52 files changed, 1497 insertions, 511 deletions

diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index b3d3e27c6299..c3626c0ba9d3 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -596,4 +596,5 @@ int p9_idpool_check(int id, struct p9_idpool *p);
 int p9_error_init(void);
 int p9_errstr2errno(char *, int);
 int p9_trans_fd_init(void);
+void p9_trans_fd_exit(void);
 #endif /* NET_9P_H */
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index 0db3a4038dc0..3ca737120a90 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -26,6 +26,8 @@
 #ifndef NET_9P_TRANSPORT_H
 #define NET_9P_TRANSPORT_H
 
+#include <linux/module.h>
+
 /**
  * enum p9_trans_status - different states of underlying transports
  * @Connected: transport is connected and healthy
@@ -91,9 +93,12 @@ struct p9_trans_module {
         int maxsize;            /* max message size of transport */
         int def;                /* this transport should be default */
         struct p9_trans * (*create)(const char *, char *, int, unsigned char);
+        struct module *owner;
 };
 
 void v9fs_register_trans(struct p9_trans_module *m);
-struct p9_trans_module *v9fs_match_trans(const substring_t *name);
-struct p9_trans_module *v9fs_default_trans(void);
+void v9fs_unregister_trans(struct p9_trans_module *m);
+struct p9_trans_module *v9fs_get_trans_by_name(const substring_t *name);
+struct p9_trans_module *v9fs_get_default_trans(void);
+void v9fs_put_trans(struct p9_trans_module *m);
 #endif /* NET_9P_TRANSPORT_H */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index cbf751094688..46a43b721dd6 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -325,7 +325,8 @@ int hci_conn_del(struct hci_conn *conn);
 void hci_conn_hash_flush(struct hci_dev *hdev);
 void hci_conn_check_pending(struct hci_dev *hdev);
 
-struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *src);
+struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 auth_type);
+int hci_conn_check_link_mode(struct hci_conn *conn);
 int hci_conn_auth(struct hci_conn *conn);
 int hci_conn_encrypt(struct hci_conn *conn);
 int hci_conn_change_link_key(struct hci_conn *conn);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index e00750836ba5..0e85ec39b638 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -152,6 +152,7 @@ struct station_parameters {
         u16 aid;
         u8 supported_rates_len;
         u8 plink_action;
+        struct ieee80211_ht_cap *ht_capa;
 };
 
 /**
@@ -268,6 +269,83 @@ struct mpath_info {
         u8 flags;
 };
 
+/**
+ * struct bss_parameters - BSS parameters
+ *
+ * Used to change BSS parameters (mainly for AP mode).
+ *
+ * @use_cts_prot: Whether to use CTS protection
+ *      (0 = no, 1 = yes, -1 = do not change)
+ * @use_short_preamble: Whether the use of short preambles is allowed
+ *      (0 = no, 1 = yes, -1 = do not change)
+ * @use_short_slot_time: Whether the use of short slot time is allowed
+ *      (0 = no, 1 = yes, -1 = do not change)
+ */
+struct bss_parameters {
+        int use_cts_prot;
+        int use_short_preamble;
+        int use_short_slot_time;
+};
+
+/**
+ * enum reg_set_by - Indicates who is trying to set the regulatory domain
+ * @REGDOM_SET_BY_INIT: regulatory domain was set by initialization. We will be
+ *      using a static world regulatory domain by default.
+ * @REGDOM_SET_BY_CORE: Core queried CRDA for a dynamic world regulatory domain.
+ * @REGDOM_SET_BY_USER: User asked the wireless core to set the
+ *      regulatory domain.
+ * @REGDOM_SET_BY_DRIVER: a wireless drivers has hinted to the wireless core
+ *      it thinks its knows the regulatory domain we should be in.
+ * @REGDOM_SET_BY_COUNTRY_IE: the wireless core has received an 802.11 country
+ *      information element with regulatory information it thinks we
+ *      should consider.
+ */
+enum reg_set_by {
+        REGDOM_SET_BY_INIT,
+        REGDOM_SET_BY_CORE,
+        REGDOM_SET_BY_USER,
+        REGDOM_SET_BY_DRIVER,
+        REGDOM_SET_BY_COUNTRY_IE,
+};
+
+struct ieee80211_freq_range {
+        u32 start_freq_khz;
+        u32 end_freq_khz;
+        u32 max_bandwidth_khz;
+};
+
+struct ieee80211_power_rule {
+        u32 max_antenna_gain;
+        u32 max_eirp;
+};
+
+struct ieee80211_reg_rule {
+        struct ieee80211_freq_range freq_range;
+        struct ieee80211_power_rule power_rule;
+        u32 flags;
+};
+
+struct ieee80211_regdomain {
+        u32 n_reg_rules;
+        char alpha2[2];
+        struct ieee80211_reg_rule reg_rules[];
+};
+
+#define MHZ_TO_KHZ(freq) (freq * 1000)
+#define KHZ_TO_MHZ(freq) (freq / 1000)
+#define DBI_TO_MBI(gain) (gain * 100)
+#define MBI_TO_DBI(gain) (gain / 100)
+#define DBM_TO_MBM(gain) (gain * 100)
+#define MBM_TO_DBM(gain) (gain / 100)
+
+#define REG_RULE(start, end, bw, gain, eirp, reg_flags) { \
+        .freq_range.start_freq_khz = (start) * 1000, \
+        .freq_range.end_freq_khz = (end) * 1000, \
+        .freq_range.max_bandwidth_khz = (bw) * 1000, \
+        .power_rule.max_antenna_gain = (gain) * 100, \
+        .power_rule.max_eirp = (eirp) * 100, \
+        .flags = reg_flags, \
+        }
 
 /* from net/wireless.h */
 struct wiphy;
@@ -285,11 +363,13 @@ struct wiphy;
  * wireless extensions but this is subject to reevaluation as soon as this
  * code is used more widely and we have a first user without wext.
  *
- * @add_virtual_intf: create a new virtual interface with the given name
+ * @add_virtual_intf: create a new virtual interface with the given name,
+ *      must set the struct wireless_dev's iftype.
  *
  * @del_virtual_intf: remove the virtual interface determined by ifindex.
  *
- * @change_virtual_intf: change type of virtual interface
+ * @change_virtual_intf: change type/configuration of virtual interface,
+ *      keep the struct wireless_dev's iftype updated.
  *
  * @add_key: add a key with the given parameters. @mac_addr will be %NULL
  *      when adding a group key.
@@ -318,6 +398,8 @@ struct wiphy;
  * @change_station: Modify a given station.
  *
  * @set_mesh_cfg: set mesh parameters (by now, just mesh id)
+ *
+ * @change_bss: Modify parameters for a given BSS.
  */
 struct cfg80211_ops {
         int     (*add_virtual_intf)(struct wiphy *wiphy, char *name,
@@ -370,6 +452,9 @@ struct cfg80211_ops {
         int     (*dump_mpath)(struct wiphy *wiphy, struct net_device *dev,
                                int idx, u8 *dst, u8 *next_hop,
                                struct mpath_info *pinfo);
+
+        int     (*change_bss)(struct wiphy *wiphy, struct net_device *dev,
+                              struct bss_parameters *params);
 };
 
 #endif /* __NET_CFG80211_H */
diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
index a6bb94530cfd..9909774eb998 100644
--- a/include/net/cipso_ipv4.h
+++ b/include/net/cipso_ipv4.h
@@ -40,11 +40,12 @@
 #include <linux/net.h>
 #include <linux/skbuff.h>
 #include <net/netlabel.h>
+#include <asm/atomic.h>
 
 /* known doi values */
 #define CIPSO_V4_DOI_UNKNOWN          0x00000000
 
-/* tag types */
+/* standard tag types */
 #define CIPSO_V4_TAG_INVALID          0
 #define CIPSO_V4_TAG_RBITMAP          1
 #define CIPSO_V4_TAG_ENUM             2
@@ -52,10 +53,14 @@
 #define CIPSO_V4_TAG_PBITMAP          6
 #define CIPSO_V4_TAG_FREEFORM         7
 
+/* non-standard tag types (tags > 127) */
+#define CIPSO_V4_TAG_LOCAL            128
+
 /* doi mapping types */
 #define CIPSO_V4_MAP_UNKNOWN          0
-#define CIPSO_V4_MAP_STD              1
+#define CIPSO_V4_MAP_TRANS            1
 #define CIPSO_V4_MAP_PASS             2
+#define CIPSO_V4_MAP_LOCAL            3
 
 /* limits */
 #define CIPSO_V4_MAX_REM_LVLS         255
@@ -79,10 +84,9 @@ struct cipso_v4_doi {
         } map;
         u8 tags[CIPSO_V4_TAG_MAXCNT];
 
-        u32 valid;
+        atomic_t refcount;
         struct list_head list;
         struct rcu_head rcu;
-        struct list_head dom_list;
 };
 
 /* Standard CIPSO mapping table */
@@ -128,25 +132,26 @@ extern int cipso_v4_rbm_strictvalid;
 
 #ifdef CONFIG_NETLABEL
 int cipso_v4_doi_add(struct cipso_v4_doi *doi_def);
-int cipso_v4_doi_remove(u32 doi,
-                        struct netlbl_audit *audit_info,
-                        void (*callback) (struct rcu_head * head));
+void cipso_v4_doi_free(struct cipso_v4_doi *doi_def);
+int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info);
 struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi);
+void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def);
 int cipso_v4_doi_walk(u32 *skip_cnt,
                      int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
                      void *cb_arg);
-int cipso_v4_doi_domhsh_add(struct cipso_v4_doi *doi_def, const char *domain);
-int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
-                               const char *domain);
 #else
 static inline int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
 {
         return -ENOSYS;
 }
 
+static inline void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
+{
+        return;
+}
+
 static inline int cipso_v4_doi_remove(u32 doi,
-                                    struct netlbl_audit *audit_info,
-                                    void (*callback) (struct rcu_head * head))
+                                      struct netlbl_audit *audit_info)
 {
         return 0;
 }
@@ -206,10 +211,15 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);
 int cipso_v4_sock_setattr(struct sock *sk,
                           const struct cipso_v4_doi *doi_def,
                           const struct netlbl_lsm_secattr *secattr);
+void cipso_v4_sock_delattr(struct sock *sk);
 int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
+int cipso_v4_skbuff_setattr(struct sk_buff *skb,
+                            const struct cipso_v4_doi *doi_def,
+                            const struct netlbl_lsm_secattr *secattr);
+int cipso_v4_skbuff_delattr(struct sk_buff *skb);
 int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
                             struct netlbl_lsm_secattr *secattr);
-int cipso_v4_validate(unsigned char **option);
+int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option);
 #else
 static inline void cipso_v4_error(struct sk_buff *skb,
                                   int error,
@@ -225,19 +235,36 @@ static inline int cipso_v4_sock_setattr(struct sock *sk,
         return -ENOSYS;
 }
 
+static inline void cipso_v4_sock_delattr(struct sock *sk)
+{
+}
+
 static inline int cipso_v4_sock_getattr(struct sock *sk,
                                         struct netlbl_lsm_secattr *secattr)
 {
         return -ENOSYS;
 }
 
+static inline int cipso_v4_skbuff_setattr(struct sk_buff *skb,
+                                      const struct cipso_v4_doi *doi_def,
+                                      const struct netlbl_lsm_secattr *secattr)
+{
+        return -ENOSYS;
+}
+
+static inline int cipso_v4_skbuff_delattr(struct sk_buff *skb)
+{
+        return -ENOSYS;
+}
+
 static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
                                           struct netlbl_lsm_secattr *secattr)
 {
         return -ENOSYS;
 }
 
-static inline int cipso_v4_validate(unsigned char **option)
+static inline int cipso_v4_validate(const struct sk_buff *skb,
+                                    unsigned char **option)
 {
         return -ENOSYS;
 }
diff --git a/include/net/dsa.h b/include/net/dsa.h
new file mode 100644
index 000000000000..52e97bfca5a1
--- /dev/null
+++ b/include/net/dsa.h
@@ -0,0 +1,37 @@
+/*
+ * include/net/dsa.h - Driver for Distributed Switch Architecture switch chips
+ * Copyright (c) 2008 Marvell Semiconductor
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __LINUX_NET_DSA_H
+#define __LINUX_NET_DSA_H
+
+#define DSA_MAX_PORTS   12
+
+struct dsa_platform_data {
+        /*
+         * Reference to a Linux network interface that connects
+         * to the switch chip.
+         */
+        struct device   *netdev;
+
+        /*
+         * How to access the switch configuration registers, and
+         * the names of the switch ports (use "cpu" to designate
+         * the switch port that the cpu is connected to).
+         */
+        struct device   *mii_bus;
+        int             sw_addr;
+        char            *port_names[DSA_MAX_PORTS];
+};
+
+extern bool dsa_uses_dsa_tags(void *dsa_ptr);
+extern bool dsa_uses_trailer_tags(void *dsa_ptr);
+
+
+#endif
diff --git a/include/net/flow.h b/include/net/flow.h
index 228b2477ceec..b45a5e4fcadd 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -47,6 +47,8 @@ struct flowi {
 #define fl4_scope       nl_u.ip4_u.scope
 
         __u8    proto;
+        __u8    flags;
+#define FLOWI_FLAG_ANYSRC 0x01
         union {
                 struct {
                         __be16  sport;
diff --git a/include/net/ieee80211.h b/include/net/ieee80211.h
index b31399e1fd83..6048579d0b24 100644
--- a/include/net/ieee80211.h
+++ b/include/net/ieee80211.h
@@ -190,10 +190,6 @@ const char *escape_essid(const char *essid, u8 essid_len);
 #endif
 #include <net/iw_handler.h>     /* new driver API */
 
-#ifndef ETH_P_PAE
-#define ETH_P_PAE 0x888E        /* Port Access Entity (IEEE 802.1X) */
-#endif                          /* ETH_P_PAE */
-
 #define ETH_P_PREAUTH 0x88C7    /* IEEE 802.11i pre-authentication */
 
 #ifndef ETH_P_80211_RAW
diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h
index e48989f04c24..f74665d7bea8 100644
--- a/include/net/inet6_hashtables.h
+++ b/include/net/inet6_hashtables.h
@@ -91,6 +91,21 @@ static inline struct sock *__inet6_lookup(struct net *net,
         return inet6_lookup_listener(net, hashinfo, daddr, hnum, dif);
 }
 
+static inline struct sock *__inet6_lookup_skb(struct inet_hashinfo *hashinfo,
+                                              struct sk_buff *skb,
+                                              const __be16 sport,
+                                              const __be16 dport)
+{
+        struct sock *sk;
+
+        if (unlikely(sk = skb_steal_sock(skb)))
+                return sk;
+        else return __inet6_lookup(dev_net(skb->dst->dev), hashinfo,
+                                   &ipv6_hdr(skb)->saddr, sport,
+                                   &ipv6_hdr(skb)->daddr, ntohs(dport),
+                                   inet6_iif(skb));
+}
+
 extern struct sock *inet6_lookup(struct net *net, struct inet_hashinfo *hashinfo,
                                  const struct in6_addr *saddr, const __be16 sport,
                                  const struct in6_addr *daddr, const __be16 dport,
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 2ff545a56fb5..03cffd9f64e3 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -51,12 +51,14 @@ struct inet_connection_sock_af_ops {
                                   char __user *optval, int optlen);
         int         (*getsockopt)(struct sock *sk, int level, int optname, 
                                   char __user *optval, int __user *optlen);
+#ifdef CONFIG_COMPAT
         int         (*compat_setsockopt)(struct sock *sk,
                                 int level, int optname,
                                 char __user *optval, int optlen);
         int         (*compat_getsockopt)(struct sock *sk,
                                 int level, int optname,
                                 char __user *optval, int __user *optlen);
+#endif
         void        (*addr2sockaddr)(struct sock *sk, struct sockaddr *);
         int         (*bind_conflict)(const struct sock *sk,
                                      const struct inet_bind_bucket *tb);
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index bb619d80f2e2..5cc182f9ecae 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -16,6 +16,7 @@
 
 
 #include <linux/interrupt.h>
+#include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/list.h>
 #include <linux/slab.h>
@@ -28,6 +29,7 @@
 #include <net/inet_connection_sock.h>
 #include <net/inet_sock.h>
 #include <net/sock.h>
+#include <net/route.h>
 #include <net/tcp_states.h>
 #include <net/netns/hash.h>
 
@@ -371,6 +373,22 @@ static inline struct sock *inet_lookup(struct net *net,
         return sk;
 }
 
+static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo,
+                                             struct sk_buff *skb,
+                                             const __be16 sport,
+                                             const __be16 dport)
+{
+        struct sock *sk;
+        const struct iphdr *iph = ip_hdr(skb);
+
+        if (unlikely(sk = skb_steal_sock(skb)))
+                return sk;
+        else
+                return __inet_lookup(dev_net(skb->dst->dev), hashinfo,
+                                     iph->saddr, sport,
+                                     iph->daddr, dport, inet_iif(skb));
+}
+
 extern int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 struct sock *sk, u32 port_offset,
                 int (*check_established)(struct inet_timewait_death_row *,
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 643e26be058e..de0ecc71cf03 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -24,7 +24,6 @@
 #include <net/flow.h>
 #include <net/sock.h>
 #include <net/request_sock.h>
-#include <net/route.h>
 #include <net/netns/hash.h>
 
 /** struct ip_options - IP Options
@@ -62,8 +61,8 @@ struct inet_request_sock {
         struct request_sock     req;
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         u16                     inet6_rsk_offset;
-        /* 2 bytes hole, try to pack */
 #endif
+        __be16                  loc_port;
         __be32                  loc_addr;
         __be32                  rmt_addr;
         __be16                  rmt_port;
@@ -73,7 +72,8 @@ struct inet_request_sock {
                                 sack_ok    : 1,
                                 wscale_ok  : 1,
                                 ecn_ok     : 1,
-                                acked      : 1;
+                                acked      : 1,
+                                no_srccheck: 1;
         struct ip_options       *opt;
 };
 
@@ -129,7 +129,8 @@ struct inet_sock {
                                 is_icsk:1,
                                 freebind:1,
                                 hdrincl:1,
-                                mc_loop:1;
+                                mc_loop:1,
+                                transparent:1;
         int                     mc_index;
         __be32                  mc_addr;
         struct ip_mc_socklist   *mc_list;
@@ -194,12 +195,6 @@ static inline int inet_sk_ehashfn(const struct sock *sk)
         return inet_ehashfn(net, laddr, lport, faddr, fport);
 }
 
-
-static inline int inet_iif(const struct sk_buff *skb)
-{
-        return skb->rtable->rt_iif;
-}
-
 static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops)
 {
         struct request_sock *req = reqsk_alloc(ops);
@@ -210,4 +205,9 @@ static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops
         return req;
 }
 
+static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
+{
+        return inet_sk(sk)->transparent ? FLOWI_FLAG_ANYSRC : 0;
+}
+
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 91324908fccd..80e4977631b8 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -128,7 +128,8 @@ struct inet_timewait_sock {
         __be16                  tw_dport;
         __u16                   tw_num;
         /* And these are ours. */
-        __u8                    tw_ipv6only:1;
+        __u8                    tw_ipv6only:1,
+                                tw_transparent:1;
         /* 15 bits hole, try to pack */
         __u16                   tw_ipv6_offset;
         unsigned long           tw_ttd;
diff --git a/include/net/ip.h b/include/net/ip.h
index 250e6ef025a4..1cbccaf0de3f 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -29,6 +29,7 @@
 
 #include <net/inet_sock.h>
 #include <net/snmp.h>
+#include <net/flow.h>
 
 struct sock;
 
@@ -140,12 +141,20 @@ static inline void ip_tr_mc_map(__be32 addr, char *buf)
 
 struct ip_reply_arg {
         struct kvec iov[1];   
+        int         flags;
         __wsum      csum;
         int         csumoffset; /* u16 offset of csum in iov[0].iov_base */
                                 /* -1 if not needed */ 
         int         bound_dev_if;
 }; 
 
+#define IP_REPLY_ARG_NOSRCCHECK 1
+
+static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
+{
+        return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
+}
+
 void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *arg,
                    unsigned int len); 
 
@@ -169,6 +178,10 @@ extern unsigned long snmp_fold_field(void *mib[], int offt);
 extern int snmp_mib_init(void *ptr[2], size_t mibsize);
 extern void snmp_mib_free(void *ptr[2]);
 
+extern struct local_ports {
+        seqlock_t       lock;
+        int             range[2];
+} sysctl_local_ports;
 extern void inet_get_local_port_range(int *low, int *high);
 
 extern int sysctl_ip_default_ttl;
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 7312c3dd309f..0b2071d9326d 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -21,11 +21,104 @@
 #include <linux/timer.h>
 
 #include <net/checksum.h>
+#include <linux/netfilter.h>            /* for union nf_inet_addr */
+#include <linux/ip.h>
+#include <linux/ipv6.h>                 /* for struct ipv6hdr */
+#include <net/ipv6.h>                   /* for ipv6_addr_copy */
+
+struct ip_vs_iphdr {
+        int len;
+        __u8 protocol;
+        union nf_inet_addr saddr;
+        union nf_inet_addr daddr;
+};
+
+static inline void
+ip_vs_fill_iphdr(int af, const void *nh, struct ip_vs_iphdr *iphdr)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6) {
+                const struct ipv6hdr *iph = nh;
+                iphdr->len = sizeof(struct ipv6hdr);
+                iphdr->protocol = iph->nexthdr;
+                ipv6_addr_copy(&iphdr->saddr.in6, &iph->saddr);
+                ipv6_addr_copy(&iphdr->daddr.in6, &iph->daddr);
+        } else
+#endif
+        {
+                const struct iphdr *iph = nh;
+                iphdr->len = iph->ihl * 4;
+                iphdr->protocol = iph->protocol;
+                iphdr->saddr.ip = iph->saddr;
+                iphdr->daddr.ip = iph->daddr;
+        }
+}
+
+static inline void ip_vs_addr_copy(int af, union nf_inet_addr *dst,
+                                   const union nf_inet_addr *src)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                ipv6_addr_copy(&dst->in6, &src->in6);
+        else
+#endif
+        dst->ip = src->ip;
+}
+
+static inline int ip_vs_addr_equal(int af, const union nf_inet_addr *a,
+                                   const union nf_inet_addr *b)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                return ipv6_addr_equal(&a->in6, &b->in6);
+#endif
+        return a->ip == b->ip;
+}
 
 #ifdef CONFIG_IP_VS_DEBUG
 #include <linux/net.h>
 
 extern int ip_vs_get_debug_level(void);
+
+static inline const char *ip_vs_dbg_addr(int af, char *buf, size_t buf_len,
+                                         const union nf_inet_addr *addr,
+                                         int *idx)
+{
+        int len;
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                len = snprintf(&buf[*idx], buf_len - *idx, "[" NIP6_FMT "]",
+                               NIP6(addr->in6)) + 1;
+        else
+#endif
+                len = snprintf(&buf[*idx], buf_len - *idx, NIPQUAD_FMT,
+                               NIPQUAD(addr->ip)) + 1;
+
+        *idx += len;
+        BUG_ON(*idx > buf_len + 1);
+        return &buf[*idx - len];
+}
+
+#define IP_VS_DBG_BUF(level, msg...)                    \
+    do {                                                \
+            char ip_vs_dbg_buf[160];                    \
+            int ip_vs_dbg_idx = 0;                      \
+            if (level <= ip_vs_get_debug_level())       \
+                    printk(KERN_DEBUG "IPVS: " msg);    \
+    } while (0)
+#define IP_VS_ERR_BUF(msg...)                           \
+    do {                                                \
+            char ip_vs_dbg_buf[160];                    \
+            int ip_vs_dbg_idx = 0;                      \
+            printk(KERN_ERR "IPVS: " msg);              \
+    } while (0)
+
+/* Only use from within IP_VS_DBG_BUF() or IP_VS_ERR_BUF macros */
+#define IP_VS_DBG_ADDR(af, addr)                        \
+    ip_vs_dbg_addr(af, ip_vs_dbg_buf,                   \
+                   sizeof(ip_vs_dbg_buf), addr,         \
+                   &ip_vs_dbg_idx)
+
 #define IP_VS_DBG(level, msg...)                        \
     do {                                                \
             if (level <= ip_vs_get_debug_level())       \
@@ -48,6 +141,8 @@ extern int ip_vs_get_debug_level(void);
                 pp->debug_packet(pp, skb, ofs, msg);    \
     } while (0)
 #else   /* NO DEBUGGING at ALL */
+#define IP_VS_DBG_BUF(level, msg...)  do {} while (0)
+#define IP_VS_ERR_BUF(msg...)  do {} while (0)
 #define IP_VS_DBG(level, msg...)  do {} while (0)
 #define IP_VS_DBG_RL(msg...)  do {} while (0)
 #define IP_VS_DBG_PKT(level, pp, skb, ofs, msg)         do {} while (0)
@@ -160,27 +255,10 @@ struct ip_vs_estimator {
 
 struct ip_vs_stats
 {
-        __u32                   conns;          /* connections scheduled */
-        __u32                   inpkts;         /* incoming packets */
-        __u32                   outpkts;        /* outgoing packets */
-        __u64                   inbytes;        /* incoming bytes */
-        __u64                   outbytes;       /* outgoing bytes */
-
-        __u32                   cps;            /* current connection rate */
-        __u32                   inpps;          /* current in packet rate */
-        __u32                   outpps;         /* current out packet rate */
-        __u32                   inbps;          /* current in byte rate */
-        __u32                   outbps;         /* current out byte rate */
-
-        /*
-         * Don't add anything before the lock, because we use memcpy() to copy
-         * the members before the lock to struct ip_vs_stats_user in
-         * ip_vs_ctl.c.
-         */
+        struct ip_vs_stats_user ustats;         /* statistics */
+        struct ip_vs_estimator  est;            /* estimator */
 
         spinlock_t              lock;           /* spin lock */
-
-        struct ip_vs_estimator  est;            /* estimator */
 };
 
 struct dst_entry;
@@ -202,21 +280,23 @@ struct ip_vs_protocol {
 
         void (*exit)(struct ip_vs_protocol *pp);
 
-        int (*conn_schedule)(struct sk_buff *skb,
+        int (*conn_schedule)(int af, struct sk_buff *skb,
                              struct ip_vs_protocol *pp,
                              int *verdict, struct ip_vs_conn **cpp);
 
         struct ip_vs_conn *
-        (*conn_in_get)(const struct sk_buff *skb,
+        (*conn_in_get)(int af,
+                       const struct sk_buff *skb,
                        struct ip_vs_protocol *pp,
-                       const struct iphdr *iph,
+                       const struct ip_vs_iphdr *iph,
                        unsigned int proto_off,
                        int inverse);
 
         struct ip_vs_conn *
-        (*conn_out_get)(const struct sk_buff *skb,
+        (*conn_out_get)(int af,
+                        const struct sk_buff *skb,
                         struct ip_vs_protocol *pp,
-                        const struct iphdr *iph,
+                        const struct ip_vs_iphdr *iph,
                         unsigned int proto_off,
                         int inverse);
 
@@ -226,7 +306,8 @@ struct ip_vs_protocol {
         int (*dnat_handler)(struct sk_buff *skb,
                             struct ip_vs_protocol *pp, struct ip_vs_conn *cp);
 
-        int (*csum_check)(struct sk_buff *skb, struct ip_vs_protocol *pp);
+        int (*csum_check)(int af, struct sk_buff *skb,
+                          struct ip_vs_protocol *pp);
 
         const char *(*state_name)(int state);
 
@@ -259,9 +340,10 @@ struct ip_vs_conn {
         struct list_head        c_list;         /* hashed list heads */
 
         /* Protocol, addresses and port numbers */
-        __be32                   caddr;          /* client address */
-        __be32                   vaddr;          /* virtual address */
-        __be32                   daddr;          /* destination address */
+        u16                      af;            /* address family */
+        union nf_inet_addr       caddr;          /* client address */
+        union nf_inet_addr       vaddr;          /* virtual address */
+        union nf_inet_addr       daddr;          /* destination address */
         __be16                   cport;
         __be16                   vport;
         __be16                   dport;
@@ -305,6 +387,45 @@ struct ip_vs_conn {
 
 
 /*
+ *      Extended internal versions of struct ip_vs_service_user and
+ *      ip_vs_dest_user for IPv6 support.
+ *
+ *      We need these to conveniently pass around service and destination
+ *      options, but unfortunately, we also need to keep the old definitions to
+ *      maintain userspace backwards compatibility for the setsockopt interface.
+ */
+struct ip_vs_service_user_kern {
+        /* virtual service addresses */
+        u16                     af;
+        u16                     protocol;
+        union nf_inet_addr      addr;           /* virtual ip address */
+        u16                     port;
+        u32                     fwmark;         /* firwall mark of service */
+
+        /* virtual service options */
+        char                    *sched_name;
+        unsigned                flags;          /* virtual service flags */
+        unsigned                timeout;        /* persistent timeout in sec */
+        u32                     netmask;        /* persistent netmask */
+};
+
+
+struct ip_vs_dest_user_kern {
+        /* destination server address */
+        union nf_inet_addr      addr;
+        u16                     port;
+
+        /* real server options */
+        unsigned                conn_flags;     /* connection flags */
+        int                     weight;         /* destination weight */
+
+        /* thresholds for active connections */
+        u32                     u_threshold;    /* upper threshold */
+        u32                     l_threshold;    /* lower threshold */
+};
+
+
+/*
  *      The information about the virtual service offered to the net
  *      and the forwarding entries
  */
@@ -314,8 +435,9 @@ struct ip_vs_service {
         atomic_t                refcnt;   /* reference counter */
         atomic_t                usecnt;   /* use counter */
 
+        u16                     af;       /* address family */
         __u16                   protocol; /* which protocol (TCP/UDP) */
-        __be32                  addr;     /* IP address for virtual service */
+        union nf_inet_addr      addr;     /* IP address for virtual service */
         __be16                  port;     /* port number for the service */
         __u32                   fwmark;   /* firewall mark of the service */
         unsigned                flags;    /* service status flags */
@@ -342,7 +464,8 @@ struct ip_vs_dest {
         struct list_head        n_list;   /* for the dests in the service */
         struct list_head        d_list;   /* for table with all the dests */
 
-        __be32                  addr;           /* IP address of the server */
+        u16                     af;             /* address family */
+        union nf_inet_addr      addr;           /* IP address of the server */
         __be16                  port;           /* port number of the server */
         volatile unsigned       flags;          /* dest status flags */
         atomic_t                conn_flags;     /* flags to copy to conn */
@@ -366,7 +489,7 @@ struct ip_vs_dest {
         /* for virtual service */
         struct ip_vs_service    *svc;           /* service it belongs to */
         __u16                   protocol;       /* which protocol (TCP/UDP) */
-        __be32                  vaddr;          /* virtual IP address */
+        union nf_inet_addr      vaddr;          /* virtual IP address */
         __be16                  vport;          /* virtual port number */
         __u32                   vfwmark;        /* firewall mark of service */
 };
@@ -380,6 +503,9 @@ struct ip_vs_scheduler {
         char                    *name;          /* scheduler name */
         atomic_t                refcnt;         /* reference counter */
         struct module           *module;        /* THIS_MODULE/NULL */
+#ifdef CONFIG_IP_VS_IPV6
+        int                     supports_ipv6;  /* scheduler has IPv6 support */
+#endif
 
         /* scheduler initializing service */
         int (*init_service)(struct ip_vs_service *svc);
@@ -479,16 +605,8 @@ extern void ip_vs_init_hash_table(struct list_head *table, int rows);
 #ifndef CONFIG_IP_VS_TAB_BITS
 #define CONFIG_IP_VS_TAB_BITS   12
 #endif
-/* make sure that IP_VS_CONN_TAB_BITS is located in [8, 20] */
-#if CONFIG_IP_VS_TAB_BITS < 8
-#define IP_VS_CONN_TAB_BITS     8
-#endif
-#if CONFIG_IP_VS_TAB_BITS > 20
-#define IP_VS_CONN_TAB_BITS     20
-#endif
-#if 8 <= CONFIG_IP_VS_TAB_BITS && CONFIG_IP_VS_TAB_BITS <= 20
+
 #define IP_VS_CONN_TAB_BITS     CONFIG_IP_VS_TAB_BITS
-#endif
 #define IP_VS_CONN_TAB_SIZE     (1 << IP_VS_CONN_TAB_BITS)
 #define IP_VS_CONN_TAB_MASK     (IP_VS_CONN_TAB_SIZE - 1)
 
@@ -500,11 +618,16 @@ enum {
 };
 
 extern struct ip_vs_conn *ip_vs_conn_in_get
-(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port);
+(int af, int protocol, const union nf_inet_addr *s_addr, __be16 s_port,
+ const union nf_inet_addr *d_addr, __be16 d_port);
+
 extern struct ip_vs_conn *ip_vs_ct_in_get
-(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port);
+(int af, int protocol, const union nf_inet_addr *s_addr, __be16 s_port,
+ const union nf_inet_addr *d_addr, __be16 d_port);
+
 extern struct ip_vs_conn *ip_vs_conn_out_get
-(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port);
+(int af, int protocol, const union nf_inet_addr *s_addr, __be16 s_port,
+ const union nf_inet_addr *d_addr, __be16 d_port);
 
 /* put back the conn without restarting its timer */
 static inline void __ip_vs_conn_put(struct ip_vs_conn *cp)
@@ -515,8 +638,9 @@ extern void ip_vs_conn_put(struct ip_vs_conn *cp);
 extern void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport);
 
 extern struct ip_vs_conn *
-ip_vs_conn_new(int proto, __be32 caddr, __be16 cport, __be32 vaddr, __be16 vport,
-               __be32 daddr, __be16 dport, unsigned flags,
+ip_vs_conn_new(int af, int proto, const union nf_inet_addr *caddr, __be16 cport,
+               const union nf_inet_addr *vaddr, __be16 vport,
+               const union nf_inet_addr *daddr, __be16 dport, unsigned flags,
                struct ip_vs_dest *dest);
 extern void ip_vs_conn_expire_now(struct ip_vs_conn *cp);
 
@@ -532,24 +656,32 @@ static inline void ip_vs_control_del(struct ip_vs_conn *cp)
 {
         struct ip_vs_conn *ctl_cp = cp->control;
         if (!ctl_cp) {
-                IP_VS_ERR("request control DEL for uncontrolled: "
-                          "%d.%d.%d.%d:%d to %d.%d.%d.%d:%d\n",
-                          NIPQUAD(cp->caddr),ntohs(cp->cport),
-                          NIPQUAD(cp->vaddr),ntohs(cp->vport));
+                IP_VS_ERR_BUF("request control DEL for uncontrolled: "
+                              "%s:%d to %s:%d\n",
+                              IP_VS_DBG_ADDR(cp->af, &cp->caddr),
+                              ntohs(cp->cport),
+                              IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
+                              ntohs(cp->vport));
+
                 return;
         }
 
-        IP_VS_DBG(7, "DELeting control for: "
-                  "cp.dst=%d.%d.%d.%d:%d ctl_cp.dst=%d.%d.%d.%d:%d\n",
-                  NIPQUAD(cp->caddr),ntohs(cp->cport),
-                  NIPQUAD(ctl_cp->caddr),ntohs(ctl_cp->cport));
+        IP_VS_DBG_BUF(7, "DELeting control for: "
+                      "cp.dst=%s:%d ctl_cp.dst=%s:%d\n",
+                      IP_VS_DBG_ADDR(cp->af, &cp->caddr),
+                      ntohs(cp->cport),
+                      IP_VS_DBG_ADDR(cp->af, &ctl_cp->caddr),
+                      ntohs(ctl_cp->cport));
 
         cp->control = NULL;
         if (atomic_read(&ctl_cp->n_control) == 0) {
-                IP_VS_ERR("BUG control DEL with n=0 : "
-                          "%d.%d.%d.%d:%d to %d.%d.%d.%d:%d\n",
-                          NIPQUAD(cp->caddr),ntohs(cp->cport),
-                          NIPQUAD(cp->vaddr),ntohs(cp->vport));
+                IP_VS_ERR_BUF("BUG control DEL with n=0 : "
+                              "%s:%d to %s:%d\n",
+                              IP_VS_DBG_ADDR(cp->af, &cp->caddr),
+                              ntohs(cp->cport),
+                              IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
+                              ntohs(cp->vport));
+
                 return;
         }
         atomic_dec(&ctl_cp->n_control);
@@ -559,17 +691,22 @@ static inline void
 ip_vs_control_add(struct ip_vs_conn *cp, struct ip_vs_conn *ctl_cp)
 {
         if (cp->control) {
-                IP_VS_ERR("request control ADD for already controlled: "
-                          "%d.%d.%d.%d:%d to %d.%d.%d.%d:%d\n",
-                          NIPQUAD(cp->caddr),ntohs(cp->cport),
-                          NIPQUAD(cp->vaddr),ntohs(cp->vport));
+                IP_VS_ERR_BUF("request control ADD for already controlled: "
+                              "%s:%d to %s:%d\n",
+                              IP_VS_DBG_ADDR(cp->af, &cp->caddr),
+                              ntohs(cp->cport),
+                              IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
+                              ntohs(cp->vport));
+
                 ip_vs_control_del(cp);
         }
 
-        IP_VS_DBG(7, "ADDing control for: "
-                  "cp.dst=%d.%d.%d.%d:%d ctl_cp.dst=%d.%d.%d.%d:%d\n",
-                  NIPQUAD(cp->caddr),ntohs(cp->cport),
-                  NIPQUAD(ctl_cp->caddr),ntohs(ctl_cp->cport));
+        IP_VS_DBG_BUF(7, "ADDing control for: "
+                      "cp.dst=%s:%d ctl_cp.dst=%s:%d\n",
+                      IP_VS_DBG_ADDR(cp->af, &cp->caddr),
+                      ntohs(cp->cport),
+                      IP_VS_DBG_ADDR(cp->af, &ctl_cp->caddr),
+                      ntohs(ctl_cp->cport));
 
         cp->control = ctl_cp;
         atomic_inc(&ctl_cp->n_control);
@@ -647,7 +784,8 @@ extern struct ip_vs_stats ip_vs_stats;
 extern const struct ctl_path net_vs_ctl_path[];
 
 extern struct ip_vs_service *
-ip_vs_service_get(__u32 fwmark, __u16 protocol, __be32 vaddr, __be16 vport);
+ip_vs_service_get(int af, __u32 fwmark, __u16 protocol,
+                  const union nf_inet_addr *vaddr, __be16 vport);
 
 static inline void ip_vs_service_put(struct ip_vs_service *svc)
 {
@@ -655,14 +793,16 @@ static inline void ip_vs_service_put(struct ip_vs_service *svc)
 }
 
 extern struct ip_vs_dest *
-ip_vs_lookup_real_service(__u16 protocol, __be32 daddr, __be16 dport);
+ip_vs_lookup_real_service(int af, __u16 protocol,
+                          const union nf_inet_addr *daddr, __be16 dport);
+
 extern int ip_vs_use_count_inc(void);
 extern void ip_vs_use_count_dec(void);
 extern int ip_vs_control_init(void);
 extern void ip_vs_control_cleanup(void);
 extern struct ip_vs_dest *
-ip_vs_find_dest(__be32 daddr, __be16 dport,
-                 __be32 vaddr, __be16 vport, __u16 protocol);
+ip_vs_find_dest(int af, const union nf_inet_addr *daddr, __be16 dport,
+                const union nf_inet_addr *vaddr, __be16 vport, __u16 protocol);
 extern struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp);
 
 
@@ -683,6 +823,8 @@ extern void ip_vs_sync_conn(struct ip_vs_conn *cp);
 /*
  *      IPVS rate estimator prototypes (from ip_vs_est.c)
  */
+extern int ip_vs_estimator_init(void);
+extern void ip_vs_estimator_cleanup(void);
 extern void ip_vs_new_estimator(struct ip_vs_stats *stats);
 extern void ip_vs_kill_estimator(struct ip_vs_stats *stats);
 extern void ip_vs_zero_estimator(struct ip_vs_stats *stats);
@@ -704,6 +846,19 @@ extern int ip_vs_icmp_xmit
 (struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp, int offset);
 extern void ip_vs_dst_reset(struct ip_vs_dest *dest);
 
+#ifdef CONFIG_IP_VS_IPV6
+extern int ip_vs_bypass_xmit_v6
+(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+extern int ip_vs_nat_xmit_v6
+(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+extern int ip_vs_tunnel_xmit_v6
+(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+extern int ip_vs_dr_xmit_v6
+(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
+extern int ip_vs_icmp_xmit_v6
+(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,
+ int offset);
+#endif
 
 /*
  *      This is a simple mechanism to ignore packets when
@@ -748,7 +903,12 @@ static inline char ip_vs_fwd_tag(struct ip_vs_conn *cp)
 }
 
 extern void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
-                struct ip_vs_conn *cp, int dir);
+                           struct ip_vs_conn *cp, int dir);
+
+#ifdef CONFIG_IP_VS_IPV6
+extern void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp,
+                              struct ip_vs_conn *cp, int dir);
+#endif
 
 extern __sum16 ip_vs_checksum_complete(struct sk_buff *skb, int offset);
 
@@ -759,6 +919,17 @@ static inline __wsum ip_vs_check_diff4(__be32 old, __be32 new, __wsum oldsum)
         return csum_partial((char *) diff, sizeof(diff), oldsum);
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+static inline __wsum ip_vs_check_diff16(const __be32 *old, const __be32 *new,
+                                        __wsum oldsum)
+{
+        __be32 diff[8] = { ~old[3], ~old[2], ~old[1], ~old[0],
+                            new[3],  new[2],  new[1],  new[0] };
+
+        return csum_partial((char *) diff, sizeof(diff), oldsum);
+}
+#endif
+
 static inline __wsum ip_vs_check_diff2(__be16 old, __be16 new, __wsum oldsum)
 {
         __be16 diff[2] = { ~old, new };
diff --git a/include/net/ipip.h b/include/net/ipip.h
index a85bda64b852..fdf9bd743705 100644
--- a/include/net/ipip.h
+++ b/include/net/ipip.h
@@ -37,7 +37,7 @@ struct ip_tunnel_prl_entry
 
 #define IPTUNNEL_XMIT() do {                                            \
         int err;                                                        \
-        int pkt_len = skb->len;                                         \
+        int pkt_len = skb->len - skb_transport_offset(skb);             \
                                                                         \
         skb->ip_summed = CHECKSUM_NONE;                                 \
         ip_select_ident(iph, &rt->u.dst, NULL);                         \
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 113028fb8f66..6d5b58a1c743 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -110,43 +110,42 @@ struct frag_hdr {
 extern int sysctl_mld_max_msf;
 extern struct ctl_path net_ipv6_ctl_path[];
 
-#define _DEVINC(statname, modifier, idev, field)                        \
+#define _DEVINC(net, statname, modifier, idev, field)                   \
 ({                                                                      \
         struct inet6_dev *_idev = (idev);                               \
         if (likely(_idev != NULL))                                      \
                 SNMP_INC_STATS##modifier((_idev)->stats.statname, (field)); \
-        SNMP_INC_STATS##modifier(statname##_statistics, (field));       \
+        SNMP_INC_STATS##modifier((net)->mib.statname##_statistics, (field));\
 })
 
-#define _DEVADD(statname, modifier, idev, field, val)                   \
+#define _DEVADD(net, statname, modifier, idev, field, val)              \
 ({                                                                      \
         struct inet6_dev *_idev = (idev);                               \
         if (likely(_idev != NULL))                                      \
                 SNMP_ADD_STATS##modifier((_idev)->stats.statname, (field), (val)); \
-        SNMP_ADD_STATS##modifier(statname##_statistics, (field), (val));\
+        SNMP_ADD_STATS##modifier((net)->mib.statname##_statistics, (field), (val));\
 })
 
 /* MIBs */
-DECLARE_SNMP_STAT(struct ipstats_mib, ipv6_statistics);
 
-#define IP6_INC_STATS(idev,field)       _DEVINC(ipv6, , idev, field)
-#define IP6_INC_STATS_BH(idev,field)    _DEVINC(ipv6, _BH, idev, field)
-#define IP6_ADD_STATS_BH(idev,field,val) _DEVADD(ipv6, _BH, idev, field, val)
-
-DECLARE_SNMP_STAT(struct icmpv6_mib, icmpv6_statistics);
-DECLARE_SNMP_STAT(struct icmpv6msg_mib, icmpv6msg_statistics);
-
-#define ICMP6_INC_STATS(idev, field)    _DEVINC(icmpv6, , idev, field)
-#define ICMP6_INC_STATS_BH(idev, field) _DEVINC(icmpv6, _BH, idev, field)
-
-#define ICMP6MSGOUT_INC_STATS(idev, field) \
-        _DEVINC(icmpv6msg, , idev, field +256)
-#define ICMP6MSGOUT_INC_STATS_BH(idev, field) \
-        _DEVINC(icmpv6msg, _BH, idev, field +256)
-#define ICMP6MSGIN_INC_STATS(idev, field) \
-         _DEVINC(icmpv6msg, , idev, field)
-#define ICMP6MSGIN_INC_STATS_BH(idev, field) \
-        _DEVINC(icmpv6msg, _BH, idev, field)
+#define IP6_INC_STATS(net, idev,field)          \
+                _DEVINC(net, ipv6, , idev, field)
+#define IP6_INC_STATS_BH(net, idev,field)       \
+                _DEVINC(net, ipv6, _BH, idev, field)
+#define IP6_ADD_STATS_BH(net, idev,field,val)   \
+                _DEVADD(net, ipv6, _BH, idev, field, val)
+
+#define ICMP6_INC_STATS(net, idev, field)       \
+                _DEVINC(net, icmpv6, , idev, field)
+#define ICMP6_INC_STATS_BH(net, idev, field)    \
+                _DEVINC(net, icmpv6, _BH, idev, field)
+
+#define ICMP6MSGOUT_INC_STATS(net, idev, field)         \
+        _DEVINC(net, icmpv6msg, , idev, field +256)
+#define ICMP6MSGOUT_INC_STATS_BH(net, idev, field)      \
+        _DEVINC(net, icmpv6msg, _BH, idev, field +256)
+#define ICMP6MSGIN_INC_STATS_BH(net, idev, field)       \
+        _DEVINC(net, icmpv6msg, _BH, idev, field)
 
 struct ip6_ra_chain
 {
@@ -576,6 +575,8 @@ extern int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf);
 extern int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
                          struct group_filter __user *optval,
                          int __user *optlen);
+extern unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr,
+                                    const struct in6_addr *daddr, u32 rnd);
 
 #ifdef CONFIG_PROC_FS
 extern int  ac6_proc_init(struct net *net);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index ff137fd7714f..5617a1613c91 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -158,13 +158,17 @@ struct ieee80211_low_level_stats {
  *      also implies a change in the AID.
  * @BSS_CHANGED_ERP_CTS_PROT: CTS protection changed
  * @BSS_CHANGED_ERP_PREAMBLE: preamble changed
+ * @BSS_CHANGED_ERP_SLOT: slot timing changed
  * @BSS_CHANGED_HT: 802.11n parameters changed
+ * @BSS_CHANGED_BASIC_RATES: Basic rateset changed
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
         BSS_CHANGED_ERP_CTS_PROT        = 1<<1,
         BSS_CHANGED_ERP_PREAMBLE        = 1<<2,
+        BSS_CHANGED_ERP_SLOT            = 1<<3,
         BSS_CHANGED_HT                  = 1<<4,
+        BSS_CHANGED_BASIC_RATES         = 1<<5,
 };
 
 /**
@@ -177,6 +181,7 @@ enum ieee80211_bss_change {
  * @aid: association ID number, valid only when @assoc is true
  * @use_cts_prot: use CTS protection
  * @use_short_preamble: use 802.11b short preamble
+ * @use_short_slot: use short slot time (only relevant for ERP)
  * @dtim_period: num of beacons before the next DTIM, for PSM
  * @timestamp: beacon timestamp
  * @beacon_int: beacon interval
@@ -184,6 +189,9 @@ enum ieee80211_bss_change {
  * @assoc_ht: association in HT mode
  * @ht_conf: ht capabilities
  * @ht_bss_conf: ht extended capabilities
+ * @basic_rates: bitmap of basic rates, each bit stands for an
+ *      index into the rate table configured by the driver in
+ *      the current band.
  */
 struct ieee80211_bss_conf {
         /* association related data */
@@ -192,10 +200,12 @@ struct ieee80211_bss_conf {
         /* erp related data */
         bool use_cts_prot;
         bool use_short_preamble;
+        bool use_short_slot;
         u8 dtim_period;
         u16 beacon_int;
         u16 assoc_capability;
         u64 timestamp;
+        u64 basic_rates;
         /* ht related data */
         bool assoc_ht;
         struct ieee80211_ht_info *ht_conf;
@@ -282,6 +292,20 @@ enum mac80211_tx_control_flags {
 #define IEEE80211_TX_INFO_DRIVER_DATA_PTRS \
         (IEEE80211_TX_INFO_DRIVER_DATA_SIZE / sizeof(void *))
 
+/* maximum number of alternate rate retry stages */
+#define IEEE80211_TX_MAX_ALTRATE        3
+
+/**
+ * struct ieee80211_tx_altrate - alternate rate selection/status
+ *
+ * @rate_idx: rate index to attempt to send with
+ * @limit: number of retries before fallback
+ */
+struct ieee80211_tx_altrate {
+        s8 rate_idx;
+        u8 limit;
+};
+
 /**
  * struct ieee80211_tx_info - skb transmit information
  *
@@ -290,6 +314,9 @@ enum mac80211_tx_control_flags {
  *  (2) driver internal use (if applicable)
  *  (3) TX status information - driver tells mac80211 what happened
  *
+ * The TX control's sta pointer is only valid during the ->tx call,
+ * it may be NULL.
+ *
  * @flags: transmit info flags, defined above
  * @band: TBD
  * @tx_rate_idx: TBD
@@ -317,18 +344,19 @@ struct ieee80211_tx_info {
 
         union {
                 struct {
+                        /* NB: vif can be NULL for injected frames */
                         struct ieee80211_vif *vif;
                         struct ieee80211_key_conf *hw_key;
+                        struct ieee80211_sta *sta;
                         unsigned long jiffies;
-                        u16 aid;
-                        s8 rts_cts_rate_idx, alt_retry_rate_idx;
+                        s8 rts_cts_rate_idx;
                         u8 retry_limit;
-                        u8 icv_len;
-                        u8 iv_len;
+                        struct ieee80211_tx_altrate retries[IEEE80211_TX_MAX_ALTRATE];
                 } control;
                 struct {
                         u64 ampdu_ack_map;
                         int ack_signal;
+                        struct ieee80211_tx_altrate retries[IEEE80211_TX_MAX_ALTRATE + 1];
                         u8 retry_count;
                         bool excessive_retries;
                         u8 ampdu_ack_len;
@@ -363,6 +391,7 @@ static inline struct ieee80211_tx_info *IEEE80211_SKB_CB(struct sk_buff *skb)
  * @RX_FLAG_TSFT: The timestamp passed in the RX status (@mactime field)
  *      is valid. This is useful in monitor mode and necessary for beacon frames
  *      to enable IBSS merging.
+ * @RX_FLAG_SHORTPRE: Short preamble was used for this frame
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR      = 1<<0,
@@ -373,6 +402,7 @@ enum mac80211_rx_flags {
         RX_FLAG_FAILED_FCS_CRC  = 1<<5,
         RX_FLAG_FAILED_PLCP_CRC = 1<<6,
         RX_FLAG_TSFT            = 1<<7,
+        RX_FLAG_SHORTPRE        = 1<<8
 };
 
 /**
@@ -418,6 +448,11 @@ struct ieee80211_rx_status {
  * @IEEE80211_CONF_PS: Enable 802.11 power save mode
  */
 enum ieee80211_conf_flags {
+        /*
+         * TODO: IEEE80211_CONF_SHORT_SLOT_TIME will be removed once drivers
+         * have been converted to use bss_info_changed() for slot time
+         * configuration
+         */
         IEEE80211_CONF_SHORT_SLOT_TIME  = (1<<0),
         IEEE80211_CONF_RADIOTAP         = (1<<1),
         IEEE80211_CONF_SUPPORT_HT_MODE  = (1<<2),
@@ -461,33 +496,6 @@ struct ieee80211_conf {
 };
 
 /**
- * enum ieee80211_if_types - types of 802.11 network interfaces
- *
- * @IEEE80211_IF_TYPE_INVALID: invalid interface type, not used
- *      by mac80211 itself
- * @IEEE80211_IF_TYPE_AP: interface in AP mode.
- * @IEEE80211_IF_TYPE_MGMT: special interface for communication with hostap
- *      daemon. Drivers should never see this type.
- * @IEEE80211_IF_TYPE_STA: interface in STA (client) mode.
- * @IEEE80211_IF_TYPE_IBSS: interface in IBSS (ad-hoc) mode.
- * @IEEE80211_IF_TYPE_MNTR: interface in monitor (rfmon) mode.
- * @IEEE80211_IF_TYPE_WDS: interface in WDS mode.
- * @IEEE80211_IF_TYPE_VLAN: VLAN interface bound to an AP, drivers
- *      will never see this type.
- * @IEEE80211_IF_TYPE_MESH_POINT: 802.11s mesh point
- */
-enum ieee80211_if_types {
-        IEEE80211_IF_TYPE_INVALID,
-        IEEE80211_IF_TYPE_AP,
-        IEEE80211_IF_TYPE_STA,
-        IEEE80211_IF_TYPE_IBSS,
-        IEEE80211_IF_TYPE_MESH_POINT,
-        IEEE80211_IF_TYPE_MNTR,
-        IEEE80211_IF_TYPE_WDS,
-        IEEE80211_IF_TYPE_VLAN,
-};
-
-/**
  * struct ieee80211_vif - per-interface data
  *
  * Data in this structure is continually present for driver
@@ -498,7 +506,7 @@ enum ieee80211_if_types {
  *      sizeof(void *).
  */
 struct ieee80211_vif {
-        enum ieee80211_if_types type;
+        enum nl80211_iftype type;
         /* must be last */
         u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
 };
@@ -506,7 +514,7 @@ struct ieee80211_vif {
 static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
 {
 #ifdef CONFIG_MAC80211_MESH
-        return vif->type == IEEE80211_IF_TYPE_MESH_POINT;
+        return vif->type == NL80211_IFTYPE_MESH_POINT;
 #endif
         return false;
 }
@@ -517,7 +525,7 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
  * @vif: pointer to a driver-use per-interface structure. The pointer
  *      itself is also used for various functions including
  *      ieee80211_beacon_get() and ieee80211_get_buffered_bc().
- * @type: one of &enum ieee80211_if_types constants. Determines the type of
+ * @type: one of &enum nl80211_iftype constants. Determines the type of
  *      added/removed interface.
  * @mac_addr: pointer to MAC address of the interface. This pointer is valid
  *      until the interface is removed (i.e. it cannot be used after
@@ -533,7 +541,7 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
  * in pure monitor mode.
  */
 struct ieee80211_if_init_conf {
-        enum ieee80211_if_types type;
+        enum nl80211_iftype type;
         struct ieee80211_vif *vif;
         void *mac_addr;
 };
@@ -641,6 +649,8 @@ enum ieee80211_key_flags {
  */
 struct ieee80211_key_conf {
         enum ieee80211_key_alg alg;
+        u8 icv_len;
+        u8 iv_len;
         u8 hw_key_idx;
         u8 flags;
         s8 keyidx;
@@ -662,6 +672,33 @@ enum set_key_cmd {
 };
 
 /**
+ * struct ieee80211_sta - station table entry
+ *
+ * A station table entry represents a station we are possibly
+ * communicating with. Since stations are RCU-managed in
+ * mac80211, any ieee80211_sta pointer you get access to must
+ * either be protected by rcu_read_lock() explicitly or implicitly,
+ * or you must take good care to not use such a pointer after a
+ * call to your sta_notify callback that removed it.
+ *
+ * @addr: MAC address
+ * @aid: AID we assigned to the station if we're an AP
+ * @supp_rates: Bitmap of supported rates (per band)
+ * @ht_info: HT capabilities of this STA
+ * @drv_priv: data area for driver use, will always be aligned to
+ *      sizeof(void *), size is determined in hw information.
+ */
+struct ieee80211_sta {
+        u64 supp_rates[IEEE80211_NUM_BANDS];
+        u8 addr[ETH_ALEN];
+        u16 aid;
+        struct ieee80211_ht_info ht_info;
+
+        /* must be last */
+        u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
+};
+
+/**
  * enum sta_notify_cmd - sta notify command
  *
  * Used with the sta_notify() callback in &struct ieee80211_ops, this
@@ -805,6 +842,11 @@ enum ieee80211_hw_flags {
  *
  * @vif_data_size: size (in bytes) of the drv_priv data area
  *      within &struct ieee80211_vif.
+ * @sta_data_size: size (in bytes) of the drv_priv data area
+ *      within &struct ieee80211_sta.
+ *
+ * @max_altrates: maximum number of alternate rate retry stages
+ * @max_altrate_tries: maximum number of tries for each stage
  */
 struct ieee80211_hw {
         struct ieee80211_conf conf;
@@ -816,12 +858,17 @@ struct ieee80211_hw {
         unsigned int extra_tx_headroom;
         int channel_change_time;
         int vif_data_size;
+        int sta_data_size;
         u16 queues;
         u16 ampdu_queues;
         u16 max_listen_interval;
         s8 max_signal;
+        u8 max_altrates;
+        u8 max_altrate_tries;
 };
 
+struct ieee80211_hw *wiphy_to_hw(struct wiphy *wiphy);
+
 /**
  * SET_IEEE80211_DEV - set device for 802.11 hardware
  *
@@ -874,11 +921,11 @@ ieee80211_get_rts_cts_rate(const struct ieee80211_hw *hw,
 
 static inline struct ieee80211_rate *
 ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
-                             const struct ieee80211_tx_info *c)
+                             const struct ieee80211_tx_info *c, int idx)
 {
-        if (c->control.alt_retry_rate_idx < 0)
+        if (c->control.retries[idx].rate_idx < 0)
                 return NULL;
-        return &hw->wiphy->bands[c->band]->bitrates[c->control.alt_retry_rate_idx];
+        return &hw->wiphy->bands[c->band]->bitrates[c->control.retries[idx].rate_idx];
 }
 
 /**
@@ -1097,7 +1144,7 @@ enum ieee80211_ampdu_mlme_action {
  *      This callback must be implemented and atomic.
  *
  * @set_tim: Set TIM bit. mac80211 calls this function when a TIM bit
- *      must be set or cleared for a given AID. Must be atomic.
+ *      must be set or cleared for a given STA. Must be atomic.
  *
  * @set_key: See the section "Hardware crypto acceleration"
  *      This callback can sleep, and is only called between add_interface
@@ -1111,7 +1158,9 @@ enum ieee80211_ampdu_mlme_action {
  * @hw_scan: Ask the hardware to service the scan request, no need to start
  *      the scan state machine in stack. The scan must honour the channel
  *      configuration done by the regulatory agent in the wiphy's registered
- *      bands.
+ *      bands. When the scan finishes, ieee80211_scan_completed() must be
+ *      called; note that it also must be called when the scan cannot finish
+ *      because the hardware is turned off! Anything else is a bug!
  *
  * @get_stats: return low-level statistics
  *
@@ -1131,7 +1180,7 @@ enum ieee80211_ampdu_mlme_action {
  *      of assocaited station or AP.
  *
  * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
- *      bursting) for a hardware TX queue. Must be atomic.
+ *      bursting) for a hardware TX queue.
  *
  * @get_tx_stats: Get statistics of the current TX queue status. This is used
  *      to get number of currently queued packets (queue length), maximum queue
@@ -1181,7 +1230,8 @@ struct ieee80211_ops {
                                  unsigned int changed_flags,
                                  unsigned int *total_flags,
                                  int mc_count, struct dev_addr_list *mc_list);
-        int (*set_tim)(struct ieee80211_hw *hw, int aid, int set);
+        int (*set_tim)(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+                       bool set);
         int (*set_key)(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                        const u8 *local_address, const u8 *address,
                        struct ieee80211_key_conf *key);
@@ -1198,7 +1248,7 @@ struct ieee80211_ops {
         int (*set_retry_limit)(struct ieee80211_hw *hw,
                                u32 short_retry, u32 long_retr);
         void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                        enum sta_notify_cmd, const u8 *addr);
+                        enum sta_notify_cmd, struct ieee80211_sta *sta);
         int (*conf_tx)(struct ieee80211_hw *hw, u16 queue,
                        const struct ieee80211_tx_queue_params *params);
         int (*get_tx_stats)(struct ieee80211_hw *hw,
@@ -1208,7 +1258,7 @@ struct ieee80211_ops {
         int (*tx_last_beacon)(struct ieee80211_hw *hw);
         int (*ampdu_action)(struct ieee80211_hw *hw,
                             enum ieee80211_ampdu_mlme_action action,
-                            const u8 *addr, u16 tid, u16 *ssn);
+                            struct ieee80211_sta *sta, u16 tid, u16 *ssn);
 };
 
 /**
@@ -1557,16 +1607,6 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
 
 /**
- * ieee80211_get_hdrlen - get header length from frame control
- *
- * This function returns the 802.11 header length in bytes (not including
- * encryption headers.)
- *
- * @fc: the frame control field (in CPU endianness)
- */
-int ieee80211_get_hdrlen(u16 fc);
-
-/**
  * ieee80211_hdrlen - get header length in bytes from frame control
  * @fc: frame control field in little-endian format
  */
@@ -1608,6 +1648,16 @@ void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue);
 void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue);
 
 /**
+ * ieee80211_queue_stopped - test status of the queue
+ * @hw: pointer as obtained from ieee80211_alloc_hw().
+ * @queue: queue number (counted from zero).
+ *
+ * Drivers should use this function instead of netif_stop_queue.
+ */
+
+int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue);
+
+/**
  * ieee80211_stop_queues - stop all queues
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  *
@@ -1758,4 +1808,85 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw, const u8 *ra,
  */
 void ieee80211_notify_mac(struct ieee80211_hw *hw,
                           enum ieee80211_notification_types  notif_type);
+
+/**
+ * ieee80211_find_sta - find a station
+ *
+ * @hw: pointer as obtained from ieee80211_alloc_hw()
+ * @addr: station's address
+ *
+ * This function must be called under RCU lock and the
+ * resulting pointer is only valid under RCU lock as well.
+ */
+struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_hw *hw,
+                                         const u8 *addr);
+
+
+/* Rate control API */
+/**
+ * struct rate_selection - rate information for/from rate control algorithms
+ *
+ * @rate_idx: selected transmission rate index
+ * @nonerp_idx: Non-ERP rate to use instead if ERP cannot be used
+ * @probe_idx: rate for probing (or -1)
+ * @max_rate_idx: maximum rate index that can be used, this is
+ *      input to the algorithm and will be enforced
+ */
+struct rate_selection {
+        s8 rate_idx, nonerp_idx, probe_idx, max_rate_idx;
+};
+
+struct rate_control_ops {
+        struct module *module;
+        const char *name;
+        void *(*alloc)(struct ieee80211_hw *hw, struct dentry *debugfsdir);
+        void (*clear)(void *priv);
+        void (*free)(void *priv);
+
+        void *(*alloc_sta)(void *priv, struct ieee80211_sta *sta, gfp_t gfp);
+        void (*rate_init)(void *priv, struct ieee80211_supported_band *sband,
+                          struct ieee80211_sta *sta, void *priv_sta);
+        void (*free_sta)(void *priv, struct ieee80211_sta *sta,
+                         void *priv_sta);
+
+        void (*tx_status)(void *priv, struct ieee80211_supported_band *sband,
+                          struct ieee80211_sta *sta, void *priv_sta,
+                          struct sk_buff *skb);
+        void (*get_rate)(void *priv, struct ieee80211_supported_band *sband,
+                         struct ieee80211_sta *sta, void *priv_sta,
+                         struct sk_buff *skb,
+                         struct rate_selection *sel);
+
+        void (*add_sta_debugfs)(void *priv, void *priv_sta,
+                                struct dentry *dir);
+        void (*remove_sta_debugfs)(void *priv, void *priv_sta);
+};
+
+static inline int rate_supported(struct ieee80211_sta *sta,
+                                 enum ieee80211_band band,
+                                 int index)
+{
+        return (sta == NULL || sta->supp_rates[band] & BIT(index));
+}
+
+static inline s8
+rate_lowest_index(struct ieee80211_supported_band *sband,
+                  struct ieee80211_sta *sta)
+{
+        int i;
+
+        for (i = 0; i < sband->n_bitrates; i++)
+                if (rate_supported(sta, sband->band, i))
+                        return i;
+
+        /* warn when we cannot find a rate. */
+        WARN_ON(1);
+
+        return 0;
+}
+
+
+int ieee80211_rate_control_register(struct rate_control_ops *ops);
+void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
+
 #endif /* MAC80211_H */
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index a8eb43cf0c7e..708009be88b6 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -16,6 +16,9 @@
 #include <net/netns/ipv6.h>
 #include <net/netns/dccp.h>
 #include <net/netns/x_tables.h>
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#include <net/netns/conntrack.h>
+#endif
 
 struct proc_dir_entry;
 struct net_device;
@@ -67,6 +70,9 @@ struct net {
 #endif
 #ifdef CONFIG_NETFILTER
         struct netns_xt         xt;
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+        struct netns_ct         ct;
+#endif
 #endif
         struct net_generic      *gen;
 };
diff --git a/include/net/netfilter/ipv4/nf_defrag_ipv4.h b/include/net/netfilter/ipv4/nf_defrag_ipv4.h
new file mode 100644
index 000000000000..6b00ea38546b
--- /dev/null
+++ b/include/net/netfilter/ipv4/nf_defrag_ipv4.h
@@ -0,0 +1,6 @@
+#ifndef _NF_DEFRAG_IPV4_H
+#define _NF_DEFRAG_IPV4_H
+
+extern void nf_defrag_ipv4_enable(void);
+
+#endif /* _NF_DEFRAG_IPV4_H */
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 0741ad592da0..b76a8685b5b5 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -123,7 +123,9 @@ struct nf_conn
 
         /* Extensions */
         struct nf_ct_ext *ext;
-
+#ifdef CONFIG_NET_NS
+        struct net *ct_net;
+#endif
         struct rcu_head rcu;
 };
 
@@ -147,6 +149,17 @@ static inline u_int8_t nf_ct_protonum(const struct nf_conn *ct)
 /* get master conntrack via master expectation */
 #define master_ct(conntr) (conntr->master)
 
+extern struct net init_net;
+
+static inline struct net *nf_ct_net(const struct nf_conn *ct)
+{
+#ifdef CONFIG_NET_NS
+        return ct->ct_net;
+#else
+        return &init_net;
+#endif
+}
+
 /* Alter reply tuple (maybe alter helper). */
 extern void
 nf_conntrack_alter_reply(struct nf_conn *ct,
@@ -182,11 +195,11 @@ extern void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced,
                                  unsigned int size);
 
 extern struct nf_conntrack_tuple_hash *
-__nf_conntrack_find(const struct nf_conntrack_tuple *tuple);
+__nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple);
 
 extern void nf_conntrack_hash_insert(struct nf_conn *ct);
 
-extern void nf_conntrack_flush(void);
+extern void nf_conntrack_flush(struct net *net);
 
 extern bool nf_ct_get_tuplepr(const struct sk_buff *skb,
                               unsigned int nhoff, u_int16_t l3num,
@@ -248,10 +261,11 @@ extern struct nf_conn nf_conntrack_untracked;
 
 /* Iterate over all conntracks: if iter returns true, it's deleted. */
 extern void
-nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data), void *data);
+nf_ct_iterate_cleanup(struct net *net, int (*iter)(struct nf_conn *i, void *data), void *data);
 extern void nf_conntrack_free(struct nf_conn *ct);
 extern struct nf_conn *
-nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
+nf_conntrack_alloc(struct net *net,
+                   const struct nf_conntrack_tuple *orig,
                    const struct nf_conntrack_tuple *repl,
                    gfp_t gfp);
 
@@ -273,16 +287,14 @@ static inline int nf_ct_is_untracked(const struct sk_buff *skb)
 
 extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);
 extern unsigned int nf_conntrack_htable_size;
-extern int nf_conntrack_checksum;
-extern atomic_t nf_conntrack_count;
 extern int nf_conntrack_max;
 
-DECLARE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
-#define NF_CT_STAT_INC(count) (__get_cpu_var(nf_conntrack_stat).count++)
-#define NF_CT_STAT_INC_ATOMIC(count)                    \
+#define NF_CT_STAT_INC(net, count)      \
+        (per_cpu_ptr((net)->ct.stat, raw_smp_processor_id())->count++)
+#define NF_CT_STAT_INC_ATOMIC(net, count)               \
 do {                                                    \
         local_bh_disable();                             \
-        __get_cpu_var(nf_conntrack_stat).count++;       \
+        per_cpu_ptr((net)->ct.stat, raw_smp_processor_id())->count++;   \
         local_bh_enable();                              \
 } while (0)
 
diff --git a/include/net/netfilter/nf_conntrack_acct.h b/include/net/netfilter/nf_conntrack_acct.h
index 5d5ae55d54c4..03e218f0be43 100644
--- a/include/net/netfilter/nf_conntrack_acct.h
+++ b/include/net/netfilter/nf_conntrack_acct.h
@@ -8,6 +8,7 @@
 
 #ifndef _NF_CONNTRACK_ACCT_H
 #define _NF_CONNTRACK_ACCT_H
+#include <net/net_namespace.h>
 #include <linux/netfilter/nf_conntrack_common.h>
 #include <linux/netfilter/nf_conntrack_tuple_common.h>
 #include <net/netfilter/nf_conntrack.h>
@@ -18,8 +19,6 @@ struct nf_conn_counter {
         u_int64_t bytes;
 };
 
-extern int nf_ct_acct;
-
 static inline
 struct nf_conn_counter *nf_conn_acct_find(const struct nf_conn *ct)
 {
@@ -29,9 +28,10 @@ struct nf_conn_counter *nf_conn_acct_find(const struct nf_conn *ct)
 static inline
 struct nf_conn_counter *nf_ct_acct_ext_add(struct nf_conn *ct, gfp_t gfp)
 {
+        struct net *net = nf_ct_net(ct);
         struct nf_conn_counter *acct;
 
-        if (!nf_ct_acct)
+        if (!net->ct.sysctl_acct)
                 return NULL;
 
         acct = nf_ct_ext_add(ct, NF_CT_EXT_ACCT, gfp);
@@ -45,7 +45,7 @@ struct nf_conn_counter *nf_ct_acct_ext_add(struct nf_conn *ct, gfp_t gfp)
 extern unsigned int
 seq_print_acct(struct seq_file *s, const struct nf_conn *ct, int dir);
 
-extern int nf_conntrack_acct_init(void);
-extern void nf_conntrack_acct_fini(void);
+extern int nf_conntrack_acct_init(struct net *net);
+extern void nf_conntrack_acct_fini(struct net *net);
 
 #endif /* _NF_CONNTRACK_ACCT_H */
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index a81771210934..e78afe7f28e3 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -20,12 +20,13 @@
 /* This header is used to share core functionality between the
    standalone connection tracking module, and the compatibility layer's use
    of connection tracking. */
-extern unsigned int nf_conntrack_in(int pf,
+extern unsigned int nf_conntrack_in(struct net *net,
+                                    u_int8_t pf,
                                     unsigned int hooknum,
                                     struct sk_buff *skb);
 
-extern int nf_conntrack_init(void);
-extern void nf_conntrack_cleanup(void);
+extern int nf_conntrack_init(struct net *net);
+extern void nf_conntrack_cleanup(struct net *net);
 
 extern int nf_conntrack_proto_init(void);
 extern void nf_conntrack_proto_fini(void);
@@ -48,7 +49,7 @@ nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
 
 /* Find a connection corresponding to a tuple. */
 extern struct nf_conntrack_tuple_hash *
-nf_conntrack_find_get(const struct nf_conntrack_tuple *tuple);
+nf_conntrack_find_get(struct net *net, const struct nf_conntrack_tuple *tuple);
 
 extern int __nf_conntrack_confirm(struct sk_buff *skb);
 
@@ -71,8 +72,6 @@ print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
             const struct nf_conntrack_l3proto *l3proto,
             const struct nf_conntrack_l4proto *proto);
 
-extern struct hlist_head *nf_conntrack_hash;
 extern spinlock_t nf_conntrack_lock ;
-extern struct hlist_head unconfirmed;
 
 #endif /* _NF_CONNTRACK_CORE_H */
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index f0b9078235c9..1285ff26a014 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -8,6 +8,7 @@
 
 #include <linux/notifier.h>
 #include <linux/interrupt.h>
+#include <net/net_namespace.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
@@ -15,9 +16,6 @@ struct nf_conntrack_ecache {
         struct nf_conn *ct;
         unsigned int events;
 };
-DECLARE_PER_CPU(struct nf_conntrack_ecache, nf_conntrack_ecache);
-
-#define CONNTRACK_ECACHE(x)     (__get_cpu_var(nf_conntrack_ecache).x)
 
 extern struct atomic_notifier_head nf_conntrack_chain;
 extern int nf_conntrack_register_notifier(struct notifier_block *nb);
@@ -25,17 +23,16 @@ extern int nf_conntrack_unregister_notifier(struct notifier_block *nb);
 
 extern void nf_ct_deliver_cached_events(const struct nf_conn *ct);
 extern void __nf_ct_event_cache_init(struct nf_conn *ct);
-extern void nf_ct_event_cache_flush(void);
+extern void nf_ct_event_cache_flush(struct net *net);
 
 static inline void
-nf_conntrack_event_cache(enum ip_conntrack_events event,
-                         const struct sk_buff *skb)
+nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
 {
-        struct nf_conn *ct = (struct nf_conn *)skb->nfct;
+        struct net *net = nf_ct_net(ct);
         struct nf_conntrack_ecache *ecache;
 
         local_bh_disable();
-        ecache = &__get_cpu_var(nf_conntrack_ecache);
+        ecache = per_cpu_ptr(net->ct.ecache, raw_smp_processor_id());
         if (ct != ecache->ct)
                 __nf_ct_event_cache_init(ct);
         ecache->events |= event;
@@ -60,16 +57,28 @@ nf_ct_expect_event(enum ip_conntrack_expect_events event,
         atomic_notifier_call_chain(&nf_ct_expect_chain, event, exp);
 }
 
+extern int nf_conntrack_ecache_init(struct net *net);
+extern void nf_conntrack_ecache_fini(struct net *net);
+
 #else /* CONFIG_NF_CONNTRACK_EVENTS */
 
 static inline void nf_conntrack_event_cache(enum ip_conntrack_events event,
-                                            const struct sk_buff *skb) {}
+                                            struct nf_conn *ct) {}
 static inline void nf_conntrack_event(enum ip_conntrack_events event,
                                       struct nf_conn *ct) {}
 static inline void nf_ct_deliver_cached_events(const struct nf_conn *ct) {}
 static inline void nf_ct_expect_event(enum ip_conntrack_expect_events event,
                                       struct nf_conntrack_expect *exp) {}
-static inline void nf_ct_event_cache_flush(void) {}
+static inline void nf_ct_event_cache_flush(struct net *net) {}
+
+static inline int nf_conntrack_ecache_init(struct net *net)
+{
+        return 0;
+}
+
+static inline void nf_conntrack_ecache_fini(struct net *net)
+{
+}
 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
 
 #endif /*_NF_CONNTRACK_ECACHE_H*/
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index dfdf4b459475..37a7fc1164b0 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -6,7 +6,6 @@
 #define _NF_CONNTRACK_EXPECT_H
 #include <net/netfilter/nf_conntrack.h>
 
-extern struct hlist_head *nf_ct_expect_hash;
 extern unsigned int nf_ct_expect_hsize;
 extern unsigned int nf_ct_expect_max;
 
@@ -56,6 +55,15 @@ struct nf_conntrack_expect
         struct rcu_head rcu;
 };
 
+static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
+{
+#ifdef CONFIG_NET_NS
+        return exp->master->ct_net;     /* by definition */
+#else
+        return &init_net;
+#endif
+}
+
 struct nf_conntrack_expect_policy
 {
         unsigned int    max_expected;
@@ -67,17 +75,17 @@ struct nf_conntrack_expect_policy
 #define NF_CT_EXPECT_PERMANENT  0x1
 #define NF_CT_EXPECT_INACTIVE   0x2
 
-int nf_conntrack_expect_init(void);
-void nf_conntrack_expect_fini(void);
+int nf_conntrack_expect_init(struct net *net);
+void nf_conntrack_expect_fini(struct net *net);
 
 struct nf_conntrack_expect *
-__nf_ct_expect_find(const struct nf_conntrack_tuple *tuple);
+__nf_ct_expect_find(struct net *net, const struct nf_conntrack_tuple *tuple);
 
 struct nf_conntrack_expect *
-nf_ct_expect_find_get(const struct nf_conntrack_tuple *tuple);
+nf_ct_expect_find_get(struct net *net, const struct nf_conntrack_tuple *tuple);
 
 struct nf_conntrack_expect *
-nf_ct_find_expectation(const struct nf_conntrack_tuple *tuple);
+nf_ct_find_expectation(struct net *net, const struct nf_conntrack_tuple *tuple);
 
 void nf_ct_unlink_expect(struct nf_conntrack_expect *exp);
 void nf_ct_remove_expectations(struct nf_conn *ct);
@@ -86,7 +94,7 @@ void nf_ct_unexpect_related(struct nf_conntrack_expect *exp);
 /* Allocate space for an expectation: this is mandatory before calling
    nf_ct_expect_related.  You will have to call put afterwards. */
 struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me);
-void nf_ct_expect_init(struct nf_conntrack_expect *, unsigned int, int,
+void nf_ct_expect_init(struct nf_conntrack_expect *, unsigned int, u_int8_t,
                        const union nf_inet_addr *,
                        const union nf_inet_addr *,
                        u_int8_t, const __be16 *, const __be16 *);
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index 723df9d1cc35..7f2f43c77284 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -39,7 +39,7 @@ struct nf_conntrack_l4proto
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
-                      int pf,
+                      u_int8_t pf,
                       unsigned int hooknum);
 
         /* Called when a new connection for this protocol found;
@@ -50,9 +50,9 @@ struct nf_conntrack_l4proto
         /* Called when a conntrack entry is destroyed */
         void (*destroy)(struct nf_conn *ct);
 
-        int (*error)(struct sk_buff *skb, unsigned int dataoff,
+        int (*error)(struct net *net, struct sk_buff *skb, unsigned int dataoff,
                      enum ip_conntrack_info *ctinfo,
-                     int pf, unsigned int hooknum);
+                     u_int8_t pf, unsigned int hooknum);
 
         /* Print out the per-protocol part of the tuple. Return like seq_* */
         int (*print_tuple)(struct seq_file *s,
@@ -117,20 +117,19 @@ extern int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
                                       struct nf_conntrack_tuple *t);
 extern const struct nla_policy nf_ct_port_nla_policy[];
 
-/* Log invalid packets */
-extern unsigned int nf_ct_log_invalid;
-
 #ifdef CONFIG_SYSCTL
 #ifdef DEBUG_INVALID_PACKETS
-#define LOG_INVALID(proto) \
-        (nf_ct_log_invalid == (proto) || nf_ct_log_invalid == IPPROTO_RAW)
+#define LOG_INVALID(net, proto)                         \
+        ((net)->ct.sysctl_log_invalid == (proto) ||     \
+         (net)->ct.sysctl_log_invalid == IPPROTO_RAW)
 #else
-#define LOG_INVALID(proto) \
-        ((nf_ct_log_invalid == (proto) || nf_ct_log_invalid == IPPROTO_RAW) \
+#define LOG_INVALID(net, proto)                         \
+        (((net)->ct.sysctl_log_invalid == (proto) ||    \
+          (net)->ct.sysctl_log_invalid == IPPROTO_RAW)  \
          && net_ratelimit())
 #endif
 #else
-#define LOG_INVALID(proto) 0
+#define LOG_INVALID(net, proto) 0
 #endif /* CONFIG_SYSCTL */
 
 #endif /*_NF_CONNTRACK_PROTOCOL_H*/
diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h
index 8c6b5ae45534..7182c06974f4 100644
--- a/include/net/netfilter/nf_log.h
+++ b/include/net/netfilter/nf_log.h
@@ -28,7 +28,7 @@ struct nf_loginfo {
         } u;
 };
 
-typedef void nf_logfn(unsigned int pf,
+typedef void nf_logfn(u_int8_t pf,
                       unsigned int hooknum,
                       const struct sk_buff *skb,
                       const struct net_device *in,
@@ -43,12 +43,12 @@ struct nf_logger {
 };
 
 /* Function to register/unregister log function. */
-int nf_log_register(int pf, const struct nf_logger *logger);
+int nf_log_register(u_int8_t pf, const struct nf_logger *logger);
 void nf_log_unregister(const struct nf_logger *logger);
-void nf_log_unregister_pf(int pf);
+void nf_log_unregister_pf(u_int8_t pf);
 
 /* Calls the registered backend logging function */
-void nf_log_packet(int pf,
+void nf_log_packet(u_int8_t pf,
                    unsigned int hooknum,
                    const struct sk_buff *skb,
                    const struct net_device *in,
diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
index d030044e9235..252fd1010b77 100644
--- a/include/net/netfilter/nf_queue.h
+++ b/include/net/netfilter/nf_queue.h
@@ -8,7 +8,7 @@ struct nf_queue_entry {
         unsigned int            id;
 
         struct nf_hook_ops      *elem;
-        int                     pf;
+        u_int8_t                pf;
         unsigned int            hook;
         struct net_device       *indev;
         struct net_device       *outdev;
@@ -24,9 +24,9 @@ struct nf_queue_handler {
         char                    *name;
 };
 
-extern int nf_register_queue_handler(int pf,
+extern int nf_register_queue_handler(u_int8_t pf,
                                      const struct nf_queue_handler *qh);
-extern int nf_unregister_queue_handler(int pf,
+extern int nf_unregister_queue_handler(u_int8_t pf,
                                        const struct nf_queue_handler *qh);
 extern void nf_unregister_queue_handlers(const struct nf_queue_handler *qh);
 extern void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);
diff --git a/include/net/netfilter/nf_tproxy_core.h b/include/net/netfilter/nf_tproxy_core.h
new file mode 100644
index 000000000000..208b46f4d6d2
--- /dev/null
+++ b/include/net/netfilter/nf_tproxy_core.h
@@ -0,0 +1,32 @@
+#ifndef _NF_TPROXY_CORE_H
+#define _NF_TPROXY_CORE_H
+
+#include <linux/types.h>
+#include <linux/in.h>
+#include <linux/skbuff.h>
+#include <net/sock.h>
+#include <net/inet_sock.h>
+#include <net/tcp.h>
+
+/* look up and get a reference to a matching socket */
+extern struct sock *
+nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
+                      const __be32 saddr, const __be32 daddr,
+                      const __be16 sport, const __be16 dport,
+                      const struct net_device *in, bool listening);
+
+static inline void
+nf_tproxy_put_sock(struct sock *sk)
+{
+        /* TIME_WAIT inet sockets have to be handled differently */
+        if ((sk->sk_protocol == IPPROTO_TCP) && (sk->sk_state == TCP_TIME_WAIT))
+                inet_twsk_put(inet_twsk(sk));
+        else
+                sock_put(sk);
+}
+
+/* assign a socket to the skb -- consumes sk */
+int
+nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk);
+
+#endif
diff --git a/include/net/netlabel.h b/include/net/netlabel.h
index e4d2d6baa983..17c442a4514e 100644
--- a/include/net/netlabel.h
+++ b/include/net/netlabel.h
@@ -9,7 +9,7 @@
  */
 
 /*
- * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
+ * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
  *
  * This program is free software;  you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -72,8 +72,10 @@ struct cipso_v4_doi;
 /* NetLabel NETLINK protocol version
  *  1: initial version
  *  2: added static labels for unlabeled connections
+ *  3: network selectors added to the NetLabel/LSM domain mapping and the
+ *     CIPSO_V4_MAP_LOCAL CIPSO mapping was added
  */
-#define NETLBL_PROTO_VERSION            2
+#define NETLBL_PROTO_VERSION            3
 
 /* NetLabel NETLINK types/families */
 #define NETLBL_NLTYPE_NONE              0
@@ -87,6 +89,8 @@ struct cipso_v4_doi;
 #define NETLBL_NLTYPE_CIPSOV6_NAME      "NLBL_CIPSOv6"
 #define NETLBL_NLTYPE_UNLABELED         5
 #define NETLBL_NLTYPE_UNLABELED_NAME    "NLBL_UNLBL"
+#define NETLBL_NLTYPE_ADDRSELECT        6
+#define NETLBL_NLTYPE_ADDRSELECT_NAME   "NLBL_ADRSEL"
 
 /*
  * NetLabel - Kernel API for accessing the network packet label mappings.
@@ -200,7 +204,7 @@ struct netlbl_lsm_secattr {
         u32 type;
         char *domain;
         struct netlbl_lsm_cache *cache;
-        union {
+        struct {
                 struct {
                         struct netlbl_lsm_secattr_catmap *cat;
                         u32 lvl;
@@ -352,12 +356,9 @@ static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr)
 int netlbl_cfg_map_del(const char *domain, struct netlbl_audit *audit_info);
 int netlbl_cfg_unlbl_add_map(const char *domain,
                              struct netlbl_audit *audit_info);
-int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
-                           struct netlbl_audit *audit_info);
 int netlbl_cfg_cipsov4_add_map(struct cipso_v4_doi *doi_def,
                                const char *domain,
                                struct netlbl_audit *audit_info);
-int netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info);
 
 /*
  * LSM security attribute operations
@@ -380,12 +381,19 @@ int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
 int netlbl_enabled(void);
 int netlbl_sock_setattr(struct sock *sk,
                         const struct netlbl_lsm_secattr *secattr);
+void netlbl_sock_delattr(struct sock *sk);
 int netlbl_sock_getattr(struct sock *sk,
                         struct netlbl_lsm_secattr *secattr);
+int netlbl_conn_setattr(struct sock *sk,
+                        struct sockaddr *addr,
+                        const struct netlbl_lsm_secattr *secattr);
+int netlbl_skbuff_setattr(struct sk_buff *skb,
+                          u16 family,
+                          const struct netlbl_lsm_secattr *secattr);
 int netlbl_skbuff_getattr(const struct sk_buff *skb,
                           u16 family,
                           struct netlbl_lsm_secattr *secattr);
-void netlbl_skbuff_err(struct sk_buff *skb, int error);
+void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway);
 
 /*
  * LSM label mapping cache operations
@@ -404,22 +412,12 @@ static inline int netlbl_cfg_unlbl_add_map(const char *domain,
 {
         return -ENOSYS;
 }
-static inline int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
-                                         struct netlbl_audit *audit_info)
-{
-        return -ENOSYS;
-}
 static inline int netlbl_cfg_cipsov4_add_map(struct cipso_v4_doi *doi_def,
                                              const char *domain,
                                              struct netlbl_audit *audit_info)
 {
         return -ENOSYS;
 }
-static inline int netlbl_cfg_cipsov4_del(u32 doi,
-                                         struct netlbl_audit *audit_info)
-{
-        return -ENOSYS;
-}
 static inline int netlbl_secattr_catmap_walk(
                                       struct netlbl_lsm_secattr_catmap *catmap,
                                       u32 offset)
@@ -456,18 +454,35 @@ static inline int netlbl_sock_setattr(struct sock *sk,
 {
         return -ENOSYS;
 }
+static inline void netlbl_sock_delattr(struct sock *sk)
+{
+}
 static inline int netlbl_sock_getattr(struct sock *sk,
                                       struct netlbl_lsm_secattr *secattr)
 {
         return -ENOSYS;
 }
+static inline int netlbl_conn_setattr(struct sock *sk,
+                                      struct sockaddr *addr,
+                                      const struct netlbl_lsm_secattr *secattr)
+{
+        return -ENOSYS;
+}
+static inline int netlbl_skbuff_setattr(struct sk_buff *skb,
+                                      u16 family,
+                                      const struct netlbl_lsm_secattr *secattr)
+{
+        return -ENOSYS;
+}
 static inline int netlbl_skbuff_getattr(const struct sk_buff *skb,
                                         u16 family,
                                         struct netlbl_lsm_secattr *secattr)
 {
         return -ENOSYS;
 }
-static inline void netlbl_skbuff_err(struct sk_buff *skb, int error)
+static inline void netlbl_skbuff_err(struct sk_buff *skb,
+                                     int error,
+                                     int gateway)
 {
         return;
 }
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 18024b8cecb8..3643bbb8e585 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -119,9 +119,6 @@
  * Nested Attributes Construction:
  *   nla_nest_start(skb, type)          start a nested attribute
  *   nla_nest_end(skb, nla)             finalize a nested attribute
- *   nla_nest_compat_start(skb, type,   start a nested compat attribute
- *                         len, data)
- *   nla_nest_compat_end(skb, type)     finalize a nested compat attribute
  *   nla_nest_cancel(skb, nla)          cancel nested attribute construction
  *
  * Attribute Length Calculations:
@@ -156,7 +153,6 @@
  *   nla_find_nested()                  find attribute in nested attributes
  *   nla_parse()                        parse and validate stream of attrs
  *   nla_parse_nested()                 parse nested attribuets
- *   nla_parse_nested_compat()          parse nested compat attributes
  *   nla_for_each_attr()                loop over all attributes
  *   nla_for_each_nested()              loop over the nested attributes
  *=========================================================================
@@ -702,7 +698,7 @@ static inline int nla_len(const struct nlattr *nla)
  */
 static inline int nla_ok(const struct nlattr *nla, int remaining)
 {
-        return remaining >= sizeof(*nla) &&
+        return remaining >= (int) sizeof(*nla) &&
                nla->nla_len >= sizeof(*nla) &&
                nla->nla_len <= remaining;
 }
@@ -752,39 +748,6 @@ static inline int nla_parse_nested(struct nlattr *tb[], int maxtype,
 }
 
 /**
- * nla_parse_nested_compat - parse nested compat attributes
- * @tb: destination array with maxtype+1 elements
- * @maxtype: maximum attribute type to be expected
- * @nla: attribute containing the nested attributes
- * @data: pointer to point to contained structure
- * @len: length of contained structure
- * @policy: validation policy
- *
- * Parse a nested compat attribute. The compat attribute contains a structure
- * and optionally a set of nested attributes. On success the data pointer
- * points to the nested data and tb contains the parsed attributes
- * (see nla_parse).
- */
-static inline int __nla_parse_nested_compat(struct nlattr *tb[], int maxtype,
-                                            struct nlattr *nla,
-                                            const struct nla_policy *policy,
-                                            int len)
-{
-        int nested_len = nla_len(nla) - NLA_ALIGN(len);
-
-        if (nested_len < 0)
-                return -EINVAL;
-        if (nested_len >= nla_attr_size(0))
-                return nla_parse(tb, maxtype, nla_data(nla) + NLA_ALIGN(len),
-                                 nested_len, policy);
-        memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
-        return 0;
-}
-
-#define nla_parse_nested_compat(tb, maxtype, nla, policy, data, len) \
-({      data = nla_len(nla) >= len ? nla_data(nla) : NULL; \
-        __nla_parse_nested_compat(tb, maxtype, nla, policy, len); })
-/**
  * nla_put_u8 - Add a u8 netlink attribute to a socket buffer
  * @skb: socket buffer to add attribute to
  * @attrtype: attribute type
@@ -1031,51 +994,6 @@ static inline int nla_nest_end(struct sk_buff *skb, struct nlattr *start)
 }
 
 /**
- * nla_nest_compat_start - Start a new level of nested compat attributes
- * @skb: socket buffer to add attributes to
- * @attrtype: attribute type of container
- * @attrlen: length of structure
- * @data: pointer to structure
- *
- * Start a nested compat attribute that contains both a structure and
- * a set of nested attributes.
- *
- * Returns the container attribute
- */
-static inline struct nlattr *nla_nest_compat_start(struct sk_buff *skb,
-                                                   int attrtype, int attrlen,
-                                                   const void *data)
-{
-        struct nlattr *start = (struct nlattr *)skb_tail_pointer(skb);
-
-        if (nla_put(skb, attrtype, attrlen, data) < 0)
-                return NULL;
-        if (nla_nest_start(skb, attrtype) == NULL) {
-                nlmsg_trim(skb, start);
-                return NULL;
-        }
-        return start;
-}
-
-/**
- * nla_nest_compat_end - Finalize nesting of compat attributes
- * @skb: socket buffer the attributes are stored in
- * @start: container attribute
- *
- * Corrects the container attribute header to include the all
- * appeneded attributes.
- *
- * Returns the total data length of the skb.
- */
-static inline int nla_nest_compat_end(struct sk_buff *skb, struct nlattr *start)
-{
-        struct nlattr *nest = (void *)start + NLMSG_ALIGN(start->nla_len);
-
-        start->nla_len = skb_tail_pointer(skb) - (unsigned char *)start;
-        return nla_nest_end(skb, nest);
-}
-
-/**
  * nla_nest_cancel - Cancel nesting of attributes
  * @skb: socket buffer the message is stored in
  * @start: container attribute
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
new file mode 100644
index 000000000000..f4498a62881b
--- /dev/null
+++ b/include/net/netns/conntrack.h
@@ -0,0 +1,30 @@
+#ifndef __NETNS_CONNTRACK_H
+#define __NETNS_CONNTRACK_H
+
+#include <linux/list.h>
+#include <asm/atomic.h>
+
+struct ctl_table_header;
+struct nf_conntrack_ecache;
+
+struct netns_ct {
+        atomic_t                count;
+        unsigned int            expect_count;
+        struct hlist_head       *hash;
+        struct hlist_head       *expect_hash;
+        struct hlist_head       unconfirmed;
+        struct ip_conntrack_stat *stat;
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
+        struct nf_conntrack_ecache *ecache;
+#endif
+        int                     sysctl_acct;
+        int                     sysctl_checksum;
+        unsigned int            sysctl_log_invalid; /* Log invalid packets */
+#ifdef CONFIG_SYSCTL
+        struct ctl_table_header *sysctl_header;
+        struct ctl_table_header *acct_sysctl_header;
+#endif
+        int                     hash_vmalloc;
+        int                     expect_vmalloc;
+};
+#endif
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index a6ed83853dcc..ece1c926b5d1 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -38,6 +38,9 @@ struct netns_ipv4 {
         struct xt_table         *iptable_raw;
         struct xt_table         *arptable_filter;
         struct xt_table         *iptable_security;
+        struct xt_table         *nat_table;
+        struct hlist_head       *nat_bysource;
+        int                     nat_vmalloced;
 #endif
 
         int sysctl_icmp_echo_ignore_all;
diff --git a/include/net/netns/mib.h b/include/net/netns/mib.h
index 449147604642..10cb7c336de5 100644
--- a/include/net/netns/mib.h
+++ b/include/net/netns/mib.h
@@ -11,6 +11,15 @@ struct netns_mib {
         DEFINE_SNMP_STAT(struct udp_mib, udplite_statistics);
         DEFINE_SNMP_STAT(struct icmp_mib, icmp_statistics);
         DEFINE_SNMP_STAT(struct icmpmsg_mib, icmpmsg_statistics);
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        struct proc_dir_entry *proc_net_devsnmp6;
+        DEFINE_SNMP_STAT(struct udp_mib, udp_stats_in6);
+        DEFINE_SNMP_STAT(struct udp_mib, udplite_stats_in6);
+        DEFINE_SNMP_STAT(struct ipstats_mib, ipv6_statistics);
+        DEFINE_SNMP_STAT(struct icmpv6_mib, icmpv6_statistics);
+        DEFINE_SNMP_STAT(struct icmpv6msg_mib, icmpv6msg_statistics);
+#endif
 };
 
 #endif
diff --git a/include/net/phonet/gprs.h b/include/net/phonet/gprs.h
new file mode 100644
index 000000000000..928daf595beb
--- /dev/null
+++ b/include/net/phonet/gprs.h
@@ -0,0 +1,38 @@
+/*
+ * File: pep_gprs.h
+ *
+ * GPRS over Phonet pipe end point socket
+ *
+ * Copyright (C) 2008 Nokia Corporation.
+ *
+ * Author: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#ifndef NET_PHONET_GPRS_H
+#define NET_PHONET_GPRS_H
+
+struct sock;
+struct sk_buff;
+
+int pep_writeable(struct sock *sk);
+int pep_write(struct sock *sk, struct sk_buff *skb);
+struct sk_buff *pep_read(struct sock *sk);
+
+int gprs_attach(struct sock *sk);
+void gprs_detach(struct sock *sk);
+
+#endif
diff --git a/include/net/phonet/pep.h b/include/net/phonet/pep.h
new file mode 100644
index 000000000000..fcd793030e4d
--- /dev/null
+++ b/include/net/phonet/pep.h
@@ -0,0 +1,160 @@
+/*
+ * File: pep.h
+ *
+ * Phonet Pipe End Point sockets definitions
+ *
+ * Copyright (C) 2008 Nokia Corporation.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#ifndef NET_PHONET_PEP_H
+#define NET_PHONET_PEP_H
+
+struct pep_sock {
+        struct pn_sock          pn_sk;
+
+        /* XXX: union-ify listening vs connected stuff ? */
+        /* Listening socket stuff: */
+        struct hlist_head       ackq;
+        struct hlist_head       hlist;
+
+        /* Connected socket stuff: */
+        struct sock             *listener;
+        struct sk_buff_head     ctrlreq_queue;
+#define PNPIPE_CTRLREQ_MAX      10
+        int                     ifindex;
+        u16                     peer_type;      /* peer type/subtype */
+        u8                      pipe_handle;
+
+        u8                      rx_credits;
+        u8                      tx_credits;
+        u8                      rx_fc;  /* RX flow control */
+        u8                      tx_fc;  /* TX flow control */
+        u8                      init_enable;    /* auto-enable at creation */
+};
+
+static inline struct pep_sock *pep_sk(struct sock *sk)
+{
+        return (struct pep_sock *)sk;
+}
+
+extern const struct proto_ops phonet_stream_ops;
+
+/* Pipe protocol definitions */
+struct pnpipehdr {
+        u8                      utid; /* transaction ID */
+        u8                      message_id;
+        u8                      pipe_handle;
+        union {
+                u8              state_after_connect;    /* connect request */
+                u8              state_after_reset;      /* reset request */
+                u8              error_code;             /* any response */
+                u8              pep_type;               /* status indication */
+                u8              data[1];
+        };
+};
+#define other_pep_type          data[1]
+
+static inline struct pnpipehdr *pnp_hdr(struct sk_buff *skb)
+{
+        return (struct pnpipehdr *)skb_transport_header(skb);
+}
+
+#define MAX_PNPIPE_HEADER (MAX_PHONET_HEADER + 4)
+
+enum {
+        PNS_PIPE_DATA = 0x20,
+
+        PNS_PEP_CONNECT_REQ = 0x40,
+        PNS_PEP_CONNECT_RESP,
+        PNS_PEP_DISCONNECT_REQ,
+        PNS_PEP_DISCONNECT_RESP,
+        PNS_PEP_RESET_REQ,
+        PNS_PEP_RESET_RESP,
+        PNS_PEP_ENABLE_REQ,
+        PNS_PEP_ENABLE_RESP,
+        PNS_PEP_CTRL_REQ,
+        PNS_PEP_CTRL_RESP,
+        PNS_PEP_DISABLE_REQ = 0x4C,
+        PNS_PEP_DISABLE_RESP,
+
+        PNS_PEP_STATUS_IND = 0x60,
+        PNS_PIPE_CREATED_IND,
+        PNS_PIPE_RESET_IND = 0x63,
+        PNS_PIPE_ENABLED_IND,
+        PNS_PIPE_REDIRECTED_IND,
+        PNS_PIPE_DISABLED_IND = 0x66,
+};
+
+#define PN_PIPE_INVALID_HANDLE  0xff
+#define PN_PEP_TYPE_COMMON      0x00
+
+/* Phonet pipe status indication */
+enum {
+        PN_PEP_IND_FLOW_CONTROL,
+        PN_PEP_IND_ID_MCFC_GRANT_CREDITS,
+};
+
+/* Phonet pipe error codes */
+enum {
+        PN_PIPE_NO_ERROR,
+        PN_PIPE_ERR_INVALID_PARAM,
+        PN_PIPE_ERR_INVALID_HANDLE,
+        PN_PIPE_ERR_INVALID_CTRL_ID,
+        PN_PIPE_ERR_NOT_ALLOWED,
+        PN_PIPE_ERR_PEP_IN_USE,
+        PN_PIPE_ERR_OVERLOAD,
+        PN_PIPE_ERR_DEV_DISCONNECTED,
+        PN_PIPE_ERR_TIMEOUT,
+        PN_PIPE_ERR_ALL_PIPES_IN_USE,
+        PN_PIPE_ERR_GENERAL,
+        PN_PIPE_ERR_NOT_SUPPORTED,
+};
+
+/* Phonet pipe states */
+enum {
+        PN_PIPE_DISABLE,
+        PN_PIPE_ENABLE,
+};
+
+/* Phonet pipe sub-block types */
+enum {
+        PN_PIPE_SB_CREATE_REQ_PEP_SUB_TYPE,
+        PN_PIPE_SB_CONNECT_REQ_PEP_SUB_TYPE,
+        PN_PIPE_SB_REDIRECT_REQ_PEP_SUB_TYPE,
+        PN_PIPE_SB_NEGOTIATED_FC,
+        PN_PIPE_SB_REQUIRED_FC_TX,
+        PN_PIPE_SB_PREFERRED_FC_RX,
+};
+
+/* Phonet pipe flow control models */
+enum {
+        PN_NO_FLOW_CONTROL,
+        PN_LEGACY_FLOW_CONTROL,
+        PN_ONE_CREDIT_FLOW_CONTROL,
+        PN_MULTI_CREDIT_FLOW_CONTROL,
+};
+
+#define pn_flow_safe(fc) ((fc) >> 1)
+
+/* Phonet pipe flow control states */
+enum {
+        PEP_IND_EMPTY,
+        PEP_IND_BUSY,
+        PEP_IND_READY,
+};
+
+#endif
diff --git a/include/net/phonet/phonet.h b/include/net/phonet/phonet.h
new file mode 100644
index 000000000000..d4e72508e145
--- /dev/null
+++ b/include/net/phonet/phonet.h
@@ -0,0 +1,112 @@
+/*
+ * File: af_phonet.h
+ *
+ * Phonet sockets kernel definitions
+ *
+ * Copyright (C) 2008 Nokia Corporation.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#ifndef AF_PHONET_H
+#define AF_PHONET_H
+
+/*
+ * The lower layers may not require more space, ever. Make sure it's
+ * enough.
+ */
+#define MAX_PHONET_HEADER       8
+
+/*
+ * Every Phonet* socket has this structure first in its
+ * protocol-specific structure under name c.
+ */
+struct pn_sock {
+        struct sock     sk;
+        u16             sobject;
+        u8              resource;
+};
+
+static inline struct pn_sock *pn_sk(struct sock *sk)
+{
+        return (struct pn_sock *)sk;
+}
+
+extern const struct proto_ops phonet_dgram_ops;
+
+struct sock *pn_find_sock_by_sa(const struct sockaddr_pn *sa);
+void phonet_get_local_port_range(int *min, int *max);
+void pn_sock_hash(struct sock *sk);
+void pn_sock_unhash(struct sock *sk);
+int pn_sock_get_port(struct sock *sk, unsigned short sport);
+
+int pn_skb_send(struct sock *sk, struct sk_buff *skb,
+                const struct sockaddr_pn *target);
+
+static inline struct phonethdr *pn_hdr(struct sk_buff *skb)
+{
+        return (struct phonethdr *)skb_network_header(skb);
+}
+
+static inline struct phonetmsg *pn_msg(struct sk_buff *skb)
+{
+        return (struct phonetmsg *)skb_transport_header(skb);
+}
+
+/*
+ * Get the other party's sockaddr from received skb. The skb begins
+ * with a Phonet header.
+ */
+static inline
+void pn_skb_get_src_sockaddr(struct sk_buff *skb, struct sockaddr_pn *sa)
+{
+        struct phonethdr *ph = pn_hdr(skb);
+        u16 obj = pn_object(ph->pn_sdev, ph->pn_sobj);
+
+        sa->spn_family = AF_PHONET;
+        pn_sockaddr_set_object(sa, obj);
+        pn_sockaddr_set_resource(sa, ph->pn_res);
+        memset(sa->spn_zero, 0, sizeof(sa->spn_zero));
+}
+
+static inline
+void pn_skb_get_dst_sockaddr(struct sk_buff *skb, struct sockaddr_pn *sa)
+{
+        struct phonethdr *ph = pn_hdr(skb);
+        u16 obj = pn_object(ph->pn_rdev, ph->pn_robj);
+
+        sa->spn_family = AF_PHONET;
+        pn_sockaddr_set_object(sa, obj);
+        pn_sockaddr_set_resource(sa, ph->pn_res);
+        memset(sa->spn_zero, 0, sizeof(sa->spn_zero));
+}
+
+/* Protocols in Phonet protocol family. */
+struct phonet_protocol {
+        const struct proto_ops  *ops;
+        struct proto            *prot;
+        int                     sock_type;
+};
+
+int phonet_proto_register(int protocol, struct phonet_protocol *pp);
+void phonet_proto_unregister(int protocol, struct phonet_protocol *pp);
+
+int phonet_sysctl_init(void);
+void phonet_sysctl_exit(void);
+void phonet_netlink_register(void);
+int isi_register(void);
+void isi_unregister(void);
+
+#endif
diff --git a/include/net/phonet/pn_dev.h b/include/net/phonet/pn_dev.h
new file mode 100644
index 000000000000..bbd2a836e04c
--- /dev/null
+++ b/include/net/phonet/pn_dev.h
@@ -0,0 +1,50 @@
+/*
+ * File: pn_dev.h
+ *
+ * Phonet network device
+ *
+ * Copyright (C) 2008 Nokia Corporation.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#ifndef PN_DEV_H
+#define PN_DEV_H
+
+struct phonet_device_list {
+        struct list_head list;
+        spinlock_t lock;
+};
+
+extern struct phonet_device_list pndevs;
+
+struct phonet_device {
+        struct list_head list;
+        struct net_device *netdev;
+        DECLARE_BITMAP(addrs, 64);
+};
+
+void phonet_device_init(void);
+void phonet_device_exit(void);
+struct net_device *phonet_device_get(struct net *net);
+
+int phonet_address_add(struct net_device *dev, u8 addr);
+int phonet_address_del(struct net_device *dev, u8 addr);
+u8 phonet_address_get(struct net_device *dev, u8 addr);
+int phonet_address_lookup(u8 addr);
+
+#define PN_NO_ADDR      0xff
+
+#endif
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index b786a5b09253..4082f39f5079 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -90,10 +90,7 @@ extern void __qdisc_run(struct Qdisc *q);
 
 static inline void qdisc_run(struct Qdisc *q)
 {
-        struct netdev_queue *txq = q->dev_queue;
-
-        if (!netif_tx_queue_stopped(txq) &&
-            !test_and_set_bit(__QDISC_STATE_RUNNING, &q->state))
+        if (!test_and_set_bit(__QDISC_STATE_RUNNING, &q->state))
                 __qdisc_run(q);
 }
 
diff --git a/include/net/route.h b/include/net/route.h
index 4f0d8c14736c..4e8cae0e5841 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -27,7 +27,7 @@
 #include <net/dst.h>
 #include <net/inetpeer.h>
 #include <net/flow.h>
-#include <net/sock.h>
+#include <net/inet_sock.h>
 #include <linux/in_route.h>
 #include <linux/rtnetlink.h>
 #include <linux/route.h>
@@ -161,6 +161,10 @@ static inline int ip_route_connect(struct rtable **rp, __be32 dst,
 
         int err;
         struct net *net = sock_net(sk);
+
+        if (inet_sk(sk)->transparent)
+                fl.flags |= FLOWI_FLAG_ANYSRC;
+
         if (!dst || !src) {
                 err = __ip_route_output_key(net, rp, &fl);
                 if (err)
@@ -204,4 +208,9 @@ static inline struct inet_peer *rt_get_peer(struct rtable *rt)
         return rt->peer;
 }
 
+static inline int inet_iif(const struct sk_buff *skb)
+{
+        return skb->rtable->rt_iif;
+}
+
 #endif  /* _ROUTE_H */
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index e5569625d2a5..3fe49d808957 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -53,6 +53,7 @@ struct Qdisc
         atomic_t                refcnt;
         unsigned long           state;
         struct sk_buff          *gso_skb;
+        struct sk_buff_head     requeue;
         struct sk_buff_head     q;
         struct netdev_queue     *dev_queue;
         struct Qdisc            *next_sched;
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index c32ddf0279c8..b05b0557211f 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -261,7 +261,9 @@ enum { SCTP_ARBITRARY_COOKIE_ECHO_LEN = 200 };
  * must be less than 65535 (2^16 - 1), or we will have overflow
  * problems creating SACK's.
  */
-#define SCTP_TSN_MAP_SIZE 2048
+#define SCTP_TSN_MAP_INITIAL BITS_PER_LONG
+#define SCTP_TSN_MAP_INCREMENT SCTP_TSN_MAP_INITIAL
+#define SCTP_TSN_MAP_SIZE 4096
 #define SCTP_TSN_MAX_GAP  65535
 
 /* We will not record more than this many duplicate TSNs between two
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 17b932b8a55a..703305d00365 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -406,10 +406,7 @@ struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id);
 
 /* A macro to walk a list of skbs.  */
 #define sctp_skb_for_each(pos, head, tmp) \
-for (pos = (head)->next;\
-     tmp = (pos)->next, pos != ((struct sk_buff *)(head));\
-     pos = tmp)
-
+        skb_queue_walk_safe(head, pos, tmp)
 
 /* A helper to append an entire skb list (list) to another (head). */
 static inline void sctp_skb_list_tail(struct sk_buff_head *list,
@@ -420,10 +417,7 @@ static inline void sctp_skb_list_tail(struct sk_buff_head *list,
         sctp_spin_lock_irqsave(&head->lock, flags);
         sctp_spin_lock(&list->lock);
 
-        list_splice((struct list_head *)list, (struct list_head *)head->prev);
-
-        head->qlen += list->qlen;
-        list->qlen = 0;
+        skb_queue_splice_tail_init(list, head);
 
         sctp_spin_unlock(&list->lock);
         sctp_spin_unlock_irqrestore(&head->lock, flags);
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 24811732bdb2..029a54a02396 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -227,6 +227,9 @@ struct sctp_chunk *sctp_make_abort_violation(const struct sctp_association *,
                                    const struct sctp_chunk *,
                                    const __u8 *,
                                    const size_t );
+struct sctp_chunk *sctp_make_violation_paramlen(const struct sctp_association *,
+                                   const struct sctp_chunk *,
+                                   struct sctp_paramhdr *);
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *,
                                   const struct sctp_transport *,
                                   const void *payload,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index ab1c472ea753..9661d7b765f0 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -731,20 +731,23 @@ struct sctp_chunk {
          */
         struct sk_buff *auth_chunk;
 
-        __u8 rtt_in_progress;   /* Is this chunk used for RTT calculation? */
-        __u8 resent;            /* Has this chunk ever been retransmitted. */
-        __u8 has_tsn;           /* Does this chunk have a TSN yet? */
-        __u8 has_ssn;           /* Does this chunk have a SSN yet? */
-        __u8 singleton;         /* Was this the only chunk in the packet? */
-        __u8 end_of_packet;     /* Was this the last chunk in the packet? */
-        __u8 ecn_ce_done;       /* Have we processed the ECN CE bit? */
-        __u8 pdiscard;          /* Discard the whole packet now? */
-        __u8 tsn_gap_acked;     /* Is this chunk acked by a GAP ACK? */
-        __s8 fast_retransmit;    /* Is this chunk fast retransmitted? */
-        __u8 tsn_missing_report; /* Data chunk missing counter. */
-        __u8 data_accepted;     /* At least 1 chunk in this packet accepted */
-        __u8 auth;              /* IN: was auth'ed | OUT: needs auth */
-        __u8 has_asconf;        /* IN: have seen an asconf before */
+#define SCTP_CAN_FRTX 0x0
+#define SCTP_NEED_FRTX 0x1
+#define SCTP_DONT_FRTX 0x2
+        __u16   rtt_in_progress:1,      /* This chunk used for RTT calc? */
+                resent:1,               /* Has this chunk ever been resent. */
+                has_tsn:1,              /* Does this chunk have a TSN yet? */
+                has_ssn:1,              /* Does this chunk have a SSN yet? */
+                singleton:1,            /* Only chunk in the packet? */
+                end_of_packet:1,        /* Last chunk in the packet? */
+                ecn_ce_done:1,          /* Have we processed the ECN CE bit? */
+                pdiscard:1,             /* Discard the whole packet now? */
+                tsn_gap_acked:1,        /* Is this chunk acked by a GAP ACK? */
+                data_accepted:1,        /* At least 1 chunk accepted */
+                auth:1,                 /* IN: was auth'ed | OUT: needs auth */
+                has_asconf:1,           /* IN: have seen an asconf before */
+                tsn_missing_report:2,   /* Data chunk missing counter. */
+                fast_retransmit:2;      /* Is this chunk fast retransmitted? */
 };
 
 void sctp_chunk_hold(struct sctp_chunk *);
@@ -1225,7 +1228,7 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw, int len,
 
 sctp_scope_t sctp_scope(const union sctp_addr *);
 int sctp_in_scope(const union sctp_addr *addr, const sctp_scope_t scope);
-int sctp_is_any(const union sctp_addr *addr);
+int sctp_is_any(struct sock *sk, const union sctp_addr *addr);
 int sctp_addr_is_valid(const union sctp_addr *addr);
 
 
@@ -1542,7 +1545,6 @@ struct sctp_association {
                  * in tsn_map--we get it by calling sctp_tsnmap_get_ctsn().
                  */
                 struct sctp_tsnmap tsn_map;
-                __u8 _map[sctp_tsnmap_storage_size(SCTP_TSN_MAP_SIZE)];
 
                 /* Ack State   : This flag indicates if the next received
                  *             : packet is to be responded to with a
diff --git a/include/net/sctp/tsnmap.h b/include/net/sctp/tsnmap.h
index 099211bf998d..4aabc5a96cf6 100644
--- a/include/net/sctp/tsnmap.h
+++ b/include/net/sctp/tsnmap.h
@@ -60,18 +60,7 @@ struct sctp_tsnmap {
          * It points at one of the two buffers with which we will
          * ping-pong between.
          */
-        __u8 *tsn_map;
-
-        /* This marks the tsn which overflows the tsn_map, when the
-         * cumulative ack point reaches this point we know we can switch
-         * maps (tsn_map and overflow_map swap).
-         */
-        __u32 overflow_tsn;
-
-        /* This is the overflow array for tsn_map.
-         * It points at one of the other ping-pong buffers.
-         */
-        __u8 *overflow_map;
+        unsigned long *tsn_map;
 
         /* This is the TSN at tsn_map[0].  */
         __u32 base_tsn;
@@ -89,15 +78,15 @@ struct sctp_tsnmap {
          */
         __u32 cumulative_tsn_ack_point;
 
+        /* This is the highest TSN we've marked.  */
+        __u32 max_tsn_seen;
+
         /* This is the minimum number of TSNs we can track.  This corresponds
          * to the size of tsn_map.   Note: the overflow_map allows us to
          * potentially track more than this quantity.
          */
         __u16 len;
 
-        /* This is the highest TSN we've marked.  */
-        __u32 max_tsn_seen;
-
         /* Data chunks pending receipt. used by SCTP_STATUS sockopt */
         __u16 pending_data;
 
@@ -105,29 +94,19 @@ struct sctp_tsnmap {
          * every SACK.  Store up to SCTP_MAX_DUP_TSNS worth of
          * information.
          */
-        __be32 dup_tsns[SCTP_MAX_DUP_TSNS];
         __u16 num_dup_tsns;
-
-        /* Record gap ack block information here.  */
-        struct sctp_gap_ack_block gabs[SCTP_MAX_GABS];
-
-        int malloced;
-
-        __u8 raw_map[0];
+        __be32 dup_tsns[SCTP_MAX_DUP_TSNS];
 };
 
 struct sctp_tsnmap_iter {
         __u32 start;
 };
 
-/* This macro assists in creation of external storage for variable length
- * internal buffers.  We double allocate so the overflow map works.
- */
-#define sctp_tsnmap_storage_size(count) (sizeof(__u8) * (count) * 2)
-
 /* Initialize a block of memory as a tsnmap.  */
 struct sctp_tsnmap *sctp_tsnmap_init(struct sctp_tsnmap *, __u16 len,
-                                     __u32 initial_tsn);
+                                     __u32 initial_tsn, gfp_t gfp);
+
+void sctp_tsnmap_free(struct sctp_tsnmap *map);
 
 /* Test the tracking state of this TSN.
  * Returns:
@@ -138,7 +117,7 @@ struct sctp_tsnmap *sctp_tsnmap_init(struct sctp_tsnmap *, __u16 len,
 int sctp_tsnmap_check(const struct sctp_tsnmap *, __u32 tsn);
 
 /* Mark this TSN as seen.  */
-void sctp_tsnmap_mark(struct sctp_tsnmap *, __u32 tsn);
+int sctp_tsnmap_mark(struct sctp_tsnmap *, __u32 tsn);
 
 /* Mark this TSN and all lower as seen. */
 void sctp_tsnmap_skip(struct sctp_tsnmap *map, __u32 tsn);
@@ -169,24 +148,16 @@ static inline __be32 *sctp_tsnmap_get_dups(struct sctp_tsnmap *map)
 }
 
 /* How many gap ack blocks do we have recorded? */
-__u16 sctp_tsnmap_num_gabs(struct sctp_tsnmap *map);
+__u16 sctp_tsnmap_num_gabs(struct sctp_tsnmap *map,
+                           struct sctp_gap_ack_block *gabs);
 
 /* Refresh the count on pending data. */
 __u16 sctp_tsnmap_pending(struct sctp_tsnmap *map);
 
-/* Return pointer to gap ack blocks as needed by SACK. */
-static inline struct sctp_gap_ack_block *sctp_tsnmap_get_gabs(struct sctp_tsnmap *map)
-{
-        return map->gabs;
-}
-
 /* Is there a gap in the TSN map?  */
 static inline int sctp_tsnmap_has_gap(const struct sctp_tsnmap *map)
 {
-        int has_gap;
-
-        has_gap = (map->cumulative_tsn_ack_point != map->max_tsn_seen);
-        return has_gap;
+        return (map->cumulative_tsn_ack_point != map->max_tsn_seen);
 }
 
 /* Mark a duplicate TSN.  Note:  limit the storage of duplicate TSN
diff --git a/include/net/sock.h b/include/net/sock.h
index 06c5259aff30..ada50c04d09f 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -482,6 +482,11 @@ static inline void sk_add_backlog(struct sock *sk, struct sk_buff *skb)
         skb->next = NULL;
 }
 
+static inline int sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+{
+        return sk->sk_backlog_rcv(sk, skb);
+}
+
 #define sk_wait_event(__sk, __timeo, __condition)                       \
         ({      int __rc;                                               \
                 release_sock(__sk);                                     \
@@ -532,6 +537,7 @@ struct proto {
         int                     (*getsockopt)(struct sock *sk, int level, 
                                         int optname, char __user *optval, 
                                         int __user *option);     
+#ifdef CONFIG_COMPAT
         int                     (*compat_setsockopt)(struct sock *sk,
                                         int level,
                                         int optname, char __user *optval,
@@ -540,6 +546,7 @@ struct proto {
                                         int level,
                                         int optname, char __user *optval,
                                         int __user *option);
+#endif
         int                     (*sendmsg)(struct kiocb *iocb, struct sock *sk,
                                            struct msghdr *msg, size_t len);
         int                     (*recvmsg)(struct kiocb *iocb, struct sock *sk,
@@ -1322,6 +1329,18 @@ static inline void sk_change_net(struct sock *sk, struct net *net)
         sock_net_set(sk, hold_net(net));
 }
 
+static inline struct sock *skb_steal_sock(struct sk_buff *skb)
+{
+        if (unlikely(skb->sk)) {
+                struct sock *sk = skb->sk;
+
+                skb->destructor = NULL;
+                skb->sk = NULL;
+                return sk;
+        }
+        return NULL;
+}
+
 extern void sock_enable_timestamp(struct sock *sk);
 extern int sock_get_timestamp(struct sock *, struct timeval __user *);
 extern int sock_get_timestampns(struct sock *, struct timespec __user *);
diff --git a/include/net/tc_act/tc_skbedit.h b/include/net/tc_act/tc_skbedit.h
new file mode 100644
index 000000000000..6abb3ed3ebf7
--- /dev/null
+++ b/include/net/tc_act/tc_skbedit.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2008, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * Author: Alexander Duyck <alexander.h.duyck@intel.com>
+ */
+
+#ifndef __NET_TC_SKBEDIT_H
+#define __NET_TC_SKBEDIT_H
+
+#include <net/act_api.h>
+
+struct tcf_skbedit {
+        struct tcf_common       common;
+        u32                     flags;
+        u32                     priority;
+        u16                     queue_mapping;
+};
+#define to_skbedit(pc) \
+        container_of(pc, struct tcf_skbedit, common)
+
+#endif /* __NET_TC_SKBEDIT_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 8983386356a5..438014d57610 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -472,6 +472,8 @@ extern void tcp_send_delayed_ack(struct sock *sk);
 
 /* tcp_input.c */
 extern void tcp_cwnd_application_limited(struct sock *sk);
+extern void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp,
+                                            struct sk_buff *skb);
 
 /* tcp_timer.c */
 extern void tcp_init_xmit_timers(struct sock *);
@@ -894,7 +896,7 @@ static inline int tcp_prequeue(struct sock *sk, struct sk_buff *skb)
                         BUG_ON(sock_owned_by_user(sk));
 
                         while ((skb1 = __skb_dequeue(&tp->ucopy.prequeue)) != NULL) {
-                                sk->sk_backlog_rcv(sk, skb1);
+                                sk_backlog_rcv(sk, skb1);
                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPPREQUEUEDROPPED);
                         }
 
@@ -974,6 +976,7 @@ static inline void tcp_openreq_init(struct request_sock *req,
         ireq->acked = 0;
         ireq->ecn_ok = 0;
         ireq->rmt_port = tcp_hdr(skb)->source;
+        ireq->loc_port = tcp_hdr(skb)->dest;
 }
 
 extern void tcp_enter_memory_pressure(struct sock *sk);
@@ -1039,13 +1042,12 @@ static inline void tcp_clear_retrans_hints_partial(struct tcp_sock *tp)
 {
         tp->lost_skb_hint = NULL;
         tp->scoreboard_skb_hint = NULL;
-        tp->retransmit_skb_hint = NULL;
-        tp->forward_skb_hint = NULL;
 }
 
 static inline void tcp_clear_all_retrans_hints(struct tcp_sock *tp)
 {
         tcp_clear_retrans_hints_partial(tp);
+        tp->retransmit_skb_hint = NULL;
 }
 
 /* MD5 Signature */
@@ -1180,49 +1182,45 @@ static inline void tcp_write_queue_purge(struct sock *sk)
 
 static inline struct sk_buff *tcp_write_queue_head(struct sock *sk)
 {
-        struct sk_buff *skb = sk->sk_write_queue.next;
-        if (skb == (struct sk_buff *) &sk->sk_write_queue)
-                return NULL;
-        return skb;
+        return skb_peek(&sk->sk_write_queue);
 }
 
 static inline struct sk_buff *tcp_write_queue_tail(struct sock *sk)
 {
-        struct sk_buff *skb = sk->sk_write_queue.prev;
-        if (skb == (struct sk_buff *) &sk->sk_write_queue)
-                return NULL;
-        return skb;
+        return skb_peek_tail(&sk->sk_write_queue);
 }
 
 static inline struct sk_buff *tcp_write_queue_next(struct sock *sk, struct sk_buff *skb)
 {
-        return skb->next;
+        return skb_queue_next(&sk->sk_write_queue, skb);
 }
 
 #define tcp_for_write_queue(skb, sk)                                    \
-                for (skb = (sk)->sk_write_queue.next;                   \
-                     (skb != (struct sk_buff *)&(sk)->sk_write_queue);  \
-                     skb = skb->next)
+        skb_queue_walk(&(sk)->sk_write_queue, skb)
 
 #define tcp_for_write_queue_from(skb, sk)                               \
-                for (; (skb != (struct sk_buff *)&(sk)->sk_write_queue);\
-                     skb = skb->next)
+        skb_queue_walk_from(&(sk)->sk_write_queue, skb)
 
 #define tcp_for_write_queue_from_safe(skb, tmp, sk)                     \
-                for (tmp = skb->next;                                   \
-                     (skb != (struct sk_buff *)&(sk)->sk_write_queue);  \
-                     skb = tmp, tmp = skb->next)
+        skb_queue_walk_from_safe(&(sk)->sk_write_queue, skb, tmp)
 
 static inline struct sk_buff *tcp_send_head(struct sock *sk)
 {
         return sk->sk_send_head;
 }
 
+static inline bool tcp_skb_is_last(const struct sock *sk,
+                                   const struct sk_buff *skb)
+{
+        return skb_queue_is_last(&sk->sk_write_queue, skb);
+}
+
 static inline void tcp_advance_send_head(struct sock *sk, struct sk_buff *skb)
 {
-        sk->sk_send_head = skb->next;
-        if (sk->sk_send_head == (struct sk_buff *)&sk->sk_write_queue)
+        if (tcp_skb_is_last(sk, skb))
                 sk->sk_send_head = NULL;
+        else
+                sk->sk_send_head = tcp_write_queue_next(sk, skb);
 }
 
 static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unlinked)
@@ -1267,12 +1265,12 @@ static inline void tcp_insert_write_queue_after(struct sk_buff *skb,
         __skb_queue_after(&sk->sk_write_queue, skb, buff);
 }
 
-/* Insert skb between prev and next on the write queue of sk.  */
+/* Insert new before skb on the write queue of sk.  */
 static inline void tcp_insert_write_queue_before(struct sk_buff *new,
                                                   struct sk_buff *skb,
                                                   struct sock *sk)
 {
-        __skb_insert(new, skb->prev, skb, &sk->sk_write_queue);
+        __skb_queue_before(&sk->sk_write_queue, skb, new);
 
         if (sk->sk_send_head == skb)
                 sk->sk_send_head = new;
@@ -1283,12 +1281,6 @@ static inline void tcp_unlink_write_queue(struct sk_buff *skb, struct sock *sk)
         __skb_unlink(skb, &sk->sk_write_queue);
 }
 
-static inline int tcp_skb_is_last(const struct sock *sk,
-                                  const struct sk_buff *skb)
-{
-        return skb->next == (struct sk_buff *)&sk->sk_write_queue;
-}
-
 static inline int tcp_write_queue_empty(struct sock *sk)
 {
         return skb_queue_empty(&sk->sk_write_queue);
diff --git a/include/net/udp.h b/include/net/udp.h
index addcdc67234c..1e205095ea68 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -148,10 +148,9 @@ extern int 	udp_lib_setsockopt(struct sock *sk, int level, int optname,
                                    char __user *optval, int optlen,
                                    int (*push_pending_frames)(struct sock *));
 
-DECLARE_SNMP_STAT(struct udp_mib, udp_stats_in6);
-
-/* UDP-Lite does not have a standardized MIB yet, so we inherit from UDP */
-DECLARE_SNMP_STAT(struct udp_mib, udplite_stats_in6);
+extern struct sock *udp4_lib_lookup(struct net *net, __be32 saddr, __be16 sport,
+                                    __be32 daddr, __be16 dport,
+                                    int dif);
 
 /*
  *      SNMP statistics for UDP and UDP-Lite
@@ -163,12 +162,14 @@ DECLARE_SNMP_STAT(struct udp_mib, udplite_stats_in6);
         if (is_udplite) SNMP_INC_STATS_BH((net)->mib.udplite_statistics, field);         \
         else            SNMP_INC_STATS_BH((net)->mib.udp_statistics, field);    }  while(0)
 
-#define UDP6_INC_STATS_BH(net, field, is_udplite)           do { (void)net;  \
-        if (is_udplite) SNMP_INC_STATS_BH(udplite_stats_in6, field);         \
-        else            SNMP_INC_STATS_BH(udp_stats_in6, field);    } while(0)
-#define UDP6_INC_STATS_USER(net, field, is_udplite)         do { (void)net;    \
-        if (is_udplite) SNMP_INC_STATS_USER(udplite_stats_in6, field);         \
-        else            SNMP_INC_STATS_USER(udp_stats_in6, field);    } while(0)
+#define UDP6_INC_STATS_BH(net, field, is_udplite)           do { \
+        if (is_udplite) SNMP_INC_STATS_BH((net)->mib.udplite_stats_in6, field);\
+        else            SNMP_INC_STATS_BH((net)->mib.udp_stats_in6, field);  \
+} while(0)
+#define UDP6_INC_STATS_USER(net, field, __lite)             do { \
+        if (__lite) SNMP_INC_STATS_USER((net)->mib.udplite_stats_in6, field);  \
+        else        SNMP_INC_STATS_USER((net)->mib.udp_stats_in6, field);      \
+} while(0)
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #define UDPX_INC_STATS_BH(sk, field) \
diff --git a/include/net/wireless.h b/include/net/wireless.h
index 9324f8dd183e..721efb363db7 100644
--- a/include/net/wireless.h
+++ b/include/net/wireless.h
@@ -60,6 +60,7 @@ enum ieee80211_channel_flags {
  * with cfg80211.
  *
  * @center_freq: center frequency in MHz
+ * @max_bandwidth: maximum allowed bandwidth for this channel, in MHz
  * @hw_value: hardware-specific value for the channel
  * @flags: channel flags from &enum ieee80211_channel_flags.
  * @orig_flags: channel flags at registration time, used by regulatory
@@ -73,6 +74,7 @@ enum ieee80211_channel_flags {
 struct ieee80211_channel {
         enum ieee80211_band band;
         u16 center_freq;
+        u8 max_bandwidth;
         u16 hw_value;
         u32 flags;
         int max_antenna_gain;
@@ -178,6 +180,7 @@ struct ieee80211_supported_band {
  * struct wiphy - wireless hardware description
  * @idx: the wiphy index assigned to this item
  * @class_dev: the class device representing /sys/class/ieee80211/<wiphy-name>
+ * @reg_notifier: the driver's regulatory notification callback
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -185,6 +188,9 @@ struct wiphy {
         /* permanent MAC address */
         u8 perm_addr[ETH_ALEN];
 
+        /* Supported interface modes, OR together BIT(NL80211_IFTYPE_...) */
+        u16 interface_modes;
+
         /* If multiple wiphys are registered and you're handed e.g.
          * a regular netdev with assigned ieee80211_ptr, you won't
          * know whether it points to a wiphy your driver has registered
@@ -194,6 +200,9 @@ struct wiphy {
 
         struct ieee80211_supported_band *bands[IEEE80211_NUM_BANDS];
 
+        /* Lets us get back the wiphy on the callback */
+        int (*reg_notifier)(struct wiphy *wiphy, enum reg_set_by setby);
+
         /* fields below are read-only, assigned by cfg80211 */
 
         /* the item in /sys/class/ieee80211/ points to this,
@@ -214,9 +223,11 @@ struct wiphy {
  * the netdev.)
  *
  * @wiphy: pointer to hardware description
+ * @iftype: interface type
  */
 struct wireless_dev {
         struct wiphy *wiphy;
+        enum nl80211_iftype iftype;
 
         /* private to the generic wireless code */
         struct list_head list;
@@ -319,7 +330,6 @@ extern int ieee80211_frequency_to_channel(int freq);
  */
 extern struct ieee80211_channel *__ieee80211_get_channel(struct wiphy *wiphy,
                                                          int freq);
-
 /**
  * ieee80211_get_channel - get channel struct from wiphy for specified frequency
  */
@@ -328,4 +338,57 @@ ieee80211_get_channel(struct wiphy *wiphy, int freq)
 {
         return __ieee80211_get_channel(wiphy, freq);
 }
+
+/**
+ * __regulatory_hint - hint to the wireless core a regulatory domain
+ * @wiphy: if a driver is providing the hint this is the driver's very
+ *      own &struct wiphy
+ * @alpha2: the ISO/IEC 3166 alpha2 being claimed the regulatory domain
+ *      should be in. If @rd is set this should be NULL
+ * @rd: a complete regulatory domain, if passed the caller need not worry
+ *      about freeing it
+ *
+ * The Wireless subsystem can use this function to hint to the wireless core
+ * what it believes should be the current regulatory domain by
+ * giving it an ISO/IEC 3166 alpha2 country code it knows its regulatory
+ * domain should be in or by providing a completely build regulatory domain.
+ *
+ * Returns -EALREADY if *a regulatory domain* has already been set. Note that
+ * this could be by another driver. It is safe for drivers to continue if
+ * -EALREADY is returned, if drivers are not capable of world roaming they
+ * should not register more channels than they support. Right now we only
+ * support listening to the first driver hint. If the driver is capable
+ * of world roaming but wants to respect its own EEPROM mappings for
+ * specific regulatory domains it should register the @reg_notifier callback
+ * on the &struct wiphy. Returns 0 if the hint went through fine or through an
+ * intersection operation. Otherwise a standard error code is returned.
+ *
+ */
+extern int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
+                const char *alpha2, struct ieee80211_regdomain *rd);
+/**
+ * regulatory_hint - driver hint to the wireless core a regulatory domain
+ * @wiphy: the driver's very own &struct wiphy
+ * @alpha2: the ISO/IEC 3166 alpha2 the driver claims its regulatory domain
+ *      should be in. If @rd is set this should be NULL. Note that if you
+ *      set this to NULL you should still set rd->alpha2 to some accepted
+ *      alpha2.
+ * @rd: a complete regulatory domain provided by the driver. If passed
+ *      the driver does not need to worry about freeing it.
+ *
+ * Wireless drivers can use this function to hint to the wireless core
+ * what it believes should be the current regulatory domain by
+ * giving it an ISO/IEC 3166 alpha2 country code it knows its regulatory
+ * domain should be in or by providing a completely build regulatory domain.
+ * If the driver provides an ISO/IEC 3166 alpha2 userspace will be queried
+ * for a regulatory domain structure for the respective country. If
+ * a regulatory domain is build and passed you should set the alpha2
+ * if possible, otherwise set it to the special value of "99" which tells
+ * the wireless core it is unknown. If you pass a built regulatory domain
+ * and we return non zero you are in charge of kfree()'ing the structure.
+ *
+ * See __regulatory_hint() documentation for possible return values.
+ */
+extern int regulatory_hint(struct wiphy *wiphy,
+                const char *alpha2, struct ieee80211_regdomain *rd);
 #endif /* __NET_WIRELESS_H */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 2933d7474a79..11c890ad8ebb 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -117,12 +117,23 @@ extern struct mutex xfrm_cfg_mutex;
       metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
  */
 
+struct xfrm_state_walk {
+        struct list_head        all;
+        u8                      state;
+        union {
+                u8              dying;
+                u8              proto;
+        };
+        u32                     seq;
+};
+
 /* Full description of state of transformer. */
 struct xfrm_state
 {
-        /* Note: bydst is re-used during gc */
-        struct list_head        all;
-        struct hlist_node       bydst;
+        union {
+                struct hlist_node       gclist;
+                struct hlist_node       bydst;
+        };
         struct hlist_node       bysrc;
         struct hlist_node       byspi;
 
@@ -134,12 +145,8 @@ struct xfrm_state
 
         u32                     genid;
 
-        /* Key manger bits */
-        struct {
-                u8              state;
-                u8              dying;
-                u32             seq;
-        } km;
+        /* Key manager bits */
+        struct xfrm_state_walk  km;
 
         /* Parameters of this state. */
         struct {
@@ -447,10 +454,20 @@ struct xfrm_tmpl
 
 #define XFRM_MAX_DEPTH          6
 
+struct xfrm_policy_walk_entry {
+        struct list_head        all;
+        u8                      dead;
+};
+
+struct xfrm_policy_walk {
+        struct xfrm_policy_walk_entry walk;
+        u8 type;
+        u32 seq;
+};
+
 struct xfrm_policy
 {
         struct xfrm_policy      *next;
-        struct list_head        bytype;
         struct hlist_node       bydst;
         struct hlist_node       byidx;
 
@@ -465,17 +482,23 @@ struct xfrm_policy
         struct xfrm_lifetime_cfg lft;
         struct xfrm_lifetime_cur curlft;
         struct dst_entry       *bundles;
-        u16                     family;
+        struct xfrm_policy_walk_entry walk;
         u8                      type;
         u8                      action;
         u8                      flags;
-        u8                      dead;
         u8                      xfrm_nr;
-        /* XXX 1 byte hole, try to pack */
+        u16                     family;
         struct xfrm_sec_ctx     *security;
         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
 };
 
+struct xfrm_kmaddress {
+        xfrm_address_t          local;
+        xfrm_address_t          remote;
+        u32                     reserved;
+        u16                     family;
+};
+
 struct xfrm_migrate {
         xfrm_address_t          old_daddr;
         xfrm_address_t          old_saddr;
@@ -515,7 +538,7 @@ struct xfrm_mgr
         int                     (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
         int                     (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
         int                     (*report)(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
-        int                     (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles);
+        int                     (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles, struct xfrm_kmaddress *k);
 };
 
 extern int xfrm_register_km(struct xfrm_mgr *km);
@@ -1243,18 +1266,6 @@ struct xfrm6_tunnel {
         int priority;
 };
 
-struct xfrm_state_walk {
-        struct xfrm_state *state;
-        int count;
-        u8 proto;
-};
-
-struct xfrm_policy_walk {
-        struct xfrm_policy *policy;
-        int count;
-        u8 type, cur_type;
-};
-
 extern void xfrm_init(void);
 extern void xfrm4_init(void);
 extern void xfrm_state_init(void);
@@ -1279,23 +1290,10 @@ static inline void xfrm6_fini(void)
 extern int xfrm_proc_init(void);
 #endif
 
-static inline void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
-{
-        walk->proto = proto;
-        walk->state = NULL;
-        walk->count = 0;
-}
-
-static inline void xfrm_state_walk_done(struct xfrm_state_walk *walk)
-{
-        if (walk->state != NULL) {
-                xfrm_state_put(walk->state);
-                walk->state = NULL;
-        }
-}
-
+extern void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
 extern int xfrm_state_walk(struct xfrm_state_walk *walk,
                            int (*func)(struct xfrm_state *, int, void*), void *);
+extern void xfrm_state_walk_done(struct xfrm_state_walk *walk);
 extern struct xfrm_state *xfrm_state_alloc(void);
 extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 
                                           struct flowi *fl, struct xfrm_tmpl *tmpl,
@@ -1419,24 +1417,10 @@ static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
 
 struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp);
 
-static inline void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type)
-{
-        walk->cur_type = XFRM_POLICY_TYPE_MAIN;
-        walk->type = type;
-        walk->policy = NULL;
-        walk->count = 0;
-}
-
-static inline void xfrm_policy_walk_done(struct xfrm_policy_walk *walk)
-{
-        if (walk->policy != NULL) {
-                xfrm_pol_put(walk->policy);
-                walk->policy = NULL;
-        }
-}
-
+extern void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
 extern int xfrm_policy_walk(struct xfrm_policy_walk *walk,
         int (*func)(struct xfrm_policy *, int, int, void*), void *);
+extern void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
 struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
                                           struct xfrm_selector *sel,
@@ -1455,12 +1439,14 @@ extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
 
 #ifdef CONFIG_XFRM_MIGRATE
 extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
-                      struct xfrm_migrate *m, int num_bundles);
+                      struct xfrm_migrate *m, int num_bundles,
+                      struct xfrm_kmaddress *k);
 extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
 extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
                                               struct xfrm_migrate *m);
 extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
-                        struct xfrm_migrate *m, int num_bundles);
+                        struct xfrm_migrate *m, int num_bundles,
+                        struct xfrm_kmaddress *k);
 #endif
 
 extern wait_queue_head_t km_waitq;