hashes: two u16 hash values used by UDP lookup tables
  *      @skc_family: network address family
@@ -119,20 +118,20 @@ struct net;
  *      @skc_portaddr_node: second hash linkage for UDP/UDP-Lite protocol
  *      @skc_prot: protocol handlers inside a network family
  *      @skc_net: reference to the network namespace of this socket
+ *      @skc_node: main hash linkage for various protocol lookup tables
+ *      @skc_nulls_node: main hash linkage for TCP/UDP/UDP-Lite protocol
+ *      @skc_tx_queue_mapping: tx queue number for this connection
+ *      @skc_refcnt: reference count
  *
  *      This is the minimal network layer representation of sockets, the header
  *      for struct sock and struct inet_timewait_sock.
  */
 struct sock_common {
-        /*
-         * first fields are not copied in sock_copy()
+        /* skc_daddr and skc_rcv_saddr must be grouped :
+         * cf INET_MATCH() and INET_TW_MATCH()
          */
-        union {
-                struct hlist_node       skc_node;
-                struct hlist_nulls_node skc_nulls_node;
-        };
-        atomic_t                skc_refcnt;
-        int                     skc_tx_queue_mapping;
+        __be32                  skc_daddr;
+        __be32                  skc_rcv_saddr;
 
         union  {
                 unsigned int    skc_hash;
@@ -150,6 +149,22 @@ struct sock_common {
 #ifdef CONFIG_NET_NS
         struct net              *skc_net;
 #endif
+        /*
+         * fields between dontcopy_begin/dontcopy_end
+         * are not copied in sock_copy()
+         */
+        /* private: */
+        int                     skc_dontcopy_begin[0];
+        /* public: */
+        union {
+                struct hlist_node       skc_node;
+                struct hlist_nulls_node skc_nulls_node;
+        };
+        int                     skc_tx_queue_mapping;
+        atomic_t                skc_refcnt;
+        /* private: */
+        int                     skc_dontcopy_end[0];
+        /* public: */
 };
 
 /**
@@ -163,7 +178,6 @@ struct sock_common {
   *     @sk_dst_cache: destination cache
   *     @sk_dst_lock: destination cache lock
   *     @sk_policy: flow policy
-  *     @sk_rmem_alloc: receive queue bytes committed
   *     @sk_receive_queue: incoming packets
   *     @sk_wmem_alloc: transmit queue bytes committed
   *     @sk_write_queue: Packet sending queue
@@ -232,7 +246,8 @@ struct sock {
 #define sk_refcnt               __sk_common.skc_refcnt
 #define sk_tx_queue_mapping     __sk_common.skc_tx_queue_mapping
 
-#define sk_copy_start           __sk_common.skc_hash
+#define sk_dontcopy_begin       __sk_common.skc_dontcopy_begin
+#define sk_dontcopy_end         __sk_common.skc_dontcopy_end
 #define sk_hash                 __sk_common.skc_hash
 #define sk_family               __sk_common.skc_family
 #define sk_state                __sk_common.skc_state
@@ -241,59 +256,67 @@ struct sock {
 #define sk_bind_node            __sk_common.skc_bind_node
 #define sk_prot                 __sk_common.skc_prot
 #define sk_net                  __sk_common.skc_net
-        kmemcheck_bitfield_begin(flags);
-        unsigned int            sk_shutdown  : 2,
-                                sk_no_check  : 2,
-                                sk_userlocks : 4,
-                                sk_protocol  : 8,
-                                sk_type      : 16;
-        kmemcheck_bitfield_end(flags);
-        int                     sk_rcvbuf;
         socket_lock_t           sk_lock;
+        struct sk_buff_head     sk_receive_queue;
         /*
          * The backlog queue is special, it is always used with
          * the per-socket spinlock held and requires low latency
          * access. Therefore we special case it's implementation.
+         * Note : rmem_alloc is in this structure to fill a hole
+         * on 64bit arches, not because its logically part of
+         * backlog.
          */
         struct {
-                struct sk_buff *head;
-                struct sk_buff *tail;
-                int len;
+                atomic_t        rmem_alloc;
+                int             len;
+                struct sk_buff  *head;
+                struct sk_buff  *tail;
         } sk_backlog;
-        struct socket_wq        *sk_wq;
-        struct dst_entry        *sk_dst_cache;
+#define sk_rmem_alloc sk_backlog.rmem_alloc
+        int                     sk_forward_alloc;
+#ifdef CONFIG_RPS
+        __u32                   sk_rxhash;
+#endif
+        atomic_t                sk_drops;
+        int                     sk_rcvbuf;
+
+        struct sk_filter __rcu  *sk_filter;
+        struct socket_wq __rcu  *sk_wq;
+
+#ifdef CONFIG_NET_DMA
+        struct sk_buff_head     sk_async_wait_queue;
+#endif
+
 #ifdef CONFIG_XFRM
         struct xfrm_policy      *sk_policy[2];
 #endif
+        unsigned long           sk_flags;
+        struct dst_entry        *sk_dst_cache;
         spinlock_t              sk_dst_lock;
-        atomic_t                sk_rmem_alloc;
         atomic_t                sk_wmem_alloc;
         atomic_t                sk_omem_alloc;
         int                     sk_sndbuf;
-        struct sk_buff_head     sk_receive_queue;
         struct sk_buff_head     sk_write_queue;
-#ifdef CONFIG_NET_DMA
-        struct sk_buff_head     sk_async_wait_queue;
-#endif
+        kmemcheck_bitfield_begin(flags);
+        unsigned int            sk_shutdown  : 2,
+                                sk_no_check  : 2,
+                                sk_userlocks : 4,
+                                sk_protocol  : 8,
+                                sk_type      : 16;
+        kmemcheck_bitfield_end(flags);
         int                     sk_wmem_queued;
-        int                     sk_forward_alloc;
         gfp_t                   sk_allocation;
         int                     sk_route_caps;
         int                     sk_route_nocaps;
         int                     sk_gso_type;
         unsigned int            sk_gso_max_size;
         int                     sk_rcvlowat;
-#ifdef CONFIG_RPS
-        __u32                   sk_rxhash;
-#endif
-        unsigned long           sk_flags;
         unsigned long           sk_lingertime;
         struct sk_buff_head     sk_error_queue;
         struct proto            *sk_prot_creator;
         rwlock_t                sk_callback_lock;
         int                     sk_err,
                                 sk_err_soft;
-        atomic_t                sk_drops;
         unsigned short          sk_ack_backlog;
         unsigned short          sk_max_ack_backlog;
         __u32                   sk_priority;
@@ -301,7 +324,6 @@ struct sock {
         const struct cred       *sk_peer_cred;
         long                    sk_rcvtimeo;
         long                    sk_sndtimeo;
-        struct sk_filter        *sk_filter;
         void                    *sk_protinfo;
         struct timer_list       sk_timer;
         ktime_t                 sk_stamp;
@@ -509,9 +531,6 @@ static __inline__ void sk_add_bind_node(struct sock *sk,
 #define sk_nulls_for_each_from(__sk, node) \
         if (__sk && ({ node = &(__sk)->sk_nulls_node; 1; })) \
                 hlist_nulls_for_each_entry_from(__sk, node, sk_nulls_node)
-#define sk_for_each_continue(__sk, node) \
-        if (__sk && ({ node = &(__sk)->sk_node; 1; })) \
-                hlist_for_each_entry_continue(__sk, node, sk_node)
 #define sk_for_each_safe(__sk, node, tmp, list) \
         hlist_for_each_entry_safe(__sk, node, tmp, list, sk_node)
 #define sk_for_each_bound(__sk, node, list) \
@@ -734,6 +753,8 @@ struct proto {
                                         int level,
                                         int optname, char __user *optval,
                                         int __user *option);
+        int                     (*compat_ioctl)(struct sock *sk,
+                                        unsigned int cmd, unsigned long arg);
 #endif
         int                     (*sendmsg)(struct kiocb *iocb, struct sock *sk,
                                            struct msghdr *msg, size_t len);
@@ -754,6 +775,7 @@ struct proto {
         void                    (*unhash)(struct sock *sk);
         void                    (*rehash)(struct sock *sk);
         int                     (*get_port)(struct sock *sk, unsigned short snum);
+        void                    (*clear_sk)(struct sock *sk, int size);
 
         /* Keeping track of sockets in use */
 #ifdef CONFIG_PROC_FS
@@ -762,7 +784,7 @@ struct proto {
 
         /* Memory pressure */
         void                    (*enter_memory_pressure)(struct sock *sk);
-        atomic_t                *memory_allocated;      /* Current allocated memory. */
+        atomic_long_t           *memory_allocated;      /* Current allocated memory. */
         struct percpu_counter   *sockets_allocated;     /* Current number of sockets. */
         /*
          * Pressure flag: try to collapse.
@@ -771,7 +793,7 @@ struct proto {
          * is strict, actions are advisory and have some latency.
          */
         int                     *memory_pressure;
-        int                     *sysctl_mem;
+        long                    *sysctl_mem;
         int                     *sysctl_wmem;
         int                     *sysctl_rmem;
         int                     max_header;
@@ -852,6 +874,8 @@ static inline void __sk_prot_rehash(struct sock *sk)
         sk->sk_prot->hash(sk);
 }
 
+void sk_prot_clear_portaddr_nulls(struct sock *sk, int size);
+
 /* About 10 seconds */
 #define SOCK_DESTROY_TIME (10*HZ)
 
@@ -1155,6 +1179,8 @@ extern void sk_common_release(struct sock *sk);
 /* Initialise core socket variables */
 extern void sock_init_data(struct socket *sock, struct sock *sk);
 
+extern void sk_filter_release_rcu(struct rcu_head *rcu);
+
 /**
  *      sk_filter_release - release a socket filter
  *      @fp: filter to remove
@@ -1165,7 +1191,7 @@ extern void sock_init_data(struct socket *sock, struct sock *sk);
 static inline void sk_filter_release(struct sk_filter *fp)
 {
         if (atomic_dec_and_test(&fp->refcnt))
-                kfree(fp);
+                call_rcu(&fp->rcu, sk_filter_release_rcu);
 }
 
 static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
@@ -1240,7 +1266,8 @@ static inline void sk_set_socket(struct sock *sk, struct socket *sock)
 
 static inline wait_queue_head_t *sk_sleep(struct sock *sk)
 {
-        return &sk->sk_wq->wait;
+        BUILD_BUG_ON(offsetof(struct socket_wq, wait) != 0);
+        return &rcu_dereference_raw(sk->sk_wq)->wait;
 }
 /* Detach socket from process context.
  * Announce socket dead, detach it from wait queue and inode.
@@ -1261,7 +1288,7 @@ static inline void sock_orphan(struct sock *sk)
 static inline void sock_graft(struct sock *sk, struct socket *parent)
 {
         write_lock_bh(&sk->sk_callback_lock);
-        rcu_assign_pointer(sk->sk_wq, parent->wq);
+        sk->sk_wq = parent->wq;
         parent->sk = sk;
         sk_set_socket(sk, parent);
         security_sock_graft(sk, parent);
@@ -1362,6 +1389,59 @@ static inline void sk_nocaps_add(struct sock *sk, int flags)
         sk->sk_route_caps &= ~flags;
 }
 
+static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
+                                           char __user *from, char *to,
+                                           int copy, int offset)
+{
+        if (skb->ip_summed == CHECKSUM_NONE) {
+                int err = 0;
+                __wsum csum = csum_and_copy_from_user(from, to, copy, 0, &err);
+                if (err)
+                        return err;
+                skb->csum = csum_block_add(skb->csum, csum, offset);
+        } else if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY) {
+                if (!access_ok(VERIFY_READ, from, copy) ||
+                    __copy_from_user_nocache(to, from, copy))
+                        return -EFAULT;
+        } else if (copy_from_user(to, from, copy))
+                return -EFAULT;
+
+        return 0;
+}
+
+static inline int skb_add_data_nocache(struct sock *sk, struct sk_buff *skb,
+                                       char __user *from, int copy)
+{
+        int err, offset = skb->len;
+
+        err = skb_do_copy_data_nocache(sk, skb, from, skb_put(skb, copy),
+                                       copy, offset);
+        if (err)
+                __skb_trim(skb, offset);
+
+        return err;
+}
+
+static inline int skb_copy_to_page_nocache(struct sock *sk, char __user *from,
+                                           struct sk_buff *skb,
+                                           struct page *page,
+                                           int off, int copy)
+{
+        int err;
+
+        err = skb_do_copy_data_nocache(sk, skb, from, page_address(page) + off,
+                                       copy, skb->len);
+        if (err)
+                return err;
+
+        skb->len             += copy;
+        skb->data_len        += copy;
+        skb->truesize        += copy;
+        sk->sk_wmem_queued   += copy;
+        sk_mem_charge(sk, copy);
+        return 0;
+}
+
 static inline int skb_copy_to_page(struct sock *sk, char __user *from,
                                    struct sk_buff *skb, struct page *page,
                                    int off, int copy)
@@ -1558,7 +1638,11 @@ static inline void sk_wake_async(struct sock *sk, int how, int band)
 }
 
 #define SOCK_MIN_SNDBUF 2048
-#define SOCK_MIN_RCVBUF 256
+/*
+ * Since sk_rmem_alloc sums skb->truesize, even a small frame might need
+ * sizeof(sk_buff) + MTU + padding, unless net driver perform copybreak
+ */
+#define SOCK_MIN_RCVBUF (2048 + sizeof(struct sk_buff))
 
 static inline void sk_stream_moderate_sndbuf(struct sock *sk)
 {
@@ -1670,17 +1754,13 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
 
 /**
  * sock_tx_timestamp - checks whether the outgoing packet is to be time stamped
- * @msg:        outgoing packet
  * @sk:         socket sending this packet
- * @shtx:       filled with instructions for time stamping
+ * @tx_flags:   filled with instructions for time stamping
  *
  * Currently only depends on SOCK_TIMESTAMPING* flags. Returns error code if
  * parameters are invalid.
  */
-extern int sock_tx_timestamp(struct msghdr *msg,
-                             struct sock *sk,
-                             union skb_shared_tx *shtx);
-
+extern int sock_tx_timestamp(struct sock *sk, __u8 *tx_flags);
 
 /**
  * sk_eat_skb - Release a skb if it is no longer needed
@@ -1722,7 +1802,7 @@ void sock_net_set(struct sock *sk, struct net *net)
 
 /*
  * Kernel sockets, f.e. rtnl or icmp_socket, are a part of a namespace.
- * They should not hold a referrence to a namespace in order to allow
+ * They should not hold a reference to a namespace in order to allow
  * to stop it.
  * Sockets after sk_change_net should be released using sk_release_kernel
  */
diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h
new file mode 100644
index 000000000000..9e8710be7a04
--- /dev/null
+++ b/include/net/tc_act/tc_csum.h
@@ -0,0 +1,15 @@
+#ifndef __NET_TC_CSUM_H
+#define __NET_TC_CSUM_H
+
+#include <linux/types.h>
+#include <net/act_api.h>
+
+struct tcf_csum {
+        struct tcf_common common;
+
+        u32 update_flags;
+};
+#define to_tcf_csum(pc) \
+        container_of(pc,struct tcf_csum,common)
+
+#endif /* __NET_TC_CSUM_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 3e4b33e36602..cda30ea354a2 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -60,6 +60,9 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
  */
 #define MAX_TCP_WINDOW          32767U
 
+/* Offer an initial receive window of 10 mss. */
+#define TCP_DEFAULT_INIT_RCVWND 10
+
 /* Minimal accepted MSS. It is (60+60+8) - (20+20). */
 #define TCP_MIN_MSS             88U
 
@@ -100,12 +103,6 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCP_SYNACK_RETRIES 5    /* number of times to retry passive opening a
                                  * connection: ~180sec is RFC minimum   */
 
-
-#define TCP_ORPHAN_RETRIES 7    /* number of times to retry on an orphaned
-                                 * socket. 7 is ~50sec-16min.
-                                 */
-
-
 #define TCP_TIMEWAIT_LEN (60*HZ) /* how long to wait to destroy TIME-WAIT
                                   * state, about 60 seconds     */
 #define TCP_FIN_TIMEOUT TCP_TIMEWAIT_LEN
@@ -199,6 +196,9 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 /* TCP thin-stream limits */
 #define TCP_THIN_LINEAR_RETRIES 6       /* After 6 linear retries, do exp. backoff */
 
+/* TCP initial congestion window as per draft-hkchu-tcpm-initcwnd-01 */
+#define TCP_INIT_CWND           10
+
 extern struct inet_timewait_death_row tcp_death_row;
 
 /* sysctl variables for tcp */
@@ -224,7 +224,7 @@ extern int sysctl_tcp_fack;
 extern int sysctl_tcp_reordering;
 extern int sysctl_tcp_ecn;
 extern int sysctl_tcp_dsack;
-extern int sysctl_tcp_mem[3];
+extern long sysctl_tcp_mem[3];
 extern int sysctl_tcp_wmem[3];
 extern int sysctl_tcp_rmem[3];
 extern int sysctl_tcp_app_win;
@@ -247,7 +247,7 @@ extern int sysctl_tcp_cookie_size;
 extern int sysctl_tcp_thin_linear_timeouts;
 extern int sysctl_tcp_thin_dupack;
 
-extern atomic_t tcp_memory_allocated;
+extern atomic_long_t tcp_memory_allocated;
 extern struct percpu_counter tcp_sockets_allocated;
 extern int tcp_memory_pressure;
 
@@ -280,7 +280,7 @@ static inline bool tcp_too_many_orphans(struct sock *sk, int shift)
         }
 
         if (sk->sk_wmem_queued > SOCK_MIN_SNDBUF &&
-            atomic_read(&tcp_memory_allocated) > sysctl_tcp_mem[2])
+            atomic_long_read(&tcp_memory_allocated) > sysctl_tcp_mem[2])
                 return true;
         return false;
 }
@@ -312,7 +312,8 @@ extern void tcp_shutdown (struct sock *sk, int how);
 
 extern int tcp_v4_rcv(struct sk_buff *skb);
 
-extern int tcp_v4_remember_stamp(struct sock *sk);
+extern struct inet_peer *tcp_v4_get_peer(struct sock *sk, bool *release_it);
+extern void *tcp_v4_tw_get_peer(struct sock *sk);
 extern int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
 extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        size_t size);
@@ -346,8 +347,6 @@ static inline void tcp_dec_quickack_mode(struct sock *sk,
         }
 }
 
-extern void tcp_enter_quickack_mode(struct sock *sk);
-
 #define TCP_ECN_OK              1
 #define TCP_ECN_QUEUE_CWR       2
 #define TCP_ECN_DEMAND_CWR      4
@@ -1036,7 +1035,13 @@ static inline int tcp_paws_check(const struct tcp_options_received *rx_opt,
                 return 1;
         if (unlikely(get_seconds() >= rx_opt->ts_recent_stamp + TCP_PAWS_24DAYS))
                 return 1;
-
+        /*
+         * Some OSes send SYN and SYNACK messages with tsval=0 tsecr=0,
+         * then following tcp messages have valid values. Ignore 0 value,
+         * or else 'negative' tsval might forbid us to accept their packets.
+         */
+        if (!rx_opt->ts_recent)
+                return 1;
         return 0;
 }
 
@@ -1063,8 +1068,6 @@ static inline int tcp_paws_reject(const struct tcp_options_received *rx_opt,
         return 1;
 }
 
-#define TCP_CHECK_TIMER(sk) do { } while (0)
-
 static inline void tcp_mib_init(struct net *net)
 {
         /* See RFC 2012 */
@@ -1150,8 +1153,6 @@ struct tcp_md5sig_pool {
         union tcp_md5sum_block  md5_blk;
 };
 
-#define TCP_MD5SIG_MAXKEYS      (~(u32)0)       /* really?! */
-
 /* - functions */
 extern int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
                                struct sock *sk, struct request_sock *req,
@@ -1395,7 +1396,7 @@ extern struct request_sock_ops tcp6_request_sock_ops;
 extern void tcp_v4_destroy_sock(struct sock *sk);
 
 extern int tcp_v4_gso_send_check(struct sk_buff *skb);
-extern struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features);
+extern struct sk_buff *tcp_tso_segment(struct sk_buff *skb, u32 features);
 extern struct sk_buff **tcp_gro_receive(struct sk_buff **head,
                                         struct sk_buff *skb);
 extern struct sk_buff **tcp4_gro_receive(struct sk_buff **head,
diff --git a/include/net/timewait_sock.h b/include/net/timewait_sock.h
index 97c3b14da55d..053b3cf2c66a 100644
--- a/include/net/timewait_sock.h
+++ b/include/net/timewait_sock.h
@@ -21,6 +21,7 @@ struct timewait_sock_ops {
         int             (*twsk_unique)(struct sock *sk,
                                        struct sock *sktw, void *twp);
         void            (*twsk_destructor)(struct sock *sk);
+        void            *(*twsk_getpeer)(struct sock *sk);
 };
 
 static inline int twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
@@ -39,4 +40,11 @@ static inline void twsk_destructor(struct sock *sk)
                 sk->sk_prot->twsk_prot->twsk_destructor(sk);
 }
 
+static inline void *twsk_getpeer(struct sock *sk)
+{
+        if (sk->sk_prot->twsk_prot->twsk_getpeer)
+                return sk->sk_prot->twsk_prot->twsk_getpeer(sk);
+        return NULL;
+}
+
 #endif /* _TIMEWAIT_SOCK_H */
diff --git a/include/net/tipc/tipc.h b/include/net/tipc/tipc.h
deleted file mode 100644
index 15af6dca0b49..000000000000
--- a/include/net/tipc/tipc.h
+++ /dev/null
@@ -1,257 +0,0 @@
-/*
- * include/net/tipc/tipc.h: Main include file for TIPC users
- * 
- * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005,2010 Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _NET_TIPC_H_
-#define _NET_TIPC_H_
-
-#ifdef __KERNEL__
-
-#include <linux/tipc.h>
-#include <linux/skbuff.h>
-
-/* 
- * Native API
- */
-
-/*
- * TIPC operating mode routines
- */
-
-u32 tipc_get_addr(void);
-
-#define TIPC_NOT_RUNNING  0
-#define TIPC_NODE_MODE    1
-#define TIPC_NET_MODE     2
-
-typedef void (*tipc_mode_event)(void *usr_handle, int mode, u32 addr);
-
-int tipc_attach(unsigned int *userref, tipc_mode_event, void *usr_handle);
-
-void tipc_detach(unsigned int userref);
-
-int tipc_get_mode(void);
-
-/*
- * TIPC port manipulation routines
- */
-
-typedef void (*tipc_msg_err_event) (void *usr_handle,
-                                    u32 portref,
-                                    struct sk_buff **buf,
-                                    unsigned char const *data,
-                                    unsigned int size,
-                                    int reason, 
-                                    struct tipc_portid const *attmpt_destid);
-
-typedef void (*tipc_named_msg_err_event) (void *usr_handle,
-                                          u32 portref,
-                                          struct sk_buff **buf,
-                                          unsigned char const *data,
-                                          unsigned int size,
-                                          int reason, 
-                                          struct tipc_name_seq const *attmpt_dest);
-
-typedef void (*tipc_conn_shutdown_event) (void *usr_handle,
-                                          u32 portref,
-                                          struct sk_buff **buf,
-                                          unsigned char const *data,
-                                          unsigned int size,
-                                          int reason);
-
-typedef void (*tipc_msg_event) (void *usr_handle,
-                                u32 portref,
-                                struct sk_buff **buf,
-                                unsigned char const *data,
-                                unsigned int size,
-                                unsigned int importance, 
-                                struct tipc_portid const *origin);
-
-typedef void (*tipc_named_msg_event) (void *usr_handle,
-                                      u32 portref,
-                                      struct sk_buff **buf,
-                                      unsigned char const *data,
-                                      unsigned int size,
-                                      unsigned int importance, 
-                                      struct tipc_portid const *orig,
-                                      struct tipc_name_seq const *dest);
-
-typedef void (*tipc_conn_msg_event) (void *usr_handle,
-                                     u32 portref,
-                                     struct sk_buff **buf,
-                                     unsigned char const *data,
-                                     unsigned int size);
-
-typedef void (*tipc_continue_event) (void *usr_handle, 
-                                     u32 portref);
-
-int tipc_createport(unsigned int tipc_user, 
-                    void *usr_handle, 
-                    unsigned int importance, 
-                    tipc_msg_err_event error_cb, 
-                    tipc_named_msg_err_event named_error_cb, 
-                    tipc_conn_shutdown_event conn_error_cb, 
-                    tipc_msg_event message_cb, 
-                    tipc_named_msg_event named_message_cb, 
-                    tipc_conn_msg_event conn_message_cb, 
-                    tipc_continue_event continue_event_cb,
-                    u32 *portref);
-
-int tipc_deleteport(u32 portref);
-
-int tipc_ownidentity(u32 portref, struct tipc_portid *port);
-
-int tipc_portimportance(u32 portref, unsigned int *importance);
-int tipc_set_portimportance(u32 portref, unsigned int importance);
-
-int tipc_portunreliable(u32 portref, unsigned int *isunreliable);
-int tipc_set_portunreliable(u32 portref, unsigned int isunreliable);
-
-int tipc_portunreturnable(u32 portref, unsigned int *isunreturnable);
-int tipc_set_portunreturnable(u32 portref, unsigned int isunreturnable);
-
-int tipc_publish(u32 portref, unsigned int scope, 
-                 struct tipc_name_seq const *name_seq);
-int tipc_withdraw(u32 portref, unsigned int scope,
-                  struct tipc_name_seq const *name_seq);
-
-int tipc_connect2port(u32 portref, struct tipc_portid const *port);
-
-int tipc_disconnect(u32 portref);
-
-int tipc_shutdown(u32 ref);
-
-int tipc_isconnected(u32 portref, int *isconnected);
-
-int tipc_peer(u32 portref, struct tipc_portid *peer);
-
-int tipc_ref_valid(u32 portref); 
-
-/*
- * TIPC messaging routines
- */
-
-#define TIPC_PORT_IMPORTANCE 100        /* send using current port setting */
-
-
-int tipc_send(u32 portref,
-              unsigned int num_sect,
-              struct iovec const *msg_sect);
-
-int tipc_send_buf(u32 portref,
-                  struct sk_buff *buf,
-                  unsigned int dsz);
-
-int tipc_send2name(u32 portref, 
-                   struct tipc_name const *name, 
-                   u32 domain,
-                   unsigned int num_sect,
-                   struct iovec const *msg_sect);
-
-int tipc_send_buf2name(u32 portref,
-                       struct tipc_name const *name,
-                       u32 domain,
-                       struct sk_buff *buf,
-                       unsigned int dsz);
-
-int tipc_forward2name(u32 portref, 
-                      struct tipc_name const *name, 
-                      u32 domain,
-                      unsigned int section_count,
-                      struct iovec const *msg_sect,
-                      struct tipc_portid const *origin,
-                      unsigned int importance);
-
-int tipc_forward_buf2name(u32 portref,
-                          struct tipc_name const *name,
-                          u32 domain,
-                          struct sk_buff *buf,
-                          unsigned int dsz,
-                          struct tipc_portid const *orig,
-                          unsigned int importance);
-
-int tipc_send2port(u32 portref,
-                   struct tipc_portid const *dest,
-                   unsigned int num_sect,
-                   struct iovec const *msg_sect);
-
-int tipc_send_buf2port(u32 portref,
-                       struct tipc_portid const *dest,
-                       struct sk_buff *buf,
-                       unsigned int dsz);
-
-int tipc_forward2port(u32 portref,
-                      struct tipc_portid const *dest,
-                      unsigned int num_sect,
-                      struct iovec const *msg_sect,
-                      struct tipc_portid const *origin,
-                      unsigned int importance);
-
-int tipc_forward_buf2port(u32 portref,
-                          struct tipc_portid const *dest,
-                          struct sk_buff *buf,
-                          unsigned int dsz,
-                          struct tipc_portid const *orig,
-                          unsigned int importance);
-
-int tipc_multicast(u32 portref, 
-                   struct tipc_name_seq const *seq, 
-                   u32 domain,  /* currently unused */
-                   unsigned int section_count,
-                   struct iovec const *msg);
-
-#if 0
-int tipc_multicast_buf(u32 portref, 
-                       struct tipc_name_seq const *seq, 
-                       u32 domain,
-                       void *buf,
-                       unsigned int size);
-#endif
-
-/*
- * TIPC subscription routines
- */
-
-int tipc_ispublished(struct tipc_name const *name);
-
-/*
- * Get number of available nodes within specified domain (excluding own node)
- */
-
-unsigned int tipc_available_nodes(const u32 domain);
-
-#endif
-
-#endif
diff --git a/include/net/tipc/tipc_bearer.h b/include/net/tipc/tipc_bearer.h
deleted file mode 100644
index ee2f304e4919..000000000000
--- a/include/net/tipc/tipc_bearer.h
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- * include/net/tipc/tipc_bearer.h: Include file for privileged access to TIPC bearers
- * 
- * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _NET_TIPC_BEARER_H_
-#define _NET_TIPC_BEARER_H_
-
-#ifdef __KERNEL__
-
-#include <linux/tipc_config.h>
-#include <linux/skbuff.h>
-#include <linux/spinlock.h>
-
-/*
- * Identifiers of supported TIPC media types
- */
-
-#define TIPC_MEDIA_TYPE_ETH     1
-
-/* 
- * Destination address structure used by TIPC bearers when sending messages
- * 
- * IMPORTANT: The fields of this structure MUST be stored using the specified
- * byte order indicated below, as the structure is exchanged between nodes
- * as part of a link setup process.
- */
-
-struct tipc_media_addr {
-        __be32  type;                   /* bearer type (network byte order) */
-        union {
-                __u8   eth_addr[6];     /* 48 bit Ethernet addr (byte array) */ 
-#if 0
-                /* Prototypes for other possible bearer types */
-
-                struct {
-                        __u16 sin_family;
-                        __u16 sin_port;
-                        struct {
-                                __u32 s_addr;
-                        } sin_addr;
-                        char pad[4];
-                } addr_in;              /* IP-based bearer */
-                __u16  sock_descr;      /* generic socket bearer */
-#endif
-        } dev_addr;
-};
-
-/**
- * struct tipc_bearer - TIPC bearer info available to privileged users
- * @usr_handle: pointer to additional user-defined information about bearer
- * @mtu: max packet size bearer can support
- * @blocked: non-zero if bearer is blocked
- * @lock: spinlock for controlling access to bearer
- * @addr: media-specific address associated with bearer
- * @name: bearer name (format = media:interface)
- * 
- * Note: TIPC initializes "name" and "lock" fields; user is responsible for
- * initialization all other fields when a bearer is enabled.
- */
-
-struct tipc_bearer {
-        void *usr_handle;
-        u32 mtu;
-        int blocked;
-        spinlock_t lock;
-        struct tipc_media_addr addr;
-        char name[TIPC_MAX_BEARER_NAME];
-};
-
-/*
- * TIPC routines available to supported media types
- */
-
-int  tipc_register_media(u32 media_type,
-                         char *media_name, 
-                         int (*enable)(struct tipc_bearer *), 
-                         void (*disable)(struct tipc_bearer *), 
-                         int (*send_msg)(struct sk_buff *, 
-                                         struct tipc_bearer *,
-                                         struct tipc_media_addr *), 
-                         char *(*addr2str)(struct tipc_media_addr *a,
-                                           char *str_buf,
-                                           int str_size),
-                         struct tipc_media_addr *bcast_addr,
-                         const u32 bearer_priority,
-                         const u32 link_tolerance,  /* [ms] */
-                         const u32 send_window_limit); 
-
-void tipc_recv_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr);
-
-int  tipc_block_bearer(const char *name);
-void tipc_continue(struct tipc_bearer *tb_ptr); 
-
-int tipc_enable_bearer(const char *bearer_name, u32 bcast_scope, u32 priority);
-int tipc_disable_bearer(const char *name);
-
-/*
- * Routines made available to TIPC by supported media types
- */
-
-int  tipc_eth_media_start(void);
-void tipc_eth_media_stop(void);
-
-#endif
-
-#endif
diff --git a/include/net/tipc/tipc_msg.h b/include/net/tipc/tipc_msg.h
deleted file mode 100644
index 2e159a812f83..000000000000
--- a/include/net/tipc/tipc_msg.h
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * include/net/tipc/tipc_msg.h: Include file for privileged access to TIPC message headers
- * 
- * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _NET_TIPC_MSG_H_
-#define _NET_TIPC_MSG_H_
-
-#ifdef __KERNEL__
-
-struct tipc_msg {
-        __be32 hdr[15];
-};
-
-
-/*
-                TIPC user data message header format, version 2:
-
-
-       1 0 9 8 7 6 5 4|3 2 1 0 9 8 7 6|5 4 3 2 1 0 9 8|7 6 5 4 3 2 1 0 
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w0:|vers | user  |hdr sz |n|d|s|-|          message size           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w1:|mstyp| error |rer cnt|lsc|opt p|      broadcast ack no         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w2:|        link level ack no      |   broadcast/link level seq no |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w3:|                       previous node                           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w4:|                      originating port                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w5:|                      destination port                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    
-   w6:|                      originating node                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w7:|                      destination node                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w8:|            name type / transport sequence number              |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   w9:|              name instance/multicast lower bound              |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    
-   wA:|                    multicast upper bound                      |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    
-      /                                                               /
-      \                           options                             \
-      /                                                               /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-*/
-
-#define TIPC_CONN_MSG   0
-#define TIPC_MCAST_MSG  1
-#define TIPC_NAMED_MSG  2
-#define TIPC_DIRECT_MSG 3
-
-
-static inline u32 msg_word(struct tipc_msg *m, u32 pos)
-{
-        return ntohl(m->hdr[pos]);
-}
-
-static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask)
-{
-        return (msg_word(m, w) >> pos) & mask;
-}
-
-static inline u32 msg_importance(struct tipc_msg *m)
-{
-        return msg_bits(m, 0, 25, 0xf);
-}
-
-static inline u32 msg_hdr_sz(struct tipc_msg *m)
-{
-        return msg_bits(m, 0, 21, 0xf) << 2;
-}
-
-static inline int msg_short(struct tipc_msg *m)
-{
-        return (msg_hdr_sz(m) == 24);
-}
-
-static inline u32 msg_size(struct tipc_msg *m)
-{
-        return msg_bits(m, 0, 0, 0x1ffff);
-}
-
-static inline u32 msg_data_sz(struct tipc_msg *m)
-{
-        return (msg_size(m) - msg_hdr_sz(m));
-}
-
-static inline unchar *msg_data(struct tipc_msg *m)
-{
-        return ((unchar *)m) + msg_hdr_sz(m);
-}
-
-static inline u32 msg_type(struct tipc_msg *m)
-{
-        return msg_bits(m, 1, 29, 0x7);
-}
-
-static inline u32 msg_named(struct tipc_msg *m)
-{
-        return (msg_type(m) == TIPC_NAMED_MSG);
-}
-
-static inline u32 msg_mcast(struct tipc_msg *m)
-{
-        return (msg_type(m) == TIPC_MCAST_MSG);
-}
-
-static inline u32 msg_connected(struct tipc_msg *m)
-{
-        return (msg_type(m) == TIPC_CONN_MSG);
-}
-
-static inline u32 msg_errcode(struct tipc_msg *m)
-{
-        return msg_bits(m, 1, 25, 0xf);
-}
-
-static inline u32 msg_prevnode(struct tipc_msg *m)
-{
-        return msg_word(m, 3);
-}
-
-static inline u32 msg_origport(struct tipc_msg *m)
-{
-        return msg_word(m, 4);
-}
-
-static inline u32 msg_destport(struct tipc_msg *m)
-{
-        return msg_word(m, 5);
-}
-
-static inline u32 msg_mc_netid(struct tipc_msg *m)
-{
-        return msg_word(m, 5);
-}
-
-static inline u32 msg_orignode(struct tipc_msg *m)
-{
-        if (likely(msg_short(m)))
-                return msg_prevnode(m);
-        return msg_word(m, 6);
-}
-
-static inline u32 msg_destnode(struct tipc_msg *m)
-{
-        return msg_word(m, 7);
-}
-
-static inline u32 msg_nametype(struct tipc_msg *m)
-{
-        return msg_word(m, 8);
-}
-
-static inline u32 msg_nameinst(struct tipc_msg *m)
-{
-        return msg_word(m, 9);
-}
-
-static inline u32 msg_namelower(struct tipc_msg *m)
-{
-        return msg_nameinst(m);
-}
-
-static inline u32 msg_nameupper(struct tipc_msg *m)
-{
-        return msg_word(m, 10);
-}
-
-#endif
-
-#endif
diff --git a/include/net/tipc/tipc_port.h b/include/net/tipc/tipc_port.h
deleted file mode 100644
index c54917cbfa48..000000000000
--- a/include/net/tipc/tipc_port.h
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * include/net/tipc/tipc_port.h: Include file for privileged access to TIPC ports
- * 
- * Copyright (c) 1994-2007, Ericsson AB
- * Copyright (c) 2005-2008, Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _NET_TIPC_PORT_H_
-#define _NET_TIPC_PORT_H_
-
-#ifdef __KERNEL__
-
-#include <linux/tipc.h>
-#include <linux/skbuff.h>
-#include <net/tipc/tipc_msg.h>
-
-#define TIPC_FLOW_CONTROL_WIN 512
-
-/**
- * struct tipc_port - native TIPC port info available to privileged users
- * @usr_handle: pointer to additional user-defined information about port
- * @lock: pointer to spinlock for controlling access to port
- * @connected: non-zero if port is currently connected to a peer port
- * @conn_type: TIPC type used when connection was established
- * @conn_instance: TIPC instance used when connection was established
- * @conn_unacked: number of unacknowledged messages received from peer port
- * @published: non-zero if port has one or more associated names
- * @congested: non-zero if cannot send because of link or port congestion
- * @max_pkt: maximum packet size "hint" used when building messages sent by port
- * @ref: unique reference to port in TIPC object registry
- * @phdr: preformatted message header used when sending messages
- */
-
-struct tipc_port {
-        void *usr_handle;
-        spinlock_t *lock;
-        int connected;
-        u32 conn_type;
-        u32 conn_instance;
-        u32 conn_unacked;
-        int published;
-        u32 congested;
-        u32 max_pkt;
-        u32 ref;
-        struct tipc_msg phdr;
-};
-
-
-struct tipc_port *tipc_createport_raw(void *usr_handle,
-                        u32 (*dispatcher)(struct tipc_port *, struct sk_buff *),
-                        void (*wakeup)(struct tipc_port *),
-                        const u32 importance);
-
-int tipc_reject_msg(struct sk_buff *buf, u32 err);
-
-int tipc_send_buf_fast(struct sk_buff *buf, u32 destnode);
-
-void tipc_acknowledge(u32 port_ref,u32 ack);
-
-struct tipc_port *tipc_get_port(const u32 ref);
-
-void *tipc_get_handle(const u32 ref);
-
-/*
- * The following routines require that the port be locked on entry
- */
-
-int tipc_disconnect_port(struct tipc_port *tp_ptr);
-
-
-#endif
-
-#endif
-
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index 42a0eb68b7b6..5271a741c3a3 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -7,16 +7,14 @@
  *      IPv6 transport protocols
  */
 
-#ifdef __KERNEL__
-
 extern struct proto rawv6_prot;
 extern struct proto udpv6_prot;
 extern struct proto udplitev6_prot;
 extern struct proto tcpv6_prot;
 
-struct flowi;
+struct flowi6;
 
-/* extention headers */
+/* extension headers */
 extern int                              ipv6_exthdrs_init(void);
 extern void                             ipv6_exthdrs_exit(void);
 extern int                              ipv6_frag_init(void);
@@ -42,7 +40,7 @@ extern int			datagram_recv_ctl(struct sock *sk,
 
 extern int                      datagram_send_ctl(struct net *net,
                                                   struct msghdr *msg,
-                                                  struct flowi *fl,
+                                                  struct flowi6 *fl6,
                                                   struct ipv6_txoptions *opt,
                                                   int *hlimit, int *tclass,
                                                   int *dontfrag);
@@ -57,5 +55,3 @@ extern const struct inet_connection_sock_af_ops ipv4_specific;
 extern void inet6_destroy_sock(struct sock *sk);
 
 #endif
-
-#endif
diff --git a/include/net/udp.h b/include/net/udp.h
index a184d3496b13..67ea6fcb3ec0 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -105,10 +105,10 @@ static inline struct udp_hslot *udp_hashslot2(struct udp_table *table,
 
 extern struct proto udp_prot;
 
-extern atomic_t udp_memory_allocated;
+extern atomic_long_t udp_memory_allocated;
 
 /* sysctl variables for udp */
-extern int sysctl_udp_mem[3];
+extern long sysctl_udp_mem[3];
 extern int sysctl_udp_rmem_min;
 extern int sysctl_udp_wmem_min;
 
@@ -144,6 +144,17 @@ static inline __wsum udp_csum_outgoing(struct sock *sk, struct sk_buff *skb)
         return csum;
 }
 
+static inline __wsum udp_csum(struct sk_buff *skb)
+{
+        __wsum csum = csum_partial(skb_transport_header(skb),
+                                   sizeof(struct udphdr), skb->csum);
+
+        for (skb = skb_shinfo(skb)->frag_list; skb; skb = skb->next) {
+                csum = csum_add(csum, skb->csum);
+        }
+        return csum;
+}
+
 /* hash routines shared between UDPv4/6 and UDP-Litev4/6 */
 static inline void udp_lib_hash(struct sock *sk)
 {
@@ -183,6 +194,9 @@ extern int udp_lib_setsockopt(struct sock *sk, int level, int optname,
 extern struct sock *udp4_lib_lookup(struct net *net, __be32 saddr, __be16 sport,
                                     __be32 daddr, __be16 dport,
                                     int dif);
+extern struct sock *udp6_lib_lookup(struct net *net, const struct in6_addr *saddr, __be16 sport,
+                                    const struct in6_addr *daddr, __be16 dport,
+                                    int dif);
 
 /*
  *      SNMP statistics for UDP and UDP-Lite
@@ -242,5 +256,5 @@ extern void udp4_proc_exit(void);
 extern void udp_init(void);
 
 extern int udp4_ufo_send_check(struct sk_buff *skb);
-extern struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb, int features);
+extern struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb, u32 features);
 #endif  /* _UDP_H */
diff --git a/include/net/udplite.h b/include/net/udplite.h
index afdffe607b24..673a024c6b2a 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -115,6 +115,18 @@ static inline __wsum udplite_csum_outgoing(struct sock *sk, struct sk_buff *skb)
         return csum;
 }
 
+static inline __wsum udplite_csum(struct sk_buff *skb)
+{
+        struct sock *sk = skb->sk;
+        int cscov = udplite_sender_cscov(udp_sk(sk), udp_hdr(skb));
+        const int off = skb_transport_offset(skb);
+        const int len = skb->len - off;
+
+        skb->ip_summed = CHECKSUM_NONE;     /* no HW support for checksumming */
+
+        return skb_checksum(skb, off, min(cscov, len), 0);
+}
+
 extern void     udplite4_register(void);
 extern int      udplite_get_port(struct sock *sk, unsigned short snum,
                         int (*scmp)(const struct sock *, const struct sock *));
diff --git a/include/net/wimax.h b/include/net/wimax.h
index 3461aa1df1e0..7328d5019d88 100644
--- a/include/net/wimax.h
+++ b/include/net/wimax.h
@@ -250,7 +250,6 @@
 
 #ifndef __NET__WIMAX_H__
 #define __NET__WIMAX_H__
-#ifdef __KERNEL__
 
 #include <linux/wimax.h>
 #include <net/genetlink.h>
@@ -286,7 +285,7 @@ struct wimax_dev;
  *     does not disconnect the device from the bus and return 0.
  *     If that fails, it should resort to some sort of cold or bus
  *     reset (even if it implies a bus disconnection and device
- *     dissapearance). In that case, -ENODEV should be returned to
+ *     disappearance). In that case, -ENODEV should be returned to
  *     indicate the device is gone.
  *     This operation has to be synchronous, and return only when the
  *     reset is complete. In case of having had to resort to bus/cold
@@ -518,8 +517,4 @@ extern ssize_t wimax_msg_len(struct sk_buff *);
 extern int wimax_rfkill(struct wimax_dev *, enum wimax_rf_state);
 extern int wimax_reset(struct wimax_dev *);
 
-#else
-/* You might be looking for linux/wimax.h */
-#error This file should not be included from user space.
-#endif /* #ifdef __KERNEL__ */
 #endif /* #ifndef __NET__WIMAX_H__ */
diff --git a/include/net/wpan-phy.h b/include/net/wpan-phy.h
index 85926231c07a..d86fffd3c03c 100644
--- a/include/net/wpan-phy.h
+++ b/include/net/wpan-phy.h
@@ -28,7 +28,7 @@ struct wpan_phy {
         struct mutex pib_lock;
 
         /*
-         * This is a PIB acording to 802.15.4-2006.
+         * This is a PIB according to 802.15.4-2006.
          * We do not provide timing-related variables, as they
          * aren't used outside of driver
          */
diff --git a/include/net/x25.h b/include/net/x25.h
index 1479cb4a41fc..a06119a05129 100644
--- a/include/net/x25.h
+++ b/include/net/x25.h
@@ -315,6 +315,8 @@ extern struct list_head x25_route_list;
 extern rwlock_t x25_route_list_lock;
 extern struct list_head x25_forward_list;
 extern rwlock_t x25_forward_list_lock;
+extern struct list_head x25_neigh_list;
+extern rwlock_t x25_neigh_list_lock;
 
 extern int x25_proc_init(void);
 extern void x25_proc_exit(void);
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 4f53532d4c2f..b203e14d26b7 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -36,6 +36,7 @@
 #define XFRM_PROTO_ROUTING      IPPROTO_ROUTING
 #define XFRM_PROTO_DSTOPTS      IPPROTO_DSTOPTS
 
+#define XFRM_ALIGN4(len)        (((len) + 3) & ~3)
 #define XFRM_ALIGN8(len)        (((len) + 7) & ~7)
 #define MODULE_ALIAS_XFRM_MODE(family, encap) \
         MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
@@ -143,6 +144,7 @@ struct xfrm_state {
         struct xfrm_id          id;
         struct xfrm_selector    sel;
         struct xfrm_mark        mark;
+        u32                     tfcpad;
 
         u32                     genid;
 
@@ -184,9 +186,14 @@ struct xfrm_state {
 
         /* State for replay detection */
         struct xfrm_replay_state replay;
+        struct xfrm_replay_state_esn *replay_esn;
 
         /* Replay detection state at the time we sent the last notification */
         struct xfrm_replay_state preplay;
+        struct xfrm_replay_state_esn *preplay_esn;
+
+        /* The functions for replay detection. */
+        struct xfrm_replay      *repl;
 
         /* internal flag that only holds state for delayed aevent at the
          * moment
@@ -257,6 +264,15 @@ struct km_event {
         struct net *net;
 };
 
+struct xfrm_replay {
+        void    (*advance)(struct xfrm_state *x, __be32 net_seq);
+        int     (*check)(struct xfrm_state *x,
+                         struct sk_buff *skb,
+                         __be32 net_seq);
+        void    (*notify)(struct xfrm_state *x, int event);
+        int     (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
+};
+
 struct net_device;
 struct xfrm_type;
 struct xfrm_dst;
@@ -265,25 +281,26 @@ struct xfrm_policy_afinfo {
         struct dst_ops          *dst_ops;
         void                    (*garbage_collect)(struct net *net);
         struct dst_entry        *(*dst_lookup)(struct net *net, int tos,
-                                               xfrm_address_t *saddr,
-                                               xfrm_address_t *daddr);
+                                               const xfrm_address_t *saddr,
+                                               const xfrm_address_t *daddr);
         int                     (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);
         void                    (*decode_session)(struct sk_buff *skb,
                                                   struct flowi *fl,
                                                   int reverse);
-        int                     (*get_tos)(struct flowi *fl);
+        int                     (*get_tos)(const struct flowi *fl);
         int                     (*init_path)(struct xfrm_dst *path,
                                              struct dst_entry *dst,
                                              int nfheader_len);
         int                     (*fill_dst)(struct xfrm_dst *xdst,
                                             struct net_device *dev,
-                                            struct flowi *fl);
+                                            const struct flowi *fl);
+        struct dst_entry        *(*blackhole_route)(struct net *net, struct dst_entry *orig);
 };
 
 extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
-extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
-extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
+extern void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c);
+extern void km_state_notify(struct xfrm_state *x, const struct km_event *c);
 
 struct xfrm_tmpl;
 extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
@@ -298,12 +315,16 @@ struct xfrm_state_afinfo {
         const struct xfrm_type  *type_map[IPPROTO_MAX];
         struct xfrm_mode        *mode_map[XFRM_MODE_MAX];
         int                     (*init_flags)(struct xfrm_state *x);
-        void                    (*init_tempsel)(struct xfrm_selector *sel, struct flowi *fl);
-        void                    (*init_temprop)(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
-                                                xfrm_address_t *daddr, xfrm_address_t *saddr);
+        void                    (*init_tempsel)(struct xfrm_selector *sel,
+                                                const struct flowi *fl);
+        void                    (*init_temprop)(struct xfrm_state *x,
+                                                const struct xfrm_tmpl *tmpl,
+                                                const xfrm_address_t *daddr,
+                                                const xfrm_address_t *saddr);
         int                     (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
         int                     (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
         int                     (*output)(struct sk_buff *skb);
+        int                     (*output_finish)(struct sk_buff *skb);
         int                     (*extract_input)(struct xfrm_state *x,
                                                  struct sk_buff *skb);
         int                     (*extract_output)(struct xfrm_state *x,
@@ -331,7 +352,8 @@ struct xfrm_type {
         void                    (*destructor)(struct xfrm_state *);
         int                     (*input)(struct xfrm_state *, struct sk_buff *skb);
         int                     (*output)(struct xfrm_state *, struct sk_buff *pskb);
-        int                     (*reject)(struct xfrm_state *, struct sk_buff *, struct flowi *);
+        int                     (*reject)(struct xfrm_state *, struct sk_buff *,
+                                          const struct flowi *);
         int                     (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
         /* Estimate maximal size of result of transformation of a dgram */
         u32                     (*get_mtu)(struct xfrm_state *, int size);
@@ -500,7 +522,7 @@ struct xfrm_policy {
         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
 };
 
-static inline struct net *xp_net(struct xfrm_policy *xp)
+static inline struct net *xp_net(const struct xfrm_policy *xp)
 {
         return read_pnet(&xp->xp_net);
 }
@@ -544,13 +566,17 @@ struct xfrm_migrate {
 struct xfrm_mgr {
         struct list_head        list;
         char                    *id;
-        int                     (*notify)(struct xfrm_state *x, struct km_event *c);
+        int                     (*notify)(struct xfrm_state *x, const struct km_event *c);
         int                     (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
         struct xfrm_policy      *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
         int                     (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
-        int                     (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
+        int                     (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
         int                     (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
-        int                     (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles, struct xfrm_kmaddress *k);
+        int                     (*migrate)(const struct xfrm_selector *sel,
+                                           u8 dir, u8 type,
+                                           const struct xfrm_migrate *m,
+                                           int num_bundles,
+                                           const struct xfrm_kmaddress *k);
 };
 
 extern int xfrm_register_km(struct xfrm_mgr *km);
@@ -569,8 +595,14 @@ struct xfrm_skb_cb {
 
         /* Sequence number for replay protection. */
         union {
-                u64 output;
-                __be32 input;
+                struct {
+                        __u32 low;
+                        __u32 hi;
+                } output;
+                struct {
+                        __be32 low;
+                        __be32 hi;
+                } input;
         } seq;
 };
 
@@ -674,6 +706,8 @@ extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
                                     u32 auid, u32 ses, u32 secid);
 extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
                                              struct sk_buff *skb);
+extern void xfrm_audit_state_replay(struct xfrm_state *x,
+                                    struct sk_buff *skb, __be32 net_seq);
 extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
 extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
                                       __be32 net_spi, __be32 net_seq);
@@ -706,6 +740,11 @@ static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
 {
 }
 
+static inline void xfrm_audit_state_replay(struct xfrm_state *x,
+                                           struct sk_buff *skb, __be32 net_seq)
+{
+}
+
 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
                                       u16 family)
 {
@@ -761,10 +800,11 @@ static inline void xfrm_state_hold(struct xfrm_state *x)
         atomic_inc(&x->refcnt);
 }
 
-static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
+static inline bool addr_match(const void *token1, const void *token2,
+                              int prefixlen)
 {
-        __be32 *a1 = token1;
-        __be32 *a2 = token2;
+        const __be32 *a1 = token1;
+        const __be32 *a2 = token2;
         int pdw;
         int pbi;
 
@@ -773,7 +813,7 @@ static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
 
         if (pdw)
                 if (memcmp(a1, a2, pdw << 2))
-                        return 0;
+                        return false;
 
         if (pbi) {
                 __be32 mask;
@@ -781,29 +821,32 @@ static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
                 mask = htonl((0xffffffff) << (32 - pbi));
 
                 if ((a1[pdw] ^ a2[pdw]) & mask)
-                        return 0;
+                        return false;
         }
 
-        return 1;
+        return true;
 }
 
 static __inline__
-__be16 xfrm_flowi_sport(struct flowi *fl)
+__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
 {
         __be16 port;
-        switch(fl->proto) {
+        switch(fl->flowi_proto) {
         case IPPROTO_TCP:
         case IPPROTO_UDP:
         case IPPROTO_UDPLITE:
         case IPPROTO_SCTP:
-                port = fl->fl_ip_sport;
+                port = uli->ports.sport;
                 break;
         case IPPROTO_ICMP:
         case IPPROTO_ICMPV6:
-                port = htons(fl->fl_icmp_type);
+                port = htons(uli->icmpt.type);
                 break;
         case IPPROTO_MH:
-                port = htons(fl->fl_mh_type);
+                port = htons(uli->mht.type);
+                break;
+        case IPPROTO_GRE:
+                port = htons(ntohl(uli->gre_key) >> 16);
                 break;
         default:
                 port = 0;       /*XXX*/
@@ -812,19 +855,22 @@ __be16 xfrm_flowi_sport(struct flowi *fl)
 }
 
 static __inline__
-__be16 xfrm_flowi_dport(struct flowi *fl)
+__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
 {
         __be16 port;
-        switch(fl->proto) {
+        switch(fl->flowi_proto) {
         case IPPROTO_TCP:
         case IPPROTO_UDP:
         case IPPROTO_UDPLITE:
         case IPPROTO_SCTP:
-                port = fl->fl_ip_dport;
+                port = uli->ports.dport;
                 break;
         case IPPROTO_ICMP:
         case IPPROTO_ICMPV6:
-                port = htons(fl->fl_icmp_code);
+                port = htons(uli->icmpt.code);
+                break;
+        case IPPROTO_GRE:
+                port = htons(ntohl(uli->gre_key) & 0xffff);
                 break;
         default:
                 port = 0;       /*XXX*/
@@ -832,7 +878,8 @@ __be16 xfrm_flowi_dport(struct flowi *fl)
         return port;
 }
 
-extern int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
+extern int xfrm_selector_match(const struct xfrm_selector *sel,
+                               const struct flowi *fl,
                                unsigned short family);
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
@@ -911,6 +958,15 @@ struct sec_path {
         struct xfrm_state       *xvec[XFRM_MAX_DEPTH];
 };
 
+static inline int secpath_exists(struct sk_buff *skb)
+{
+#ifdef CONFIG_XFRM
+        return skb->sp != NULL;
+#else
+        return 0;
+#endif
+}
+
 static inline struct sec_path *
 secpath_get(struct sec_path *sp)
 {
@@ -940,7 +996,7 @@ secpath_reset(struct sk_buff *skb)
 }
 
 static inline int
-xfrm_addr_any(xfrm_address_t *addr, unsigned short family)
+xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
 {
         switch (family) {
         case AF_INET:
@@ -952,21 +1008,21 @@ xfrm_addr_any(xfrm_address_t *addr, unsigned short family)
 }
 
 static inline int
-__xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
+__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
 {
         return  (tmpl->saddr.a4 &&
                  tmpl->saddr.a4 != x->props.saddr.a4);
 }
 
 static inline int
-__xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
+__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
 {
         return  (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
                  ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
 }
 
 static inline int
-xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
+xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
 {
         switch (family) {
         case AF_INET:
@@ -1119,49 +1175,49 @@ static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
 #endif
 
 static __inline__
-xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
+xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
 {
         switch (family){
         case AF_INET:
-                return (xfrm_address_t *)&fl->fl4_dst;
+                return (xfrm_address_t *)&fl->u.ip4.daddr;
         case AF_INET6:
-                return (xfrm_address_t *)&fl->fl6_dst;
+                return (xfrm_address_t *)&fl->u.ip6.daddr;
         }
         return NULL;
 }
 
 static __inline__
-xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
+xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
 {
         switch (family){
         case AF_INET:
-                return (xfrm_address_t *)&fl->fl4_src;
+                return (xfrm_address_t *)&fl->u.ip4.saddr;
         case AF_INET6:
-                return (xfrm_address_t *)&fl->fl6_src;
+                return (xfrm_address_t *)&fl->u.ip6.saddr;
         }
         return NULL;
 }
 
 static __inline__
-void xfrm_flowi_addr_get(struct flowi *fl,
+void xfrm_flowi_addr_get(const struct flowi *fl,
                          xfrm_address_t *saddr, xfrm_address_t *daddr,
                          unsigned short family)
 {
         switch(family) {
         case AF_INET:
-                memcpy(&saddr->a4, &fl->fl4_src, sizeof(saddr->a4));
-                memcpy(&daddr->a4, &fl->fl4_dst, sizeof(daddr->a4));
+                memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
+                memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
                 break;
         case AF_INET6:
-                ipv6_addr_copy((struct in6_addr *)&saddr->a6, &fl->fl6_src);
-                ipv6_addr_copy((struct in6_addr *)&daddr->a6, &fl->fl6_dst);
+                ipv6_addr_copy((struct in6_addr *)&saddr->a6, &fl->u.ip6.saddr);
+                ipv6_addr_copy((struct in6_addr *)&daddr->a6, &fl->u.ip6.daddr);
                 break;
         }
 }
 
 static __inline__ int
-__xfrm4_state_addr_check(struct xfrm_state *x,
-                         xfrm_address_t *daddr, xfrm_address_t *saddr)
+__xfrm4_state_addr_check(const struct xfrm_state *x,
+                         const xfrm_address_t *daddr, const xfrm_address_t *saddr)
 {
         if (daddr->a4 == x->id.daddr.a4 &&
             (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
@@ -1170,8 +1226,8 @@ __xfrm4_state_addr_check(struct xfrm_state *x,
 }
 
 static __inline__ int
-__xfrm6_state_addr_check(struct xfrm_state *x,
-                         xfrm_address_t *daddr, xfrm_address_t *saddr)
+__xfrm6_state_addr_check(const struct xfrm_state *x,
+                         const xfrm_address_t *daddr, const xfrm_address_t *saddr)
 {
         if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
             (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)|| 
@@ -1182,8 +1238,8 @@ __xfrm6_state_addr_check(struct xfrm_state *x,
 }
 
 static __inline__ int
-xfrm_state_addr_check(struct xfrm_state *x,
-                      xfrm_address_t *daddr, xfrm_address_t *saddr,
+xfrm_state_addr_check(const struct xfrm_state *x,
+                      const xfrm_address_t *daddr, const xfrm_address_t *saddr,
                       unsigned short family)
 {
         switch (family) {
@@ -1196,23 +1252,23 @@ xfrm_state_addr_check(struct xfrm_state *x,
 }
 
 static __inline__ int
-xfrm_state_addr_flow_check(struct xfrm_state *x, struct flowi *fl,
+xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
                            unsigned short family)
 {
         switch (family) {
         case AF_INET:
                 return __xfrm4_state_addr_check(x,
-                                                (xfrm_address_t *)&fl->fl4_dst,
-                                                (xfrm_address_t *)&fl->fl4_src);
+                                                (const xfrm_address_t *)&fl->u.ip4.daddr,
+                                                (const xfrm_address_t *)&fl->u.ip4.saddr);
         case AF_INET6:
                 return __xfrm6_state_addr_check(x,
-                                                (xfrm_address_t *)&fl->fl6_dst,
-                                                (xfrm_address_t *)&fl->fl6_src);
+                                                (const xfrm_address_t *)&fl->u.ip6.daddr,
+                                                (const xfrm_address_t *)&fl->u.ip6.saddr);
         }
         return 0;
 }
 
-static inline int xfrm_state_kern(struct xfrm_state *x)
+static inline int xfrm_state_kern(const struct xfrm_state *x)
 {
         return atomic_read(&x->tunnel_users);
 }
@@ -1264,7 +1320,7 @@ struct xfrm_tunnel {
         int (*handler)(struct sk_buff *skb);
         int (*err_handler)(struct sk_buff *skb, u32 info);
 
-        struct xfrm_tunnel *next;
+        struct xfrm_tunnel __rcu *next;
         int priority;
 };
 
@@ -1272,7 +1328,7 @@ struct xfrm6_tunnel {
         int (*handler)(struct sk_buff *skb);
         int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
                            u8 type, u8 code, int offset, __be32 info);
-        struct xfrm6_tunnel *next;
+        struct xfrm6_tunnel __rcu *next;
         int priority;
 };
 
@@ -1316,8 +1372,10 @@ extern int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
                            int (*func)(struct xfrm_state *, int, void*), void *);
 extern void xfrm_state_walk_done(struct xfrm_state_walk *walk);
 extern struct xfrm_state *xfrm_state_alloc(struct net *net);
-extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 
-                                          struct flowi *fl, struct xfrm_tmpl *tmpl,
+extern struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
+                                          const xfrm_address_t *saddr,
+                                          const struct flowi *fl,
+                                          struct xfrm_tmpl *tmpl,
                                           struct xfrm_policy *pol, int *err,
                                           unsigned short family);
 extern struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
@@ -1330,11 +1388,11 @@ extern void xfrm_state_insert(struct xfrm_state *x);
 extern int xfrm_state_add(struct xfrm_state *x);
 extern int xfrm_state_update(struct xfrm_state *x);
 extern struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
-                                            xfrm_address_t *daddr, __be32 spi,
+                                            const xfrm_address_t *daddr, __be32 spi,
                                             u8 proto, unsigned short family);
 extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
-                                                   xfrm_address_t *daddr,
-                                                   xfrm_address_t *saddr,
+                                                   const xfrm_address_t *daddr,
+                                                   const xfrm_address_t *saddr,
                                                    u8 proto,
                                                    unsigned short family);
 #ifdef CONFIG_XFRM_SUB_POLICY
@@ -1379,11 +1437,10 @@ extern int xfrm_state_delete(struct xfrm_state *x);
 extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
 extern void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
 extern void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
-extern int xfrm_replay_check(struct xfrm_state *x,
-                             struct sk_buff *skb, __be32 seq);
-extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq);
-extern void xfrm_replay_notify(struct xfrm_state *x, int event);
+extern u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
+extern int xfrm_init_replay(struct xfrm_state *x);
 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
+extern int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
 extern int xfrm_init_state(struct xfrm_state *x);
 extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi,
@@ -1407,6 +1464,7 @@ static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
 extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm4_output(struct sk_buff *skb);
+extern int xfrm4_output_finish(struct sk_buff *skb);
 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
 extern int xfrm6_extract_header(struct sk_buff *skb);
@@ -1419,11 +1477,11 @@ extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
 extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
-extern void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr);
-extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr);
+extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
 extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_output(struct sk_buff *skb);
+extern int xfrm6_output_finish(struct sk_buff *skb);
 extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
                                  u8 **prevhdr);
 
@@ -1462,21 +1520,19 @@ u32 xfrm_get_acqseq(void);
 extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
 struct xfrm_state *xfrm_find_acq(struct net *net, struct xfrm_mark *mark,
                                  u8 mode, u32 reqid, u8 proto,
-                                 xfrm_address_t *daddr,
-                                 xfrm_address_t *saddr, int create,
+                                 const xfrm_address_t *daddr,
+                                 const xfrm_address_t *saddr, int create,
                                  unsigned short family);
 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
-extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
-                          struct flowi *fl, int family, int strict);
 
 #ifdef CONFIG_XFRM_MIGRATE
-extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
-                      struct xfrm_migrate *m, int num_bundles,
-                      struct xfrm_kmaddress *k);
+extern int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+                      const struct xfrm_migrate *m, int num_bundles,
+                      const struct xfrm_kmaddress *k);
 extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
 extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
                                               struct xfrm_migrate *m);
-extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
+extern int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
                         struct xfrm_migrate *m, int num_bundles,
                         struct xfrm_kmaddress *k);
 #endif
@@ -1496,10 +1552,10 @@ extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
 extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
 extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
 extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
-extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
-extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
-extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
-extern struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len,
+extern struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
+extern struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
+extern struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
+extern struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
                                                    int probe);
 
 struct hash_desc;
@@ -1507,7 +1563,8 @@ struct scatterlist;
 typedef int (icv_update_fn_t)(struct hash_desc *, struct scatterlist *,
                               unsigned int);
 
-static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
+static inline int xfrm_addr_cmp(const xfrm_address_t *a,
+                                const xfrm_address_t *b,
                                 int family)
 {
         switch (family) {
@@ -1515,8 +1572,8 @@ static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
         case AF_INET:
                 return (__force u32)a->a4 - (__force u32)b->a4;
         case AF_INET6:
-                return ipv6_addr_cmp((struct in6_addr *)a,
-                                     (struct in6_addr *)b);
+                return ipv6_addr_cmp((const struct in6_addr *)a,
+                                     (const struct in6_addr *)b);
         }
 }
 
@@ -1540,17 +1597,44 @@ static inline int xfrm_aevent_is_on(struct net *net)
 }
 #endif
 
-static inline int xfrm_alg_len(struct xfrm_algo *alg)
+static inline int xfrm_alg_len(const struct xfrm_algo *alg)
 {
         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
 }
 
-static inline int xfrm_alg_auth_len(struct xfrm_algo_auth *alg)
+static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
 {
         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
 }
 
+static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
+{
+        return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
+}
+
 #ifdef CONFIG_XFRM_MIGRATE
+static inline int xfrm_replay_clone(struct xfrm_state *x,
+                                     struct xfrm_state *orig)
+{
+        x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
+                                GFP_KERNEL);
+        if (!x->replay_esn)
+                return -ENOMEM;
+
+        x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
+        x->replay_esn->replay_window = orig->replay_esn->replay_window;
+
+        x->preplay_esn = kmemdup(x->replay_esn,
+                                 xfrm_replay_state_esn_len(x->replay_esn),
+                                 GFP_KERNEL);
+        if (!x->preplay_esn) {
+                kfree(x->replay_esn);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
 {
         return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
@@ -1593,7 +1677,7 @@ static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
         return m->v & m->m;
 }
 
-static inline int xfrm_mark_put(struct sk_buff *skb, struct xfrm_mark *m)
+static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
 {
         if (m->m | m->v)
                 NLA_PUT(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);