38 files changed, 1302 insertions, 442 deletions

diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index 008711e8e78f..342dcf13d039 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -40,6 +40,7 @@
  * @P9_DEBUG_FID: fid allocation/deallocation tracking
  * @P9_DEBUG_PKT: packet marshalling/unmarshalling
  * @P9_DEBUG_FSC: FS-cache tracing
+ * @P9_DEBUG_VPKT: Verbose packet debugging (full packet dump)
  *
  * These flags are passed at mount time to turn on various levels of
  * verbosity and tracing which will be output to the system logs.
@@ -57,6 +58,7 @@ enum p9_debug_flags {
         P9_DEBUG_FID =          (1<<9),
         P9_DEBUG_PKT =          (1<<10),
         P9_DEBUG_FSC =          (1<<11),
+        P9_DEBUG_VPKT =         (1<<12),
 };
 
 #ifdef CONFIG_NET_9P_DEBUG
@@ -74,10 +76,14 @@ do {  \
         } \
 } while (0)
 
+#define P9_DUMP_PKT(way, pdu) p9pdu_dump(way, pdu)
+
 #else
 #define P9_DPRINTK(level, format, arg...)  do { } while (0)
+#define P9_DUMP_PKT(way, pdu) do { } while (0)
 #endif
 
+
 #define P9_EPRINTK(level, format, arg...) \
 do { \
         printk(level "9p: %s (%d): " \
@@ -175,6 +181,10 @@ enum p9_msg_t {
         P9_RLINK,
         P9_TMKDIR = 72,
         P9_RMKDIR,
+        P9_TRENAMEAT = 74,
+        P9_RRENAMEAT,
+        P9_TUNLINKAT = 76,
+        P9_RUNLINKAT,
         P9_TVERSION = 100,
         P9_RVERSION,
         P9_TAUTH = 102,
@@ -321,21 +331,6 @@ enum p9_qid_t {
 #define P9_READDIRHDRSZ 24
 
 /**
- * struct p9_str - length prefixed string type
- * @len: length of the string
- * @str: the string
- *
- * The protocol uses length prefixed strings for all
- * string data, so we replicate that for our internal
- * string members.
- */
-
-struct p9_str {
-        u16 len;
-        char *str;
-};
-
-/**
  * struct p9_qid - file system entity information
  * @type: 8-bit type &p9_qid_t
  * @version: 16-bit monotonically incrementing version number
@@ -371,11 +366,11 @@ struct p9_qid {
  * @atime: Last access/read time
  * @mtime: Last modify/write time
  * @length: file length
- * @name: last element of path (aka filename) in type &p9_str
- * @uid: owner name in type &p9_str
- * @gid: group owner in type &p9_str
- * @muid: last modifier in type &p9_str
- * @extension: area used to encode extended UNIX support in type &p9_str
+ * @name: last element of path (aka filename)
+ * @uid: owner name
+ * @gid: group owner
+ * @muid: last modifier
+ * @extension: area used to encode extended UNIX support
  * @n_uid: numeric user id of owner (part of 9p2000.u extension)
  * @n_gid: numeric group id (part of 9p2000.u extension)
  * @n_muid: numeric user id of laster modifier (part of 9p2000.u extension)
@@ -512,11 +507,6 @@ struct p9_getlock {
         char *client_id;
 };
 
-/* Structures for Protocol Operations */
-struct p9_tstatfs {
-        u32 fid;
-};
-
 struct p9_rstatfs {
         u32 type;
         u32 bsize;
@@ -529,159 +519,6 @@ struct p9_rstatfs {
         u32 namelen;
 };
 
-struct p9_trename {
-        u32 fid;
-        u32 newdirfid;
-        struct p9_str name;
-};
-
-struct p9_rrename {
-};
-
-struct p9_tversion {
-        u32 msize;
-        struct p9_str version;
-};
-
-struct p9_rversion {
-        u32 msize;
-        struct p9_str version;
-};
-
-struct p9_tauth {
-        u32 afid;
-        struct p9_str uname;
-        struct p9_str aname;
-        u32 n_uname;            /* 9P2000.u extensions */
-};
-
-struct p9_rauth {
-        struct p9_qid qid;
-};
-
-struct p9_rerror {
-        struct p9_str error;
-        u32 errno;              /* 9p2000.u extension */
-};
-
-struct p9_tflush {
-        u16 oldtag;
-};
-
-struct p9_rflush {
-};
-
-struct p9_tattach {
-        u32 fid;
-        u32 afid;
-        struct p9_str uname;
-        struct p9_str aname;
-        u32 n_uname;            /* 9P2000.u extensions */
-};
-
-struct p9_rattach {
-        struct p9_qid qid;
-};
-
-struct p9_twalk {
-        u32 fid;
-        u32 newfid;
-        u16 nwname;
-        struct p9_str wnames[16];
-};
-
-struct p9_rwalk {
-        u16 nwqid;
-        struct p9_qid wqids[16];
-};
-
-struct p9_topen {
-        u32 fid;
-        u8 mode;
-};
-
-struct p9_ropen {
-        struct p9_qid qid;
-        u32 iounit;
-};
-
-struct p9_tcreate {
-        u32 fid;
-        struct p9_str name;
-        u32 perm;
-        u8 mode;
-        struct p9_str extension;
-};
-
-struct p9_rcreate {
-        struct p9_qid qid;
-        u32 iounit;
-};
-
-struct p9_tread {
-        u32 fid;
-        u64 offset;
-        u32 count;
-};
-
-struct p9_rread {
-        u32 count;
-        u8 *data;
-};
-
-struct p9_twrite {
-        u32 fid;
-        u64 offset;
-        u32 count;
-        u8 *data;
-};
-
-struct p9_rwrite {
-        u32 count;
-};
-
-struct p9_treaddir {
-        u32 fid;
-        u64 offset;
-        u32 count;
-};
-
-struct p9_rreaddir {
-        u32 count;
-        u8 *data;
-};
-
-
-struct p9_tclunk {
-        u32 fid;
-};
-
-struct p9_rclunk {
-};
-
-struct p9_tremove {
-        u32 fid;
-};
-
-struct p9_rremove {
-};
-
-struct p9_tstat {
-        u32 fid;
-};
-
-struct p9_rstat {
-        struct p9_wstat stat;
-};
-
-struct p9_twstat {
-        u32 fid;
-        struct p9_wstat stat;
-};
-
-struct p9_rwstat {
-};
-
 /**
  * struct p9_fcall - primary packet structure
  * @size: prefixed length of the structure
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index d26d5e98a173..55ce72ce9861 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -36,9 +36,9 @@
  */
 
 enum p9_proto_versions{
-        p9_proto_legacy = 0,
-        p9_proto_2000u = 1,
-        p9_proto_2000L = 2,
+        p9_proto_legacy,
+        p9_proto_2000u,
+        p9_proto_2000L,
 };
 
 
@@ -211,7 +211,10 @@ struct p9_dirent {
 };
 
 int p9_client_statfs(struct p9_fid *fid, struct p9_rstatfs *sb);
-int p9_client_rename(struct p9_fid *fid, struct p9_fid *newdirfid, char *name);
+int p9_client_rename(struct p9_fid *fid, struct p9_fid *newdirfid,
+                     const char *name);
+int p9_client_renameat(struct p9_fid *olddirfid, const char *old_name,
+                       struct p9_fid *newdirfid, const char *new_name);
 struct p9_client *p9_client_create(const char *dev_name, char *options);
 void p9_client_destroy(struct p9_client *clnt);
 void p9_client_disconnect(struct p9_client *clnt);
@@ -231,6 +234,7 @@ int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
 int p9_client_clunk(struct p9_fid *fid);
 int p9_client_fsync(struct p9_fid *fid, int datasync);
 int p9_client_remove(struct p9_fid *fid);
+int p9_client_unlinkat(struct p9_fid *dfid, const char *name, int flags);
 int p9_client_read(struct p9_fid *fid, char *data, char __user *udata,
                                                         u64 offset, u32 count);
 int p9_client_write(struct p9_fid *fid, char *data, const char __user *udata,
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index d8549fb9c742..83531ebeee99 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -67,7 +67,7 @@ struct p9_trans_module {
 
 void v9fs_register_trans(struct p9_trans_module *m);
 void v9fs_unregister_trans(struct p9_trans_module *m);
-struct p9_trans_module *v9fs_get_trans_by_name(const substring_t *name);
+struct p9_trans_module *v9fs_get_trans_by_name(char *s);
 struct p9_trans_module *v9fs_get_default_trans(void);
 void v9fs_put_trans(struct p9_trans_module *m);
 #endif /* NET_9P_TRANSPORT_H */
diff --git a/include/net/act_api.h b/include/net/act_api.h
index bab385f13ac3..c739531e1564 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -72,7 +72,7 @@ struct tcf_act_hdr {
 
 struct tc_action {
         void                    *priv;
-        struct tc_action_ops    *ops;
+        const struct tc_action_ops      *ops;
         __u32                   type; /* for backward compat(TCA_OLD_COMPAT) */
         __u32                   order;
         struct tc_action        *next;
@@ -86,7 +86,7 @@ struct tc_action_ops {
         __u32   type; /* TBD to match kind */
         __u32   capab;  /* capabilities includes 4 bit version */
         struct module           *owner;
-        int     (*act)(struct sk_buff *, struct tc_action *, struct tcf_result *);
+        int     (*act)(struct sk_buff *, const struct tc_action *, struct tcf_result *);
         int     (*get_stats)(struct sk_buff *, struct tc_action *);
         int     (*dump)(struct sk_buff *, struct tc_action *, int, int);
         int     (*cleanup)(struct tc_action *, int bind);
@@ -115,7 +115,7 @@ extern void tcf_hash_insert(struct tcf_common *p, struct tcf_hashinfo *hinfo);
 extern int tcf_register_action(struct tc_action_ops *a);
 extern int tcf_unregister_action(struct tc_action_ops *a);
 extern void tcf_action_destroy(struct tc_action *a, int bind);
-extern int tcf_action_exec(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res);
+extern int tcf_action_exec(struct sk_buff *skb, const struct tc_action *a, struct tcf_result *res);
 extern struct tc_action *tcf_action_init(struct nlattr *nla, struct nlattr *est, char *n, int ovr, int bind);
 extern struct tc_action *tcf_action_init_1(struct nlattr *nla, struct nlattr *est, char *n, int ovr, int bind);
 extern int tcf_action_dump(struct sk_buff *skb, struct tc_action *a, int, int);
diff --git a/include/net/arp.h b/include/net/arp.h
index 91f0568a04ef..4979af8b1559 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -8,6 +8,36 @@
 
 extern struct neigh_table arp_tbl;
 
+static inline u32 arp_hashfn(u32 key, const struct net_device *dev, u32 hash_rnd)
+{
+        u32 val = key ^ dev->ifindex;
+
+        return val * hash_rnd;
+}
+
+static inline struct neighbour *__ipv4_neigh_lookup(struct neigh_table *tbl, struct net_device *dev, u32 key)
+{
+        struct neigh_hash_table *nht;
+        struct neighbour *n;
+        u32 hash_val;
+
+        rcu_read_lock_bh();
+        nht = rcu_dereference_bh(tbl->nht);
+        hash_val = arp_hashfn(key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
+        for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
+             n != NULL;
+             n = rcu_dereference_bh(n->next)) {
+                if (n->dev == dev && *(u32 *)n->primary_key == key) {
+                        if (!atomic_inc_not_zero(&n->refcnt))
+                                n = NULL;
+                        break;
+                }
+        }
+        rcu_read_unlock_bh();
+
+        return n;
+}
+
 extern void     arp_init(void);
 extern int      arp_find(unsigned char *haddr, struct sk_buff *skb);
 extern int      arp_ioctl(struct net *net, unsigned int cmd, void __user *arg);
@@ -15,7 +45,6 @@ extern void     arp_send(int type, int ptype, __be32 dest_ip,
                          struct net_device *dev, __be32 src_ip,
                          const unsigned char *dest_hw,
                          const unsigned char *src_hw, const unsigned char *th);
-extern int      arp_bind_neighbour(struct dst_entry *dst);
 extern int      arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir);
 extern void     arp_ifdown(struct net_device *dev);
 
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 43750439c521..e727555d4ee9 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -56,6 +56,7 @@
 #define BT_SECURITY     4
 struct bt_security {
         __u8 level;
+        __u8 key_size;
 };
 #define BT_SECURITY_SDP         0
 #define BT_SECURITY_LOW         1
@@ -69,9 +70,19 @@ struct bt_security {
 #define BT_FLUSHABLE_OFF        0
 #define BT_FLUSHABLE_ON         1
 
-#define BT_INFO(fmt, arg...) printk(KERN_INFO "Bluetooth: " fmt "\n" , ## arg)
-#define BT_ERR(fmt, arg...)  printk(KERN_ERR "%s: " fmt "\n" , __func__ , ## arg)
-#define BT_DBG(fmt, arg...)  pr_debug("%s: " fmt "\n" , __func__ , ## arg)
+#define BT_POWER        9
+struct bt_power {
+        __u8 force_active;
+};
+#define BT_POWER_FORCE_ACTIVE_OFF 0
+#define BT_POWER_FORCE_ACTIVE_ON  1
+
+__attribute__((format (printf, 2, 3)))
+int bt_printk(const char *level, const char *fmt, ...);
+
+#define BT_INFO(fmt, arg...)   bt_printk(KERN_INFO, pr_fmt(fmt), ##arg)
+#define BT_ERR(fmt, arg...)    bt_printk(KERN_ERR, pr_fmt(fmt), ##arg)
+#define BT_DBG(fmt, arg...)    pr_debug(fmt "\n", ##arg)
 
 /* Connection and socket states */
 enum {
@@ -130,7 +141,8 @@ int  bt_sock_register(int proto, const struct net_proto_family *ops);
 int  bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
-int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags);
+int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
+                                struct msghdr *msg, size_t len, int flags);
 int  bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         struct msghdr *msg, size_t len, int flags);
 uint bt_sock_poll(struct file * file, struct socket *sock, poll_table *wait);
@@ -150,6 +162,7 @@ struct bt_skb_cb {
         __u8 retries;
         __u8 sar;
         unsigned short channel;
+        __u8 force_active;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
 
@@ -164,8 +177,8 @@ static inline struct sk_buff *bt_skb_alloc(unsigned int len, gfp_t how)
         return skb;
 }
 
-static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk, unsigned long len, 
-                                                        int nb, int *err)
+static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk,
+                                        unsigned long len, int nb, int *err)
 {
         struct sk_buff *skb;
 
@@ -195,7 +208,7 @@ out:
         return NULL;
 }
 
-int bt_err(__u16 code);
+int bt_to_errno(__u16 code);
 
 extern int hci_sock_init(void);
 extern void hci_sock_cleanup(void);
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 0c20227e57f6..be30aabe7b88 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -211,11 +211,16 @@ enum {
 #define LMP_EDR_3S_ESCO 0x80
 
 #define LMP_EXT_INQ     0x01
+#define LMP_SIMUL_LE_BR 0x02
 #define LMP_SIMPLE_PAIR 0x08
 #define LMP_NO_FLUSH    0x40
 
 #define LMP_LSTO        0x01
 #define LMP_INQ_TX_PWR  0x02
+#define LMP_EXTFEATURES 0x80
+
+/* Extended LMP features */
+#define LMP_HOST_LE     0x02
 
 /* Connection modes */
 #define HCI_CM_ACTIVE   0x0000
@@ -254,6 +259,10 @@ enum {
 #define HCI_LK_UNAUTH_COMBINATION       0x04
 #define HCI_LK_AUTH_COMBINATION         0x05
 #define HCI_LK_CHANGED_COMBINATION      0x06
+/* The spec doesn't define types for SMP keys */
+#define HCI_LK_SMP_LTK                  0x81
+#define HCI_LK_SMP_IRK                  0x82
+#define HCI_LK_SMP_CSRK                 0x83
 
 /* -----  HCI Commands ---- */
 #define HCI_OP_NOP                      0x0000
@@ -653,6 +662,12 @@ struct hci_rp_read_local_oob_data {
 
 #define HCI_OP_READ_INQ_RSP_TX_POWER    0x0c58
 
+#define HCI_OP_WRITE_LE_HOST_SUPPORTED  0x0c6d
+struct hci_cp_write_le_host_supported {
+        __u8 le;
+        __u8 simul;
+} __packed;
+
 #define HCI_OP_READ_LOCAL_VERSION       0x1001
 struct hci_rp_read_local_version {
         __u8     status;
@@ -676,6 +691,9 @@ struct hci_rp_read_local_features {
 } __packed;
 
 #define HCI_OP_READ_LOCAL_EXT_FEATURES  0x1004
+struct hci_cp_read_local_ext_features {
+        __u8     page;
+} __packed;
 struct hci_rp_read_local_ext_features {
         __u8     status;
         __u8     page;
@@ -710,6 +728,12 @@ struct hci_rp_le_read_buffer_size {
         __u8     le_max_pkt;
 } __packed;
 
+#define HCI_OP_LE_SET_SCAN_ENABLE       0x200c
+struct hci_cp_le_set_scan_enable {
+        __u8     enable;
+        __u8     filter_dup;
+} __packed;
+
 #define HCI_OP_LE_CREATE_CONN           0x200d
 struct hci_cp_le_create_conn {
         __le16   scan_interval;
@@ -739,6 +763,33 @@ struct hci_cp_le_conn_update {
         __le16   max_ce_len;
 } __packed;
 
+#define HCI_OP_LE_START_ENC             0x2019
+struct hci_cp_le_start_enc {
+        __le16  handle;
+        __u8    rand[8];
+        __le16  ediv;
+        __u8    ltk[16];
+} __packed;
+
+#define HCI_OP_LE_LTK_REPLY             0x201a
+struct hci_cp_le_ltk_reply {
+        __le16  handle;
+        __u8    ltk[16];
+} __packed;
+struct hci_rp_le_ltk_reply {
+        __u8    status;
+        __le16  handle;
+} __packed;
+
+#define HCI_OP_LE_LTK_NEG_REPLY         0x201b
+struct hci_cp_le_ltk_neg_reply {
+        __le16  handle;
+} __packed;
+struct hci_rp_le_ltk_neg_reply {
+        __u8    status;
+        __le16  handle;
+} __packed;
+
 /* ---- HCI Events ---- */
 #define HCI_EV_INQUIRY_COMPLETE         0x01
 
@@ -1029,6 +1080,32 @@ struct hci_ev_le_conn_complete {
         __u8     clk_accurancy;
 } __packed;
 
+#define HCI_EV_LE_LTK_REQ               0x05
+struct hci_ev_le_ltk_req {
+        __le16  handle;
+        __u8    random[8];
+        __le16  ediv;
+} __packed;
+
+/* Advertising report event types */
+#define ADV_IND         0x00
+#define ADV_DIRECT_IND  0x01
+#define ADV_SCAN_IND    0x02
+#define ADV_NONCONN_IND 0x03
+#define ADV_SCAN_RSP    0x04
+
+#define ADDR_LE_DEV_PUBLIC      0x00
+#define ADDR_LE_DEV_RANDOM      0x01
+
+#define HCI_EV_LE_ADVERTISING_REPORT    0x02
+struct hci_ev_le_advertising_info {
+        __u8     evt_type;
+        __u8     bdaddr_type;
+        bdaddr_t bdaddr;
+        __u8     length;
+        __u8     data[0];
+} __packed;
+
 /* Internal events generated by Bluetooth stack */
 #define HCI_EV_STACK_INTERNAL   0xfd
 struct hci_ev_stack_internal {
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 6c994c004d15..8f441b8b2963 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -25,6 +25,7 @@
 #ifndef __HCI_CORE_H
 #define __HCI_CORE_H
 
+#include <linux/interrupt.h>
 #include <net/bluetooth/hci.h>
 
 /* HCI upper protocols */
@@ -74,12 +75,28 @@ struct bt_uuid {
         u8 svc_hint;
 };
 
+struct key_master_id {
+        __le16 ediv;
+        u8 rand[8];
+} __packed;
+
+struct link_key_data {
+        bdaddr_t bdaddr;
+        u8 type;
+        u8 val[16];
+        u8 pin_len;
+        u8 dlen;
+        u8 data[0];
+} __packed;
+
 struct link_key {
         struct list_head list;
         bdaddr_t bdaddr;
         u8 type;
         u8 val[16];
         u8 pin_len;
+        u8 dlen;
+        u8 data[0];
 };
 
 struct oob_data {
@@ -89,6 +106,12 @@ struct oob_data {
         u8 randomizer[16];
 };
 
+struct adv_entry {
+        struct list_head list;
+        bdaddr_t bdaddr;
+        u8 bdaddr_type;
+};
+
 #define NUM_REASSEMBLY 4
 struct hci_dev {
         struct list_head list;
@@ -107,6 +130,7 @@ struct hci_dev {
         __u8            major_class;
         __u8            minor_class;
         __u8            features[8];
+        __u8            extfeatures[8];
         __u8            commands[64];
         __u8            ssp_mode;
         __u8            hci_ver;
@@ -171,6 +195,8 @@ struct hci_dev {
 
         __u16                   init_last_cmd;
 
+        struct crypto_blkcipher *tfm;
+
         struct inquiry_cache    inq_cache;
         struct hci_conn_hash    conn_hash;
         struct list_head        blacklist;
@@ -181,6 +207,9 @@ struct hci_dev {
 
         struct list_head        remote_oob_data;
 
+        struct list_head        adv_entries;
+        struct timer_list       adv_timer;
+
         struct hci_dev_stats    stat;
 
         struct sk_buff_head     driver_init;
@@ -212,9 +241,9 @@ struct hci_conn {
         struct list_head list;
 
         atomic_t        refcnt;
-        spinlock_t      lock;
 
         bdaddr_t        dst;
+        __u8            dst_type;
         __u16           handle;
         __u16           state;
         __u8            mode;
@@ -233,6 +262,7 @@ struct hci_conn {
         __u8            sec_level;
         __u8            pending_sec_level;
         __u8            pin_length;
+        __u8            enc_key_size;
         __u8            io_capability;
         __u8            power_save;
         __u16           disc_timeout;
@@ -259,7 +289,6 @@ struct hci_conn {
         struct hci_dev  *hdev;
         void            *l2cap_data;
         void            *sco_data;
-        void            *priv;
 
         struct hci_conn *link;
 
@@ -307,12 +336,14 @@ static inline long inquiry_entry_age(struct inquiry_entry *e)
         return jiffies - e->timestamp;
 }
 
-struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
+struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
+                                                        bdaddr_t *bdaddr);
 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data);
 
 /* ----- HCI Connections ----- */
 enum {
         HCI_CONN_AUTH_PEND,
+        HCI_CONN_REAUTH_PEND,
         HCI_CONN_ENCRYPT_PEND,
         HCI_CONN_RSWITCH_PEND,
         HCI_CONN_MODE_CHANGE_PEND,
@@ -420,14 +451,15 @@ int hci_conn_del(struct hci_conn *conn);
 void hci_conn_hash_flush(struct hci_dev *hdev);
 void hci_conn_check_pending(struct hci_dev *hdev);
 
-struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type);
+struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
+                                                __u8 sec_level, __u8 auth_type);
 int hci_conn_check_link_mode(struct hci_conn *conn);
 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type);
 int hci_conn_change_link_key(struct hci_conn *conn);
 int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 
-void hci_conn_enter_active_mode(struct hci_conn *conn);
+void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
 void hci_conn_enter_sniff_mode(struct hci_conn *conn);
 
 void hci_conn_hold_device(struct hci_conn *conn);
@@ -449,10 +481,12 @@ static inline void hci_conn_put(struct hci_conn *conn)
                                 timeo = msecs_to_jiffies(conn->disc_timeout);
                                 if (!conn->out)
                                         timeo *= 2;
-                        } else
+                        } else {
                                 timeo = msecs_to_jiffies(10);
-                } else
+                        }
+                } else {
                         timeo = msecs_to_jiffies(10);
+                }
                 mod_timer(&conn->disc_timer, jiffies + timeo);
         }
 }
@@ -511,6 +545,8 @@ int hci_inquiry(void __user *arg);
 
 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_blacklist_clear(struct hci_dev *hdev);
+int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
 int hci_uuids_clear(struct hci_dev *hdev);
 
@@ -518,6 +554,11 @@ int hci_link_keys_clear(struct hci_dev *hdev);
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                         bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
+struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
+struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
+                                        bdaddr_t *bdaddr, u8 type);
+int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
+                        u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16]);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
 int hci_remote_oob_data_clear(struct hci_dev *hdev);
@@ -527,6 +568,12 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
                                                                 u8 *randomizer);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
+#define ADV_CLEAR_TIMEOUT (3*60*HZ) /* Three minutes */
+int hci_adv_entries_clear(struct hci_dev *hdev);
+struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int hci_add_adv_entry(struct hci_dev *hdev,
+                                        struct hci_ev_le_advertising_info *ev);
+
 void hci_del_off_timer(struct hci_dev *hdev);
 
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
@@ -553,6 +600,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define lmp_no_flush_capable(dev)  ((dev)->features[6] & LMP_NO_FLUSH)
 #define lmp_le_capable(dev)        ((dev)->features[4] & LMP_LE)
 
+/* ----- Extended LMP capabilities ----- */
+#define lmp_host_le_capable(dev)   ((dev)->extfeatures[0] & LMP_HOST_LE)
+
 /* ----- HCI protocols ----- */
 struct hci_proto {
         char            *name;
@@ -561,16 +611,20 @@ struct hci_proto {
 
         void            *priv;
 
-        int (*connect_ind)      (struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type);
+        int (*connect_ind)      (struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                                                __u8 type);
         int (*connect_cfm)      (struct hci_conn *conn, __u8 status);
         int (*disconn_ind)      (struct hci_conn *conn);
         int (*disconn_cfm)      (struct hci_conn *conn, __u8 reason);
-        int (*recv_acldata)     (struct hci_conn *conn, struct sk_buff *skb, __u16 flags);
+        int (*recv_acldata)     (struct hci_conn *conn, struct sk_buff *skb,
+                                                                __u16 flags);
         int (*recv_scodata)     (struct hci_conn *conn, struct sk_buff *skb);
-        int (*security_cfm)     (struct hci_conn *conn, __u8 status, __u8 encrypt);
+        int (*security_cfm)     (struct hci_conn *conn, __u8 status,
+                                                                __u8 encrypt);
 };
 
-static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
+static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                                                __u8 type)
 {
         register struct hci_proto *hp;
         int mask = 0;
@@ -656,7 +710,8 @@ static inline void hci_proto_auth_cfm(struct hci_conn *conn, __u8 status)
                 conn->security_cfm_cb(conn, status);
 }
 
-static inline void hci_proto_encrypt_cfm(struct hci_conn *conn, __u8 status, __u8 encrypt)
+static inline void hci_proto_encrypt_cfm(struct hci_conn *conn, __u8 status,
+                                                                __u8 encrypt)
 {
         register struct hci_proto *hp;
 
@@ -681,7 +736,8 @@ struct hci_cb {
 
         char *name;
 
-        void (*security_cfm)    (struct hci_conn *conn, __u8 status, __u8 encrypt);
+        void (*security_cfm)    (struct hci_conn *conn, __u8 status,
+                                                                __u8 encrypt);
         void (*key_change_cfm)  (struct hci_conn *conn, __u8 status);
         void (*role_switch_cfm) (struct hci_conn *conn, __u8 status, __u8 role);
 };
@@ -707,13 +763,17 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
         read_unlock_bh(&hci_cb_list_lock);
 }
 
-static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status, __u8 encrypt)
+static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
+                                                                __u8 encrypt)
 {
         struct list_head *p;
 
         if (conn->sec_level == BT_SECURITY_SDP)
                 conn->sec_level = BT_SECURITY_LOW;
 
+        if (conn->pending_sec_level > conn->sec_level)
+                conn->sec_level = conn->pending_sec_level;
+
         hci_proto_encrypt_cfm(conn, status, encrypt);
 
         read_lock_bh(&hci_cb_list_lock);
@@ -738,7 +798,8 @@ static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
         read_unlock_bh(&hci_cb_list_lock);
 }
 
-static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status, __u8 role)
+static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
+                                                                __u8 role)
 {
         struct list_head *p;
 
@@ -830,4 +891,9 @@ void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result);
 
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
+void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
+                                                        __u8 ltk[16]);
+void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]);
+void hci_le_ltk_neg_reply(struct hci_conn *conn);
+
 #endif /* __HCI_CORE_H */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index d09c9b1118e3..4f34ad25e75c 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -37,7 +37,6 @@
 #define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
 #define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
 #define L2CAP_DEFAULT_ACK_TO            200
-#define L2CAP_LOCAL_BUSY_TRIES          12
 #define L2CAP_LE_DEFAULT_MTU            23
 
 #define L2CAP_CONN_TIMEOUT      (40000) /* 40 seconds */
@@ -130,6 +129,12 @@ struct l2cap_conninfo {
 #define L2CAP_SDU_END               0x8000
 #define L2CAP_SDU_CONTINUE          0xC000
 
+/* L2CAP Command rej. reasons */
+#define L2CAP_REJ_NOT_UNDERSTOOD      0x0000
+#define L2CAP_REJ_MTU_EXCEEDED        0x0001
+#define L2CAP_REJ_INVALID_CID         0x0002
+
+
 /* L2CAP structures */
 struct l2cap_hdr {
         __le16     len;
@@ -144,8 +149,19 @@ struct l2cap_cmd_hdr {
 } __packed;
 #define L2CAP_CMD_HDR_SIZE      4
 
-struct l2cap_cmd_rej {
+struct l2cap_cmd_rej_unk {
+        __le16     reason;
+} __packed;
+
+struct l2cap_cmd_rej_mtu {
+        __le16     reason;
+        __le16     max_mtu;
+} __packed;
+
+struct l2cap_cmd_rej_cid {
         __le16     reason;
+        __le16     scid;
+        __le16     dcid;
 } __packed;
 
 struct l2cap_conn_req {
@@ -287,6 +303,10 @@ struct l2cap_chan {
 
         struct l2cap_conn       *conn;
 
+        __u8            state;
+
+        atomic_t        refcnt;
+
         __le16          psm;
         __u16           dcid;
         __u16           scid;
@@ -295,6 +315,7 @@ struct l2cap_chan {
         __u16           omtu;
         __u16           flush_to;
         __u8            mode;
+        __u8            chan_type;
 
         __le16          sport;
 
@@ -302,6 +323,7 @@ struct l2cap_chan {
         __u8            role_switch;
         __u8            force_reliable;
         __u8            flushable;
+        __u8            force_active;
 
         __u8            ident;
 
@@ -318,8 +340,8 @@ struct l2cap_chan {
         __u16           monitor_timeout;
         __u16           mps;
 
-        __u8            conf_state;
-        __u16           conn_state;
+        unsigned long   conf_state;
+        unsigned long   conn_state;
 
         __u8            next_tx_seq;
         __u8            expected_ack_seq;
@@ -339,18 +361,29 @@ struct l2cap_chan {
         __u8            remote_max_tx;
         __u16           remote_mps;
 
+        struct timer_list       chan_timer;
         struct timer_list       retrans_timer;
         struct timer_list       monitor_timer;
         struct timer_list       ack_timer;
         struct sk_buff          *tx_send_head;
         struct sk_buff_head     tx_q;
         struct sk_buff_head     srej_q;
-        struct sk_buff_head     busy_q;
-        struct work_struct      busy_work;
         struct list_head        srej_l;
 
         struct list_head list;
         struct list_head global_l;
+
+        void            *data;
+        struct l2cap_ops *ops;
+};
+
+struct l2cap_ops {
+        char            *name;
+
+        struct l2cap_chan       *(*new_connection) (void *data);
+        int                     (*recv) (void *data, struct sk_buff *skb);
+        void                    (*close) (void *data);
+        void                    (*state_change) (void *data, int state);
 };
 
 struct l2cap_conn {
@@ -376,6 +409,15 @@ struct l2cap_conn {
 
         __u8            disc_reason;
 
+        __u8            preq[7]; /* SMP Pairing Request */
+        __u8            prsp[7]; /* SMP Pairing Response */
+        __u8            prnd[16]; /* SMP Pairing Random */
+        __u8            pcnf[16]; /* SMP Pairing Confirm */
+        __u8            tk[16]; /* SMP Temporary Key */
+        __u8            smp_key_size;
+
+        struct timer_list security_timer;
+
         struct list_head chan_l;
         rwlock_t        chan_lock;
 };
@@ -384,44 +426,57 @@ struct l2cap_conn {
 #define L2CAP_INFO_FEAT_MASK_REQ_SENT   0x04
 #define L2CAP_INFO_FEAT_MASK_REQ_DONE   0x08
 
+#define L2CAP_CHAN_RAW                  1
+#define L2CAP_CHAN_CONN_LESS            2
+#define L2CAP_CHAN_CONN_ORIENTED        3
+
 /* ----- L2CAP socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
 
 struct l2cap_pinfo {
         struct bt_sock  bt;
         struct l2cap_chan       *chan;
+        struct sk_buff  *rx_busy_skb;
 };
 
-#define L2CAP_CONF_REQ_SENT       0x01
-#define L2CAP_CONF_INPUT_DONE     0x02
-#define L2CAP_CONF_OUTPUT_DONE    0x04
-#define L2CAP_CONF_MTU_DONE       0x08
-#define L2CAP_CONF_MODE_DONE      0x10
-#define L2CAP_CONF_CONNECT_PEND   0x20
-#define L2CAP_CONF_NO_FCS_RECV    0x40
-#define L2CAP_CONF_STATE2_DEVICE  0x80
+enum {
+        CONF_REQ_SENT,
+        CONF_INPUT_DONE,
+        CONF_OUTPUT_DONE,
+        CONF_MTU_DONE,
+        CONF_MODE_DONE,
+        CONF_CONNECT_PEND,
+        CONF_NO_FCS_RECV,
+        CONF_STATE2_DEVICE,
+};
 
 #define L2CAP_CONF_MAX_CONF_REQ 2
 #define L2CAP_CONF_MAX_CONF_RSP 2
 
-#define L2CAP_CONN_SAR_SDU         0x0001
-#define L2CAP_CONN_SREJ_SENT       0x0002
-#define L2CAP_CONN_WAIT_F          0x0004
-#define L2CAP_CONN_SREJ_ACT        0x0008
-#define L2CAP_CONN_SEND_PBIT       0x0010
-#define L2CAP_CONN_REMOTE_BUSY     0x0020
-#define L2CAP_CONN_LOCAL_BUSY      0x0040
-#define L2CAP_CONN_REJ_ACT         0x0080
-#define L2CAP_CONN_SEND_FBIT       0x0100
-#define L2CAP_CONN_RNR_SENT        0x0200
-#define L2CAP_CONN_SAR_RETRY       0x0400
-
-#define __mod_retrans_timer() mod_timer(&chan->retrans_timer, \
-                jiffies +  msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
-#define __mod_monitor_timer() mod_timer(&chan->monitor_timer, \
-                jiffies + msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
-#define __mod_ack_timer() mod_timer(&chan->ack_timer, \
-                jiffies + msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
+enum {
+        CONN_SAR_SDU,
+        CONN_SREJ_SENT,
+        CONN_WAIT_F,
+        CONN_SREJ_ACT,
+        CONN_SEND_PBIT,
+        CONN_REMOTE_BUSY,
+        CONN_LOCAL_BUSY,
+        CONN_REJ_ACT,
+        CONN_SEND_FBIT,
+        CONN_RNR_SENT,
+};
+
+#define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
+#define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
+#define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
+                L2CAP_DEFAULT_RETRANS_TO);
+#define __clear_retrans_timer(c) l2cap_clear_timer(c, &c->retrans_timer)
+#define __set_monitor_timer(c) l2cap_set_timer(c, &c->monitor_timer, \
+                L2CAP_DEFAULT_MONITOR_TO);
+#define __clear_monitor_timer(c) l2cap_clear_timer(c, &c->monitor_timer)
+#define __set_ack_timer(c) l2cap_set_timer(c, &chan->ack_timer, \
+                L2CAP_DEFAULT_ACK_TO);
+#define __clear_ack_timer(c) l2cap_clear_timer(c, &c->ack_timer)
 
 static inline int l2cap_tx_window_full(struct l2cap_chan *ch)
 {
@@ -446,32 +501,17 @@ extern int disable_ertm;
 int l2cap_init_sockets(void);
 void l2cap_cleanup_sockets(void);
 
-void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data);
 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan);
 int __l2cap_wait_ack(struct sock *sk);
 
-struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
-struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
-struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len, u16 control, u16 sdulen);
-int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
-void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb);
-void l2cap_streaming_send(struct l2cap_chan *chan);
-int l2cap_ertm_send(struct l2cap_chan *chan);
-
 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm);
 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
 
-void l2cap_sock_set_timer(struct sock *sk, long timeout);
-void l2cap_sock_clear_timer(struct sock *sk);
-void __l2cap_sock_close(struct sock *sk, int reason);
-void l2cap_sock_kill(struct sock *sk);
-void l2cap_sock_init(struct sock *sk, struct sock *parent);
-struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
-                                                        int proto, gfp_t prio);
-void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err);
 struct l2cap_chan *l2cap_chan_create(struct sock *sk);
-void l2cap_chan_del(struct l2cap_chan *chan, int err);
+void l2cap_chan_close(struct l2cap_chan *chan, int reason);
 void l2cap_chan_destroy(struct l2cap_chan *chan);
 int l2cap_chan_connect(struct l2cap_chan *chan);
+int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
+void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
 
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 4899286ed4e4..5428fd32ccec 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -101,6 +101,8 @@ struct mgmt_key_info {
         u8 type;
         u8 val[16];
         u8 pin_len;
+        u8 dlen;
+        u8 data[0];
 } __packed;
 
 #define MGMT_OP_LOAD_KEYS               0x000D
@@ -199,6 +201,16 @@ struct mgmt_cp_remove_remote_oob_data {
 
 #define MGMT_OP_STOP_DISCOVERY          0x001C
 
+#define MGMT_OP_BLOCK_DEVICE            0x001D
+struct mgmt_cp_block_device {
+        bdaddr_t bdaddr;
+} __packed;
+
+#define MGMT_OP_UNBLOCK_DEVICE          0x001E
+struct mgmt_cp_unblock_device {
+        bdaddr_t bdaddr;
+} __packed;
+
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
         __le16 opcode;
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 6eac4a760c3b..d5eee2093b1e 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -234,7 +234,8 @@ int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 /* ---- RFCOMM DLCs (channels) ---- */
 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio);
 void rfcomm_dlc_free(struct rfcomm_dlc *d);
-int  rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel);
+int  rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst,
+                                                                u8 channel);
 int  rfcomm_dlc_close(struct rfcomm_dlc *d, int reason);
 int  rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb);
 int  rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig);
@@ -271,7 +272,8 @@ static inline void rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 }
 
 /* ---- RFCOMM sessions ---- */
-void   rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst);
+void   rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src,
+                                                                bdaddr_t *dst);
 
 static inline void rfcomm_session_hold(struct rfcomm_session *s)
 {
@@ -312,7 +314,8 @@ struct rfcomm_pinfo {
 int  rfcomm_init_sockets(void);
 void rfcomm_cleanup_sockets(void);
 
-int  rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d);
+int  rfcomm_connect_ind(struct rfcomm_session *s, u8 channel,
+                                                        struct rfcomm_dlc **d);
 
 /* ---- RFCOMM TTY ---- */
 #define RFCOMM_MAX_DEV  256
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
index 8f2edbf979dc..46c457612300 100644
--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -1,3 +1,25 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+
 #ifndef __SMP_H
 #define __SMP_H
 
@@ -16,6 +38,23 @@ struct smp_cmd_pairing {
         __u8    resp_key_dist;
 } __packed;
 
+#define SMP_IO_DISPLAY_ONLY     0x00
+#define SMP_IO_DISPLAY_YESNO    0x01
+#define SMP_IO_KEYBOARD_ONLY    0x02
+#define SMP_IO_NO_INPUT_OUTPUT  0x03
+#define SMP_IO_KEYBOARD_DISPLAY 0x04
+
+#define SMP_OOB_NOT_PRESENT     0x00
+#define SMP_OOB_PRESENT         0x01
+
+#define SMP_DIST_ENC_KEY        0x01
+#define SMP_DIST_ID_KEY         0x02
+#define SMP_DIST_SIGN           0x04
+
+#define SMP_AUTH_NONE           0x00
+#define SMP_AUTH_BONDING        0x01
+#define SMP_AUTH_MITM           0x04
+
 #define SMP_CMD_PAIRING_CONFIRM 0x03
 struct smp_cmd_pairing_confirm {
         __u8    confirm_val[16];
@@ -73,4 +112,12 @@ struct smp_cmd_security_req {
 #define SMP_UNSPECIFIED         0x08
 #define SMP_REPEATED_ATTEMPTS           0x09
 
+#define SMP_MIN_ENC_KEY_SIZE            7
+#define SMP_MAX_ENC_KEY_SIZE            16
+
+/* SMP Commands */
+int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level);
+int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
+int smp_distribute_keys(struct l2cap_conn *conn, __u8 force);
+
 #endif /* __SMP_H */
diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
new file mode 100644
index 000000000000..c5dedd87b4cb
--- /dev/null
+++ b/include/net/caif/caif_hsi.h
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) ST-Ericsson AB 2010
+ * Contact: Sjur Brendeland / sjur.brandeland@stericsson.com
+ * Author:  Daniel Martensson / daniel.martensson@stericsson.com
+ *          Dmitry.Tarnyagin  / dmitry.tarnyagin@stericsson.com
+ * License terms: GNU General Public License (GPL) version 2
+ */
+
+#ifndef CAIF_HSI_H_
+#define CAIF_HSI_H_
+
+#include <net/caif/caif_layer.h>
+#include <net/caif/caif_device.h>
+#include <linux/atomic.h>
+
+/*
+ * Maximum number of CAIF frames that can reside in the same HSI frame.
+ */
+#define CFHSI_MAX_PKTS 15
+
+/*
+ * Maximum number of bytes used for the frame that can be embedded in the
+ * HSI descriptor.
+ */
+#define CFHSI_MAX_EMB_FRM_SZ 96
+
+/*
+ * Decides if HSI buffers should be prefilled with 0xFF pattern for easier
+ * debugging. Both TX and RX buffers will be filled before the transfer.
+ */
+#define CFHSI_DBG_PREFILL               0
+
+/* Structure describing a HSI packet descriptor. */
+#pragma pack(1) /* Byte alignment. */
+struct cfhsi_desc {
+        u8 header;
+        u8 offset;
+        u16 cffrm_len[CFHSI_MAX_PKTS];
+        u8 emb_frm[CFHSI_MAX_EMB_FRM_SZ];
+};
+#pragma pack() /* Default alignment. */
+
+/* Size of the complete HSI packet descriptor. */
+#define CFHSI_DESC_SZ (sizeof(struct cfhsi_desc))
+
+/*
+ * Size of the complete HSI packet descriptor excluding the optional embedded
+ * CAIF frame.
+ */
+#define CFHSI_DESC_SHORT_SZ (CFHSI_DESC_SZ - CFHSI_MAX_EMB_FRM_SZ)
+
+/*
+ * Maximum bytes transferred in one transfer.
+ */
+/* TODO: 4096 is temporary... */
+#define CFHSI_MAX_PAYLOAD_SZ (CFHSI_MAX_PKTS * 4096)
+
+/* Size of the complete HSI TX buffer. */
+#define CFHSI_BUF_SZ_TX (CFHSI_DESC_SZ + CFHSI_MAX_PAYLOAD_SZ)
+
+/* Size of the complete HSI RX buffer. */
+#define CFHSI_BUF_SZ_RX ((2 * CFHSI_DESC_SZ) + CFHSI_MAX_PAYLOAD_SZ)
+
+/* Bitmasks for the HSI descriptor. */
+#define CFHSI_PIGGY_DESC                (0x01 << 7)
+
+#define CFHSI_TX_STATE_IDLE                     0
+#define CFHSI_TX_STATE_XFER                     1
+
+#define CFHSI_RX_STATE_DESC                     0
+#define CFHSI_RX_STATE_PAYLOAD                  1
+
+/* Bitmasks for power management. */
+#define CFHSI_WAKE_UP                           0
+#define CFHSI_WAKE_UP_ACK                       1
+#define CFHSI_WAKE_DOWN_ACK                     2
+#define CFHSI_AWAKE                             3
+#define CFHSI_PENDING_RX                        4
+#define CFHSI_SHUTDOWN                          6
+#define CFHSI_FLUSH_FIFO                        7
+
+#ifndef CFHSI_INACTIVITY_TOUT
+#define CFHSI_INACTIVITY_TOUT                   (1 * HZ)
+#endif /* CFHSI_INACTIVITY_TOUT */
+
+#ifndef CFHSI_WAKEUP_TOUT
+#define CFHSI_WAKEUP_TOUT                       (3 * HZ)
+#endif /* CFHSI_WAKEUP_TOUT */
+
+
+/* Structure implemented by the CAIF HSI driver. */
+struct cfhsi_drv {
+        void (*tx_done_cb) (struct cfhsi_drv *drv);
+        void (*rx_done_cb) (struct cfhsi_drv *drv);
+        void (*wake_up_cb) (struct cfhsi_drv *drv);
+        void (*wake_down_cb) (struct cfhsi_drv *drv);
+};
+
+/* Structure implemented by HSI device. */
+struct cfhsi_dev {
+        int (*cfhsi_up) (struct cfhsi_dev *dev);
+        int (*cfhsi_down) (struct cfhsi_dev *dev);
+        int (*cfhsi_tx) (u8 *ptr, int len, struct cfhsi_dev *dev);
+        int (*cfhsi_rx) (u8 *ptr, int len, struct cfhsi_dev *dev);
+        int (*cfhsi_wake_up) (struct cfhsi_dev *dev);
+        int (*cfhsi_wake_down) (struct cfhsi_dev *dev);
+        int (*cfhsi_fifo_occupancy)(struct cfhsi_dev *dev, size_t *occupancy);
+        int (*cfhsi_rx_cancel)(struct cfhsi_dev *dev);
+        struct cfhsi_drv *drv;
+};
+
+/* Structure implemented by CAIF HSI drivers. */
+struct cfhsi {
+        struct caif_dev_common cfdev;
+        struct net_device *ndev;
+        struct platform_device *pdev;
+        struct sk_buff_head qhead;
+        struct cfhsi_drv drv;
+        struct cfhsi_dev *dev;
+        int tx_state;
+        int rx_state;
+        int rx_len;
+        u8 *rx_ptr;
+        u8 *tx_buf;
+        u8 *rx_buf;
+        spinlock_t lock;
+        int flow_off_sent;
+        u32 q_low_mark;
+        u32 q_high_mark;
+        struct list_head list;
+        struct work_struct wake_up_work;
+        struct work_struct wake_down_work;
+        struct work_struct rx_done_work;
+        struct work_struct tx_done_work;
+        struct workqueue_struct *wq;
+        wait_queue_head_t wake_up_wait;
+        wait_queue_head_t wake_down_wait;
+        wait_queue_head_t flush_fifo_wait;
+        struct timer_list timer;
+        unsigned long bits;
+};
+
+extern struct platform_driver cfhsi_driver;
+
+#endif          /* CAIF_HSI_H_ */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 396e8fc8910e..d17f47fc9e31 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -777,6 +777,7 @@ struct cfg80211_ssid {
  * @n_channels: total number of channels to scan
  * @ie: optional information element(s) to add into Probe Request or %NULL
  * @ie_len: length of ie in octets
+ * @rates: bitmap of rates to advertise for each band
  * @wiphy: the wiphy this was for
  * @dev: the interface
  * @aborted: (internal) scan request was notified as aborted
@@ -788,6 +789,8 @@ struct cfg80211_scan_request {
         const u8 *ie;
         size_t ie_len;
 
+        u32 rates[IEEE80211_NUM_BANDS];
+
         /* internal */
         struct wiphy *wiphy;
         struct net_device *dev;
@@ -1146,14 +1149,32 @@ struct cfg80211_wowlan_trig_pkt_pattern {
  * @magic_pkt: wake up on receiving magic packet
  * @patterns: wake up on receiving packet matching a pattern
  * @n_patterns: number of patterns
+ * @gtk_rekey_failure: wake up on GTK rekey failure
+ * @eap_identity_req: wake up on EAP identity request packet
+ * @four_way_handshake: wake up on 4-way handshake
+ * @rfkill_release: wake up when rfkill is released
  */
 struct cfg80211_wowlan {
-        bool any, disconnect, magic_pkt;
+        bool any, disconnect, magic_pkt, gtk_rekey_failure,
+             eap_identity_req, four_way_handshake,
+             rfkill_release;
         struct cfg80211_wowlan_trig_pkt_pattern *patterns;
         int n_patterns;
 };
 
 /**
+ * struct cfg80211_gtk_rekey_data - rekey data
+ * @kek: key encryption key
+ * @kck: key confirmation key
+ * @replay_ctr: replay counter
+ */
+struct cfg80211_gtk_rekey_data {
+        u8 kek[NL80211_KEK_LEN];
+        u8 kck[NL80211_KCK_LEN];
+        u8 replay_ctr[NL80211_REPLAY_CTR_LEN];
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -1197,6 +1218,8 @@ struct cfg80211_wowlan {
  *
  * @set_default_mgmt_key: set the default management frame key on an interface
  *
+ * @set_rekey_data: give the data necessary for GTK rekeying to the driver
+ *
  * @add_beacon: Add a beacon with given parameters, @head, @interval
  *      and @dtim_period will be valid, @tail is optional.
  * @set_beacon: Change the beacon parameters for an access point mode
@@ -1284,6 +1307,12 @@ struct cfg80211_wowlan {
  *      frame on another channel
  *
  * @testmode_cmd: run a test mode command
+ * @testmode_dump: Implement a test mode dump. The cb->args[2] and up may be
+ *      used by the function, but 0 and 1 must not be touched. Additionally,
+ *      return error codes other than -ENOBUFS and -ENOENT will terminate the
+ *      dump and return to userspace with an error, so be careful. If any data
+ *      was passed in from userspace then the data/len arguments will be present
+ *      and point to the data contained in %NL80211_ATTR_TESTDATA.
  *
  * @set_bitrate_mask: set the bitrate mask configuration
  *
@@ -1433,6 +1462,9 @@ struct cfg80211_ops {
 
 #ifdef CONFIG_NL80211_TESTMODE
         int     (*testmode_cmd)(struct wiphy *wiphy, void *data, int len);
+        int     (*testmode_dump)(struct wiphy *wiphy, struct sk_buff *skb,
+                                 struct netlink_callback *cb,
+                                 void *data, int len);
 #endif
 
         int     (*set_bitrate_mask)(struct wiphy *wiphy,
@@ -1490,6 +1522,9 @@ struct cfg80211_ops {
                                 struct net_device *dev,
                                 struct cfg80211_sched_scan_request *request);
         int     (*sched_scan_stop)(struct wiphy *wiphy, struct net_device *dev);
+
+        int     (*set_rekey_data)(struct wiphy *wiphy, struct net_device *dev,
+                                  struct cfg80211_gtk_rekey_data *data);
 };
 
 /*
@@ -1647,11 +1682,21 @@ struct ieee80211_txrx_stypes {
  * @WIPHY_WOWLAN_MAGIC_PKT: supports wakeup on magic packet
  *      (see nl80211.h)
  * @WIPHY_WOWLAN_DISCONNECT: supports wakeup on disconnect
+ * @WIPHY_WOWLAN_SUPPORTS_GTK_REKEY: supports GTK rekeying while asleep
+ * @WIPHY_WOWLAN_GTK_REKEY_FAILURE: supports wakeup on GTK rekey failure
+ * @WIPHY_WOWLAN_EAP_IDENTITY_REQ: supports wakeup on EAP identity request
+ * @WIPHY_WOWLAN_4WAY_HANDSHAKE: supports wakeup on 4-way handshake failure
+ * @WIPHY_WOWLAN_RFKILL_RELEASE: supports wakeup on RF-kill release
  */
 enum wiphy_wowlan_support_flags {
-        WIPHY_WOWLAN_ANY        = BIT(0),
-        WIPHY_WOWLAN_MAGIC_PKT  = BIT(1),
-        WIPHY_WOWLAN_DISCONNECT = BIT(2),
+        WIPHY_WOWLAN_ANY                = BIT(0),
+        WIPHY_WOWLAN_MAGIC_PKT          = BIT(1),
+        WIPHY_WOWLAN_DISCONNECT         = BIT(2),
+        WIPHY_WOWLAN_SUPPORTS_GTK_REKEY = BIT(3),
+        WIPHY_WOWLAN_GTK_REKEY_FAILURE  = BIT(4),
+        WIPHY_WOWLAN_EAP_IDENTITY_REQ   = BIT(5),
+        WIPHY_WOWLAN_4WAY_HANDSHAKE     = BIT(6),
+        WIPHY_WOWLAN_RFKILL_RELEASE     = BIT(7),
 };
 
 /**
@@ -1716,9 +1761,13 @@ struct wiphy_wowlan_support {
  *      this variable determines its size
  * @max_scan_ssids: maximum number of SSIDs the device can scan for in
  *      any given scan
+ * @max_sched_scan_ssids: maximum number of SSIDs the device can scan
+ *      for in any given scheduled scan
  * @max_scan_ie_len: maximum length of user-controlled IEs device can
  *      add to probe request frames transmitted during a scan, must not
  *      include fixed IEs like supported rates
+ * @max_sched_scan_ie_len: same as max_scan_ie_len, but for scheduled
+ *      scans
  * @coverage_class: current coverage class
  * @fw_version: firmware version for ethtool reporting
  * @hw_version: hardware version for ethtool reporting
@@ -1770,7 +1819,9 @@ struct wiphy {
 
         int bss_priv_size;
         u8 max_scan_ssids;
+        u8 max_sched_scan_ssids;
         u16 max_scan_ie_len;
+        u16 max_sched_scan_ie_len;
 
         int n_cipher_suites;
         const u32 *cipher_suites;
@@ -2849,8 +2900,10 @@ struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp);
 
 #define CFG80211_TESTMODE_CMD(cmd)      .testmode_cmd = (cmd),
+#define CFG80211_TESTMODE_DUMP(cmd)     .testmode_dump = (cmd),
 #else
 #define CFG80211_TESTMODE_CMD(cmd)
+#define CFG80211_TESTMODE_DUMP(cmd)
 #endif
 
 /**
@@ -3022,6 +3075,16 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
                                  const u8 *peer, u32 num_packets, gfp_t gfp);
 
+/**
+ * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
+ * @dev: network device
+ * @bssid: BSSID of AP (to avoid races)
+ * @replay_ctr: new replay counter
+ * @gfp: allocation flags
+ */
+void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
+                               const u8 *replay_ctr, gfp_t gfp);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/dcbnl.h b/include/net/dcbnl.h
index e5983c9053dc..f5aa39997f0b 100644
--- a/include/net/dcbnl.h
+++ b/include/net/dcbnl.h
@@ -28,8 +28,16 @@ struct dcb_app_type {
         struct list_head  list;
 };
 
-u8 dcb_setapp(struct net_device *, struct dcb_app *);
+int dcb_setapp(struct net_device *, struct dcb_app *);
 u8 dcb_getapp(struct net_device *, struct dcb_app *);
+int dcb_ieee_setapp(struct net_device *, struct dcb_app *);
+int dcb_ieee_delapp(struct net_device *, struct dcb_app *);
+u8 dcb_ieee_getapp_mask(struct net_device *, struct dcb_app *);
+
+int dcbnl_ieee_notify(struct net_device *dev, int event, int cmd,
+                      u32 seq, u32 pid);
+int dcbnl_cee_notify(struct net_device *dev, int event, int cmd,
+                     u32 seq, u32 pid);
 
 /*
  * Ops struct for the netlink callbacks.  Used by DCB-enabled drivers through
@@ -43,6 +51,7 @@ struct dcbnl_rtnl_ops {
         int (*ieee_setpfc) (struct net_device *, struct ieee_pfc *);
         int (*ieee_getapp) (struct net_device *, struct dcb_app *);
         int (*ieee_setapp) (struct net_device *, struct dcb_app *);
+        int (*ieee_delapp) (struct net_device *, struct dcb_app *);
         int (*ieee_peer_getets) (struct net_device *, struct ieee_ets *);
         int (*ieee_peer_getpfc) (struct net_device *, struct ieee_pfc *);
 
diff --git a/include/net/dst.h b/include/net/dst.h
index e12ddfb9eb16..29e255796ce1 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -37,8 +37,7 @@ struct dst_entry {
         unsigned long           _metrics;
         unsigned long           expires;
         struct dst_entry        *path;
-        struct neighbour        *neighbour;
-        struct hh_cache         *hh;
+        struct neighbour        *_neighbour;
 #ifdef CONFIG_XFRM
         struct xfrm_state       *xfrm;
 #else
@@ -47,6 +46,14 @@ struct dst_entry {
         int                     (*input)(struct sk_buff*);
         int                     (*output)(struct sk_buff*);
 
+        int                     flags;
+#define DST_HOST                0x0001
+#define DST_NOXFRM              0x0002
+#define DST_NOPOLICY            0x0004
+#define DST_NOHASH              0x0008
+#define DST_NOCACHE             0x0010
+#define DST_NOCOUNT             0x0020
+
         short                   error;
         short                   obsolete;
         unsigned short          header_len;     /* more space at head required */
@@ -62,7 +69,7 @@ struct dst_entry {
          * (L1_CACHE_SIZE would be too much)
          */
 #ifdef CONFIG_64BIT
-        long                    __pad_to_align_refcnt[1];
+        long                    __pad_to_align_refcnt[2];
 #endif
         /*
          * __refcnt wants to be on a different cache line from
@@ -71,13 +78,6 @@ struct dst_entry {
         atomic_t                __refcnt;       /* client references    */
         int                     __use;
         unsigned long           lastuse;
-        int                     flags;
-#define DST_HOST                0x0001
-#define DST_NOXFRM              0x0002
-#define DST_NOPOLICY            0x0004
-#define DST_NOHASH              0x0008
-#define DST_NOCACHE             0x0010
-#define DST_NOCOUNT             0x0020
         union {
                 struct dst_entry        *next;
                 struct rtable __rcu     *rt_next;
@@ -86,6 +86,16 @@ struct dst_entry {
         };
 };
 
+static inline struct neighbour *dst_get_neighbour(struct dst_entry *dst)
+{
+        return dst->_neighbour;
+}
+
+static inline void dst_set_neighbour(struct dst_entry *dst, struct neighbour *neigh)
+{
+        dst->_neighbour = neigh;
+}
+
 extern u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
 extern const u32 dst_default_metrics[RTAX_MAX];
 
@@ -371,8 +381,15 @@ static inline void dst_rcu_free(struct rcu_head *head)
 
 static inline void dst_confirm(struct dst_entry *dst)
 {
-        if (dst)
-                neigh_confirm(dst->neighbour);
+        if (dst) {
+                struct neighbour *n = dst_get_neighbour(dst);
+                neigh_confirm(n);
+        }
+}
+
+static inline struct neighbour *dst_neigh_lookup(const struct dst_entry *dst, const void *daddr)
+{
+        return dst->ops->neigh_lookup(dst, daddr);
 }
 
 static inline void dst_link_failure(struct sk_buff *skb)
diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
index dc0746328947..9adb99845a56 100644
--- a/include/net/dst_ops.h
+++ b/include/net/dst_ops.h
@@ -26,6 +26,7 @@ struct dst_ops {
         void                    (*link_failure)(struct sk_buff *);
         void                    (*update_pmtu)(struct dst_entry *dst, u32 mtu);
         int                     (*local_out)(struct sk_buff *skb);
+        struct neighbour *      (*neigh_lookup)(const struct dst_entry *dst, const void *daddr);
 
         struct kmem_cache       *kmem_cachep;
 
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index d420f28b6d60..82d8d09faa44 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -160,6 +160,38 @@ static inline void *genlmsg_put(struct sk_buff *skb, u32 pid, u32 seq,
 }
 
 /**
+ * genlmsg_nlhdr - Obtain netlink header from user specified header
+ * @user_hdr: user header as returned from genlmsg_put()
+ * @family: generic netlink family
+ *
+ * Returns pointer to netlink header.
+ */
+static inline struct nlmsghdr *genlmsg_nlhdr(void *user_hdr,
+                                             struct genl_family *family)
+{
+        return (struct nlmsghdr *)((char *)user_hdr -
+                                   family->hdrsize -
+                                   GENL_HDRLEN -
+                                   NLMSG_HDRLEN);
+}
+
+/**
+ * genl_dump_check_consistent - check if sequence is consistent and advertise if not
+ * @cb: netlink callback structure that stores the sequence number
+ * @user_hdr: user header as returned from genlmsg_put()
+ * @family: generic netlink family
+ *
+ * Cf. nl_dump_check_consistent(), this just provides a wrapper to make it
+ * simpler to use with generic netlink.
+ */
+static inline void genl_dump_check_consistent(struct netlink_callback *cb,
+                                              void *user_hdr,
+                                              struct genl_family *family)
+{
+        nl_dump_check_consistent(cb, genlmsg_nlhdr(user_hdr, family));
+}
+
+/**
  * genlmsg_put_reply - Add generic netlink header to a reply message
  * @skb: socket buffer holding the message
  * @info: receiver info
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 8a159cc3d68b..4233e6f9841d 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -32,13 +32,17 @@ struct inet_peer {
         struct inet_peer __rcu  *avl_left, *avl_right;
         struct inetpeer_addr    daddr;
         __u32                   avl_height;
-        struct list_head        unused;
-        __u32                   dtime;          /* the time of last use of not
-                                                 * referenced entries */
-        atomic_t                refcnt;
+
+        u32                     metrics[RTAX_MAX];
+        u32                     rate_tokens;    /* rate limiting for ICMP */
+        unsigned long           rate_last;
+        unsigned long           pmtu_expires;
+        u32                     pmtu_orig;
+        u32                     pmtu_learned;
+        struct inetpeer_addr_base redirect_learned;
         /*
          * Once inet_peer is queued for deletion (refcnt == -1), following fields
-         * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp, metrics
+         * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
          * We can share memory with rcu_head to help keep inet_peer small.
          */
         union {
@@ -47,16 +51,14 @@ struct inet_peer {
                         atomic_t                        ip_id_count;    /* IP ID for the next packet */
                         __u32                           tcp_ts;
                         __u32                           tcp_ts_stamp;
-                        u32                             metrics[RTAX_MAX];
-                        u32                             rate_tokens;    /* rate limiting for ICMP */
-                        unsigned long                   rate_last;
-                        unsigned long                   pmtu_expires;
-                        u32                             pmtu_orig;
-                        u32                             pmtu_learned;
-                        struct inetpeer_addr_base       redirect_learned;
                 };
                 struct rcu_head         rcu;
+                struct inet_peer        *gc_next;
         };
+
+        /* following fields might be frequently dirtied */
+        __u32                   dtime;  /* the time of last use of not referenced entries */
+        atomic_t                refcnt;
 };
 
 void                    inet_initpeers(void) __init;
@@ -69,7 +71,7 @@ static inline bool inet_metrics_new(const struct inet_peer *p)
 }
 
 /* can be called with or without local BH being disabled */
-struct inet_peer        *inet_getpeer(struct inetpeer_addr *daddr, int create);
+struct inet_peer        *inet_getpeer(const struct inetpeer_addr *daddr, int create);
 
 static inline struct inet_peer *inet_getpeer_v4(__be32 v4daddr, int create)
 {
@@ -104,11 +106,18 @@ static inline void inet_peer_refcheck(const struct inet_peer *p)
 
 
 /* can be called with or without local BH being disabled */
-static inline __u16     inet_getid(struct inet_peer *p, int more)
+static inline int inet_getid(struct inet_peer *p, int more)
 {
+        int old, new;
         more++;
         inet_peer_refcheck(p);
-        return atomic_add_return(more, &p->ip_id_count) - more;
+        do {
+                old = atomic_read(&p->ip_id_count);
+                new = old + more;
+                if (!new)
+                        new = 1;
+        } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
+        return new;
 }
 
 #endif /* _NET_INETPEER_H */
diff --git a/include/net/ip.h b/include/net/ip.h
index 66dd49149208..aa76c7a4d9c3 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -228,8 +228,6 @@ extern struct ctl_path net_ipv4_ctl_path[];
 extern int inet_peer_threshold;
 extern int inet_peer_minttl;
 extern int inet_peer_maxttl;
-extern int inet_peer_gc_mintime;
-extern int inet_peer_gc_maxtime;
 
 /* From ip_output.c */
 extern int sysctl_ip_dynaddr;
@@ -238,6 +236,11 @@ extern void ipfrag_init(void);
 
 extern void ip_static_sysctl_init(void);
 
+static inline bool ip_is_fragment(const struct iphdr *iph)
+{
+        return (iph->frag_off & htons(IP_MF | IP_OFFSET)) != 0;
+}
+
 #ifdef CONFIG_INET
 #include <net/dst.h>
 
@@ -401,7 +404,8 @@ enum ip_defrag_users {
         __IP_DEFRAG_CONNTRACK_BRIDGE_IN = IP_DEFRAG_CONNTRACK_BRIDGE_IN + USHRT_MAX,
         IP_DEFRAG_VS_IN,
         IP_DEFRAG_VS_OUT,
-        IP_DEFRAG_VS_FWD
+        IP_DEFRAG_VS_FWD,
+        IP_DEFRAG_AF_PACKET,
 };
 
 int ip_defrag(struct sk_buff *skb, u32 user);
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 477ef75f3873..5735a0f979c3 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -87,7 +87,6 @@ struct rt6_info {
         struct dst_entry                dst;
 
 #define rt6i_dev                        dst.dev
-#define rt6i_nexthop                    dst.neighbour
 #define rt6i_expires                    dst.expires
 
         /*
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 481f856c650f..b1370c4015b6 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -836,8 +836,6 @@ struct netns_ipvs {
         int                     num_services;    /* no of virtual services */
 
         rwlock_t                rs_lock;         /* real services table */
-        /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
-        struct lock_class_key   ctl_key;        /* ctl_mutex debuging */
         /* Trash for destinations */
         struct list_head        dest_trash;
         /* Service counters */
@@ -1089,19 +1087,19 @@ ip_vs_control_add(struct ip_vs_conn *cp, struct ip_vs_conn *ctl_cp)
 /*
  * IPVS netns init & cleanup functions
  */
-extern int __ip_vs_estimator_init(struct net *net);
-extern int __ip_vs_control_init(struct net *net);
-extern int __ip_vs_protocol_init(struct net *net);
-extern int __ip_vs_app_init(struct net *net);
-extern int __ip_vs_conn_init(struct net *net);
-extern int __ip_vs_sync_init(struct net *net);
-extern void __ip_vs_conn_cleanup(struct net *net);
-extern void __ip_vs_app_cleanup(struct net *net);
-extern void __ip_vs_protocol_cleanup(struct net *net);
-extern void __ip_vs_control_cleanup(struct net *net);
-extern void __ip_vs_estimator_cleanup(struct net *net);
-extern void __ip_vs_sync_cleanup(struct net *net);
-extern void __ip_vs_service_cleanup(struct net *net);
+extern int ip_vs_estimator_net_init(struct net *net);
+extern int ip_vs_control_net_init(struct net *net);
+extern int ip_vs_protocol_net_init(struct net *net);
+extern int ip_vs_app_net_init(struct net *net);
+extern int ip_vs_conn_net_init(struct net *net);
+extern int ip_vs_sync_net_init(struct net *net);
+extern void ip_vs_conn_net_cleanup(struct net *net);
+extern void ip_vs_app_net_cleanup(struct net *net);
+extern void ip_vs_protocol_net_cleanup(struct net *net);
+extern void ip_vs_control_net_cleanup(struct net *net);
+extern void ip_vs_estimator_net_cleanup(struct net *net);
+extern void ip_vs_sync_net_cleanup(struct net *net);
+extern void ip_vs_service_net_cleanup(struct net *net);
 
 /*
  *      IPVS application functions
@@ -1119,8 +1117,6 @@ extern void ip_vs_app_inc_put(struct ip_vs_app *inc);
 
 extern int ip_vs_app_pkt_out(struct ip_vs_conn *, struct sk_buff *skb);
 extern int ip_vs_app_pkt_in(struct ip_vs_conn *, struct sk_buff *skb);
-extern int ip_vs_app_init(void);
-extern void ip_vs_app_cleanup(void);
 
 void ip_vs_bind_pe(struct ip_vs_service *svc, struct ip_vs_pe *pe);
 void ip_vs_unbind_pe(struct ip_vs_service *svc);
@@ -1223,15 +1219,11 @@ extern int start_sync_thread(struct net *net, int state, char *mcast_ifn,
                              __u8 syncid);
 extern int stop_sync_thread(struct net *net, int state);
 extern void ip_vs_sync_conn(struct net *net, struct ip_vs_conn *cp);
-extern int ip_vs_sync_init(void);
-extern void ip_vs_sync_cleanup(void);
 
 
 /*
  *      IPVS rate estimator prototypes (from ip_vs_est.c)
  */
-extern int ip_vs_estimator_init(void);
-extern void ip_vs_estimator_cleanup(void);
 extern void ip_vs_start_estimator(struct net *net, struct ip_vs_stats *stats);
 extern void ip_vs_stop_estimator(struct net *net, struct ip_vs_stats *stats);
 extern void ip_vs_zero_estimator(struct ip_vs_stats *stats);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index c033ed00df7d..3b5ac1fbff39 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -463,17 +463,7 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
         return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
 }
 
-static __inline__ void ipv6_select_ident(struct frag_hdr *fhdr)
-{
-        static u32 ipv6_fragmentation_id = 1;
-        static DEFINE_SPINLOCK(ip6_id_lock);
-
-        spin_lock_bh(&ip6_id_lock);
-        fhdr->identification = htonl(ipv6_fragmentation_id);
-        if (++ipv6_fragmentation_id == 0)
-                ipv6_fragmentation_id = 1;
-        spin_unlock_bh(&ip6_id_lock);
-}
+extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
 
 /*
  *      Prototypes exported by ipv6
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index e6d6a66a8f71..9259e97864d7 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -20,6 +20,7 @@
 #include <linux/device.h>
 #include <linux/ieee80211.h>
 #include <net/cfg80211.h>
+#include <asm/unaligned.h>
 
 /**
  * DOC: Introduction
@@ -193,6 +194,17 @@ enum ieee80211_bss_change {
 #define IEEE80211_BSS_ARP_ADDR_LIST_LEN 4
 
 /**
+ * enum ieee80211_rssi_event - RSSI threshold event
+ * An indicator for when RSSI goes below/above a certain threshold.
+ * @RSSI_EVENT_HIGH: AP's rssi crossed the high threshold set by the driver.
+ * @RSSI_EVENT_LOW: AP's rssi crossed the low threshold set by the driver.
+ */
+enum ieee80211_rssi_event {
+        RSSI_EVENT_HIGH,
+        RSSI_EVENT_LOW,
+};
+
+/**
  * struct ieee80211_bss_conf - holds the BSS's changing parameters
  *
  * This structure keeps information about a BSS (and an association
@@ -933,6 +945,7 @@ enum set_key_cmd {
  * @aid: AID we assigned to the station if we're an AP
  * @supp_rates: Bitmap of supported rates (per band)
  * @ht_cap: HT capabilities of this STA; restricted to our own TX capabilities
+ * @wme: indicates whether the STA supports WME. Only valid during AP-mode.
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *), size is determined in hw information.
  */
@@ -941,6 +954,7 @@ struct ieee80211_sta {
         u8 addr[ETH_ALEN];
         u16 aid;
         struct ieee80211_sta_ht_cap ht_cap;
+        bool wme;
 
         /* must be last */
         u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
@@ -960,21 +974,6 @@ enum sta_notify_cmd {
 };
 
 /**
- * enum ieee80211_tkip_key_type - get tkip key
- *
- * Used by drivers which need to get a tkip key for skb. Some drivers need a
- * phase 1 key, others need a phase 2 key. A single function allows the driver
- * to get the key, this enum indicates what type of key is required.
- *
- * @IEEE80211_TKIP_P1_KEY: the driver needs a phase 1 key
- * @IEEE80211_TKIP_P2_KEY: the driver needs a phase 2 key
- */
-enum ieee80211_tkip_key_type {
-        IEEE80211_TKIP_P1_KEY,
-        IEEE80211_TKIP_P2_KEY,
-};
-
-/**
  * enum ieee80211_hw_flags - hardware flags
  *
  * These flags are used to indicate hardware capabilities to
@@ -1587,6 +1586,20 @@ enum ieee80211_ampdu_mlme_action {
 };
 
 /**
+ * enum ieee80211_tx_sync_type - TX sync type
+ * @IEEE80211_TX_SYNC_AUTH: sync TX for authentication
+ *      (and possibly also before direct probe)
+ * @IEEE80211_TX_SYNC_ASSOC: sync TX for association
+ * @IEEE80211_TX_SYNC_ACTION: sync TX for action frame
+ *      (not implemented yet)
+ */
+enum ieee80211_tx_sync_type {
+        IEEE80211_TX_SYNC_AUTH,
+        IEEE80211_TX_SYNC_ASSOC,
+        IEEE80211_TX_SYNC_ACTION,
+};
+
+/**
  * struct ieee80211_ops - callbacks from mac80211 to the driver
  *
  * This structure contains various callbacks that the driver may
@@ -1626,6 +1639,10 @@ enum ieee80211_ampdu_mlme_action {
  *      ask the device to suspend. This is only invoked when WoWLAN is
  *      configured, otherwise the device is deconfigured completely and
  *      reconfigured at resume time.
+ *      The driver may also impose special conditions under which it
+ *      wants to use the "normal" suspend (deconfigure), say if it only
+ *      supports WoWLAN when the device is associated. In this case, it
+ *      must return 1 from this function.
  *
  * @resume: If WoWLAN was configured, this indicates that mac80211 is
  *      now resuming its operation, after this the device must be fully
@@ -1671,6 +1688,26 @@ enum ieee80211_ampdu_mlme_action {
  *      of the bss parameters has changed when a call is made. The callback
  *      can sleep.
  *
+ * @tx_sync: Called before a frame is sent to an AP/GO. In the GO case, the
+ *      driver should sync with the GO's powersaving so the device doesn't
+ *      transmit the frame while the GO is asleep. In the regular AP case
+ *      it may be used by drivers for devices implementing other restrictions
+ *      on talking to APs, e.g. due to regulatory enforcement or just HW
+ *      restrictions.
+ *      This function is called for every authentication, association and
+ *      action frame separately since applications might attempt to auth
+ *      with multiple APs before chosing one to associate to. If it returns
+ *      an error, the corresponding authentication, association or frame
+ *      transmission is aborted and reported as having failed. It is always
+ *      called after tuning to the correct channel.
+ *      The callback might be called multiple times before @finish_tx_sync
+ *      (but @finish_tx_sync will be called once for each) but in practice
+ *      this is unlikely to happen. It can also refuse in that case if the
+ *      driver cannot handle that situation.
+ *      This callback can sleep.
+ * @finish_tx_sync: Called as a counterpart to @tx_sync, unless that returned
+ *      an error. This callback can sleep.
+ *
  * @prepare_multicast: Prepare for multicast filter configuration.
  *      This callback is optional, and its return value is passed
  *      to configure_filter(). This callback must be atomic.
@@ -1694,6 +1731,12 @@ enum ieee80211_ampdu_mlme_action {
  *      which set IEEE80211_KEY_FLAG_TKIP_REQ_RX_P1_KEY.
  *      The callback must be atomic.
  *
+ * @set_rekey_data: If the device supports GTK rekeying, for example while the
+ *      host is suspended, it can assign this callback to retrieve the data
+ *      necessary to do GTK rekeying, this is the KEK, KCK and replay counter.
+ *      After rekeying was done it should (for example during resume) notify
+ *      userspace of the new replay counter using ieee80211_gtk_rekey_notify().
+ *
  * @hw_scan: Ask the hardware to service the scan request, no need to start
  *      the scan state machine in stack. The scan must honour the channel
  *      configuration done by the regulatory agent in the wiphy's
@@ -1708,6 +1751,14 @@ enum ieee80211_ampdu_mlme_action {
  *      any error unless this callback returned a negative error code.
  *      The callback can sleep.
  *
+ * @cancel_hw_scan: Ask the low-level tp cancel the active hw scan.
+ *      The driver should ask the hardware to cancel the scan (if possible),
+ *      but the scan will be completed only after the driver will call
+ *      ieee80211_scan_completed().
+ *      This callback is needed for wowlan, to prevent enqueueing a new
+ *      scan_work after the low-level driver was already suspended.
+ *      The callback can sleep.
+ *
  * @sched_scan_start: Ask the hardware to start scanning repeatedly at
  *      specific intervals.  The driver must call the
  *      ieee80211_sched_scan_results() function whenever it finds results.
@@ -1816,6 +1867,7 @@ enum ieee80211_ampdu_mlme_action {
  *
  * @testmode_cmd: Implement a cfg80211 test mode command.
  *      The callback can sleep.
+ * @testmode_dump: Implement a cfg80211 test mode dump. The callback can sleep.
  *
  * @flush: Flush all pending frames from the hardware queue, making sure
  *      that the hardware queues are empty. If the parameter @drop is set
@@ -1860,6 +1912,8 @@ enum ieee80211_ampdu_mlme_action {
  * @set_bitrate_mask: Set a mask of rates to be used for rate control selection
  *      when transmitting a frame. Currently only legacy rates are handled.
  *      The callback can sleep.
+ * @rssi_callback: Notify driver when the average RSSI goes above/below
+ *      thresholds that were registered previously. The callback can sleep.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1881,6 +1935,14 @@ struct ieee80211_ops {
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_bss_conf *info,
                                  u32 changed);
+
+        int (*tx_sync)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                       const u8 *bssid, enum ieee80211_tx_sync_type type);
+        void (*finish_tx_sync)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               const u8 *bssid,
+                               enum ieee80211_tx_sync_type type);
+
         u64 (*prepare_multicast)(struct ieee80211_hw *hw,
                                  struct netdev_hw_addr_list *mc_list);
         void (*configure_filter)(struct ieee80211_hw *hw,
@@ -1897,8 +1959,13 @@ struct ieee80211_ops {
                                 struct ieee80211_key_conf *conf,
                                 struct ieee80211_sta *sta,
                                 u32 iv32, u16 *phase1key);
+        void (*set_rekey_data)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct cfg80211_gtk_rekey_data *data);
         int (*hw_scan)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct cfg80211_scan_request *req);
+        void (*cancel_hw_scan)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif);
         int (*sched_scan_start)(struct ieee80211_hw *hw,
                                 struct ieee80211_vif *vif,
                                 struct cfg80211_sched_scan_request *req,
@@ -1936,6 +2003,9 @@ struct ieee80211_ops {
         void (*set_coverage_class)(struct ieee80211_hw *hw, u8 coverage_class);
 #ifdef CONFIG_NL80211_TESTMODE
         int (*testmode_cmd)(struct ieee80211_hw *hw, void *data, int len);
+        int (*testmode_dump)(struct ieee80211_hw *hw, struct sk_buff *skb,
+                             struct netlink_callback *cb,
+                             void *data, int len);
 #endif
         void (*flush)(struct ieee80211_hw *hw, bool drop);
         void (*channel_switch)(struct ieee80211_hw *hw,
@@ -1960,6 +2030,8 @@ struct ieee80211_ops {
         bool (*tx_frames_pending)(struct ieee80211_hw *hw);
         int (*set_bitrate_mask)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                                 const struct cfg80211_bitrate_mask *mask);
+        void (*rssi_callback)(struct ieee80211_hw *hw,
+                              enum ieee80211_rssi_event rssi_event);
 };
 
 /**
@@ -2550,21 +2622,136 @@ struct sk_buff *
 ieee80211_get_buffered_bc(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 
 /**
- * ieee80211_get_tkip_key - get a TKIP rc4 for skb
+ * ieee80211_get_tkip_p1k_iv - get a TKIP phase 1 key for IV32
+ *
+ * This function returns the TKIP phase 1 key for the given IV32.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @iv32: IV32 to get the P1K for
+ * @p1k: a buffer to which the key will be written, as 5 u16 values
+ */
+void ieee80211_get_tkip_p1k_iv(struct ieee80211_key_conf *keyconf,
+                               u32 iv32, u16 *p1k);
+
+/**
+ * ieee80211_get_tkip_p1k - get a TKIP phase 1 key
+ *
+ * This function returns the TKIP phase 1 key for the IV32 taken
+ * from the given packet.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @skb: the packet to take the IV32 value from that will be encrypted
+ *      with this P1K
+ * @p1k: a buffer to which the key will be written, as 5 u16 values
+ */
+static inline void ieee80211_get_tkip_p1k(struct ieee80211_key_conf *keyconf,
+                                          struct sk_buff *skb, u16 *p1k)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        const u8 *data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
+        u32 iv32 = get_unaligned_le32(&data[4]);
+
+        ieee80211_get_tkip_p1k_iv(keyconf, iv32, p1k);
+}
+
+/**
+ * ieee80211_get_tkip_rx_p1k - get a TKIP phase 1 key for RX
+ *
+ * This function returns the TKIP phase 1 key for the given IV32
+ * and transmitter address.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @ta: TA that will be used with the key
+ * @iv32: IV32 to get the P1K for
+ * @p1k: a buffer to which the key will be written, as 5 u16 values
+ */
+void ieee80211_get_tkip_rx_p1k(struct ieee80211_key_conf *keyconf,
+                               const u8 *ta, u32 iv32, u16 *p1k);
+
+/**
+ * ieee80211_get_tkip_p2k - get a TKIP phase 2 key
+ *
+ * This function computes the TKIP RC4 key for the IV values
+ * in the packet.
+ *
+ * @keyconf: the parameter passed with the set key
+ * @skb: the packet to take the IV32/IV16 values from that will be
+ *      encrypted with this key
+ * @p2k: a buffer to which the key will be written, 16 bytes
+ */
+void ieee80211_get_tkip_p2k(struct ieee80211_key_conf *keyconf,
+                            struct sk_buff *skb, u8 *p2k);
+
+/**
+ * struct ieee80211_key_seq - key sequence counter
  *
- * This function computes a TKIP rc4 key for an skb. It computes
- * a phase 1 key if needed (iv16 wraps around). This function is to
- * be used by drivers which can do HW encryption but need to compute
- * to phase 1/2 key in SW.
+ * @tkip: TKIP data, containing IV32 and IV16 in host byte order
+ * @ccmp: PN data, most significant byte first (big endian,
+ *      reverse order than in packet)
+ * @aes_cmac: PN data, most significant byte first (big endian,
+ *      reverse order than in packet)
+ */
+struct ieee80211_key_seq {
+        union {
+                struct {
+                        u32 iv32;
+                        u16 iv16;
+                } tkip;
+                struct {
+                        u8 pn[6];
+                } ccmp;
+                struct {
+                        u8 pn[6];
+                } aes_cmac;
+        };
+};
+
+/**
+ * ieee80211_get_key_tx_seq - get key TX sequence counter
+ *
+ * @keyconf: the parameter passed with the set key
+ * @seq: buffer to receive the sequence data
+ *
+ * This function allows a driver to retrieve the current TX IV/PN
+ * for the given key. It must not be called if IV generation is
+ * offloaded to the device.
+ *
+ * Note that this function may only be called when no TX processing
+ * can be done concurrently, for example when queues are stopped
+ * and the stop has been synchronized.
+ */
+void ieee80211_get_key_tx_seq(struct ieee80211_key_conf *keyconf,
+                              struct ieee80211_key_seq *seq);
+
+/**
+ * ieee80211_get_key_rx_seq - get key RX sequence counter
  *
  * @keyconf: the parameter passed with the set key
- * @skb: the skb for which the key is needed
- * @type: TBD
- * @key: a buffer to which the key will be written
+ * @tid: The TID, or -1 for the management frame value (CCMP only);
+ *      the value on TID 0 is also used for non-QoS frames. For
+ *      CMAC, only TID 0 is valid.
+ * @seq: buffer to receive the sequence data
+ *
+ * This function allows a driver to retrieve the current RX IV/PNs
+ * for the given key. It must not be called if IV checking is done
+ * by the device and not by mac80211.
+ *
+ * Note that this function may only be called when no RX processing
+ * can be done concurrently.
  */
-void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
-                                struct sk_buff *skb,
-                                enum ieee80211_tkip_key_type type, u8 *key);
+void ieee80211_get_key_rx_seq(struct ieee80211_key_conf *keyconf,
+                              int tid, struct ieee80211_key_seq *seq);
+
+/**
+ * ieee80211_gtk_rekey_notify - notify userspace supplicant of rekeying
+ * @vif: virtual interface the rekeying was done on
+ * @bssid: The BSSID of the AP, for checking association
+ * @replay_ctr: the new replay counter after GTK rekeying
+ * @gfp: allocation flags
+ */
+void ieee80211_gtk_rekey_notify(struct ieee80211_vif *vif, const u8 *bssid,
+                                const u8 *replay_ctr, gfp_t gfp);
+
 /**
  * ieee80211_wake_queue - wake specific queue
  * @hw: pointer as obtained from ieee80211_alloc_hw().
@@ -2830,6 +3017,33 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
                                struct ieee80211_sta *pubsta, bool block);
 
 /**
+ * ieee80211_iter_keys - iterate keys programmed into the device
+ * @hw: pointer obtained from ieee80211_alloc_hw()
+ * @vif: virtual interface to iterate, may be %NULL for all
+ * @iter: iterator function that will be called for each key
+ * @iter_data: custom data to pass to the iterator function
+ *
+ * This function can be used to iterate all the keys known to
+ * mac80211, even those that weren't previously programmed into
+ * the device. This is intended for use in WoWLAN if the device
+ * needs reprogramming of the keys during suspend. Note that due
+ * to locking reasons, it is also only safe to call this at few
+ * spots since it must hold the RTNL and be able to sleep.
+ *
+ * The order in which the keys are iterated matches the order
+ * in which they were originally installed and handed to the
+ * set_key callback.
+ */
+void ieee80211_iter_keys(struct ieee80211_hw *hw,
+                         struct ieee80211_vif *vif,
+                         void (*iter)(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      struct ieee80211_sta *sta,
+                                      struct ieee80211_key_conf *key,
+                                      void *data),
+                         void *iter_data);
+
+/**
  * ieee80211_ap_probereq_get - retrieve a Probe Request template
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
@@ -2870,6 +3084,29 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif);
 void ieee80211_connection_loss(struct ieee80211_vif *vif);
 
 /**
+ * ieee80211_resume_disconnect - disconnect from AP after resume
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * Instructs mac80211 to disconnect from the AP after resume.
+ * Drivers can use this after WoWLAN if they know that the
+ * connection cannot be kept up, for example because keys were
+ * used while the device was asleep but the replay counters or
+ * similar cannot be retrieved from the device during resume.
+ *
+ * Note that due to implementation issues, if the driver uses
+ * the reconfiguration functionality during resume the interface
+ * will still be added as associated first during resume and then
+ * disconnect normally later.
+ *
+ * This function can only be called from the resume callback and
+ * the driver must not be holding any of its own locks while it
+ * calls this function, or at least not any locks it needs in the
+ * key configuration paths (if it supports HW crypto).
+ */
+void ieee80211_resume_disconnect(struct ieee80211_vif *vif);
+
+/**
  * ieee80211_disable_dyn_ps - force mac80211 to temporarily disable dynamic psm
  *
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
@@ -2916,6 +3153,16 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
                                gfp_t gfp);
 
 /**
+ * ieee80211_get_operstate - get the operstate of the vif
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * The driver might need to know the operstate of the net_device
+ * (specifically, whether the link is IF_OPER_UP after resume)
+ */
+unsigned char ieee80211_get_operstate(struct ieee80211_vif *vif);
+
+/**
  * ieee80211_chswitch_done - Complete channel switch process
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @success: make the channel switch successful or not
@@ -2965,6 +3212,23 @@ void ieee80211_ready_on_channel(struct ieee80211_hw *hw);
  */
 void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw);
 
+/**
+ * ieee80211_stop_rx_ba_session - callback to stop existing BA sessions
+ *
+ * in order not to harm the system performance and user experience, the device
+ * may request not to allow any rx ba session and tear down existing rx ba
+ * sessions based on system constraints such as periodic BT activity that needs
+ * to limit wlan activity (eg.sco or a2dp)."
+ * in such cases, the intention is to limit the duration of the rx ppdu and
+ * therefore prevent the peer device to use a-mpdu aggregation.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @ba_rx_bitmap: Bit map of open rx ba per tid
+ * @addr: & to bssid mac address
+ */
+void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
+                                  const u8 *addr);
+
 /* Rate control API */
 
 /**
@@ -3150,4 +3414,9 @@ ieee80211_vif_type_p2p(struct ieee80211_vif *vif)
         return ieee80211_iftype_p2p(vif->type, vif->p2p);
 }
 
+void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
+                                   int rssi_min_thold,
+                                   int rssi_max_thold);
+
+void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif);
 #endif /* MAC80211_H */
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 4014b623880c..4ba8521490ba 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -108,8 +108,8 @@ struct neighbour {
         __u8                    dead;
         seqlock_t               ha_lock;
         unsigned char           ha[ALIGN(MAX_ADDR_LEN, sizeof(unsigned long))];
-        struct hh_cache         *hh;
-        int                     (*output)(struct sk_buff *skb);
+        struct hh_cache         hh;
+        int                     (*output)(struct neighbour *, struct sk_buff *);
         const struct neigh_ops  *ops;
         struct rcu_head         rcu;
         struct net_device       *dev;
@@ -118,12 +118,10 @@ struct neighbour {
 
 struct neigh_ops {
         int                     family;
-        void                    (*solicit)(struct neighbour *, struct sk_buff*);
-        void                    (*error_report)(struct neighbour *, struct sk_buff*);
-        int                     (*output)(struct sk_buff*);
-        int                     (*connected_output)(struct sk_buff*);
-        int                     (*hh_output)(struct sk_buff*);
-        int                     (*queue_xmit)(struct sk_buff*);
+        void                    (*solicit)(struct neighbour *, struct sk_buff *);
+        void                    (*error_report)(struct neighbour *, struct sk_buff *);
+        int                     (*output)(struct neighbour *, struct sk_buff *);
+        int                     (*connected_output)(struct neighbour *, struct sk_buff *);
 };
 
 struct pneigh_entry {
@@ -142,7 +140,7 @@ struct pneigh_entry {
 
 struct neigh_hash_table {
         struct neighbour __rcu  **hash_buckets;
-        unsigned int            hash_mask;
+        unsigned int            hash_shift;
         __u32                   hash_rnd;
         struct rcu_head         rcu;
 };
@@ -205,9 +203,10 @@ extern int			neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                                              u32 flags);
 extern void                     neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev);
 extern int                      neigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
-extern int                      neigh_resolve_output(struct sk_buff *skb);
-extern int                      neigh_connected_output(struct sk_buff *skb);
-extern int                      neigh_compat_output(struct sk_buff *skb);
+extern int                      neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb);
+extern int                      neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb);
+extern int                      neigh_compat_output(struct neighbour *neigh, struct sk_buff *skb);
+extern int                      neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb);
 extern struct neighbour         *neigh_event_ns(struct neigh_table *tbl,
                                                 u8 *lladdr, void *saddr,
                                                 struct net_device *dev);
@@ -341,7 +340,16 @@ static inline int neigh_hh_output(struct hh_cache *hh, struct sk_buff *skb)
         } while (read_seqretry(&hh->hh_lock, seq));
 
         skb_push(skb, hh_len);
-        return hh->hh_output(skb);
+        return dev_queue_xmit(skb);
+}
+
+static inline int neigh_output(struct neighbour *n, struct sk_buff *skb)
+{
+        struct hh_cache *hh = &n->hh;
+        if ((n->nud_state & NUD_CONNECTED) && hh->hh_len)
+                return neigh_hh_output(hh, skb);
+        else
+                return n->output(n, skb);
 }
 
 static inline struct neighbour *
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index aef430d779bd..1ab1aec209ac 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -65,6 +65,7 @@ struct net {
         struct list_head        dev_base_head;
         struct hlist_head       *dev_name_head;
         struct hlist_head       *dev_index_head;
+        unsigned int            dev_base_seq;   /* protected by rtnl_mutex */
 
         /* core fib_rules */
         struct list_head        rules_ops;
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 02740a94f108..98c185441bee 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -638,6 +638,30 @@ static inline int nlmsg_unicast(struct sock *sk, struct sk_buff *skb, u32 pid)
              nlmsg_ok(pos, rem); \
              pos = nlmsg_next(pos, &(rem)))
 
+/**
+ * nl_dump_check_consistent - check if sequence is consistent and advertise if not
+ * @cb: netlink callback structure that stores the sequence number
+ * @nlh: netlink message header to write the flag to
+ *
+ * This function checks if the sequence (generation) number changed during dump
+ * and if it did, advertises it in the netlink message header.
+ *
+ * The correct way to use it is to set cb->seq to the generation counter when
+ * all locks for dumping have been acquired, and then call this function for
+ * each message that is generated.
+ *
+ * Note that due to initialisation concerns, 0 is an invalid sequence number
+ * and must not be used by code that uses this functionality.
+ */
+static inline void
+nl_dump_check_consistent(struct netlink_callback *cb,
+                         struct nlmsghdr *nlh)
+{
+        if (cb->prev_seq && cb->seq != cb->prev_seq)
+                nlh->nlmsg_flags |= NLM_F_DUMP_INTR;
+        cb->prev_seq = cb->seq;
+}
+
 /**************************************************************************
  * Netlink Attributes
  **************************************************************************/
diff --git a/include/net/nfc.h b/include/net/nfc.h
new file mode 100644
index 000000000000..cc0130312f70
--- /dev/null
+++ b/include/net/nfc.h
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2011 Instituto Nokia de Tecnologia
+ *
+ * Authors:
+ *    Lauro Ramos Venancio <lauro.venancio@openbossa.org>
+ *    Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#ifndef __NET_NFC_H
+#define __NET_NFC_H
+
+#include <linux/device.h>
+#include <linux/skbuff.h>
+
+#define nfc_dev_info(dev, fmt, arg...) dev_info((dev), "NFC: " fmt "\n", ## arg)
+#define nfc_dev_err(dev, fmt, arg...) dev_err((dev), "NFC: " fmt "\n", ## arg)
+#define nfc_dev_dbg(dev, fmt, arg...) dev_dbg((dev), fmt "\n", ## arg)
+
+struct nfc_dev;
+
+/**
+ * data_exchange_cb_t - Definition of nfc_data_exchange callback
+ *
+ * @context: nfc_data_exchange cb_context parameter
+ * @skb: response data
+ * @err: If an error has occurred during data exchange, it is the
+ *      error number. Zero means no error.
+ *
+ * When a rx or tx package is lost or corrupted or the target gets out
+ * of the operating field, err is -EIO.
+ */
+typedef void (*data_exchange_cb_t)(void *context, struct sk_buff *skb,
+                                                                int err);
+
+struct nfc_ops {
+        int (*start_poll)(struct nfc_dev *dev, u32 protocols);
+        void (*stop_poll)(struct nfc_dev *dev);
+        int (*activate_target)(struct nfc_dev *dev, u32 target_idx,
+                                                        u32 protocol);
+        void (*deactivate_target)(struct nfc_dev *dev, u32 target_idx);
+        int (*data_exchange)(struct nfc_dev *dev, u32 target_idx,
+                                struct sk_buff *skb, data_exchange_cb_t cb,
+                                                        void *cb_context);
+};
+
+struct nfc_target {
+        u32 idx;
+        u32 supported_protocols;
+        u16 sens_res;
+        u8 sel_res;
+};
+
+struct nfc_genl_data {
+        u32 poll_req_pid;
+        struct mutex genl_data_mutex;
+};
+
+struct nfc_dev {
+        unsigned idx;
+        unsigned target_idx;
+        struct nfc_target *targets;
+        int n_targets;
+        int targets_generation;
+        spinlock_t targets_lock;
+        struct device dev;
+        bool polling;
+        struct nfc_genl_data genl_data;
+        u32 supported_protocols;
+
+        struct nfc_ops *ops;
+};
+#define to_nfc_dev(_dev) container_of(_dev, struct nfc_dev, dev)
+
+extern struct class nfc_class;
+
+struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
+                                        u32 supported_protocols);
+
+/**
+ * nfc_free_device - free nfc device
+ *
+ * @dev: The nfc device to free
+ */
+static inline void nfc_free_device(struct nfc_dev *dev)
+{
+        put_device(&dev->dev);
+}
+
+int nfc_register_device(struct nfc_dev *dev);
+
+void nfc_unregister_device(struct nfc_dev *dev);
+
+/**
+ * nfc_set_parent_dev - set the parent device
+ *
+ * @nfc_dev: The nfc device whose parent is being set
+ * @dev: The parent device
+ */
+static inline void nfc_set_parent_dev(struct nfc_dev *nfc_dev,
+                                        struct device *dev)
+{
+        nfc_dev->dev.parent = dev;
+}
+
+/**
+ * nfc_set_drvdata - set driver specifc data
+ *
+ * @dev: The nfc device
+ * @data: Pointer to driver specifc data
+ */
+static inline void nfc_set_drvdata(struct nfc_dev *dev, void *data)
+{
+        dev_set_drvdata(&dev->dev, data);
+}
+
+/**
+ * nfc_get_drvdata - get driver specifc data
+ *
+ * @dev: The nfc device
+ */
+static inline void *nfc_get_drvdata(struct nfc_dev *dev)
+{
+        return dev_get_drvdata(&dev->dev);
+}
+
+/**
+ * nfc_device_name - get the nfc device name
+ *
+ * @dev: The nfc device whose name to return
+ */
+static inline const char *nfc_device_name(struct nfc_dev *dev)
+{
+        return dev_name(&dev->dev);
+}
+
+struct sk_buff *nfc_alloc_skb(unsigned int size, gfp_t gfp);
+
+int nfc_targets_found(struct nfc_dev *dev, struct nfc_target *targets,
+                                                        int ntargets);
+
+#endif /* __NET_NFC_H */
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 65afc4966204..fffdc603f4c8 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -99,9 +99,9 @@ static inline void qdisc_run(struct Qdisc *q)
                 __qdisc_run(q);
 }
 
-extern int tc_classify_compat(struct sk_buff *skb, struct tcf_proto *tp,
+extern int tc_classify_compat(struct sk_buff *skb, const struct tcf_proto *tp,
                               struct tcf_result *res);
-extern int tc_classify(struct sk_buff *skb, struct tcf_proto *tp,
+extern int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                        struct tcf_result *res);
 
 /* Calculate maximal size of packet seen by hard_start_xmit
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 4093ca78cf60..678f1ffaf843 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -6,11 +6,14 @@
 
 typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *, void *);
 typedef int (*rtnl_dumpit_func)(struct sk_buff *, struct netlink_callback *);
+typedef u16 (*rtnl_calcit_func)(struct sk_buff *);
 
 extern int      __rtnl_register(int protocol, int msgtype,
-                                rtnl_doit_func, rtnl_dumpit_func);
+                                rtnl_doit_func, rtnl_dumpit_func,
+                                rtnl_calcit_func);
 extern void     rtnl_register(int protocol, int msgtype,
-                              rtnl_doit_func, rtnl_dumpit_func);
+                              rtnl_doit_func, rtnl_dumpit_func,
+                              rtnl_calcit_func);
 extern int      rtnl_unregister(int protocol, int msgtype);
 extern void     rtnl_unregister_all(int protocol);
 
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index b931f021d7ab..4fc88f3ccd5f 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -181,8 +181,9 @@ struct tcf_proto_ops {
         struct tcf_proto_ops    *next;
         char                    kind[IFNAMSIZ];
 
-        int                     (*classify)(struct sk_buff*, struct tcf_proto*,
-                                        struct tcf_result *);
+        int                     (*classify)(struct sk_buff *,
+                                            const struct tcf_proto *,
+                                            struct tcf_result *);
         int                     (*init)(struct tcf_proto*);
         void                    (*destroy)(struct tcf_proto*);
 
@@ -205,8 +206,9 @@ struct tcf_proto {
         /* Fast access part */
         struct tcf_proto        *next;
         void                    *root;
-        int                     (*classify)(struct sk_buff*, struct tcf_proto*,
-                                        struct tcf_result *);
+        int                     (*classify)(struct sk_buff *,
+                                            const struct tcf_proto *,
+                                            struct tcf_result *);
         __be16                  protocol;
 
         /* All the rest */
@@ -214,7 +216,7 @@ struct tcf_proto {
         u32                     classid;
         struct Qdisc            *q;
         void                    *data;
-        struct tcf_proto_ops    *ops;
+        const struct tcf_proto_ops      *ops;
 };
 
 struct qdisc_skb_cb {
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index b2c2366676a7..6a72a58cde59 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -120,6 +120,7 @@ extern int sctp_copy_local_addr_list(struct sctp_bind_addr *,
                                      int flags);
 extern struct sctp_pf *sctp_get_pf_specific(sa_family_t family);
 extern int sctp_register_pf(struct sctp_pf *, sa_family_t);
+extern void sctp_addr_wq_mgmt(struct sctp_sockaddr_entry *, int);
 
 /*
  * sctp/socket.c
@@ -134,6 +135,7 @@ void sctp_sock_rfree(struct sk_buff *skb);
 void sctp_copy_sock(struct sock *newsk, struct sock *sk,
                     struct sctp_association *asoc);
 extern struct percpu_counter sctp_sockets_allocated;
+extern int sctp_asconf_mgmt(struct sctp_sock *, struct sctp_sockaddr_entry *);
 
 /*
  * sctp/primitive.c
@@ -285,20 +287,21 @@ do {							\
                 pr_cont(fmt, ##args);                   \
 } while (0)
 #define SCTP_DEBUG_PRINTK_IPADDR(fmt_lead, fmt_trail,                   \
-                                 args_lead, saddr, args_trail...)       \
+                                 args_lead, addr, args_trail...)        \
 do {                                                                    \
+        const union sctp_addr *_addr = (addr);                          \
         if (sctp_debug_flag) {                                          \
-                if (saddr->sa.sa_family == AF_INET6) {                  \
+                if (_addr->sa.sa_family == AF_INET6) {                  \
                         printk(KERN_DEBUG                               \
                                pr_fmt(fmt_lead "%pI6" fmt_trail),       \
                                args_lead,                               \
-                               &saddr->v6.sin6_addr,                    \
+                               &_addr->v6.sin6_addr,                    \
                                args_trail);                             \
                 } else {                                                \
                         printk(KERN_DEBUG                               \
                                pr_fmt(fmt_lead "%pI4" fmt_trail),       \
                                args_lead,                               \
-                               &saddr->v4.sin_addr.s_addr,              \
+                               &_addr->v4.sin_addr.s_addr,              \
                                args_trail);                             \
                 }                                                       \
         }                                                               \
@@ -598,7 +601,7 @@ static inline int ipver2af(__u8 ipver)
                 return AF_INET6;
         default:
                 return 0;
-        };
+        }
 }
 
 /* Convert from an address parameter type to an address family.  */
@@ -611,7 +614,7 @@ static inline int param_type2af(__be16 type)
                 return AF_INET6;
         default:
                 return 0;
-        };
+        }
 }
 
 /* Perform some sanity checks. */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 7df327a6d564..31d7ea2e1d2a 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -205,6 +205,11 @@ extern struct sctp_globals {
          * It is a list of sctp_sockaddr_entry.
          */
         struct list_head local_addr_list;
+        int default_auto_asconf;
+        struct list_head addr_waitq;
+        struct timer_list addr_wq_timer;
+        struct list_head auto_asconf_splist;
+        spinlock_t addr_wq_lock;
 
         /* Lock that protects the local_addr_list writers */
         spinlock_t addr_list_lock;
@@ -264,6 +269,11 @@ extern struct sctp_globals {
 #define sctp_port_hashtable             (sctp_globals.port_hashtable)
 #define sctp_local_addr_list            (sctp_globals.local_addr_list)
 #define sctp_local_addr_lock            (sctp_globals.addr_list_lock)
+#define sctp_auto_asconf_splist         (sctp_globals.auto_asconf_splist)
+#define sctp_addr_waitq                 (sctp_globals.addr_waitq)
+#define sctp_addr_wq_timer              (sctp_globals.addr_wq_timer)
+#define sctp_addr_wq_lock               (sctp_globals.addr_wq_lock)
+#define sctp_default_auto_asconf        (sctp_globals.default_auto_asconf)
 #define sctp_scope_policy               (sctp_globals.ipv4_scope_policy)
 #define sctp_addip_enable               (sctp_globals.addip_enable)
 #define sctp_addip_noauth               (sctp_globals.addip_noauth_enable)
@@ -341,6 +351,8 @@ struct sctp_sock {
         atomic_t pd_mode;
         /* Receive to here while partial delivery is in effect. */
         struct sk_buff_head pd_lobby;
+        struct list_head auto_asconf_list;
+        int do_auto_asconf;
 };
 
 static inline struct sctp_sock *sctp_sk(const struct sock *sk)
@@ -792,6 +804,8 @@ struct sctp_sockaddr_entry {
         __u8 valid;
 };
 
+#define SCTP_ADDRESS_TICK_DELAY 500
+
 typedef struct sctp_chunk *(sctp_packet_phandler_t)(struct sctp_association *);
 
 /* This structure holds lists of chunks as we are assembling for
@@ -1236,6 +1250,7 @@ sctp_scope_t sctp_scope(const union sctp_addr *);
 int sctp_in_scope(const union sctp_addr *addr, const sctp_scope_t scope);
 int sctp_is_any(struct sock *sk, const union sctp_addr *addr);
 int sctp_addr_is_valid(const union sctp_addr *addr);
+int sctp_is_ep_boundall(struct sock *sk);
 
 
 /* What type of endpoint?  */
@@ -1898,6 +1913,8 @@ struct sctp_association {
          * after reaching 4294967295.
          */
         __u32 addip_serial;
+        union sctp_addr *asconf_addr_del_pending;
+        int src_out_of_asoc_ok;
 
         /* SCTP AUTH: list of the endpoint shared keys.  These
          * keys are provided out of band by the user applicaton
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 32fd51274037..0842ef00b2fe 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -92,6 +92,7 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_LOCAL_AUTH_CHUNKS  27      /* Read only */
 #define SCTP_GET_ASSOC_NUMBER   28      /* Read only */
 #define SCTP_GET_ASSOC_ID_LIST  29      /* Read only */
+#define SCTP_AUTO_ASCONF       30
 
 /* Internal Socket Options. Some of the sctp library functions are
  * implemented using these socket options.
diff --git a/include/net/snmp.h b/include/net/snmp.h
index 479083a78b0c..8f0f9ac0307f 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -116,57 +116,51 @@ struct linux_xfrm_mib {
         unsigned long   mibs[LINUX_MIB_XFRMMAX];
 };
 
-/* 
- * FIXME: On x86 and some other CPUs the split into user and softirq parts
- * is not needed because addl $1,memory is atomic against interrupts (but 
- * atomic_inc would be overkill because of the lock cycles). Wants new 
- * nonlocked_atomic_inc() primitives -AK
- */ 
+#define SNMP_ARRAY_SZ 1
+
 #define DEFINE_SNMP_STAT(type, name)    \
-        __typeof__(type) __percpu *name[2]
+        __typeof__(type) __percpu *name[SNMP_ARRAY_SZ]
 #define DEFINE_SNMP_STAT_ATOMIC(type, name)     \
         __typeof__(type) *name
 #define DECLARE_SNMP_STAT(type, name)   \
-        extern __typeof__(type) __percpu *name[2]
-
-#define SNMP_STAT_BHPTR(name)   (name[0])
-#define SNMP_STAT_USRPTR(name)  (name[1])
+        extern __typeof__(type) __percpu *name[SNMP_ARRAY_SZ]
 
 #define SNMP_INC_STATS_BH(mib, field)   \
                         __this_cpu_inc(mib[0]->mibs[field])
+
 #define SNMP_INC_STATS_USER(mib, field) \
-                        this_cpu_inc(mib[1]->mibs[field])
+                        irqsafe_cpu_inc(mib[0]->mibs[field])
+
 #define SNMP_INC_STATS_ATOMIC_LONG(mib, field)  \
                         atomic_long_inc(&mib->mibs[field])
+
 #define SNMP_INC_STATS(mib, field)      \
-                        this_cpu_inc(mib[!in_softirq()]->mibs[field])
+                        irqsafe_cpu_inc(mib[0]->mibs[field])
+
 #define SNMP_DEC_STATS(mib, field)      \
-                        this_cpu_dec(mib[!in_softirq()]->mibs[field])
+                        irqsafe_cpu_dec(mib[0]->mibs[field])
+
 #define SNMP_ADD_STATS_BH(mib, field, addend)   \
                         __this_cpu_add(mib[0]->mibs[field], addend)
+
 #define SNMP_ADD_STATS_USER(mib, field, addend) \
-                        this_cpu_add(mib[1]->mibs[field], addend)
+                        irqsafe_cpu_add(mib[0]->mibs[field], addend)
+
 #define SNMP_ADD_STATS(mib, field, addend)      \
-                        this_cpu_add(mib[!in_softirq()]->mibs[field], addend)
+                        irqsafe_cpu_add(mib[0]->mibs[field], addend)
 /*
  * Use "__typeof__(*mib[0]) *ptr" instead of "__typeof__(mib[0]) ptr"
  * to make @ptr a non-percpu pointer.
  */
 #define SNMP_UPD_PO_STATS(mib, basefield, addend)       \
         do { \
-                __typeof__(*mib[0]) *ptr; \
-                preempt_disable(); \
-                ptr = this_cpu_ptr((mib)[!in_softirq()]); \
-                ptr->mibs[basefield##PKTS]++; \
-                ptr->mibs[basefield##OCTETS] += addend;\
-                preempt_enable(); \
+                irqsafe_cpu_inc(mib[0]->mibs[basefield##PKTS]);         \
+                irqsafe_cpu_add(mib[0]->mibs[basefield##OCTETS], addend);       \
         } while (0)
 #define SNMP_UPD_PO_STATS_BH(mib, basefield, addend)    \
         do { \
-                __typeof__(*mib[0]) *ptr = \
-                        __this_cpu_ptr((mib)[0]); \
-                ptr->mibs[basefield##PKTS]++; \
-                ptr->mibs[basefield##OCTETS] += addend;\
+                __this_cpu_inc(mib[0]->mibs[basefield##PKTS]);          \
+                __this_cpu_add(mib[0]->mibs[basefield##OCTETS], addend);        \
         } while (0)
 
 
@@ -179,40 +173,20 @@ struct linux_xfrm_mib {
                 ptr->mibs[field] += addend;                             \
                 u64_stats_update_end(&ptr->syncp);                      \
         } while (0)
+
 #define SNMP_ADD_STATS64_USER(mib, field, addend)                       \
         do {                                                            \
-                __typeof__(*mib[0]) *ptr;                               \
-                preempt_disable();                                      \
-                ptr = __this_cpu_ptr((mib)[1]);                         \
-                u64_stats_update_begin(&ptr->syncp);                    \
-                ptr->mibs[field] += addend;                             \
-                u64_stats_update_end(&ptr->syncp);                      \
-                preempt_enable();                                       \
+                local_bh_disable();                                     \
+                SNMP_ADD_STATS64_BH(mib, field, addend);                \
+                local_bh_enable();                                      \
         } while (0)
+
 #define SNMP_ADD_STATS64(mib, field, addend)                            \
-        do {                                                            \
-                __typeof__(*mib[0]) *ptr;                               \
-                preempt_disable();                                      \
-                ptr = __this_cpu_ptr((mib)[!in_softirq()]);             \
-                u64_stats_update_begin(&ptr->syncp);                    \
-                ptr->mibs[field] += addend;                             \
-                u64_stats_update_end(&ptr->syncp);                      \
-                preempt_enable();                                       \
-        } while (0)
+                SNMP_ADD_STATS64_USER(mib, field, addend)
+
 #define SNMP_INC_STATS64_BH(mib, field) SNMP_ADD_STATS64_BH(mib, field, 1)
 #define SNMP_INC_STATS64_USER(mib, field) SNMP_ADD_STATS64_USER(mib, field, 1)
 #define SNMP_INC_STATS64(mib, field) SNMP_ADD_STATS64(mib, field, 1)
-#define SNMP_UPD_PO_STATS64(mib, basefield, addend)                     \
-        do {                                                            \
-                __typeof__(*mib[0]) *ptr;                               \
-                preempt_disable();                                      \
-                ptr = __this_cpu_ptr((mib)[!in_softirq()]);             \
-                u64_stats_update_begin(&ptr->syncp);                    \
-                ptr->mibs[basefield##PKTS]++;                           \
-                ptr->mibs[basefield##OCTETS] += addend;                 \
-                u64_stats_update_end(&ptr->syncp);                      \
-                preempt_enable();                                       \
-        } while (0)
 #define SNMP_UPD_PO_STATS64_BH(mib, basefield, addend)                  \
         do {                                                            \
                 __typeof__(*mib[0]) *ptr;                               \
@@ -222,6 +196,12 @@ struct linux_xfrm_mib {
                 ptr->mibs[basefield##OCTETS] += addend;                 \
                 u64_stats_update_end(&ptr->syncp);                      \
         } while (0)
+#define SNMP_UPD_PO_STATS64(mib, basefield, addend)                     \
+        do {                                                            \
+                local_bh_disable();                                     \
+                SNMP_UPD_PO_STATS64_BH(mib, basefield, addend);         \
+                local_bh_enable();                                      \
+        } while (0)
 #else
 #define SNMP_INC_STATS64_BH(mib, field)         SNMP_INC_STATS_BH(mib, field)
 #define SNMP_INC_STATS64_USER(mib, field)       SNMP_INC_STATS_USER(mib, field)
diff --git a/include/net/sock.h b/include/net/sock.h
index c0b938cb4b1a..8e4062f165b8 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -40,6 +40,7 @@
 #ifndef _SOCK_H
 #define _SOCK_H
 
+#include <linux/hardirq.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/list_nulls.h>
@@ -562,6 +563,7 @@ enum sock_flags {
         SOCK_TIMESTAMPING_SYS_HARDWARE, /* %SOF_TIMESTAMPING_SYS_HARDWARE */
         SOCK_FASYNC, /* fasync() active */
         SOCK_RXQ_OVFL,
+        SOCK_ZEROCOPY, /* buffers from userspace */
 };
 
 static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
@@ -1301,8 +1303,7 @@ extern unsigned long sock_i_ino(struct sock *sk);
 static inline struct dst_entry *
 __sk_dst_get(struct sock *sk)
 {
-        return rcu_dereference_check(sk->sk_dst_cache, rcu_read_lock_held() ||
-                                                       sock_owned_by_user(sk) ||
+        return rcu_dereference_check(sk->sk_dst_cache, sock_owned_by_user(sk) ||
                                                        lockdep_is_held(&sk->sk_lock.slock));
 }
 
diff --git a/include/net/tcp.h b/include/net/tcp.h
index cda30ea354a2..149a415d1e0a 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -122,7 +122,13 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #endif
 #define TCP_RTO_MAX     ((unsigned)(120*HZ))
 #define TCP_RTO_MIN     ((unsigned)(HZ/5))
-#define TCP_TIMEOUT_INIT ((unsigned)(3*HZ))     /* RFC 1122 initial RTO value   */
+#define TCP_TIMEOUT_INIT ((unsigned)(1*HZ))     /* RFC2988bis initial RTO value */
+#define TCP_TIMEOUT_FALLBACK ((unsigned)(3*HZ)) /* RFC 1122 initial RTO value, now
+                                                 * used as a fallback RTO for the
+                                                 * initial data transmission if no
+                                                 * valid RTT sample has been acquired,
+                                                 * most likely due to retrans in 3WHS.
+                                                 */
 
 #define TCP_RESOURCE_PROBE_INTERVAL ((unsigned)(HZ/2U)) /* Maximal interval between probes
                                                          * for local resources.
@@ -295,7 +301,7 @@ static inline void tcp_synq_overflow(struct sock *sk)
 static inline int tcp_synq_no_recent_overflow(const struct sock *sk)
 {
         unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp;
-        return time_after(jiffies, last_overflow + TCP_TIMEOUT_INIT);
+        return time_after(jiffies, last_overflow + TCP_TIMEOUT_FALLBACK);
 }
 
 extern struct proto tcp_prot;
@@ -508,6 +514,7 @@ extern void tcp_initialize_rcv_mss(struct sock *sk);
 extern int tcp_mtu_to_mss(struct sock *sk, int pmtu);
 extern int tcp_mss_to_mtu(struct sock *sk, int mss);
 extern void tcp_mtup_init(struct sock *sk);
+extern void tcp_valid_rtt_meas(struct sock *sk, u32 seq_rtt);
 
 static inline void tcp_bound_rto(const struct sock *sk)
 {
diff --git a/include/net/wimax.h b/include/net/wimax.h
index 7328d5019d88..322ff4fbdb4a 100644
--- a/include/net/wimax.h
+++ b/include/net/wimax.h
@@ -423,7 +423,6 @@ struct wimax_dev {
         int (*op_reset)(struct wimax_dev *wimax_dev);
 
         struct rfkill *rfkill;
-        struct input_dev *rfkill_input;
         unsigned rf_hw;
         unsigned rf_sw;
         char name[32];