49 files changed, 1280 insertions, 414 deletions

diff --git a/include/net/act_api.h b/include/net/act_api.h
index 565eed8fe496..c05fd717c588 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -16,7 +16,7 @@ struct tcf_common {
         u32                             tcfc_capab;
         int                             tcfc_action;
         struct tcf_t                    tcfc_tm;
-        struct gnet_stats_basic         tcfc_bstats;
+        struct gnet_stats_basic_packed  tcfc_bstats;
         struct gnet_stats_queue         tcfc_qstats;
         struct gnet_stats_rate_est      tcfc_rate_est;
         spinlock_t                      tcfc_lock;
diff --git a/include/net/ieee802154/af_ieee802154.h b/include/net/af_ieee802154.h
index 0d78605fb1a6..75e64c7a2960 100644
--- a/include/net/ieee802154/af_ieee802154.h
+++ b/include/net/af_ieee802154.h
@@ -54,7 +54,9 @@ struct sockaddr_ieee802154 {
         struct ieee802154_addr addr;
 };
 
-/* master device */
-#define IEEE802154_SIOC_ADD_SLAVE               (SIOCDEVPRIVATE + 0)
+/* get/setsockopt */
+#define SOL_IEEE802154  0
+
+#define WPAN_WANTACK    0
 
 #endif
diff --git a/include/net/arp.h b/include/net/arp.h
index c236270ec95e..716f43c5c98e 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -26,6 +26,6 @@ extern struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
                                   const unsigned char *target_hw);
 extern void arp_xmit(struct sk_buff *skb);
 
-extern struct neigh_ops arp_broken_ops;
+extern const struct neigh_ops arp_broken_ops;
 
 #endif  /* _ARP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 968166a45f86..718394e2c01e 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -138,8 +138,11 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
 struct bt_skb_cb {
         __u8 pkt_type;
         __u8 incoming;
+        __u8 tx_seq;
+        __u8 retries;
+        __u8 sar;
 };
-#define bt_cb(skb) ((struct bt_skb_cb *)(skb->cb)) 
+#define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
 
 static inline struct sk_buff *bt_skb_alloc(unsigned int len, gfp_t how)
 {
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index c4ca4228b083..7b640aeddb64 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -117,7 +117,7 @@ struct hci_dev {
         struct sk_buff          *sent_cmd;
         struct sk_buff          *reassembly[3];
 
-        struct semaphore        req_lock;
+        struct mutex            req_lock;
         wait_queue_head_t       req_wait_q;
         __u32                   req_status;
         __u32                   req_result;
@@ -187,6 +187,7 @@ struct hci_conn {
         struct work_struct work_del;
 
         struct device   dev;
+        atomic_t        devref;
 
         struct hci_dev  *hdev;
         void            *l2cap_data;
@@ -339,6 +340,9 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 void hci_conn_enter_active_mode(struct hci_conn *conn);
 void hci_conn_enter_sniff_mode(struct hci_conn *conn);
 
+void hci_conn_hold_device(struct hci_conn *conn);
+void hci_conn_put_device(struct hci_conn *conn);
+
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
         atomic_inc(&conn->refcnt);
@@ -700,8 +704,8 @@ struct hci_sec_filter {
 #define HCI_REQ_PEND      1
 #define HCI_REQ_CANCELED  2
 
-#define hci_req_lock(d)         down(&d->req_lock)
-#define hci_req_unlock(d)       up(&d->req_lock)
+#define hci_req_lock(d)         mutex_lock(&d->req_lock)
+#define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
 
 void hci_req_complete(struct hci_dev *hdev, int result);
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index e919fca1072a..9516f4b4a3c2 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -27,12 +27,14 @@
 
 /* L2CAP defaults */
 #define L2CAP_DEFAULT_MTU               672
+#define L2CAP_DEFAULT_MIN_MTU           48
 #define L2CAP_DEFAULT_FLUSH_TO          0xffff
-#define L2CAP_DEFAULT_RX_WINDOW         1
-#define L2CAP_DEFAULT_MAX_RECEIVE       1
-#define L2CAP_DEFAULT_RETRANS_TO        300    /* 300 milliseconds */
-#define L2CAP_DEFAULT_MONITOR_TO        1000   /* 1 second */
-#define L2CAP_DEFAULT_MAX_RX_APDU       0xfff7
+#define L2CAP_DEFAULT_TX_WINDOW         63
+#define L2CAP_DEFAULT_NUM_TO_ACK        (L2CAP_DEFAULT_TX_WINDOW/5)
+#define L2CAP_DEFAULT_MAX_TX            3
+#define L2CAP_DEFAULT_RETRANS_TO        1000    /* 1 second */
+#define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
+#define L2CAP_DEFAULT_MAX_PDU_SIZE      672
 
 #define L2CAP_CONN_TIMEOUT      (40000) /* 40 seconds */
 #define L2CAP_INFO_TIMEOUT      (4000)  /*  4 seconds */
@@ -52,6 +54,7 @@ struct l2cap_options {
         __u16 imtu;
         __u16 flush_to;
         __u8  mode;
+        __u8  fcs;
 };
 
 #define L2CAP_CONNINFO  0x02
@@ -93,6 +96,32 @@ struct l2cap_conninfo {
 #define L2CAP_FCS_NONE          0x00
 #define L2CAP_FCS_CRC16         0x01
 
+/* L2CAP Control Field bit masks */
+#define L2CAP_CTRL_SAR               0xC000
+#define L2CAP_CTRL_REQSEQ            0x3F00
+#define L2CAP_CTRL_TXSEQ             0x007E
+#define L2CAP_CTRL_RETRANS           0x0080
+#define L2CAP_CTRL_FINAL             0x0080
+#define L2CAP_CTRL_POLL              0x0010
+#define L2CAP_CTRL_SUPERVISE         0x000C
+#define L2CAP_CTRL_FRAME_TYPE        0x0001 /* I- or S-Frame */
+
+#define L2CAP_CTRL_TXSEQ_SHIFT      1
+#define L2CAP_CTRL_REQSEQ_SHIFT     8
+#define L2CAP_CTRL_SAR_SHIFT       14
+
+/* L2CAP Supervisory Function */
+#define L2CAP_SUPER_RCV_READY           0x0000
+#define L2CAP_SUPER_REJECT              0x0004
+#define L2CAP_SUPER_RCV_NOT_READY       0x0008
+#define L2CAP_SUPER_SELECT_REJECT       0x000C
+
+/* L2CAP Segmentation and Reassembly */
+#define L2CAP_SDU_UNSEGMENTED       0x0000
+#define L2CAP_SDU_START             0x4000
+#define L2CAP_SDU_END               0x8000
+#define L2CAP_SDU_CONTINUE          0xC000
+
 /* L2CAP structures */
 struct l2cap_hdr {
         __le16     len;
@@ -190,7 +219,7 @@ struct l2cap_conf_rfc {
 #define L2CAP_MODE_RETRANS      0x01
 #define L2CAP_MODE_FLOWCTL      0x02
 #define L2CAP_MODE_ERTM         0x03
-#define L2CAP_MODE_STREAM       0x04
+#define L2CAP_MODE_STREAMING    0x04
 
 struct l2cap_disconn_req {
         __le16     dcid;
@@ -261,6 +290,14 @@ struct l2cap_conn {
 
 /* ----- L2CAP channel and socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
+#define TX_QUEUE(sk) (&l2cap_pi(sk)->tx_queue)
+#define SREJ_QUEUE(sk) (&l2cap_pi(sk)->srej_queue)
+#define SREJ_LIST(sk) (&l2cap_pi(sk)->srej_l.list)
+
+struct srej_list {
+        __u8    tx_seq;
+        struct list_head list;
+};
 
 struct l2cap_pinfo {
         struct bt_sock  bt;
@@ -271,30 +308,97 @@ struct l2cap_pinfo {
         __u16           imtu;
         __u16           omtu;
         __u16           flush_to;
-        __u8            sec_level;
+        __u8            mode;
+        __u8            num_conf_req;
+        __u8            num_conf_rsp;
+
+        __u8            fcs;
+        __u8            sec_level;
         __u8            role_switch;
-        __u8            force_reliable;
+        __u8            force_reliable;
 
         __u8            conf_req[64];
         __u8            conf_len;
         __u8            conf_state;
-        __u8            conf_retry;
+        __u8            conn_state;
+
+        __u8            next_tx_seq;
+        __u8            expected_ack_seq;
+        __u8            req_seq;
+        __u8            expected_tx_seq;
+        __u8            buffer_seq;
+        __u8            buffer_seq_srej;
+        __u8            srej_save_reqseq;
+        __u8            unacked_frames;
+        __u8            retry_count;
+        __u8            num_to_ack;
+        __u16           sdu_len;
+        __u16           partial_sdu_len;
+        struct sk_buff  *sdu;
 
         __u8            ident;
 
+        __u8            remote_tx_win;
+        __u8            remote_max_tx;
+        __u16           retrans_timeout;
+        __u16           monitor_timeout;
+        __u16           max_pdu_size;
+
         __le16          sport;
 
+        struct timer_list       retrans_timer;
+        struct timer_list       monitor_timer;
+        struct sk_buff_head     tx_queue;
+        struct sk_buff_head     srej_queue;
+        struct srej_list        srej_l;
         struct l2cap_conn       *conn;
         struct sock             *next_c;
         struct sock             *prev_c;
 };
 
-#define L2CAP_CONF_REQ_SENT     0x01
-#define L2CAP_CONF_INPUT_DONE   0x02
-#define L2CAP_CONF_OUTPUT_DONE  0x04
-#define L2CAP_CONF_CONNECT_PEND 0x80
-
-#define L2CAP_CONF_MAX_RETRIES  2
+#define L2CAP_CONF_REQ_SENT       0x01
+#define L2CAP_CONF_INPUT_DONE     0x02
+#define L2CAP_CONF_OUTPUT_DONE    0x04
+#define L2CAP_CONF_MTU_DONE       0x08
+#define L2CAP_CONF_MODE_DONE      0x10
+#define L2CAP_CONF_CONNECT_PEND   0x20
+#define L2CAP_CONF_NO_FCS_RECV    0x40
+#define L2CAP_CONF_STATE2_DEVICE  0x80
+
+#define L2CAP_CONF_MAX_CONF_REQ 2
+#define L2CAP_CONF_MAX_CONF_RSP 2
+
+#define L2CAP_CONN_SAR_SDU         0x01
+#define L2CAP_CONN_SREJ_SENT       0x02
+#define L2CAP_CONN_WAIT_F          0x04
+#define L2CAP_CONN_SREJ_ACT        0x08
+#define L2CAP_CONN_SEND_PBIT       0x10
+#define L2CAP_CONN_REMOTE_BUSY     0x20
+#define L2CAP_CONN_LOCAL_BUSY      0x40
+
+#define __mod_retrans_timer() mod_timer(&l2cap_pi(sk)->retrans_timer, \
+                jiffies +  msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
+#define __mod_monitor_timer() mod_timer(&l2cap_pi(sk)->monitor_timer, \
+                jiffies + msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
+
+static inline int l2cap_tx_window_full(struct sock *sk)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        int sub;
+
+        sub = (pi->next_tx_seq - pi->expected_ack_seq) % 64;
+
+        if (sub < 0)
+                sub += 64;
+
+        return (sub == pi->remote_tx_win);
+}
+
+#define __get_txseq(ctrl) ((ctrl) & L2CAP_CTRL_TXSEQ) >> 1
+#define __get_reqseq(ctrl) ((ctrl) & L2CAP_CTRL_REQSEQ) >> 8
+#define __is_iframe(ctrl) !((ctrl) & L2CAP_CTRL_FRAME_TYPE)
+#define __is_sframe(ctrl) (ctrl) & L2CAP_CTRL_FRAME_TYPE
+#define __is_sar_start(ctrl) ((ctrl) & L2CAP_CTRL_SAR) == L2CAP_SDU_START
 
 void l2cap_load(void);
 
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 80072611d26a..921d7b3c7f8d 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -29,6 +29,7 @@
 #define RFCOMM_CONN_TIMEOUT (HZ * 30)
 #define RFCOMM_DISC_TIMEOUT (HZ * 20)
 #define RFCOMM_AUTH_TIMEOUT (HZ * 25)
+#define RFCOMM_IDLE_TIMEOUT (HZ * 2)
 
 #define RFCOMM_DEFAULT_MTU      127
 #define RFCOMM_DEFAULT_CREDITS  7
@@ -154,6 +155,7 @@ struct rfcomm_msc {
 struct rfcomm_session {
         struct list_head list;
         struct socket   *sock;
+        struct timer_list timer;
         unsigned long    state;
         unsigned long    flags;
         atomic_t         refcnt;
@@ -355,7 +357,17 @@ struct rfcomm_dev_list_req {
 };
 
 int  rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
+
+#ifdef CONFIG_BT_RFCOMM_TTY
 int  rfcomm_init_ttys(void);
 void rfcomm_cleanup_ttys(void);
-
+#else
+static inline int rfcomm_init_ttys(void)
+{
+        return 0;
+}
+static inline void rfcomm_cleanup_ttys(void)
+{
+}
+#endif
 #endif /* __RFCOMM_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 1a21895b732b..3d874c620219 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -80,7 +80,6 @@ enum ieee80211_channel_flags {
  * with cfg80211.
  *
  * @center_freq: center frequency in MHz
- * @max_bandwidth: maximum allowed bandwidth for this channel, in MHz
  * @hw_value: hardware-specific value for the channel
  * @flags: channel flags from &enum ieee80211_channel_flags.
  * @orig_flags: channel flags at registration time, used by regulatory
@@ -97,7 +96,6 @@ enum ieee80211_channel_flags {
 struct ieee80211_channel {
         enum ieee80211_band band;
         u16 center_freq;
-        u8 max_bandwidth;
         u16 hw_value;
         u32 flags;
         int max_antenna_gain;
@@ -372,6 +370,10 @@ struct rate_info {
  * @txrate: current unicast bitrate to this station
  * @rx_packets: packets received from this station
  * @tx_packets: packets transmitted to this station
+ * @generation: generation number for nl80211 dumps.
+ *      This number should increase every time the list of stations
+ *      changes, i.e. when a station is added or removed, so that
+ *      userspace can tell whether it got a consistent snapshot.
  */
 struct station_info {
         u32 filled;
@@ -385,6 +387,8 @@ struct station_info {
         struct rate_info txrate;
         u32 rx_packets;
         u32 tx_packets;
+
+        int generation;
 };
 
 /**
@@ -444,6 +448,10 @@ enum mpath_info_flags {
  * @flags: mesh path flags
  * @discovery_timeout: total mesh path discovery timeout, in msecs
  * @discovery_retries: mesh path discovery retries
+ * @generation: generation number for nl80211 dumps.
+ *      This number should increase every time the list of mesh paths
+ *      changes, i.e. when a station is added or removed, so that
+ *      userspace can tell whether it got a consistent snapshot.
  */
 struct mpath_info {
         u32 filled;
@@ -454,6 +462,8 @@ struct mpath_info {
         u32 discovery_timeout;
         u8 discovery_retries;
         u8 flags;
+
+        int generation;
 };
 
 /**
@@ -538,23 +548,26 @@ struct cfg80211_ssid {
  * @ssids: SSIDs to scan for (active scan only)
  * @n_ssids: number of SSIDs
  * @channels: channels to scan on.
- * @n_channels: number of channels for each band
+ * @n_channels: total number of channels to scan
  * @ie: optional information element(s) to add into Probe Request or %NULL
  * @ie_len: length of ie in octets
  * @wiphy: the wiphy this was for
- * @ifidx: the interface index
+ * @dev: the interface
  */
 struct cfg80211_scan_request {
         struct cfg80211_ssid *ssids;
         int n_ssids;
-        struct ieee80211_channel **channels;
         u32 n_channels;
         const u8 *ie;
         size_t ie_len;
 
         /* internal */
         struct wiphy *wiphy;
-        int ifidx;
+        struct net_device *dev;
+        bool aborted;
+
+        /* keep last */
+        struct ieee80211_channel *channels[0];
 };
 
 /**
@@ -584,7 +597,6 @@ enum cfg80211_signal_type {
  *      is no guarantee that these are well-formed!)
  * @len_information_elements: total length of the information elements
  * @signal: signal strength value (type depends on the wiphy's signal_type)
- * @hold: BSS should not expire
  * @free_priv: function pointer to free private data
  * @priv: private area for driver use, has at least wiphy->bss_priv_size bytes
  */
@@ -605,37 +617,59 @@ struct cfg80211_bss {
 };
 
 /**
+ * ieee80211_bss_get_ie - find IE with given ID
+ * @bss: the bss to search
+ * @ie: the IE ID
+ * Returns %NULL if not found.
+ */
+const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
+
+
+/**
+ * struct cfg80211_crypto_settings - Crypto settings
+ * @wpa_versions: indicates which, if any, WPA versions are enabled
+ *      (from enum nl80211_wpa_versions)
+ * @cipher_group: group key cipher suite (or 0 if unset)
+ * @n_ciphers_pairwise: number of AP supported unicast ciphers
+ * @ciphers_pairwise: unicast key cipher suites
+ * @n_akm_suites: number of AKM suites
+ * @akm_suites: AKM suites
+ * @control_port: Whether user space controls IEEE 802.1X port, i.e.,
+ *      sets/clears %NL80211_STA_FLAG_AUTHORIZED. If true, the driver is
+ *      required to assume that the port is unauthorized until authorized by
+ *      user space. Otherwise, port is marked authorized by default.
+ */
+struct cfg80211_crypto_settings {
+        u32 wpa_versions;
+        u32 cipher_group;
+        int n_ciphers_pairwise;
+        u32 ciphers_pairwise[NL80211_MAX_NR_CIPHER_SUITES];
+        int n_akm_suites;
+        u32 akm_suites[NL80211_MAX_NR_AKM_SUITES];
+        bool control_port;
+};
+
+/**
  * struct cfg80211_auth_request - Authentication request data
  *
  * This structure provides information needed to complete IEEE 802.11
  * authentication.
- * NOTE: This structure will likely change when more code from mac80211 is
- * moved into cfg80211 so that non-mac80211 drivers can benefit from it, too.
- * Before using this in a driver that does not use mac80211, it would be better
- * to check the status of that work and better yet, volunteer to work on it.
- *
- * @chan: The channel to use or %NULL if not specified (auto-select based on
- *      scan results)
- * @peer_addr: The address of the peer STA (AP BSSID in infrastructure case);
- *      this field is required to be present; if the driver wants to help with
- *      BSS selection, it should use (yet to be added) MLME event to allow user
- *      space SME to be notified of roaming candidate, so that the SME can then
- *      use the authentication request with the recommended BSSID and whatever
- *      other data may be needed for authentication/association
- * @ssid: SSID or %NULL if not yet available
- * @ssid_len: Length of ssid in octets
+ *
+ * @bss: The BSS to authenticate with.
  * @auth_type: Authentication type (algorithm)
  * @ie: Extra IEs to add to Authentication frame or %NULL
  * @ie_len: Length of ie buffer in octets
+ * @key_len: length of WEP key for shared key authentication
+ * @key_idx: index of WEP key for shared key authentication
+ * @key: WEP key for shared key authentication
  */
 struct cfg80211_auth_request {
-        struct ieee80211_channel *chan;
-        u8 *peer_addr;
-        const u8 *ssid;
-        size_t ssid_len;
-        enum nl80211_auth_type auth_type;
+        struct cfg80211_bss *bss;
         const u8 *ie;
         size_t ie_len;
+        enum nl80211_auth_type auth_type;
+        const u8 *key;
+        u8 key_len, key_idx;
 };
 
 /**
@@ -643,35 +677,19 @@ struct cfg80211_auth_request {
  *
  * This structure provides information needed to complete IEEE 802.11
  * (re)association.
- * NOTE: This structure will likely change when more code from mac80211 is
- * moved into cfg80211 so that non-mac80211 drivers can benefit from it, too.
- * Before using this in a driver that does not use mac80211, it would be better
- * to check the status of that work and better yet, volunteer to work on it.
- *
- * @chan: The channel to use or %NULL if not specified (auto-select based on
- *      scan results)
- * @peer_addr: The address of the peer STA (AP BSSID); this field is required
- *      to be present and the STA must be in State 2 (authenticated) with the
- *      peer STA
- * @ssid: SSID
- * @ssid_len: Length of ssid in octets
+ * @bss: The BSS to associate with.
  * @ie: Extra IEs to add to (Re)Association Request frame or %NULL
  * @ie_len: Length of ie buffer in octets
  * @use_mfp: Use management frame protection (IEEE 802.11w) in this association
- * @control_port: Whether user space controls IEEE 802.1X port, i.e.,
- *      sets/clears %NL80211_STA_FLAG_AUTHORIZED. If true, the driver is
- *      required to assume that the port is unauthorized until authorized by
- *      user space. Otherwise, port is marked authorized by default.
+ * @crypto: crypto settings
+ * @prev_bssid: previous BSSID, if not %NULL use reassociate frame
  */
 struct cfg80211_assoc_request {
-        struct ieee80211_channel *chan;
-        u8 *peer_addr;
-        const u8 *ssid;
-        size_t ssid_len;
-        const u8 *ie;
+        struct cfg80211_bss *bss;
+        const u8 *ie, *prev_bssid;
         size_t ie_len;
+        struct cfg80211_crypto_settings crypto;
         bool use_mfp;
-        bool control_port;
 };
 
 /**
@@ -680,16 +698,16 @@ struct cfg80211_assoc_request {
  * This structure provides information needed to complete IEEE 802.11
  * deauthentication.
  *
- * @peer_addr: The address of the peer STA (AP BSSID); this field is required
- *      to be present and the STA must be authenticated with the peer STA
+ * @bss: the BSS to deauthenticate from
  * @ie: Extra IEs to add to Deauthentication frame or %NULL
  * @ie_len: Length of ie buffer in octets
+ * @reason_code: The reason code for the deauthentication
  */
 struct cfg80211_deauth_request {
-        u8 *peer_addr;
-        u16 reason_code;
+        struct cfg80211_bss *bss;
         const u8 *ie;
         size_t ie_len;
+        u16 reason_code;
 };
 
 /**
@@ -698,16 +716,16 @@ struct cfg80211_deauth_request {
  * This structure provides information needed to complete IEEE 802.11
  * disassocation.
  *
- * @peer_addr: The address of the peer STA (AP BSSID); this field is required
- *      to be present and the STA must be associated with the peer STA
+ * @bss: the BSS to disassociate from
  * @ie: Extra IEs to add to Disassociation frame or %NULL
  * @ie_len: Length of ie buffer in octets
+ * @reason_code: The reason code for the disassociation
  */
 struct cfg80211_disassoc_request {
-        u8 *peer_addr;
-        u16 reason_code;
+        struct cfg80211_bss *bss;
         const u8 *ie;
         size_t ie_len;
+        u16 reason_code;
 };
 
 /**
@@ -726,6 +744,8 @@ struct cfg80211_disassoc_request {
  * @ie: information element(s) to include in the beacon
  * @ie_len: length of that
  * @beacon_interval: beacon interval to use
+ * @privacy: this is a protected network, keys will be configured
+ *      after joining
  */
 struct cfg80211_ibss_params {
         u8 *ssid;
@@ -735,6 +755,42 @@ struct cfg80211_ibss_params {
         u8 ssid_len, ie_len;
         u16 beacon_interval;
         bool channel_fixed;
+        bool privacy;
+};
+
+/**
+ * struct cfg80211_connect_params - Connection parameters
+ *
+ * This structure provides information needed to complete IEEE 802.11
+ * authentication and association.
+ *
+ * @channel: The channel to use or %NULL if not specified (auto-select based
+ *      on scan results)
+ * @bssid: The AP BSSID or %NULL if not specified (auto-select based on scan
+ *      results)
+ * @ssid: SSID
+ * @ssid_len: Length of ssid in octets
+ * @auth_type: Authentication type (algorithm)
+ * @assoc_ie: IEs for association request
+ * @assoc_ie_len: Length of assoc_ie in octets
+ * @privacy: indicates whether privacy-enabled APs should be used
+ * @crypto: crypto settings
+ * @key_len: length of WEP key for shared key authentication
+ * @key_idx: index of WEP key for shared key authentication
+ * @key: WEP key for shared key authentication
+ */
+struct cfg80211_connect_params {
+        struct ieee80211_channel *channel;
+        u8 *bssid;
+        u8 *ssid;
+        size_t ssid_len;
+        enum nl80211_auth_type auth_type;
+        u8 *ie;
+        size_t ie_len;
+        bool privacy;
+        struct cfg80211_crypto_settings crypto;
+        const u8 *key;
+        u8 key_len, key_idx;
 };
 
 /**
@@ -764,6 +820,26 @@ enum tx_power_setting {
         TX_POWER_FIXED,
 };
 
+/*
+ * cfg80211_bitrate_mask - masks for bitrate control
+ */
+struct cfg80211_bitrate_mask {
+/*
+ * As discussed in Berlin, this struct really
+ * should look like this:
+
+        struct {
+                u32 legacy;
+                u8 mcs[IEEE80211_HT_MCS_MASK_LEN];
+        } control[IEEE80211_NUM_BANDS];
+
+ * Since we can always fix in-kernel users, let's keep
+ * it simpler for now:
+ */
+        u32 fixed;   /* fixed bitrate, 0 == not fixed */
+        u32 maxrate; /* in kbps, 0 == no limit */
+};
+
 /**
  * struct cfg80211_ops - backend description for wireless configuration
  *
@@ -781,7 +857,8 @@ enum tx_power_setting {
  * @resume: wiphy device needs to be resumed
  *
  * @add_virtual_intf: create a new virtual interface with the given name,
- *      must set the struct wireless_dev's iftype.
+ *      must set the struct wireless_dev's iftype. Beware: You must create
+ *      the new netdev in the wiphy's network namespace!
  *
  * @del_virtual_intf: remove the virtual interface determined by ifindex.
  *
@@ -841,6 +918,12 @@ enum tx_power_setting {
  * @deauth: Request to deauthenticate from the specified peer
  * @disassoc: Request to disassociate from the specified peer
  *
+ * @connect: Connect to the ESS with the specified parameters. When connected,
+ *      call cfg80211_connect_result() with status code %WLAN_STATUS_SUCCESS.
+ *      If the connection fails for some reason, call cfg80211_connect_result()
+ *      with the status from the AP.
+ * @disconnect: Disconnect from the BSS/ESS.
+ *
  * @join_ibss: Join the specified IBSS (or create if necessary). Once done, call
  *      cfg80211_ibss_joined(), also call that function when changing BSSID due
  *      to a merge.
@@ -857,6 +940,8 @@ enum tx_power_setting {
  *
  * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
  *      functions to adjust rfkill hw state
+ *
+ * @testmode_cmd: run a test mode command
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy);
@@ -865,8 +950,9 @@ struct cfg80211_ops {
         int     (*add_virtual_intf)(struct wiphy *wiphy, char *name,
                                     enum nl80211_iftype type, u32 *flags,
                                     struct vif_params *params);
-        int     (*del_virtual_intf)(struct wiphy *wiphy, int ifindex);
-        int     (*change_virtual_intf)(struct wiphy *wiphy, int ifindex,
+        int     (*del_virtual_intf)(struct wiphy *wiphy, struct net_device *dev);
+        int     (*change_virtual_intf)(struct wiphy *wiphy,
+                                       struct net_device *dev,
                                        enum nl80211_iftype type, u32 *flags,
                                        struct vif_params *params);
 
@@ -939,9 +1025,16 @@ struct cfg80211_ops {
         int     (*assoc)(struct wiphy *wiphy, struct net_device *dev,
                          struct cfg80211_assoc_request *req);
         int     (*deauth)(struct wiphy *wiphy, struct net_device *dev,
-                          struct cfg80211_deauth_request *req);
+                          struct cfg80211_deauth_request *req,
+                          void *cookie);
         int     (*disassoc)(struct wiphy *wiphy, struct net_device *dev,
-                            struct cfg80211_disassoc_request *req);
+                            struct cfg80211_disassoc_request *req,
+                            void *cookie);
+
+        int     (*connect)(struct wiphy *wiphy, struct net_device *dev,
+                           struct cfg80211_connect_params *sme);
+        int     (*disconnect)(struct wiphy *wiphy, struct net_device *dev,
+                              u16 reason_code);
 
         int     (*join_ibss)(struct wiphy *wiphy, struct net_device *dev,
                              struct cfg80211_ibss_params *params);
@@ -953,7 +1046,23 @@ struct cfg80211_ops {
                                 enum tx_power_setting type, int dbm);
         int     (*get_tx_power)(struct wiphy *wiphy, int *dbm);
 
+        int     (*set_wds_peer)(struct wiphy *wiphy, struct net_device *dev,
+                                u8 *addr);
+
         void    (*rfkill_poll)(struct wiphy *wiphy);
+
+#ifdef CONFIG_NL80211_TESTMODE
+        int     (*testmode_cmd)(struct wiphy *wiphy, void *data, int len);
+#endif
+
+        int     (*set_bitrate_mask)(struct wiphy *wiphy,
+                                    struct net_device *dev,
+                                    const u8 *peer,
+                                    const struct cfg80211_bitrate_mask *mask);
+
+        /* some temporary stuff to finish wext */
+        int     (*set_power_mgmt)(struct wiphy *wiphy, struct net_device *dev,
+                                  bool enabled, int timeout);
 };
 
 /*
@@ -979,6 +1088,10 @@ struct cfg80211_ops {
  *      channels at a later time. This can be used for devices which do not
  *      have calibration information gauranteed for frequencies or settings
  *      outside of its regulatory domain.
+ * @disable_beacon_hints: enable this if your driver needs to ensure that
+ *      passive scan flags and beaconing flags may not be lifted by cfg80211
+ *      due to regulatory beacon hints. For more information on beacon
+ *      hints read the documenation for regulatory_hint_found_beacon()
  * @reg_notifier: the driver's regulatory notification callback
  * @regd: the driver's regulatory domain, if one was requested via
  *      the regulatory_hint() API. This can be used by the driver
@@ -992,6 +1105,12 @@ struct cfg80211_ops {
  * @frag_threshold: Fragmentation threshold (dot11FragmentationThreshold);
  *      -1 = fragmentation disabled, only odd values >= 256 used
  * @rts_threshold: RTS threshold (dot11RTSThreshold); -1 = RTS/CTS disabled
+ * @net: the network namespace this wiphy currently lives in
+ * @netnsok: if set to false, do not allow changing the netns of this
+ *      wiphy at all
+ * @ps_default: default for powersave, will be set depending on the
+ *      kernel's default on wiphy_new(), but can be changed by the
+ *      driver if it has a good reason to override the default
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -1004,6 +1123,10 @@ struct wiphy {
 
         bool custom_regulatory;
         bool strict_regulatory;
+        bool disable_beacon_hints;
+
+        bool netnsok;
+        bool ps_default;
 
         enum cfg80211_signal_type signal_type;
 
@@ -1043,9 +1166,35 @@ struct wiphy {
         /* dir in debugfs: ieee80211/<wiphyname> */
         struct dentry *debugfsdir;
 
+#ifdef CONFIG_NET_NS
+        /* the network namespace this phy lives in currently */
+        struct net *_net;
+#endif
+
         char priv[0] __attribute__((__aligned__(NETDEV_ALIGN)));
 };
 
+#ifdef CONFIG_NET_NS
+static inline struct net *wiphy_net(struct wiphy *wiphy)
+{
+        return wiphy->_net;
+}
+
+static inline void wiphy_net_set(struct wiphy *wiphy, struct net *net)
+{
+        wiphy->_net = net;
+}
+#else
+static inline struct net *wiphy_net(struct wiphy *wiphy)
+{
+        return &init_net;
+}
+
+static inline void wiphy_net_set(struct wiphy *wiphy, struct net *net)
+{
+}
+#endif
+
 /**
  * wiphy_priv - return priv from wiphy
  *
@@ -1058,6 +1207,17 @@ static inline void *wiphy_priv(struct wiphy *wiphy)
 }
 
 /**
+ * priv_to_wiphy - return the wiphy containing the priv
+ *
+ * @priv: a pointer previously returned by wiphy_priv
+ */
+static inline struct wiphy *priv_to_wiphy(void *priv)
+{
+        BUG_ON(!priv);
+        return container_of(priv, struct wiphy, priv);
+}
+
+/**
  * set_wiphy_dev - set device pointer for wiphy
  *
  * @wiphy: The wiphy whose device to bind
@@ -1129,6 +1289,13 @@ extern void wiphy_unregister(struct wiphy *wiphy);
  */
 extern void wiphy_free(struct wiphy *wiphy);
 
+/* internal structs */
+struct cfg80211_conn;
+struct cfg80211_internal_bss;
+struct cfg80211_cached_keys;
+
+#define MAX_AUTH_BSSES          4
+
 /**
  * struct wireless_dev - wireless per-netdev state
  *
@@ -1152,22 +1319,45 @@ struct wireless_dev {
         struct wiphy *wiphy;
         enum nl80211_iftype iftype;
 
-        /* private to the generic wireless code */
+        /* the remainder of this struct should be private to cfg80211 */
         struct list_head list;
         struct net_device *netdev;
 
-        /* currently used for IBSS - might be rearranged in the future */
-        struct cfg80211_bss *current_bss;
-        u8 bssid[ETH_ALEN];
+        struct mutex mtx;
+
+        struct work_struct cleanup_work;
+
+        /* currently used for IBSS and SME - might be rearranged later */
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         u8 ssid_len;
+        enum {
+                CFG80211_SME_IDLE,
+                CFG80211_SME_CONNECTING,
+                CFG80211_SME_CONNECTED,
+        } sme_state;
+        struct cfg80211_conn *conn;
+        struct cfg80211_cached_keys *connect_keys;
+
+        struct list_head event_list;
+        spinlock_t event_lock;
+
+        struct cfg80211_internal_bss *authtry_bsses[MAX_AUTH_BSSES];
+        struct cfg80211_internal_bss *auth_bsses[MAX_AUTH_BSSES];
+        struct cfg80211_internal_bss *current_bss; /* associated / joined */
 
 #ifdef CONFIG_WIRELESS_EXT
         /* wext data */
         struct {
                 struct cfg80211_ibss_params ibss;
-                u8 bssid[ETH_ALEN];
+                struct cfg80211_connect_params connect;
+                struct cfg80211_cached_keys *keys;
+                u8 *ie;
+                size_t ie_len;
+                u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
+                u8 ssid[IEEE80211_MAX_SSID_LEN];
                 s8 default_key, default_mgmt_key;
+                bool ps, prev_bssid_valid;
+                int ps_timeout;
         } wext;
 #endif
 };
@@ -1347,20 +1537,6 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb);
 extern int regulatory_hint(struct wiphy *wiphy, const char *alpha2);
 
 /**
- * regulatory_hint_11d - hints a country IE as a regulatory domain
- * @wiphy: the wireless device giving the hint (used only for reporting
- *      conflicts)
- * @country_ie: pointer to the country IE
- * @country_ie_len: length of the country IE
- *
- * We will intersect the rd with the what CRDA tells us should apply
- * for the alpha2 this country IE belongs to, this prevents APs from
- * sending us incorrect or outdated information against a country.
- */
-extern void regulatory_hint_11d(struct wiphy *wiphy,
-                                u8 *country_ie,
-                                u8 country_ie_len);
-/**
  * wiphy_apply_custom_regulatory - apply a custom driver regulatory domain
  * @wiphy: the wireless device we want to process the regulatory domain on
  * @regd: the custom regulatory domain to use for this wiphy
@@ -1428,27 +1604,34 @@ int cfg80211_wext_siwmlme(struct net_device *dev,
 int cfg80211_wext_giwrange(struct net_device *dev,
                            struct iw_request_info *info,
                            struct iw_point *data, char *extra);
-int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
-                               struct iw_request_info *info,
-                               struct iw_freq *freq, char *extra);
-int cfg80211_ibss_wext_giwfreq(struct net_device *dev,
-                               struct iw_request_info *info,
-                               struct iw_freq *freq, char *extra);
-int cfg80211_ibss_wext_siwessid(struct net_device *dev,
-                                struct iw_request_info *info,
-                                struct iw_point *data, char *ssid);
-int cfg80211_ibss_wext_giwessid(struct net_device *dev,
-                                struct iw_request_info *info,
-                                struct iw_point *data, char *ssid);
-int cfg80211_ibss_wext_siwap(struct net_device *dev,
-                             struct iw_request_info *info,
-                             struct sockaddr *ap_addr, char *extra);
-int cfg80211_ibss_wext_giwap(struct net_device *dev,
-                             struct iw_request_info *info,
-                             struct sockaddr *ap_addr, char *extra);
+int cfg80211_wext_siwgenie(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *extra);
+int cfg80211_wext_siwauth(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *data, char *extra);
+int cfg80211_wext_giwauth(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *data, char *extra);
 
-struct ieee80211_channel *cfg80211_wext_freq(struct wiphy *wiphy,
-                                             struct iw_freq *freq);
+int cfg80211_wext_siwfreq(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_freq *freq, char *extra);
+int cfg80211_wext_giwfreq(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_freq *freq, char *extra);
+int cfg80211_wext_siwessid(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *ssid);
+int cfg80211_wext_giwessid(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *ssid);
+int cfg80211_wext_siwrate(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *rate, char *extra);
+int cfg80211_wext_giwrate(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *rate, char *extra);
 
 int cfg80211_wext_siwrts(struct net_device *dev,
                          struct iw_request_info *info,
@@ -1483,6 +1666,21 @@ int cfg80211_wext_siwtxpower(struct net_device *dev,
 int cfg80211_wext_giwtxpower(struct net_device *dev,
                              struct iw_request_info *info,
                              union iwreq_data *data, char *keybuf);
+struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev);
+
+int cfg80211_wext_siwpower(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *wrq, char *extra);
+int cfg80211_wext_giwpower(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *wrq, char *extra);
+
+int cfg80211_wext_siwap(struct net_device *dev,
+                        struct iw_request_info *info,
+                        struct sockaddr *ap_addr, char *extra);
+int cfg80211_wext_giwap(struct net_device *dev,
+                        struct iw_request_info *info,
+                        struct sockaddr *ap_addr, char *extra);
 
 /*
  * callbacks for asynchronous cfg80211 methods, notification
@@ -1564,7 +1762,7 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *bss);
  * This function is called whenever an authentication has been processed in
  * station mode. The driver is required to call either this function or
  * cfg80211_send_auth_timeout() to indicate the result of cfg80211_ops::auth()
- * call.
+ * call. This function may sleep.
  */
 void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
 
@@ -1572,6 +1770,8 @@ void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
  * cfg80211_send_auth_timeout - notification of timed out authentication
  * @dev: network device
  * @addr: The MAC address of the device with which the authentication timed out
+ *
+ * This function may sleep.
  */
 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr);
 
@@ -1584,7 +1784,7 @@ void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr);
  * This function is called whenever a (re)association response has been
  * processed in station mode. The driver is required to call either this
  * function or cfg80211_send_assoc_timeout() to indicate the result of
- * cfg80211_ops::assoc() call.
+ * cfg80211_ops::assoc() call. This function may sleep.
  */
 void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len);
 
@@ -1592,6 +1792,8 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len);
  * cfg80211_send_assoc_timeout - notification of timed out association
  * @dev: network device
  * @addr: The MAC address of the device with which the association timed out
+ *
+ * This function may sleep.
  */
 void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr);
 
@@ -1600,41 +1802,30 @@ void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr);
  * @dev: network device
  * @buf: deauthentication frame (header + body)
  * @len: length of the frame data
+ * @cookie: cookie from ->deauth if called within that callback,
+ *      %NULL otherwise
  *
  * This function is called whenever deauthentication has been processed in
  * station mode. This includes both received deauthentication frames and
- * locally generated ones.
+ * locally generated ones. This function may sleep.
  */
-void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len);
+void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len,
+                          void *cookie);
 
 /**
  * cfg80211_send_disassoc - notification of processed disassociation
  * @dev: network device
  * @buf: disassociation response frame (header + body)
  * @len: length of the frame data
+ * @cookie: cookie from ->disassoc if called within that callback,
+ *      %NULL otherwise
  *
  * This function is called whenever disassociation has been processed in
  * station mode. This includes both received disassociation frames and locally
- * generated ones.
- */
-void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len);
-
-/**
- * cfg80211_hold_bss - exclude bss from expiration
- * @bss: bss which should not expire
- *
- * In a case when the BSS is not updated but it shouldn't expire this
- * function can be used to mark the BSS to be excluded from expiration.
- */
-void cfg80211_hold_bss(struct cfg80211_bss *bss);
-
-/**
- * cfg80211_unhold_bss - remove expiration exception from the BSS
- * @bss: bss which can expire again
- *
- * This function marks the BSS to be expirable again.
+ * generated ones. This function may sleep.
  */
-void cfg80211_unhold_bss(struct cfg80211_bss *bss);
+void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len,
+                            void *cookie);
 
 /**
  * cfg80211_michael_mic_failure - notification of Michael MIC failure (TKIP)
@@ -1643,6 +1834,7 @@ void cfg80211_unhold_bss(struct cfg80211_bss *bss);
  * @key_type: The key type that the received frame used
  * @key_id: Key identifier (0..3)
  * @tsc: The TSC value of the frame that generated the MIC failure (6 octets)
+ * @gfp: allocation flags
  *
  * This function is called whenever the local MAC detects a MIC failure in a
  * received frame. This matches with MLME-MICHAELMICFAILURE.indication()
@@ -1650,7 +1842,7 @@ void cfg80211_unhold_bss(struct cfg80211_bss *bss);
  */
 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
                                   enum nl80211_key_type key_type, int key_id,
-                                  const u8 *tsc);
+                                  const u8 *tsc, gfp_t gfp);
 
 /**
  * cfg80211_ibss_joined - notify cfg80211 that device joined an IBSS
@@ -1687,4 +1879,137 @@ void wiphy_rfkill_start_polling(struct wiphy *wiphy);
  */
 void wiphy_rfkill_stop_polling(struct wiphy *wiphy);
 
+#ifdef CONFIG_NL80211_TESTMODE
+/**
+ * cfg80211_testmode_alloc_reply_skb - allocate testmode reply
+ * @wiphy: the wiphy
+ * @approxlen: an upper bound of the length of the data that will
+ *      be put into the skb
+ *
+ * This function allocates and pre-fills an skb for a reply to
+ * the testmode command. Since it is intended for a reply, calling
+ * it outside of the @testmode_cmd operation is invalid.
+ *
+ * The returned skb (or %NULL if any errors happen) is pre-filled
+ * with the wiphy index and set up in a way that any data that is
+ * put into the skb (with skb_put(), nla_put() or similar) will end
+ * up being within the %NL80211_ATTR_TESTDATA attribute, so all that
+ * needs to be done with the skb is adding data for the corresponding
+ * userspace tool which can then read that data out of the testdata
+ * attribute. You must not modify the skb in any other way.
+ *
+ * When done, call cfg80211_testmode_reply() with the skb and return
+ * its error code as the result of the @testmode_cmd operation.
+ */
+struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
+                                                  int approxlen);
+
+/**
+ * cfg80211_testmode_reply - send the reply skb
+ * @skb: The skb, must have been allocated with
+ *      cfg80211_testmode_alloc_reply_skb()
+ *
+ * Returns an error code or 0 on success, since calling this
+ * function will usually be the last thing before returning
+ * from the @testmode_cmd you should return the error code.
+ * Note that this function consumes the skb regardless of the
+ * return value.
+ */
+int cfg80211_testmode_reply(struct sk_buff *skb);
+
+/**
+ * cfg80211_testmode_alloc_event_skb - allocate testmode event
+ * @wiphy: the wiphy
+ * @approxlen: an upper bound of the length of the data that will
+ *      be put into the skb
+ * @gfp: allocation flags
+ *
+ * This function allocates and pre-fills an skb for an event on the
+ * testmode multicast group.
+ *
+ * The returned skb (or %NULL if any errors happen) is set up in the
+ * same way as with cfg80211_testmode_alloc_reply_skb() but prepared
+ * for an event. As there, you should simply add data to it that will
+ * then end up in the %NL80211_ATTR_TESTDATA attribute. Again, you must
+ * not modify the skb in any other way.
+ *
+ * When done filling the skb, call cfg80211_testmode_event() with the
+ * skb to send the event.
+ */
+struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
+                                                  int approxlen, gfp_t gfp);
+
+/**
+ * cfg80211_testmode_event - send the event
+ * @skb: The skb, must have been allocated with
+ *      cfg80211_testmode_alloc_event_skb()
+ * @gfp: allocation flags
+ *
+ * This function sends the given @skb, which must have been allocated
+ * by cfg80211_testmode_alloc_event_skb(), as an event. It always
+ * consumes it.
+ */
+void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp);
+
+#define CFG80211_TESTMODE_CMD(cmd)      .testmode_cmd = (cmd),
+#else
+#define CFG80211_TESTMODE_CMD(cmd)
+#endif
+
+/**
+ * cfg80211_connect_result - notify cfg80211 of connection result
+ *
+ * @dev: network device
+ * @bssid: the BSSID of the AP
+ * @req_ie: association request IEs (maybe be %NULL)
+ * @req_ie_len: association request IEs length
+ * @resp_ie: association response IEs (may be %NULL)
+ * @resp_ie_len: assoc response IEs length
+ * @status: status code, 0 for successful connection, use
+ *      %WLAN_STATUS_UNSPECIFIED_FAILURE if your device cannot give you
+ *      the real status code for failures.
+ * @gfp: allocation flags
+ *
+ * It should be called by the underlying driver whenever connect() has
+ * succeeded.
+ */
+void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
+                             const u8 *req_ie, size_t req_ie_len,
+                             const u8 *resp_ie, size_t resp_ie_len,
+                             u16 status, gfp_t gfp);
+
+/**
+ * cfg80211_roamed - notify cfg80211 of roaming
+ *
+ * @dev: network device
+ * @bssid: the BSSID of the new AP
+ * @req_ie: association request IEs (maybe be %NULL)
+ * @req_ie_len: association request IEs length
+ * @resp_ie: association response IEs (may be %NULL)
+ * @resp_ie_len: assoc response IEs length
+ * @gfp: allocation flags
+ *
+ * It should be called by the underlying driver whenever it roamed
+ * from one AP to another while connected.
+ */
+void cfg80211_roamed(struct net_device *dev, const u8 *bssid,
+                     const u8 *req_ie, size_t req_ie_len,
+                     const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp);
+
+/**
+ * cfg80211_disconnected - notify cfg80211 that connection was dropped
+ *
+ * @dev: network device
+ * @ie: information elements of the deauth/disassoc frame (may be %NULL)
+ * @ie_len: length of IEs
+ * @reason: reason code for the disconnection, set it to 0 if unknown
+ * @gfp: allocation flags
+ *
+ * After it calls this function, the driver should enter an idle state
+ * and not try to connect to any AP any more.
+ */
+void cfg80211_disconnected(struct net_device *dev, u16 reason,
+                           u8 *ie, size_t ie_len, gfp_t gfp);
+
+
 #endif /* __NET_CFG80211_H */
diff --git a/include/net/dcbnl.h b/include/net/dcbnl.h
index 775cfc8055be..b36ac7e0914d 100644
--- a/include/net/dcbnl.h
+++ b/include/net/dcbnl.h
@@ -48,6 +48,8 @@ struct dcbnl_rtnl_ops {
         void (*setbcncfg)(struct net_device *, int, u32);
         void (*getbcnrp)(struct net_device *, int, u8 *);
         void (*setbcnrp)(struct net_device *, int, u8);
+        u8   (*setapp)(struct net_device *, u8, u16, u8);
+        u8   (*getapp)(struct net_device *, u8, u16);
 };
 
 #endif /* __NET_DCBNL_H__ */
diff --git a/include/net/dst.h b/include/net/dst.h
index 7fc409c19b37..5a900ddcf10d 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -8,6 +8,7 @@
 #ifndef _NET_DST_H
 #define _NET_DST_H
 
+#include <net/dst_ops.h>
 #include <linux/netdevice.h>
 #include <linux/rtnetlink.h>
 #include <linux/rcupdate.h>
@@ -102,28 +103,6 @@ struct dst_entry
         };
 };
 
-
-struct dst_ops
-{
-        unsigned short          family;
-        __be16                  protocol;
-        unsigned                gc_thresh;
-
-        int                     (*gc)(struct dst_ops *ops);
-        struct dst_entry *      (*check)(struct dst_entry *, __u32 cookie);
-        void                    (*destroy)(struct dst_entry *);
-        void                    (*ifdown)(struct dst_entry *,
-                                          struct net_device *dev, int how);
-        struct dst_entry *      (*negative_advice)(struct dst_entry *);
-        void                    (*link_failure)(struct sk_buff *);
-        void                    (*update_pmtu)(struct dst_entry *dst, u32 mtu);
-        int                     (*local_out)(struct sk_buff *skb);
-
-        atomic_t                entries;
-        struct kmem_cache               *kmem_cachep;
-        struct net              *dst_net;
-};
-
 #ifdef __KERNEL__
 
 static inline u32
diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
new file mode 100644
index 000000000000..d1ff9b7e99b8
--- /dev/null
+++ b/include/net/dst_ops.h
@@ -0,0 +1,28 @@
+#ifndef _NET_DST_OPS_H
+#define _NET_DST_OPS_H
+#include <linux/types.h>
+
+struct dst_entry;
+struct kmem_cachep;
+struct net_device;
+struct sk_buff;
+
+struct dst_ops {
+        unsigned short          family;
+        __be16                  protocol;
+        unsigned                gc_thresh;
+
+        int                     (*gc)(struct dst_ops *ops);
+        struct dst_entry *      (*check)(struct dst_entry *, __u32 cookie);
+        void                    (*destroy)(struct dst_entry *);
+        void                    (*ifdown)(struct dst_entry *,
+                                          struct net_device *dev, int how);
+        struct dst_entry *      (*negative_advice)(struct dst_entry *);
+        void                    (*link_failure)(struct sk_buff *);
+        void                    (*update_pmtu)(struct dst_entry *dst, u32 mtu);
+        int                     (*local_out)(struct sk_buff *skb);
+
+        atomic_t                entries;
+        struct kmem_cache       *kmem_cachep;
+};
+#endif
diff --git a/include/net/gen_stats.h b/include/net/gen_stats.h
index d136b5240ef2..c1488553e349 100644
--- a/include/net/gen_stats.h
+++ b/include/net/gen_stats.h
@@ -28,7 +28,7 @@ extern int gnet_stats_start_copy_compat(struct sk_buff *skb, int type,
                                         spinlock_t *lock, struct gnet_dump *d);
 
 extern int gnet_stats_copy_basic(struct gnet_dump *d,
-                                 struct gnet_stats_basic *b);
+                                 struct gnet_stats_basic_packed *b);
 extern int gnet_stats_copy_rate_est(struct gnet_dump *d,
                                     struct gnet_stats_rate_est *r);
 extern int gnet_stats_copy_queue(struct gnet_dump *d,
@@ -37,14 +37,14 @@ extern int gnet_stats_copy_app(struct gnet_dump *d, void *st, int len);
 
 extern int gnet_stats_finish_copy(struct gnet_dump *d);
 
-extern int gen_new_estimator(struct gnet_stats_basic *bstats,
+extern int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                              struct gnet_stats_rate_est *rate_est,
                              spinlock_t *stats_lock, struct nlattr *opt);
-extern void gen_kill_estimator(struct gnet_stats_basic *bstats,
+extern void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                                struct gnet_stats_rate_est *rate_est);
-extern int gen_replace_estimator(struct gnet_stats_basic *bstats,
+extern int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
                                  struct gnet_stats_rate_est *rate_est,
                                  spinlock_t *stats_lock, struct nlattr *opt);
-extern bool gen_estimator_active(const struct gnet_stats_basic *bstats,
+extern bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                                  const struct gnet_stats_rate_est *rate_est);
 #endif
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 1b0e3ee4ddd8..2a1c06874c42 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -3,6 +3,7 @@
 
 #include <linux/genetlink.h>
 #include <net/netlink.h>
+#include <net/net_namespace.h>
 
 /**
  * struct genl_multicast_group - generic netlink multicast group
@@ -27,6 +28,8 @@ struct genl_multicast_group
  * @name: name of family
  * @version: protocol version
  * @maxattr: maximum number of attributes supported
+ * @netnsok: set to true if the family can handle network
+ *      namespaces and should be presented in all of them
  * @attrbuf: buffer to store parsed attributes
  * @ops_list: list of all assigned operations
  * @family_list: family list
@@ -39,6 +42,7 @@ struct genl_family
         char                    name[GENL_NAMSIZ];
         unsigned int            version;
         unsigned int            maxattr;
+        bool                    netnsok;
         struct nlattr **        attrbuf;        /* private */
         struct list_head        ops_list;       /* private */
         struct list_head        family_list;    /* private */
@@ -62,8 +66,32 @@ struct genl_info
         struct genlmsghdr *     genlhdr;
         void *                  userhdr;
         struct nlattr **        attrs;
+#ifdef CONFIG_NET_NS
+        struct net *            _net;
+#endif
 };
 
+#ifdef CONFIG_NET_NS
+static inline struct net *genl_info_net(struct genl_info *info)
+{
+        return info->_net;
+}
+
+static inline void genl_info_net_set(struct genl_info *info, struct net *net)
+{
+        info->_net = net;
+}
+#else
+static inline struct net *genl_info_net(struct genl_info *info)
+{
+        return &init_net;
+}
+
+static inline void genl_info_net_set(struct genl_info *info, struct net *net)
+{
+}
+#endif
+
 /**
  * struct genl_ops - generic netlink operations
  * @cmd: command identifier
@@ -98,8 +126,6 @@ extern int genl_register_mc_group(struct genl_family *family,
 extern void genl_unregister_mc_group(struct genl_family *family,
                                      struct genl_multicast_group *grp);
 
-extern struct sock *genl_sock;
-
 /**
  * genlmsg_put - Add generic netlink header to netlink message
  * @skb: socket buffer holding the message
@@ -170,7 +196,21 @@ static inline void genlmsg_cancel(struct sk_buff *skb, void *hdr)
 }
 
 /**
- * genlmsg_multicast - multicast a netlink message
+ * genlmsg_multicast_netns - multicast a netlink message to a specific netns
+ * @net: the net namespace
+ * @skb: netlink message as socket buffer
+ * @pid: own netlink pid to avoid sending to yourself
+ * @group: multicast group id
+ * @flags: allocation flags
+ */
+static inline int genlmsg_multicast_netns(struct net *net, struct sk_buff *skb,
+                                          u32 pid, unsigned int group, gfp_t flags)
+{
+        return nlmsg_multicast(net->genl_sock, skb, pid, group, flags);
+}
+
+/**
+ * genlmsg_multicast - multicast a netlink message to the default netns
  * @skb: netlink message as socket buffer
  * @pid: own netlink pid to avoid sending to yourself
  * @group: multicast group id
@@ -179,17 +219,29 @@ static inline void genlmsg_cancel(struct sk_buff *skb, void *hdr)
 static inline int genlmsg_multicast(struct sk_buff *skb, u32 pid,
                                     unsigned int group, gfp_t flags)
 {
-        return nlmsg_multicast(genl_sock, skb, pid, group, flags);
+        return genlmsg_multicast_netns(&init_net, skb, pid, group, flags);
 }
 
 /**
+ * genlmsg_multicast_allns - multicast a netlink message to all net namespaces
+ * @skb: netlink message as socket buffer
+ * @pid: own netlink pid to avoid sending to yourself
+ * @group: multicast group id
+ * @flags: allocation flags
+ *
+ * This function must hold the RTNL or rcu_read_lock().
+ */
+int genlmsg_multicast_allns(struct sk_buff *skb, u32 pid,
+                            unsigned int group, gfp_t flags);
+
+/**
  * genlmsg_unicast - unicast a netlink message
  * @skb: netlink message as socket buffer
  * @pid: netlink pid of the destination socket
  */
-static inline int genlmsg_unicast(struct sk_buff *skb, u32 pid)
+static inline int genlmsg_unicast(struct net *net, struct sk_buff *skb, u32 pid)
 {
-        return nlmsg_unicast(genl_sock, skb, pid);
+        return nlmsg_unicast(net->genl_sock, skb, pid);
 }
 
 /**
@@ -199,7 +251,7 @@ static inline int genlmsg_unicast(struct sk_buff *skb, u32 pid)
  */
 static inline int genlmsg_reply(struct sk_buff *skb, struct genl_info *info)
 {
-        return genlmsg_unicast(skb, info->snd_pid);
+        return genlmsg_unicast(genl_info_net(info), skb, info->snd_pid);
 }
 
 /**
diff --git a/include/net/ieee802154/mac_def.h b/include/net/ieee802154.h
index 8cb684635650..d52685defb11 100644
--- a/include/net/ieee802154/mac_def.h
+++ b/include/net/ieee802154.h
@@ -23,8 +23,8 @@
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
  */
 
-#ifndef IEEE802154_MAC_DEF_H
-#define IEEE802154_MAC_DEF_H
+#ifndef NET_IEEE802154_H
+#define NET_IEEE802154_H
 
 #define IEEE802154_FC_TYPE_BEACON       0x0     /* Frame is beacon */
 #define IEEE802154_FC_TYPE_DATA         0x1     /* Frame is data */
diff --git a/include/net/ieee802154/nl802154.h b/include/net/ieee802154/nl802154.h
deleted file mode 100644
index 78efcdf52b59..000000000000
--- a/include/net/ieee802154/nl802154.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * nl802154.h
- *
- * Copyright (C) 2007, 2008, 2009 Siemens AG
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- */
-
-#ifndef IEEE802154_NL_H
-#define IEEE802154_NL_H
-
-struct net_device;
-struct ieee802154_addr;
-
-int ieee802154_nl_assoc_indic(struct net_device *dev,
-                struct ieee802154_addr *addr, u8 cap);
-int ieee802154_nl_assoc_confirm(struct net_device *dev,
-                u16 short_addr, u8 status);
-int ieee802154_nl_disassoc_indic(struct net_device *dev,
-                struct ieee802154_addr *addr, u8 reason);
-int ieee802154_nl_disassoc_confirm(struct net_device *dev,
-                u8 status);
-int ieee802154_nl_scan_confirm(struct net_device *dev,
-                u8 status, u8 scan_type, u32 unscanned,
-                u8 *edl/*, struct list_head *pan_desc_list */);
-int ieee802154_nl_beacon_indic(struct net_device *dev, u16 panid,
-                u16 coord_addr);
-
-#endif
diff --git a/include/net/ieee802154/netdevice.h b/include/net/ieee802154_netdev.h
index e2506af3e7c8..5dc6a61952de 100644
--- a/include/net/ieee802154/netdevice.h
+++ b/include/net/ieee802154_netdev.h
@@ -80,7 +80,7 @@ static inline int mac_cb_type(struct sk_buff *skb)
 struct ieee802154_mlme_ops {
         int (*assoc_req)(struct net_device *dev,
                         struct ieee802154_addr *addr,
-                        u8 channel, u8 cap);
+                        u8 channel, u8 page, u8 cap);
         int (*assoc_resp)(struct net_device *dev,
                         struct ieee802154_addr *addr,
                         u16 short_addr, u8 status);
@@ -89,10 +89,10 @@ struct ieee802154_mlme_ops {
                         u8 reason);
         int (*start_req)(struct net_device *dev,
                         struct ieee802154_addr *addr,
-                        u8 channel, u8 bcn_ord, u8 sf_ord,
+                        u8 channel, u8 page, u8 bcn_ord, u8 sf_ord,
                         u8 pan_coord, u8 blx, u8 coord_realign);
         int (*scan_req)(struct net_device *dev,
-                        u8 type, u32 channels, u8 duration);
+                        u8 type, u32 channels, u8 page, u8 duration);
 
         /*
          * FIXME: these should become the part of PIB/MIB interface.
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 7c5c0f79168a..15b492a9aa79 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -22,6 +22,12 @@
 #include <net/flow.h>
 #include <net/netlink.h>
 
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+#define FIB6_TABLE_HASHSZ 256
+#else
+#define FIB6_TABLE_HASHSZ 1
+#endif
+
 struct rt6_info;
 
 struct fib6_config
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index bbae1e87efcd..98978e73f666 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -99,47 +99,47 @@ static inline const char *ip_vs_dbg_addr(int af, char *buf, size_t buf_len,
         return &buf[*idx - len];
 }
 
-#define IP_VS_DBG_BUF(level, msg...)                    \
-    do {                                                \
-            char ip_vs_dbg_buf[160];                    \
-            int ip_vs_dbg_idx = 0;                      \
-            if (level <= ip_vs_get_debug_level())       \
-                    printk(KERN_DEBUG "IPVS: " msg);    \
-    } while (0)
-#define IP_VS_ERR_BUF(msg...)                           \
-    do {                                                \
-            char ip_vs_dbg_buf[160];                    \
-            int ip_vs_dbg_idx = 0;                      \
-            printk(KERN_ERR "IPVS: " msg);              \
-    } while (0)
+#define IP_VS_DBG_BUF(level, msg, ...)                                  \
+        do {                                                            \
+                char ip_vs_dbg_buf[160];                                \
+                int ip_vs_dbg_idx = 0;                                  \
+                if (level <= ip_vs_get_debug_level())                   \
+                        printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__);  \
+        } while (0)
+#define IP_VS_ERR_BUF(msg...)                                           \
+        do {                                                            \
+                char ip_vs_dbg_buf[160];                                \
+                int ip_vs_dbg_idx = 0;                                  \
+                pr_err(msg);                                            \
+        } while (0)
 
 /* Only use from within IP_VS_DBG_BUF() or IP_VS_ERR_BUF macros */
-#define IP_VS_DBG_ADDR(af, addr)                        \
-    ip_vs_dbg_addr(af, ip_vs_dbg_buf,                   \
-                   sizeof(ip_vs_dbg_buf), addr,         \
-                   &ip_vs_dbg_idx)
-
-#define IP_VS_DBG(level, msg...)                        \
-    do {                                                \
-            if (level <= ip_vs_get_debug_level())       \
-                    printk(KERN_DEBUG "IPVS: " msg);    \
-    } while (0)
-#define IP_VS_DBG_RL(msg...)                            \
-    do {                                                \
-            if (net_ratelimit())                        \
-                    printk(KERN_DEBUG "IPVS: " msg);    \
-    } while (0)
-#define IP_VS_DBG_PKT(level, pp, skb, ofs, msg)         \
-    do {                                                \
-            if (level <= ip_vs_get_debug_level())       \
-                pp->debug_packet(pp, skb, ofs, msg);    \
-    } while (0)
-#define IP_VS_DBG_RL_PKT(level, pp, skb, ofs, msg)      \
-    do {                                                \
-            if (level <= ip_vs_get_debug_level() &&     \
-                net_ratelimit())                        \
-                pp->debug_packet(pp, skb, ofs, msg);    \
-    } while (0)
+#define IP_VS_DBG_ADDR(af, addr)                                        \
+        ip_vs_dbg_addr(af, ip_vs_dbg_buf,                               \
+                       sizeof(ip_vs_dbg_buf), addr,                     \
+                       &ip_vs_dbg_idx)
+
+#define IP_VS_DBG(level, msg, ...)                                      \
+        do {                                                            \
+                if (level <= ip_vs_get_debug_level())                   \
+                        printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__);  \
+        } while (0)
+#define IP_VS_DBG_RL(msg, ...)                                          \
+        do {                                                            \
+                if (net_ratelimit())                                    \
+                        printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__);  \
+        } while (0)
+#define IP_VS_DBG_PKT(level, pp, skb, ofs, msg)                         \
+        do {                                                            \
+                if (level <= ip_vs_get_debug_level())                   \
+                        pp->debug_packet(pp, skb, ofs, msg);            \
+        } while (0)
+#define IP_VS_DBG_RL_PKT(level, pp, skb, ofs, msg)                      \
+        do {                                                            \
+                if (level <= ip_vs_get_debug_level() &&                 \
+                    net_ratelimit())                                    \
+                        pp->debug_packet(pp, skb, ofs, msg);            \
+        } while (0)
 #else   /* NO DEBUGGING at ALL */
 #define IP_VS_DBG_BUF(level, msg...)  do {} while (0)
 #define IP_VS_ERR_BUF(msg...)  do {} while (0)
@@ -150,29 +150,27 @@ static inline const char *ip_vs_dbg_addr(int af, char *buf, size_t buf_len,
 #endif
 
 #define IP_VS_BUG() BUG()
-#define IP_VS_ERR(msg...) printk(KERN_ERR "IPVS: " msg)
-#define IP_VS_INFO(msg...) printk(KERN_INFO "IPVS: " msg)
-#define IP_VS_WARNING(msg...) \
-        printk(KERN_WARNING "IPVS: " msg)
-#define IP_VS_ERR_RL(msg...)                            \
-    do {                                                \
-            if (net_ratelimit())                        \
-                    printk(KERN_ERR "IPVS: " msg);      \
-    } while (0)
+#define IP_VS_ERR_RL(msg, ...)                                          \
+        do {                                                            \
+                if (net_ratelimit())                                    \
+                        pr_err(msg, ##__VA_ARGS__);                     \
+        } while (0)
 
 #ifdef CONFIG_IP_VS_DEBUG
 #define EnterFunction(level)                                            \
-    do {                                                                \
-            if (level <= ip_vs_get_debug_level())                       \
-                    printk(KERN_DEBUG "Enter: %s, %s line %i\n",        \
-                           __func__, __FILE__, __LINE__);               \
-    } while (0)
-#define LeaveFunction(level)                                            \
-    do {                                                                \
-            if (level <= ip_vs_get_debug_level())                       \
-                        printk(KERN_DEBUG "Leave: %s, %s line %i\n",    \
-                               __func__, __FILE__, __LINE__);       \
-    } while (0)
+        do {                                                            \
+                if (level <= ip_vs_get_debug_level())                   \
+                        printk(KERN_DEBUG                               \
+                               pr_fmt("Enter: %s, %s line %i\n"),       \
+                               __func__, __FILE__, __LINE__);           \
+        } while (0)
+#define LeaveFunction(level)                                            \
+        do {                                                            \
+                if (level <= ip_vs_get_debug_level())                   \
+                        printk(KERN_DEBUG                               \
+                               pr_fmt("Leave: %s, %s line %i\n"),       \
+                               __func__, __FILE__, __LINE__);           \
+        } while (0)
 #else
 #define EnterFunction(level)   do {} while (0)
 #define LeaveFunction(level)   do {} while (0)
@@ -740,7 +738,8 @@ extern void ip_vs_protocol_cleanup(void);
 extern void ip_vs_protocol_timeout_change(int flags);
 extern int *ip_vs_create_timeout_table(int *table, int size);
 extern int
-ip_vs_set_state_timeout(int *table, int num, char **names, char *name, int to);
+ip_vs_set_state_timeout(int *table, int num, const char *const *names,
+                        const char *name, int to);
 extern void
 ip_vs_tcpudp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
                           int offset, const char *msg);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index f27fd83d67d8..ad9a51130254 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -441,6 +441,18 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
         return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
 }
 
+static __inline__ void ipv6_select_ident(struct frag_hdr *fhdr)
+{
+        static u32 ipv6_fragmentation_id = 1;
+        static DEFINE_SPINLOCK(ip6_id_lock);
+
+        spin_lock_bh(&ip6_id_lock);
+        fhdr->identification = htonl(ipv6_fragmentation_id);
+        if (++ipv6_fragmentation_id == 0)
+                ipv6_fragmentation_id = 1;
+        spin_unlock_bh(&ip6_id_lock);
+}
+
 /*
  *      Prototypes exported by ipv6
  */
diff --git a/include/net/irda/ircomm_event.h b/include/net/irda/ircomm_event.h
index c290447872d1..bc0c6f31f1c6 100644
--- a/include/net/irda/ircomm_event.h
+++ b/include/net/irda/ircomm_event.h
@@ -74,7 +74,7 @@ struct ircomm_info {
         struct qos_info *qos;
 };
 
-extern char *ircomm_state[];
+extern const char *const ircomm_state[];
 
 struct ircomm_cb;   /* Forward decl. */
 
diff --git a/include/net/irda/ircomm_tty_attach.h b/include/net/irda/ircomm_tty_attach.h
index f91a5695aa44..0a63bbb972d7 100644
--- a/include/net/irda/ircomm_tty_attach.h
+++ b/include/net/irda/ircomm_tty_attach.h
@@ -66,8 +66,8 @@ struct ircomm_tty_info {
         __u8      dlsap_sel;
 };
 
-extern char *ircomm_state[];
-extern char *ircomm_tty_state[];
+extern const char *const ircomm_state[];
+extern const char *const ircomm_tty_state[];
 
 int ircomm_tty_do_event(struct ircomm_tty_cb *self, IRCOMM_TTY_EVENT event,
                         struct sk_buff *skb, struct ircomm_tty_info *info);
diff --git a/include/net/irda/irlap_event.h b/include/net/irda/irlap_event.h
index 2ae2e119ef4b..4c90824c50fb 100644
--- a/include/net/irda/irlap_event.h
+++ b/include/net/irda/irlap_event.h
@@ -120,7 +120,7 @@ typedef enum { /* FIXME check the two first reason codes */
         LAP_PRIMARY_CONFLICT,
 } LAP_REASON;
 
-extern const char *irlap_state[];
+extern const char *const irlap_state[];
 
 void irlap_do_event(struct irlap_cb *self, IRLAP_EVENT event, 
                     struct sk_buff *skb, struct irlap_info *info);
diff --git a/include/net/irda/irlmp_event.h b/include/net/irda/irlmp_event.h
index e03ae4ae3963..9e4ec17a7449 100644
--- a/include/net/irda/irlmp_event.h
+++ b/include/net/irda/irlmp_event.h
@@ -79,8 +79,8 @@ typedef enum {
         LM_LAP_IDLE_TIMEOUT,
 } IRLMP_EVENT;
 
-extern const char *irlmp_state[];
-extern const char *irlsap_state[];
+extern const char *const irlmp_state[];
+extern const char *const irlsap_state[];
 
 void irlmp_watchdog_timer_expired(void *data);
 void irlmp_discovery_timer_expired(void *data);
diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index 51b9a37de991..e9054a283fde 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -416,13 +416,13 @@ struct iw_spy_data
  * data (i.e. valid as long as struct net_device exist, same locking rules).
  */
 /* Forward declaration */
-struct ieee80211_device;
+struct libipw_device;
 /* The struct */
 struct iw_public_data {
         /* Driver enhanced spy support */
         struct iw_spy_data *            spy_data;
-        /* Structure managed by the in-kernel IEEE 802.11 layer */
-        struct ieee80211_device *       ieee80211;
+        /* Legacy structure managed by the ipw2x00-specific IEEE 802.11 layer */
+        struct libipw_device *          libipw;
 };
 
 /**************************** PROTOTYPES ****************************/
@@ -443,7 +443,7 @@ extern int dev_get_wireless_info(char * buffer, char **start, off_t offset,
 extern void wireless_send_event(struct net_device *     dev,
                                 unsigned int            cmd,
                                 union iwreq_data *      wrqu,
-                                char *                  extra);
+                                const char *            extra);
 
 /* We may need a function to send a stream of events to user space.
  * More on that later... */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index c06104476973..466859b285e1 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -73,6 +73,21 @@
  */
 
 /**
+ * DOC: mac80211 workqueue
+ *
+ * mac80211 provides its own workqueue for drivers and internal mac80211 use.
+ * The workqueue is a single threaded workqueue and can only be accessed by
+ * helpers for sanity checking. Drivers must ensure all work added onto the
+ * mac80211 workqueue should be cancelled on the driver stop() callback.
+ *
+ * mac80211 will flushed the workqueue upon interface removal and during
+ * suspend.
+ *
+ * All work performed on the mac80211 workqueue must not acquire the RTNL lock.
+ *
+ */
+
+/**
  * enum ieee80211_max_queues - maximum number of queues
  *
  * @IEEE80211_MAX_QUEUES: Maximum number of regular device queues.
@@ -224,7 +239,14 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_AMPDU: this frame should be sent as part of an A-MPDU
  * @IEEE80211_TX_CTL_INJECTED: Frame was injected, internal to mac80211.
  * @IEEE80211_TX_STAT_TX_FILTERED: The frame was not transmitted
- *      because the destination STA was in powersave mode.
+ *      because the destination STA was in powersave mode. Note that to
+ *      avoid race conditions, the filter must be set by the hardware or
+ *      firmware upon receiving a frame that indicates that the station
+ *      went to sleep (must be done on device to filter frames already on
+ *      the queue) and may only be unset after mac80211 gives the OK for
+ *      that by setting the IEEE80211_TX_CTL_CLEAR_PS_FILT (see above),
+ *      since only then is it guaranteed that no more frames are in the
+ *      hardware queue.
  * @IEEE80211_TX_STAT_ACK: Frame was acknowledged
  * @IEEE80211_TX_STAT_AMPDU: The frame was aggregated, so status
  *      is for the whole aggregation.
@@ -241,6 +263,15 @@ struct ieee80211_bss_conf {
  *      it can be sent out.
  * @IEEE80211_TX_INTFL_RETRIED: completely internal to mac80211,
  *      used to indicate that a frame was already retried due to PS
+ * @IEEE80211_TX_INTFL_DONT_ENCRYPT: completely internal to mac80211,
+ *      used to indicate frame should not be encrypted
+ * @IEEE80211_TX_CTL_PSPOLL_RESPONSE: (internal?)
+ *      This frame is a response to a PS-poll frame and should be sent
+ *      although the station is in powersave mode.
+ * @IEEE80211_TX_CTL_MORE_FRAMES: More frames will be passed to the
+ *      transmit function after the current frame, this can be used
+ *      by drivers to kick the DMA queue only if unset or when the
+ *      queue gets full.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -259,6 +290,9 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_INTFL_RCALGO               = BIT(13),
         IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
         IEEE80211_TX_INTFL_RETRIED              = BIT(15),
+        IEEE80211_TX_INTFL_DONT_ENCRYPT         = BIT(16),
+        IEEE80211_TX_CTL_PSPOLL_RESPONSE        = BIT(17),
+        IEEE80211_TX_CTL_MORE_FRAMES            = BIT(18),
 };
 
 /**
@@ -316,6 +350,21 @@ enum mac80211_rate_control_flags {
  *
  * When used for transmit status reporting, the driver should
  * always report the rate along with the flags it used.
+ *
+ * &struct ieee80211_tx_info contains an array of these structs
+ * in the control information, and it will be filled by the rate
+ * control algorithm according to what should be sent. For example,
+ * if this array contains, in the format { <idx>, <count> } the
+ * information
+ *    { 3, 2 }, { 2, 2 }, { 1, 4 }, { -1, 0 }, { -1, 0 }
+ * then this means that the frame should be transmitted
+ * up to twice at rate 3, up to twice at rate 2, and up to four
+ * times at rate 1 if it doesn't get acknowledged. Say it gets
+ * acknowledged by the peer after the fifth attempt, the status
+ * information should then contain
+ *   { 3, 2 }, { 2, 2 }, { 1, 1 }, { -1, 0 } ...
+ * since it was transmitted twice at rate 3, twice at rate 2
+ * and once at rate 1 after which we received an acknowledgement.
  */
 struct ieee80211_tx_rate {
         s8 idx;
@@ -397,6 +446,11 @@ static inline struct ieee80211_tx_info *IEEE80211_SKB_CB(struct sk_buff *skb)
         return (struct ieee80211_tx_info *)skb->cb;
 }
 
+static inline struct ieee80211_rx_status *IEEE80211_SKB_RXCB(struct sk_buff *skb)
+{
+        return (struct ieee80211_rx_status *)skb->cb;
+}
+
 /**
  * ieee80211_tx_info_clear_status - clear TX status
  *
@@ -478,7 +532,7 @@ enum mac80211_rx_flags {
  *
  * The low-level driver should provide this information (the subset
  * supported by hardware) to the 802.11 code with each received
- * frame.
+ * frame, in the skb's control buffer (cb).
  *
  * @mactime: value in microseconds of the 64-bit Time Synchronization Function
  *      (TSF) timer when the first data symbol (MPDU) arrived at the hardware.
@@ -529,7 +583,6 @@ enum ieee80211_conf_flags {
 /**
  * enum ieee80211_conf_changed - denotes which configuration changed
  *
- * @_IEEE80211_CONF_CHANGE_RADIO_ENABLED: DEPRECATED
  * @IEEE80211_CONF_CHANGE_LISTEN_INTERVAL: the listen interval changed
  * @IEEE80211_CONF_CHANGE_RADIOTAP: the radiotap flag changed
  * @IEEE80211_CONF_CHANGE_PS: the PS flag or dynamic PS timeout changed
@@ -539,7 +592,6 @@ enum ieee80211_conf_flags {
  * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
  */
 enum ieee80211_conf_changed {
-        _IEEE80211_CONF_CHANGE_RADIO_ENABLED    = BIT(0),
         IEEE80211_CONF_CHANGE_LISTEN_INTERVAL   = BIT(2),
         IEEE80211_CONF_CHANGE_RADIOTAP          = BIT(3),
         IEEE80211_CONF_CHANGE_PS                = BIT(4),
@@ -549,14 +601,6 @@ enum ieee80211_conf_changed {
         IEEE80211_CONF_CHANGE_IDLE              = BIT(8),
 };
 
-static inline __deprecated enum ieee80211_conf_changed
-__IEEE80211_CONF_CHANGE_RADIO_ENABLED(void)
-{
-        return _IEEE80211_CONF_CHANGE_RADIO_ENABLED;
-}
-#define IEEE80211_CONF_CHANGE_RADIO_ENABLED \
-        __IEEE80211_CONF_CHANGE_RADIO_ENABLED()
-
 /**
  * struct ieee80211_conf - configuration of the device
  *
@@ -564,9 +608,6 @@ __IEEE80211_CONF_CHANGE_RADIO_ENABLED(void)
  *
  * @flags: configuration flags defined above
  *
- * @radio_enabled: when zero, driver is required to switch off the radio.
- * @beacon_int: DEPRECATED, DO NOT USE
- *
  * @listen_interval: listen interval in units of beacon interval
  * @max_sleep_period: the maximum number of beacon intervals to sleep for
  *      before checking the beacon for a TIM bit (managed mode only); this
@@ -590,13 +631,11 @@ __IEEE80211_CONF_CHANGE_RADIO_ENABLED(void)
  *    number of transmissions not the number of retries
  */
 struct ieee80211_conf {
-        int __deprecated beacon_int;
         u32 flags;
         int power_level, dynamic_ps_timeout;
         int max_sleep_period;
 
         u16 listen_interval;
-        bool __deprecated radio_enabled;
 
         u8 long_frame_max_tx_count, short_frame_max_tx_count;
 
@@ -901,12 +940,6 @@ enum ieee80211_hw_flags {
  *
  * @conf: &struct ieee80211_conf, device configuration, don't use.
  *
- * @workqueue: single threaded workqueue available for driver use,
- *      allocated by mac80211 on registration and flushed when an
- *      interface is removed.
- *      NOTICE: All work performed on this workqueue must not
- *      acquire the RTNL lock.
- *
  * @priv: pointer to private area that was allocated for driver use
  *      along with this structure.
  *
@@ -942,7 +975,6 @@ enum ieee80211_hw_flags {
 struct ieee80211_hw {
         struct ieee80211_conf conf;
         struct wiphy *wiphy;
-        struct workqueue_struct *workqueue;
         const char *rate_control_algorithm;
         void *priv;
         u32 flags;
@@ -1172,10 +1204,13 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * the driver's configure_filter() function which frames should be
  * passed to mac80211 and which should be filtered out.
  *
- * The configure_filter() callback is invoked with the parameters
- * @mc_count and @mc_list for the combined multicast address list
- * of all virtual interfaces, @changed_flags telling which flags
- * were changed and @total_flags with the new flag states.
+ * Before configure_filter() is invoked, the prepare_multicast()
+ * callback is invoked with the parameters @mc_count and @mc_list
+ * for the combined multicast address list of all virtual interfaces.
+ * It's use is optional, and it returns a u64 that is passed to
+ * configure_filter(). Additionally, configure_filter() has the
+ * arguments @changed_flags telling which flags were changed and
+ * @total_flags with the new flag states.
  *
  * If your device has no multicast address filters your driver will
  * need to check both the %FIF_ALLMULTI flag and the @mc_count
@@ -1224,10 +1259,13 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  *      mac80211 needs to do and the amount of CPU wakeups, so you should
  *      honour this flag if possible.
  *
- * @FIF_CONTROL: pass control frames, if PROMISC_IN_BSS is not set then
- *      only those addressed to this station
+ * @FIF_CONTROL: pass control frames (except for PS Poll), if PROMISC_IN_BSS
+ *  is not set then only those addressed to this station.
  *
  * @FIF_OTHER_BSS: pass frames destined to other BSSes
+ *
+ * @FIF_PSPOLL: pass PS Poll frames, if PROMISC_IN_BSS  is not set then only
+ *  those addressed to this station.
  */
 enum ieee80211_filter_flags {
         FIF_PROMISC_IN_BSS      = 1<<0,
@@ -1237,6 +1275,7 @@ enum ieee80211_filter_flags {
         FIF_BCN_PRBRESP_PROMISC = 1<<4,
         FIF_CONTROL             = 1<<5,
         FIF_OTHER_BSS           = 1<<6,
+        FIF_PSPOLL              = 1<<7,
 };
 
 /**
@@ -1289,7 +1328,8 @@ enum ieee80211_ampdu_mlme_action {
  *      is disabled. This should turn off the hardware (at least
  *      it must turn off frame reception.)
  *      May be called right after add_interface if that rejects
- *      an interface.
+ *      an interface. If you added any work onto the mac80211 workqueue
+ *      you should ensure to cancel it on this callback.
  *      Must be implemented.
  *
  * @add_interface: Called when a netdevice attached to the hardware is
@@ -1323,9 +1363,13 @@ enum ieee80211_ampdu_mlme_action {
  *      for association indication. The @changed parameter indicates which
  *      of the bss parameters has changed when a call is made.
  *
+ * @prepare_multicast: Prepare for multicast filter configuration.
+ *      This callback is optional, and its return value is passed
+ *      to configure_filter(). This callback must be atomic.
+ *
  * @configure_filter: Configure the device's RX filter.
  *      See the section "Frame filtering" for more information.
- *      This callback must be implemented and atomic.
+ *      This callback must be implemented.
  *
  * @set_tim: Set TIM bit. mac80211 calls this function when a TIM bit
  *      must be set or cleared for a given STA. Must be atomic.
@@ -1411,6 +1455,8 @@ enum ieee80211_ampdu_mlme_action {
  * @rfkill_poll: Poll rfkill hardware state. If you need this, you also
  *      need to set wiphy->rfkill_poll to %true before registration,
  *      and need to call wiphy_rfkill_set_hw_state() in the callback.
+ *
+ * @testmode_cmd: Implement a cfg80211 test mode command.
  */
 struct ieee80211_ops {
         int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1425,10 +1471,12 @@ struct ieee80211_ops {
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_bss_conf *info,
                                  u32 changed);
+        u64 (*prepare_multicast)(struct ieee80211_hw *hw,
+                                 int mc_count, struct dev_addr_list *mc_list);
         void (*configure_filter)(struct ieee80211_hw *hw,
                                  unsigned int changed_flags,
                                  unsigned int *total_flags,
-                                 int mc_count, struct dev_addr_list *mc_list);
+                                 u64 multicast);
         int (*set_tim)(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
                        bool set);
         int (*set_key)(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -1461,6 +1509,9 @@ struct ieee80211_ops {
                             struct ieee80211_sta *sta, u16 tid, u16 *ssn);
 
         void (*rfkill_poll)(struct ieee80211_hw *hw);
+#ifdef CONFIG_NL80211_TESTMODE
+        int (*testmode_cmd)(struct ieee80211_hw *hw, void *data, int len);
+#endif
 };
 
 /**
@@ -1606,10 +1657,6 @@ void ieee80211_free_hw(struct ieee80211_hw *hw);
  */
 void ieee80211_restart_hw(struct ieee80211_hw *hw);
 
-/* trick to avoid symbol clashes with the ieee80211 subsystem */
-void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
-                    struct ieee80211_rx_status *status);
-
 /**
  * ieee80211_rx - receive frame
  *
@@ -1624,14 +1671,8 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
  *
  * @hw: the hardware this frame came in on
  * @skb: the buffer to receive, owned by mac80211 after this call
- * @status: status of this frame; the status pointer need not be valid
- *      after this function returns
  */
-static inline void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
-                                struct ieee80211_rx_status *status)
-{
-        __ieee80211_rx(hw, skb, status);
-}
+void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb);
 
 /**
  * ieee80211_rx_irqsafe - receive frame
@@ -1644,13 +1685,8 @@ static inline void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
  *
  * @hw: the hardware this frame came in on
  * @skb: the buffer to receive, owned by mac80211 after this call
- * @status: status of this frame; the status pointer need not be valid
- *      after this function returns and is not freed by mac80211,
- *      it is recommended that it points to a stack area
  */
-void ieee80211_rx_irqsafe(struct ieee80211_hw *hw,
-                          struct sk_buff *skb,
-                          struct ieee80211_rx_status *status);
+void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb);
 
 /**
  * ieee80211_tx_status - transmit status callback
@@ -1917,6 +1953,31 @@ void ieee80211_iterate_active_interfaces_atomic(struct ieee80211_hw *hw,
                                                 void *data);
 
 /**
+ * ieee80211_queue_work - add work onto the mac80211 workqueue
+ *
+ * Drivers and mac80211 use this to add work onto the mac80211 workqueue.
+ * This helper ensures drivers are not queueing work when they should not be.
+ *
+ * @hw: the hardware struct for the interface we are adding work for
+ * @work: the work we want to add onto the mac80211 workqueue
+ */
+void ieee80211_queue_work(struct ieee80211_hw *hw, struct work_struct *work);
+
+/**
+ * ieee80211_queue_delayed_work - add work onto the mac80211 workqueue
+ *
+ * Drivers and mac80211 use this to queue delayed work onto the mac80211
+ * workqueue.
+ *
+ * @hw: the hardware struct for the interface we are adding work for
+ * @dwork: delayable work to queue onto the mac80211 workqueue
+ * @delay: number of jiffies to wait before queueing
+ */
+void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
+                                  struct delayed_work *dwork,
+                                  unsigned long delay);
+
+/**
  * ieee80211_start_tx_ba_session - Start a tx Block Ack session.
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @ra: receiver address of the BA session recipient
@@ -2090,6 +2151,29 @@ static inline int rate_supported(struct ieee80211_sta *sta,
         return (sta == NULL || sta->supp_rates[band] & BIT(index));
 }
 
+/**
+ * rate_control_send_low - helper for drivers for management/no-ack frames
+ *
+ * Rate control algorithms that agree to use the lowest rate to
+ * send management frames and NO_ACK data with the respective hw
+ * retries should use this in the beginning of their mac80211 get_rate
+ * callback. If true is returned the rate control can simply return.
+ * If false is returned we guarantee that sta and sta and priv_sta is
+ * not null.
+ *
+ * Rate control algorithms wishing to do more intelligent selection of
+ * rate for multicast/broadcast frames may choose to not use this.
+ *
+ * @sta: &struct ieee80211_sta pointer to the target destination. Note
+ *      that this may be null.
+ * @priv_sta: private rate control structure. This may be null.
+ * @txrc: rate control information we sholud populate for mac80211.
+ */
+bool rate_control_send_low(struct ieee80211_sta *sta,
+                           void *priv_sta,
+                           struct ieee80211_tx_rate_control *txrc);
+
+
 static inline s8
 rate_lowest_index(struct ieee80211_supported_band *sband,
                   struct ieee80211_sta *sta)
@@ -2106,6 +2190,17 @@ rate_lowest_index(struct ieee80211_supported_band *sband,
         return 0;
 }
 
+static inline
+bool rate_usable_index_exists(struct ieee80211_supported_band *sband,
+                              struct ieee80211_sta *sta)
+{
+        unsigned int i;
+
+        for (i = 0; i < sband->n_bitrates; i++)
+                if (rate_supported(sta, sband->band, i))
+                        return true;
+        return false;
+}
 
 int ieee80211_rate_control_register(struct rate_control_ops *ops);
 void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index d8d790e56d3d..3817fda82a80 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -24,6 +24,7 @@
 
 #include <linux/err.h>
 #include <linux/sysctl.h>
+#include <linux/workqueue.h>
 #include <net/rtnetlink.h>
 
 /*
@@ -117,7 +118,7 @@ struct neighbour
         int                     (*output)(struct sk_buff *skb);
         struct sk_buff_head     arp_queue;
         struct timer_list       timer;
-        struct neigh_ops        *ops;
+        const struct neigh_ops  *ops;
         u8                      primary_key[0];
 };
 
@@ -167,7 +168,7 @@ struct neigh_table
         int                     gc_thresh2;
         int                     gc_thresh3;
         unsigned long           last_flush;
-        struct timer_list       gc_timer;
+        struct delayed_work     gc_work;
         struct timer_list       proxy_timer;
         struct sk_buff_head     proxy_queue;
         atomic_t                entries;
@@ -178,7 +179,6 @@ struct neigh_table
         struct neighbour        **hash_buckets;
         unsigned int            hash_mask;
         __u32                   hash_rnd;
-        unsigned int            hash_chain_gc;
         struct pneigh_entry     **phash_buckets;
 };
 
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index ded434b032a4..a1202841aadd 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -26,6 +26,7 @@ struct net_device;
 struct sock;
 struct ctl_table_header;
 struct net_generic;
+struct sock;
 
 struct net {
         atomic_t                count;          /* To decided when the network
@@ -57,6 +58,7 @@ struct net {
         spinlock_t              rules_mod_lock;
 
         struct sock             *rtnl;                  /* rtnetlink socket */
+        struct sock             *genl_sock;
 
         struct netns_core       core;
         struct netns_mib        mib;
@@ -78,6 +80,9 @@ struct net {
 #ifdef CONFIG_XFRM
         struct netns_xfrm       xfrm;
 #endif
+#ifdef CONFIG_WIRELESS_EXT
+        struct sk_buff_head     wext_nlevents;
+#endif
         struct net_generic      *gen;
 };
 
@@ -106,6 +111,8 @@ static inline struct net *copy_net_ns(unsigned long flags, struct net *net_ns)
 
 extern struct list_head net_namespace_list;
 
+extern struct net *get_net_ns_by_pid(pid_t pid);
+
 #ifdef CONFIG_NET_NS
 extern void __put_net(struct net *net);
 
@@ -208,6 +215,9 @@ static inline struct net *read_pnet(struct net * const *pnet)
 #define for_each_net(VAR)                               \
         list_for_each_entry(VAR, &net_namespace_list, list)
 
+#define for_each_net_rcu(VAR)                           \
+        list_for_each_entry_rcu(VAR, &net_namespace_list, list)
+
 #ifdef CONFIG_NET_NS
 #define __net_init
 #define __net_exit
@@ -229,13 +239,15 @@ struct pernet_operations {
  * needs per network namespace operations use device pernet operations,
  * otherwise use pernet subsys operations.
  *
- * This is critically important.  Most of the network code cleanup
- * runs with the assumption that dev_remove_pack has been called so no
- * new packets will arrive during and after the cleanup functions have
- * been called.  dev_remove_pack is not per namespace so instead the
- * guarantee of no more packets arriving in a network namespace is
- * provided by ensuring that all network devices and all sockets have
- * left the network namespace before the cleanup methods are called.
+ * Network interfaces need to be removed from a dying netns _before_
+ * subsys notifiers can be called, as most of the network code cleanup
+ * (which is done from subsys notifiers) runs with the assumption that
+ * dev_remove_pack has been called so no new packets will arrive during
+ * and after the cleanup functions have been called.  dev_remove_pack
+ * is not per namespace so instead the guarantee of no more packets
+ * arriving in a network namespace is provided by ensuring that all
+ * network devices and all sockets have left the network namespace
+ * before the cleanup methods are called.
  *
  * For the longest time the ipv4 icmp code was registered as a pernet
  * device which caused kernel oops, and panics during network
diff --git a/include/net/netfilter/nf_nat_core.h b/include/net/netfilter/nf_nat_core.h
index 58684066388c..33602ab66190 100644
--- a/include/net/netfilter/nf_nat_core.h
+++ b/include/net/netfilter/nf_nat_core.h
@@ -31,6 +31,6 @@ struct nlattr;
 extern int
 (*nfnetlink_parse_nat_setup_hook)(struct nf_conn *ct,
                                   enum nf_nat_manip_type manip,
-                                  struct nlattr *attr);
+                                  const struct nlattr *attr);
 
 #endif /* _NF_NAT_CORE_H */
diff --git a/include/net/netfilter/xt_rateest.h b/include/net/netfilter/xt_rateest.h
index 65d594dffbff..ddbf37e19616 100644
--- a/include/net/netfilter/xt_rateest.h
+++ b/include/net/netfilter/xt_rateest.h
@@ -8,7 +8,7 @@ struct xt_rateest {
         spinlock_t                      lock;
         struct gnet_estimator           params;
         struct gnet_stats_rate_est      rstats;
-        struct gnet_stats_basic         bstats;
+        struct gnet_stats_basic_packed  bstats;
 };
 
 extern struct xt_rateest *xt_rateest_lookup(const char *name);
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 007bdb07dabb..a63b2192ac1c 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -365,7 +365,7 @@ static inline struct nlmsghdr *nlmsg_next(struct nlmsghdr *nlh, int *remaining)
  *
  * See nla_parse()
  */
-static inline int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen,
+static inline int nlmsg_parse(const struct nlmsghdr *nlh, int hdrlen,
                               struct nlattr *tb[], int maxtype,
                               const struct nla_policy *policy)
 {
@@ -414,7 +414,7 @@ static inline int nlmsg_validate(struct nlmsghdr *nlh, int hdrlen, int maxtype,
  *
  * Returns 1 if a report back to the application is requested.
  */
-static inline int nlmsg_report(struct nlmsghdr *nlh)
+static inline int nlmsg_report(const struct nlmsghdr *nlh)
 {
         return !!(nlh->nlmsg_flags & NLM_F_ECHO);
 }
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index afab4e4cbac7..dfeb2d7c425b 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -6,6 +6,7 @@
 
 #ifndef __NETNS_IPV6_H__
 #define __NETNS_IPV6_H__
+#include <net/dst_ops.h>
 
 struct ctl_table_header;
 
@@ -42,7 +43,7 @@ struct netns_ipv6 {
         struct timer_list       ip6_fib_timer;
         struct hlist_head       *fib_table_hash;
         struct fib6_table       *fib6_main_tbl;
-        struct dst_ops          *ip6_dst_ops;
+        struct dst_ops          ip6_dst_ops;
         unsigned int             ip6_rt_gc_expire;
         unsigned long            ip6_rt_last_gc;
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
diff --git a/include/net/netns/x_tables.h b/include/net/netns/x_tables.h
index 9554a644a8f8..591db7d657a3 100644
--- a/include/net/netns/x_tables.h
+++ b/include/net/netns/x_tables.h
@@ -8,8 +8,11 @@ struct ebt_table;
 
 struct netns_xt {
         struct list_head tables[NFPROTO_NUMPROTO];
+#if defined(CONFIG_BRIDGE_NF_EBTABLES) || \
+    defined(CONFIG_BRIDGE_NF_EBTABLES_MODULE)
         struct ebt_table *broute_table;
         struct ebt_table *frame_filter;
         struct ebt_table *frame_nat;
+#endif
 };
 #endif
diff --git a/include/net/nl802154.h b/include/net/nl802154.h
new file mode 100644
index 000000000000..99d2ba1c7e03
--- /dev/null
+++ b/include/net/nl802154.h
@@ -0,0 +1,126 @@
+/*
+ * nl802154.h
+ *
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef IEEE802154_NL_H
+#define IEEE802154_NL_H
+
+struct net_device;
+struct ieee802154_addr;
+
+/**
+ * ieee802154_nl_assoc_indic - Notify userland of an association request.
+ * @dev: The network device on which this association request was
+ *       received.
+ * @addr: The address of the device requesting association.
+ * @cap: The capability information field from the device.
+ *
+ * This informs a userland coordinator of a device requesting to
+ * associate with the PAN controlled by the coordinator.
+ *
+ * Note: This is in section 7.3.1 of the IEEE 802.15.4-2006 document.
+ */
+int ieee802154_nl_assoc_indic(struct net_device *dev,
+                struct ieee802154_addr *addr, u8 cap);
+
+/**
+ * ieee802154_nl_assoc_confirm - Notify userland of association.
+ * @dev: The device which has completed association.
+ * @short_addr: The short address assigned to the device.
+ * @status: The status of the association.
+ *
+ * Inform userland of the result of an association request. If the
+ * association request included asking the coordinator to allocate
+ * a short address then it is returned in @short_addr.
+ *
+ * Note: This is in section 7.3.2 of the IEEE 802.15.4 document.
+ */
+int ieee802154_nl_assoc_confirm(struct net_device *dev,
+                u16 short_addr, u8 status);
+
+/**
+ * ieee802154_nl_disassoc_indic - Notify userland of disassociation.
+ * @dev: The device on which disassociation was indicated.
+ * @addr: The device which is disassociating.
+ * @reason: The reason for the disassociation.
+ *
+ * Inform userland that a device has disassociated from the network.
+ *
+ * Note: This is in section 7.3.3 of the IEEE 802.15.4 document.
+ */
+int ieee802154_nl_disassoc_indic(struct net_device *dev,
+                struct ieee802154_addr *addr, u8 reason);
+
+/**
+ * ieee802154_nl_disassoc_confirm - Notify userland of disassociation
+ * completion.
+ * @dev: The device on which disassociation was ordered.
+ * @status: The result of the disassociation.
+ *
+ * Inform userland of the result of requesting that a device
+ * disassociate, or the result of requesting that we disassociate from
+ * a PAN managed by another coordinator.
+ *
+ * Note: This is in section 7.1.4.3 of the IEEE 802.15.4 document.
+ */
+int ieee802154_nl_disassoc_confirm(struct net_device *dev,
+                u8 status);
+
+/**
+ * ieee802154_nl_scan_confirm - Notify userland of completion of scan.
+ * @dev: The device which was instructed to scan.
+ * @status: The status of the scan operation.
+ * @scan_type: What type of scan was performed.
+ * @unscanned: Any channels that the device was unable to scan.
+ * @edl: The energy levels (if a passive scan).
+ *
+ *
+ * Note: This is in section 7.1.11 of the IEEE 802.15.4 document.
+ * Note: This API does not permit the return of an active scan result.
+ */
+int ieee802154_nl_scan_confirm(struct net_device *dev,
+                u8 status, u8 scan_type, u32 unscanned, u8 page,
+                u8 *edl/*, struct list_head *pan_desc_list */);
+
+/**
+ * ieee802154_nl_beacon_indic - Notify userland of a received beacon.
+ * @dev: The device on which a beacon was received.
+ * @panid: The PAN of the coordinator.
+ * @coord_addr: The short address of the coordinator on that PAN.
+ *
+ * Note: This is in section 7.1.5 of the IEEE 802.15.4 document.
+ * Note: This API does not provide extended information such as what
+ * channel the PAN is on or what the LQI of the beacon frame was on
+ * receipt.
+ * Note: This API cannot indicate a beacon frame for a coordinator
+ *       operating in long addressing mode.
+ */
+int ieee802154_nl_beacon_indic(struct net_device *dev, u16 panid,
+                u16 coord_addr);
+
+/**
+ * ieee802154_nl_start_confirm - Notify userland of completion of start.
+ * @dev: The device which was instructed to scan.
+ * @status: The status of the scan operation.
+ *
+ * Note: This is in section 7.1.14 of the IEEE 802.15.4 document.
+ */
+int ieee802154_nl_start_confirm(struct net_device *dev, u8 status);
+
+#endif
diff --git a/include/net/phonet/pn_dev.h b/include/net/phonet/pn_dev.h
index 29d126736611..44c923c9e21d 100644
--- a/include/net/phonet/pn_dev.h
+++ b/include/net/phonet/pn_dev.h
@@ -49,4 +49,6 @@ void phonet_address_notify(int event, struct net_device *dev, u8 addr);
 
 #define PN_NO_ADDR      0xff
 
+extern const struct file_operations pn_sock_seq_fops;
+
 #endif
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 82a3191375f5..f911ec7598ef 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -87,6 +87,9 @@ extern struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r,
 extern void qdisc_put_rtab(struct qdisc_rate_table *tab);
 extern void qdisc_put_stab(struct qdisc_size_table *tab);
 extern void qdisc_warn_nonwc(char *txt, struct Qdisc *qdisc);
+extern int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
+                           struct net_device *dev, struct netdev_queue *txq,
+                           spinlock_t *root_lock);
 
 extern void __qdisc_run(struct Qdisc *q);
 
diff --git a/include/net/rose.h b/include/net/rose.h
index cbd5364b2c8a..5ba9f02731eb 100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -156,7 +156,7 @@ extern int  sysctl_rose_maximum_vcs;
 extern int  sysctl_rose_window_size;
 extern int  rosecmp(rose_address *, rose_address *);
 extern int  rosecmpm(rose_address *, rose_address *, unsigned short);
-extern const char *rose2asc(const rose_address *);
+extern char *rose2asc(char *buf, const rose_address *);
 extern struct sock *rose_find_socket(unsigned int, struct rose_neigh *);
 extern void rose_kill_by_neigh(struct rose_neigh *);
 extern unsigned int rose_new_lci(struct rose_neigh *);
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 3c1895e54b7f..c3aa044d3fc3 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -14,7 +14,7 @@ extern void	rtnl_register(int protocol, int msgtype,
 extern int      rtnl_unregister(int protocol, int msgtype);
 extern void     rtnl_unregister_all(int protocol);
 
-static inline int rtnl_msg_family(struct nlmsghdr *nlh)
+static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
 {
         if (nlmsg_len(nlh) >= sizeof(struct rtgenmsg))
                 return ((struct rtgenmsg *) nlmsg_data(nlh))->rtgen_family;
@@ -70,6 +70,9 @@ struct rtnl_link_ops {
         size_t                  (*get_xstats_size)(const struct net_device *dev);
         int                     (*fill_xstats)(struct sk_buff *skb,
                                                const struct net_device *dev);
+        int                     (*get_tx_queues)(struct net *net, struct nlattr *tb[],
+                                                 unsigned int *tx_queues,
+                                                 unsigned int *real_tx_queues);
 };
 
 extern int      __rtnl_link_register(struct rtnl_link_ops *ops);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 964ffa0d8815..88eb9de095de 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -45,6 +45,8 @@ struct Qdisc
 #define TCQ_F_BUILTIN           1
 #define TCQ_F_THROTTLED         2
 #define TCQ_F_INGRESS           4
+#define TCQ_F_CAN_BYPASS        8
+#define TCQ_F_MQROOT            16
 #define TCQ_F_WARN_NONWC        (1 << 16)
         int                     padded;
         struct Qdisc_ops        *ops;
@@ -72,13 +74,14 @@ struct Qdisc
          */
         unsigned long           state;
         struct sk_buff_head     q;
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
 };
 
 struct Qdisc_class_ops
 {
         /* Child qdisc manipulation */
+        unsigned int            (*select_queue)(struct Qdisc *, struct tcmsg *);
         int                     (*graft)(struct Qdisc *, unsigned long cl,
                                         struct Qdisc *, struct Qdisc **);
         struct Qdisc *          (*leaf)(struct Qdisc *, unsigned long cl);
@@ -121,6 +124,7 @@ struct Qdisc_ops
         void                    (*reset)(struct Qdisc *);
         void                    (*destroy)(struct Qdisc *);
         int                     (*change)(struct Qdisc *, struct nlattr *arg);
+        void                    (*attach)(struct Qdisc *);
 
         int                     (*dump)(struct Qdisc *, struct sk_buff *);
         int                     (*dump_stats)(struct Qdisc *, struct gnet_dump *);
@@ -182,6 +186,11 @@ struct qdisc_skb_cb {
         char                    data[];
 };
 
+static inline int qdisc_qlen(struct Qdisc *q)
+{
+        return q->q.qlen;
+}
+
 static inline struct qdisc_skb_cb *qdisc_skb_cb(struct sk_buff *skb)
 {
         return (struct qdisc_skb_cb *)skb->cb;
@@ -249,6 +258,8 @@ static inline void sch_tree_unlock(struct Qdisc *q)
 
 extern struct Qdisc noop_qdisc;
 extern struct Qdisc_ops noop_qdisc_ops;
+extern struct Qdisc_ops pfifo_fast_ops;
+extern struct Qdisc_ops mq_qdisc_ops;
 
 struct Qdisc_class_common
 {
@@ -296,6 +307,8 @@ extern void dev_init_scheduler(struct net_device *dev);
 extern void dev_shutdown(struct net_device *dev);
 extern void dev_activate(struct net_device *dev);
 extern void dev_deactivate(struct net_device *dev);
+extern struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
+                                     struct Qdisc *qdisc);
 extern void qdisc_reset(struct Qdisc *qdisc);
 extern void qdisc_destroy(struct Qdisc *qdisc);
 extern void qdisc_tree_decrease_qlen(struct Qdisc *qdisc, unsigned int n);
@@ -387,13 +400,18 @@ static inline int qdisc_enqueue_root(struct sk_buff *skb, struct Qdisc *sch)
         return qdisc_enqueue(skb, sch) & NET_XMIT_MASK;
 }
 
+static inline void __qdisc_update_bstats(struct Qdisc *sch, unsigned int len)
+{
+        sch->bstats.bytes += len;
+        sch->bstats.packets++;
+}
+
 static inline int __qdisc_enqueue_tail(struct sk_buff *skb, struct Qdisc *sch,
                                        struct sk_buff_head *list)
 {
         __skb_queue_tail(list, skb);
         sch->qstats.backlog += qdisc_pkt_len(skb);
-        sch->bstats.bytes += qdisc_pkt_len(skb);
-        sch->bstats.packets++;
+        __qdisc_update_bstats(sch, qdisc_pkt_len(skb));
 
         return NET_XMIT_SUCCESS;
 }
diff --git a/include/net/scm.h b/include/net/scm.h
index f45bb6eca7d4..cf48c800e926 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -26,7 +26,6 @@ struct scm_cookie
 #ifdef CONFIG_SECURITY_NETWORK
         u32                     secid;          /* Passed security ID   */
 #endif
-        unsigned long           seq;            /* Connection seqno     */
 };
 
 extern void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm);
@@ -59,7 +58,6 @@ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
         scm->creds.gid = current_gid();
         scm->creds.pid = task_tgid_vnr(p);
         scm->fp = NULL;
-        scm->seq = 0;
         unix_get_peersec_dgram(sock, scm);
         if (msg->msg_controllen <= 0)
                 return 0;
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 3b966802e05d..8be5135ff7aa 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -106,6 +106,7 @@ typedef enum {
         SCTP_CMD_ASSOC_SHKEY,    /* generate the association shared keys */
         SCTP_CMD_T1_RETRAN,      /* Mark for retransmission after T1 timeout  */
         SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
+        SCTP_CMD_SEND_MSG,       /* Send the whole use message */
         SCTP_CMD_LAST
 } sctp_verb_t;
 
@@ -139,6 +140,7 @@ typedef union {
         struct sctp_ulpevent *ulpevent;
         struct sctp_packet *packet;
         sctp_sackhdr_t *sackh;
+        struct sctp_datamsg *msg;
 } sctp_arg_t;
 
 /* We are simulating ML type constructors here.
@@ -188,6 +190,7 @@ SCTP_ARG_CONSTRUCTOR(PEER_INIT,	sctp_init_chunk_t *, init)
 SCTP_ARG_CONSTRUCTOR(ULPEVENT,  struct sctp_ulpevent *, ulpevent)
 SCTP_ARG_CONSTRUCTOR(PACKET,    struct sctp_packet *, packet)
 SCTP_ARG_CONSTRUCTOR(SACKH,     sctp_sackhdr_t *, sackh)
+SCTP_ARG_CONSTRUCTOR(DATAMSG,   struct sctp_datamsg *, msg)
 
 typedef struct {
         sctp_arg_t obj;
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index b05b0557211f..58f714a3b670 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -231,7 +231,7 @@ typedef enum {
         SCTP_SS_LISTENING      = TCP_LISTEN,
         SCTP_SS_ESTABLISHING   = TCP_SYN_SENT,
         SCTP_SS_ESTABLISHED    = TCP_ESTABLISHED,
-        SCTP_SS_DISCONNECTING  = TCP_CLOSING,
+        SCTP_SS_CLOSING        = TCP_CLOSING,
 } sctp_sock_state_t;
 
 /* These functions map various type to printable names.  */
@@ -241,7 +241,9 @@ const char *sctp_tname(const sctp_subtype_t);	/* timeouts */
 const char *sctp_pname(const sctp_subtype_t);   /* primitives */
 
 /* This is a table of printable names of sctp_state_t's.  */
-extern const char *sctp_state_tbl[], *sctp_evttype_tbl[], *sctp_status_tbl[];
+extern const char *const sctp_state_tbl[];
+extern const char *const sctp_evttype_tbl[];
+extern const char *const sctp_status_tbl[];
 
 /* Maximum chunk length considering padding requirements. */
 enum { SCTP_MAX_CHUNK_LEN = ((1<<16) - sizeof(__u32)) };
@@ -361,6 +363,13 @@ typedef enum {
         SCTP_SCOPE_UNUSABLE,            /* IPv4 unusable addresses */
 } sctp_scope_t;
 
+typedef enum {
+        SCTP_SCOPE_POLICY_DISABLE,      /* Disable IPv4 address scoping */
+        SCTP_SCOPE_POLICY_ENABLE,       /* Enable IPv4 address scoping */
+        SCTP_SCOPE_POLICY_PRIVATE,      /* Follow draft but allow IPv4 private addresses */
+        SCTP_SCOPE_POLICY_LINK,         /* Follow draft but allow IPv4 link local addresses */
+} sctp_scope_policy_t;
+
 /* Based on IPv4 scoping <draft-stewart-tsvwg-sctp-ipv4-00.txt>,
  * SCTP IPv4 unusable addresses: 0.0.0.0/8, 224.0.0.0/4, 198.18.0.0/24,
  * 192.88.99.0/24.
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index d16a304cbed4..8a6d5297de16 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -486,15 +486,16 @@ static inline __s32 sctp_jitter(__u32 rto)
 }
 
 /* Break down data chunks at this point.  */
-static inline int sctp_frag_point(const struct sctp_sock *sp, int pmtu)
+static inline int sctp_frag_point(const struct sctp_association *asoc, int pmtu)
 {
+        struct sctp_sock *sp = sctp_sk(asoc->base.sk);
         int frag = pmtu;
 
         frag -= sp->pf->af->net_header_len;
         frag -= sizeof(struct sctphdr) + sizeof(struct sctp_data_chunk);
 
-        if (sp->user_frag)
-                frag = min_t(int, frag, sp->user_frag);
+        if (asoc->user_frag)
+                frag = min_t(int, frag, asoc->user_frag);
 
         frag = min_t(int, frag, SCTP_MAX_CHUNK_LEN);
 
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index edfcacf3250e..42d00ced5eb8 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -219,6 +219,15 @@ extern struct sctp_globals {
         /* Flag to idicate if SCTP-AUTH is enabled */
         int auth_enable;
 
+        /*
+         * Policy to control SCTP IPv4 address scoping
+         * 0   - Disable IPv4 address scoping
+         * 1   - Enable IPv4 address scoping
+         * 2   - Selectively allow only IPv4 private addresses
+         * 3   - Selectively allow only IPv4 link local address
+         */
+        int ipv4_scope_policy;
+
         /* Flag to indicate whether computing and verifying checksum
          * is disabled. */
         int checksum_disable;
@@ -252,6 +261,7 @@ extern struct sctp_globals {
 #define sctp_port_hashtable             (sctp_globals.port_hashtable)
 #define sctp_local_addr_list            (sctp_globals.local_addr_list)
 #define sctp_local_addr_lock            (sctp_globals.addr_list_lock)
+#define sctp_scope_policy               (sctp_globals.ipv4_scope_policy)
 #define sctp_addip_enable               (sctp_globals.addip_enable)
 #define sctp_addip_noauth               (sctp_globals.addip_noauth_enable)
 #define sctp_prsctp_enable              (sctp_globals.prsctp_enable)
@@ -628,7 +638,7 @@ struct sctp_datamsg {
         /* Chunks waiting to be submitted to lower layer. */
         struct list_head chunks;
         /* Chunks that have been transmitted. */
-        struct list_head track;
+        size_t msg_size;
         /* Reference counting. */
         atomic_t refcnt;
         /* When is this message no longer interesting to the peer? */
@@ -643,6 +653,7 @@ struct sctp_datamsg {
 struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *,
                                             struct sctp_sndrcvinfo *,
                                             struct msghdr *, int len);
+void sctp_datamsg_free(struct sctp_datamsg *);
 void sctp_datamsg_put(struct sctp_datamsg *);
 void sctp_chunk_fail(struct sctp_chunk *, int error);
 int sctp_chunk_abandoned(struct sctp_chunk *);
@@ -811,22 +822,12 @@ struct sctp_packet {
         /* pointer to the auth chunk for this packet */
         struct sctp_chunk *auth;
 
-        /* This packet contains a COOKIE-ECHO chunk. */
-        __u8 has_cookie_echo;
-
-        /* This packet contains a SACK chunk. */
-        __u8 has_sack;
-
-        /* This packet contains an AUTH chunk */
-        __u8 has_auth;
-
-        /* This packet contains at least 1 DATA chunk */
-        __u8 has_data;
-
-        /* SCTP cannot fragment this packet. So let ip fragment it. */
-        __u8 ipfragok;
-
-        __u8 malloced;
+        u8  has_cookie_echo:1,  /* This packet contains a COOKIE-ECHO chunk. */
+            has_sack:1,         /* This packet contains a SACK chunk. */
+            has_auth:1,         /* This packet contains an AUTH chunk */
+            has_data:1,         /* This packet contains at least 1 DATA chunk */
+            ipfragok:1,         /* So let ip fragment this packet */
+            malloced:1;         /* Is it malloced? */
 };
 
 struct sctp_packet *sctp_packet_init(struct sctp_packet *,
@@ -1567,13 +1568,13 @@ struct sctp_association {
                 __u32   sack_cnt;
 
                 /* These are capabilities which our peer advertised.  */
-                __u8    ecn_capable;     /* Can peer do ECN? */
-                __u8    ipv4_address;    /* Peer understands IPv4 addresses? */
-                __u8    ipv6_address;    /* Peer understands IPv6 addresses? */
-                __u8    hostname_address;/* Peer understands DNS addresses? */
-                __u8    asconf_capable;  /* Does peer support ADDIP? */
-                __u8    prsctp_capable;  /* Can peer do PR-SCTP? */
-                __u8    auth_capable;    /* Is peer doing SCTP-AUTH? */
+                __u8    ecn_capable:1,      /* Can peer do ECN? */
+                        ipv4_address:1,     /* Peer understands IPv4 addresses? */
+                        ipv6_address:1,     /* Peer understands IPv6 addresses? */
+                        hostname_address:1, /* Peer understands DNS addresses? */
+                        asconf_capable:1,   /* Does peer support ADDIP? */
+                        prsctp_capable:1,   /* Can peer do PR-SCTP? */
+                        auth_capable:1;     /* Is peer doing SCTP-AUTH? */
 
                 __u32   adaptation_ind;  /* Adaptation Code point. */
 
@@ -1738,6 +1739,12 @@ struct sctp_association {
          */
         __u32 rwnd_over;
 
+        /* Keeps treack of rwnd pressure.  This happens when we have
+         * a window, but not recevie buffer (i.e small packets).  This one
+         * is releases slowly (1 PMTU at a time ).
+         */
+        __u32 rwnd_press;
+
         /* This is the sndbuf size in use for the association.
          * This corresponds to the sndbuf size for the association,
          * as specified in the sk->sndbuf.
@@ -1756,6 +1763,7 @@ struct sctp_association {
 
         /* The message size at which SCTP fragmentation will occur. */
         __u32 frag_point;
+        __u32 user_frag;
 
         /* Counter used to count INIT errors. */
         int init_err_counter;
@@ -1905,11 +1913,8 @@ struct sctp_association {
 
         __u16 active_key_id;
 
-        /* Need to send an ECNE Chunk? */
-        char need_ecne;
-
-        /* Is it a temporary association? */
-        char temp;
+        __u8 need_ecne:1,       /* Need to send an ECNE Chunk? */
+             temp:1;            /* Is it a temporary association? */
 };
 
 
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 1580c04f68bc..be2334aaf52e 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -210,12 +210,6 @@ enum sctp_sinfo_flags {
 };
 
 
-typedef union {
-        __u8                    raw;
-        struct sctp_initmsg     init;
-        struct sctp_sndrcvinfo  sndrcv;
-} sctp_cmsg_data_t;
-
 /* These are cmsg_types.  */
 typedef enum sctp_cmsg_type {
         SCTP_INIT,              /* 5.2.1 SCTP Initiation Structure */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 88af84306471..b71a446d58f6 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -469,6 +469,7 @@ extern void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
                                       int nonagle);
 extern int tcp_may_send_now(struct sock *sk);
 extern int tcp_retransmit_skb(struct sock *, struct sk_buff *);
+extern void tcp_retransmit_timer(struct sock *sk);
 extern void tcp_xmit_retransmit_queue(struct sock *);
 extern void tcp_simple_retransmit(struct sock *);
 extern int tcp_trim_head(struct sock *, struct sk_buff *, u32);
@@ -521,6 +522,17 @@ extern int tcp_mtu_to_mss(struct sock *sk, int pmtu);
 extern int tcp_mss_to_mtu(struct sock *sk, int mss);
 extern void tcp_mtup_init(struct sock *sk);
 
+static inline void tcp_bound_rto(const struct sock *sk)
+{
+        if (inet_csk(sk)->icsk_rto > TCP_RTO_MAX)
+                inet_csk(sk)->icsk_rto = TCP_RTO_MAX;
+}
+
+static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
+{
+        return (tp->srtt >> 3) + tp->rttvar;
+}
+
 static inline void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)
 {
         tp->pred_flags = htonl((tp->tcp_header_len << 26) |
@@ -1007,6 +1019,11 @@ static inline int keepalive_time_when(const struct tcp_sock *tp)
         return tp->keepalive_time ? : sysctl_tcp_keepalive_time;
 }
 
+static inline int keepalive_probes(const struct tcp_sock *tp)
+{
+        return tp->keepalive_probes ? : sysctl_tcp_keepalive_probes;
+}
+
 static inline int tcp_fin_time(const struct sock *sk)
 {
         int fin_timeout = tcp_sk(sk)->linger2 ? : sysctl_tcp_fin_timeout;
@@ -1169,7 +1186,7 @@ extern int			tcp_v4_md5_do_del(struct sock *sk,
 #define tcp_twsk_md5_key(twsk)  NULL
 #endif
 
-extern struct tcp_md5sig_pool   **tcp_alloc_md5sig_pool(void);
+extern struct tcp_md5sig_pool   **tcp_alloc_md5sig_pool(struct sock *);
 extern void                     tcp_free_md5sig_pool(void);
 
 extern struct tcp_md5sig_pool   *__tcp_get_md5sig_pool(int cpu);
@@ -1235,6 +1252,29 @@ static inline struct sk_buff *tcp_write_queue_prev(struct sock *sk, struct sk_bu
 #define tcp_for_write_queue_from_safe(skb, tmp, sk)                     \
         skb_queue_walk_from_safe(&(sk)->sk_write_queue, skb, tmp)
 
+/* This function calculates a "timeout" which is equivalent to the timeout of a
+ * TCP connection after "boundary" unsucessful, exponentially backed-off
+ * retransmissions with an initial RTO of TCP_RTO_MIN.
+ */
+static inline bool retransmits_timed_out(const struct sock *sk,
+                                         unsigned int boundary)
+{
+        unsigned int timeout, linear_backoff_thresh;
+
+        if (!inet_csk(sk)->icsk_retransmits)
+                return false;
+
+        linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
+
+        if (boundary <= linear_backoff_thresh)
+                timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
+        else
+                timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+                          (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
+
+        return (tcp_time_stamp - tcp_sk(sk)->retrans_stamp) >= timeout;
+}
+
 static inline struct sk_buff *tcp_send_head(struct sock *sk)
 {
         return sk->sk_send_head;
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index bfb240c6cf79..d65381cad0fc 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -51,7 +51,7 @@ extern int			datagram_send_ctl(struct net *net,
 /*
  *      address family specific functions
  */
-extern struct inet_connection_sock_af_ops ipv4_specific;
+extern const struct inet_connection_sock_af_ops ipv4_specific;
 
 extern void inet6_destroy_sock(struct sock *sk);
 
diff --git a/include/net/udp.h b/include/net/udp.h
index 90e6ce56be65..5fb029f817a3 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -207,4 +207,7 @@ extern void udp4_proc_exit(void);
 #endif
 
 extern void udp_init(void);
+
+extern int udp4_ufo_send_check(struct sk_buff *skb);
+extern struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb, int features);
 #endif  /* _UDP_H */
diff --git a/include/net/wpan-phy.h b/include/net/wpan-phy.h
new file mode 100644
index 000000000000..547b1e271ac9
--- /dev/null
+++ b/include/net/wpan-phy.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ */
+
+#ifndef WPAN_PHY_H
+#define WPAN_PHY_H
+
+#include <linux/netdevice.h>
+#include <linux/mutex.h>
+
+struct wpan_phy {
+        struct mutex pib_lock;
+
+        /*
+         * This is a PIB acording to 802.15.4-2006.
+         * We do not provide timing-related variables, as they
+         * aren't used outside of driver
+         */
+        u8 current_channel;
+        u8 current_page;
+        u32 channels_supported;
+        u8 transmit_power;
+        u8 cca_mode;
+
+        struct device dev;
+        int idx;
+
+        char priv[0] __attribute__((__aligned__(NETDEV_ALIGN)));
+};
+
+struct wpan_phy *wpan_phy_alloc(size_t priv_size);
+int wpan_phy_register(struct device *parent, struct wpan_phy *phy);
+void wpan_phy_unregister(struct wpan_phy *phy);
+void wpan_phy_free(struct wpan_phy *phy);
+
+static inline void *wpan_phy_priv(struct wpan_phy *phy)
+{
+        BUG_ON(!phy);
+        return &phy->priv;
+}
+
+struct wpan_phy *wpan_phy_find(const char *str);
+static inline const char *wpan_phy_name(struct wpan_phy *phy)
+{
+        return dev_name(&phy->dev);
+}
+#endif
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 9e3a3f4c1f60..223e90a44824 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1280,7 +1280,7 @@ struct xfrm6_tunnel {
 };
 
 extern void xfrm_init(void);
-extern void xfrm4_init(void);
+extern void xfrm4_init(int rt_hash_size);
 extern int xfrm_state_init(struct net *net);
 extern void xfrm_state_fini(struct net *net);
 extern void xfrm4_state_init(void);