27 files changed, 435 insertions, 299 deletions

diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h
new file mode 100644
index 000000000000..9b64b6d67873
--- /dev/null
+++ b/include/linux/brcmphy.h
@@ -0,0 +1,6 @@
+#define PHY_BRCM_WIRESPEED_ENABLE       0x00000001
+#define PHY_BRCM_AUTO_PWRDWN_ENABLE     0x00000002
+#define PHY_BRCM_APD_CLK125_ENABLE      0x00000004
+#define PHY_BRCM_STD_IBND_DISABLE       0x00000008
+#define PHY_BRCM_EXT_IBND_RX_ENABLE     0x00000010
+#define PHY_BRCM_EXT_IBND_TX_ENABLE     0x00000020
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 0b5e03eae6d2..9300f37cd7e8 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -306,20 +306,32 @@ struct ieee80211_ht_addt_info {
 #define IEEE80211_HT_CAP_SGI_40                 0x0040
 #define IEEE80211_HT_CAP_DELAY_BA               0x0400
 #define IEEE80211_HT_CAP_MAX_AMSDU              0x0800
+/* 802.11n HT capability AMPDU settings */
 #define IEEE80211_HT_CAP_AMPDU_FACTOR           0x03
 #define IEEE80211_HT_CAP_AMPDU_DENSITY          0x1C
+/* 802.11n HT capability MSC set */
+#define IEEE80211_SUPP_MCS_SET_UEQM             4
+#define IEEE80211_HT_CAP_MAX_STREAMS            4
+#define IEEE80211_SUPP_MCS_SET_LEN              10
+/* maximum streams the spec allows */
+#define IEEE80211_HT_CAP_MCS_TX_DEFINED         0x01
+#define IEEE80211_HT_CAP_MCS_TX_RX_DIFF         0x02
+#define IEEE80211_HT_CAP_MCS_TX_STREAMS         0x0C
+#define IEEE80211_HT_CAP_MCS_TX_UEQM            0x10
 /* 802.11n HT IE masks */
 #define IEEE80211_HT_IE_CHA_SEC_OFFSET          0x03
+#define IEEE80211_HT_IE_CHA_SEC_ABOVE           0x01
+#define IEEE80211_HT_IE_CHA_SEC_BELOW           0x03
 #define IEEE80211_HT_IE_CHA_WIDTH               0x04
 #define IEEE80211_HT_IE_HT_PROTECTION           0x0003
 #define IEEE80211_HT_IE_NON_GF_STA_PRSNT        0x0004
 #define IEEE80211_HT_IE_NON_HT_STA_PRSNT        0x0010
 
 /* MIMO Power Save Modes */
-#define WLAN_HT_CAP_MIMO_PS_STATIC         0
-#define WLAN_HT_CAP_MIMO_PS_DYNAMIC        1
-#define WLAN_HT_CAP_MIMO_PS_INVALID        2
-#define WLAN_HT_CAP_MIMO_PS_DISABLED       3
+#define WLAN_HT_CAP_MIMO_PS_STATIC      0
+#define WLAN_HT_CAP_MIMO_PS_DYNAMIC     1
+#define WLAN_HT_CAP_MIMO_PS_INVALID     2
+#define WLAN_HT_CAP_MIMO_PS_DISABLED    3
 
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
@@ -552,16 +564,17 @@ enum ieee80211_back_parties {
  */
 static inline u8 *ieee80211_get_SA(struct ieee80211_hdr *hdr)
 {
-        u8 *raw = (u8 *) hdr;
-        u8 tofrom = (*(raw+1)) & 3; /* get the TODS and FROMDS bits */
-
-        switch (tofrom) {
-                case 2:
-                        return hdr->addr3;
-                case 3:
-                        return hdr->addr4;
+        __le16 fc = hdr->frame_control;
+        fc &= cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS);
+
+        switch (fc) {
+        case __constant_cpu_to_le16(IEEE80211_FCTL_FROMDS):
+                return hdr->addr3;
+        case __constant_cpu_to_le16(IEEE80211_FCTL_TODS|IEEE80211_FCTL_FROMDS):
+                return hdr->addr4;
+        default:
+                return hdr->addr2;
         }
-        return hdr->addr2;
 }
 
 /**
@@ -577,12 +590,13 @@ static inline u8 *ieee80211_get_SA(struct ieee80211_hdr *hdr)
  */
 static inline u8 *ieee80211_get_DA(struct ieee80211_hdr *hdr)
 {
-        u8 *raw = (u8 *) hdr;
-        u8 to_ds = (*(raw+1)) & 1; /* get the TODS bit */
+        __le16 fc = hdr->frame_control;
+        fc &= cpu_to_le16(IEEE80211_FCTL_TODS);
 
-        if (to_ds)
+        if (fc)
                 return hdr->addr3;
-        return hdr->addr1;
+        else
+                return hdr->addr1;
 }
 
 /**
@@ -595,8 +609,8 @@ static inline u8 *ieee80211_get_DA(struct ieee80211_hdr *hdr)
  */
 static inline int ieee80211_get_morefrag(struct ieee80211_hdr *hdr)
 {
-        return (le16_to_cpu(hdr->frame_control) &
-                IEEE80211_FCTL_MOREFRAGS) != 0;
+        __le16 fc = hdr->frame_control;
+        return !!(fc & cpu_to_le16(IEEE80211_FCTL_MOREFRAGS));
 }
 
 #endif /* IEEE80211_H */
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h
index 0a383ac083cb..759bc043dc65 100644
--- a/include/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/linux/netfilter/nfnetlink_conntrack.h
@@ -81,6 +81,7 @@ enum ctattr_protoinfo {
         CTA_PROTOINFO_UNSPEC,
         CTA_PROTOINFO_TCP,
         CTA_PROTOINFO_DCCP,
+        CTA_PROTOINFO_SCTP,
         __CTA_PROTOINFO_MAX
 };
 #define CTA_PROTOINFO_MAX (__CTA_PROTOINFO_MAX - 1)
@@ -103,6 +104,15 @@ enum ctattr_protoinfo_dccp {
 };
 #define CTA_PROTOINFO_DCCP_MAX (__CTA_PROTOINFO_DCCP_MAX - 1)
 
+enum ctattr_protoinfo_sctp {
+        CTA_PROTOINFO_SCTP_UNSPEC,
+        CTA_PROTOINFO_SCTP_STATE,
+        CTA_PROTOINFO_SCTP_VTAG_ORIGINAL,
+        CTA_PROTOINFO_SCTP_VTAG_REPLY,
+        __CTA_PROTOINFO_SCTP_MAX
+};
+#define CTA_PROTOINFO_SCTP_MAX (__CTA_PROTOINFO_SCTP_MAX - 1)
+
 enum ctattr_counters {
         CTA_COUNTERS_UNSPEC,
         CTA_COUNTERS_PACKETS,           /* old 64bit counters */
diff --git a/include/linux/netfilter_bridge/ebt_ip6.h b/include/linux/netfilter_bridge/ebt_ip6.h
new file mode 100644
index 000000000000..2273c3ae33ca
--- /dev/null
+++ b/include/linux/netfilter_bridge/ebt_ip6.h
@@ -0,0 +1,40 @@
+/*
+ *  ebt_ip6
+ *
+ *      Authors:
+ * Kuo-Lang Tseng <kuo-lang.tseng@intel.com>
+ * Manohar Castelino <manohar.r.castelino@intel.com>
+ *
+ *  Jan 11, 2008
+ *
+ */
+
+#ifndef __LINUX_BRIDGE_EBT_IP6_H
+#define __LINUX_BRIDGE_EBT_IP6_H
+
+#define EBT_IP6_SOURCE 0x01
+#define EBT_IP6_DEST 0x02
+#define EBT_IP6_TCLASS 0x04
+#define EBT_IP6_PROTO 0x08
+#define EBT_IP6_SPORT 0x10
+#define EBT_IP6_DPORT 0x20
+#define EBT_IP6_MASK (EBT_IP6_SOURCE | EBT_IP6_DEST | EBT_IP6_TCLASS |\
+                      EBT_IP6_PROTO | EBT_IP6_SPORT | EBT_IP6_DPORT)
+#define EBT_IP6_MATCH "ip6"
+
+/* the same values are used for the invflags */
+struct ebt_ip6_info
+{
+        struct in6_addr saddr;
+        struct in6_addr daddr;
+        struct in6_addr smsk;
+        struct in6_addr dmsk;
+        uint8_t  tclass;
+        uint8_t  protocol;
+        uint8_t  bitmask;
+        uint8_t  invflags;
+        uint16_t sport[2];
+        uint16_t dport[2];
+};
+
+#endif
diff --git a/include/linux/netfilter_bridge/ebt_log.h b/include/linux/netfilter_bridge/ebt_log.h
index 96e231ae7554..b76e653157e5 100644
--- a/include/linux/netfilter_bridge/ebt_log.h
+++ b/include/linux/netfilter_bridge/ebt_log.h
@@ -4,7 +4,8 @@
 #define EBT_LOG_IP 0x01 /* if the frame is made by ip, log the ip information */
 #define EBT_LOG_ARP 0x02
 #define EBT_LOG_NFLOG 0x04
-#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP)
+#define EBT_LOG_IP6 0x08
+#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP | EBT_LOG_IP6)
 #define EBT_LOG_PREFIX_SIZE 30
 #define EBT_LOG_WATCHER "log"
 
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index 650318b0c405..29c7727ff0e8 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -60,6 +60,7 @@ enum nf_ip_hook_priorities {
         NF_IP_PRI_MANGLE = -150,
         NF_IP_PRI_NAT_DST = -100,
         NF_IP_PRI_FILTER = 0,
+        NF_IP_PRI_SECURITY = 50,
         NF_IP_PRI_NAT_SRC = 100,
         NF_IP_PRI_SELINUX_LAST = 225,
         NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index 3475a65dae9b..fd50988b83ec 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -64,6 +64,7 @@ enum nf_ip6_hook_priorities {
         NF_IP6_PRI_MANGLE = -150,
         NF_IP6_PRI_NAT_DST = -100,
         NF_IP6_PRI_FILTER = 0,
+        NF_IP6_PRI_SECURITY = 50,
         NF_IP6_PRI_NAT_SRC = 100,
         NF_IP6_PRI_SELINUX_LAST = 225,
         NF_IP6_PRI_LAST = INT_MAX,
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index bec1062a25a1..9ff1b54908f3 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -193,7 +193,7 @@ extern int netlink_unregister_notifier(struct notifier_block *nb);
 
 /* finegrained unicast helpers: */
 struct sock *netlink_getsockbyfilp(struct file *filp);
-int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
+int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
                       long *timeo, struct sock *ssk);
 void netlink_detachskb(struct sock *sk, struct sk_buff *skb);
 int netlink_sendskb(struct sock *sk, struct sk_buff *skb);
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 9b940e644179..1bbb346066dd 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1980,6 +1980,7 @@
 #define PCI_DEVICE_ID_TIGON3_5787M      0x1693
 #define PCI_DEVICE_ID_TIGON3_5782       0x1696
 #define PCI_DEVICE_ID_TIGON3_5784       0x1698
+#define PCI_DEVICE_ID_TIGON3_5785       0x1699
 #define PCI_DEVICE_ID_TIGON3_5786       0x169a
 #define PCI_DEVICE_ID_TIGON3_5787       0x169b
 #define PCI_DEVICE_ID_TIGON3_5788       0x169c
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 18e62e3d406f..9881295f3857 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -296,10 +296,9 @@ struct tcp_sock {
         u32     rcv_ssthresh;   /* Current window clamp                 */
 
         u32     frto_highmark;  /* snd_nxt when RTO occurred */
-        u8      reordering;     /* Packet reordering metric.            */
+        u16     advmss;         /* Advertised MSS                       */
         u8      frto_counter;   /* Number of new acks after RTO */
         u8      nonagle;        /* Disable Nagle algorithm?             */
-        u8      keepalive_probes; /* num of allowed keep alive probes   */
 
 /* RTT measurement */
         u32     srtt;           /* smoothed round trip time << 3        */
@@ -310,6 +309,10 @@ struct tcp_sock {
 
         u32     packets_out;    /* Packets which are "in flight"        */
         u32     retrans_out;    /* Retransmitted packets out            */
+
+        u16     urg_data;       /* Saved octet of OOB data and control flags */
+        u8      urg_mode;       /* In urgent mode               */
+        u8      ecn_flags;      /* ECN status bits.                     */
 /*
  *      Options received (usually on last packet, some only on SYN packets).
  */
@@ -325,13 +328,24 @@ struct tcp_sock {
         u32     snd_cwnd_used;
         u32     snd_cwnd_stamp;
 
-        struct sk_buff_head     out_of_order_queue; /* Out of order segments go here */
-
         u32     rcv_wnd;        /* Current receiver window              */
         u32     write_seq;      /* Tail(+1) of data held in tcp send buffer */
         u32     pushed_seq;     /* Last pushed seq, required to talk to windows */
+        u32     lost_out;       /* Lost packets                 */
+        u32     sacked_out;     /* SACK'd packets                       */
+        u32     fackets_out;    /* FACK'd packets                       */
+        u32     tso_deferred;
+        u32     bytes_acked;    /* Appropriate Byte Counting - RFC3465 */
 
-/*      SACKs data      */
+        /* from STCP, retrans queue hinting */
+        struct sk_buff* lost_skb_hint;
+        struct sk_buff *scoreboard_skb_hint;
+        struct sk_buff *retransmit_skb_hint;
+        struct sk_buff *forward_skb_hint;
+
+        struct sk_buff_head     out_of_order_queue; /* Out of order segments go here */
+
+        /* SACKs data, these 2 need to be together (see tcp_build_and_update_options) */
         struct tcp_sack_block duplicate_sack[1]; /* D-SACK block */
         struct tcp_sack_block selective_acks[4]; /* The SACKS themselves*/
 
@@ -342,23 +356,14 @@ struct tcp_sock {
                                          * sacked_out > 0)
                                          */
 
-        /* from STCP, retrans queue hinting */
-        struct sk_buff* lost_skb_hint;
-
-        struct sk_buff *scoreboard_skb_hint;
-        struct sk_buff *retransmit_skb_hint;
-        struct sk_buff *forward_skb_hint;
-
         int     lost_cnt_hint;
         int     retransmit_cnt_hint;
 
         u32     lost_retrans_low;       /* Sent seq after any rxmit (lowest) */
 
-        u16     advmss;         /* Advertised MSS                       */
+        u8      reordering;     /* Packet reordering metric.            */
+        u8      keepalive_probes; /* num of allowed keep alive probes   */
         u32     prior_ssthresh; /* ssthresh saved at recovery start     */
-        u32     lost_out;       /* Lost packets                 */
-        u32     sacked_out;     /* SACK'd packets                       */
-        u32     fackets_out;    /* FACK'd packets                       */
         u32     high_seq;       /* snd_nxt at onset of congestion       */
 
         u32     retrans_stamp;  /* Timestamp of the last retransmit,
@@ -366,25 +371,18 @@ struct tcp_sock {
                                  * the first SYN. */
         u32     undo_marker;    /* tracking retrans started here. */
         int     undo_retrans;   /* number of undoable retransmissions. */
+        u32     total_retrans;  /* Total retransmits for entire connection */
+
         u32     urg_seq;        /* Seq of received urgent pointer */
-        u16     urg_data;       /* Saved octet of OOB data and control flags */
-        u8      urg_mode;       /* In urgent mode               */
-        u8      ecn_flags;      /* ECN status bits.                     */
         u32     snd_up;         /* Urgent pointer               */
 
-        u32     total_retrans;  /* Total retransmits for entire connection */
-        u32     bytes_acked;    /* Appropriate Byte Counting - RFC3465 */
-
         unsigned int            keepalive_time;   /* time before keep alive takes place */
         unsigned int            keepalive_intvl;  /* time interval between keep alive probes */
-        int                     linger2;
 
         struct tcp_deferred_accept_info defer_tcp_accept;
 
         unsigned long last_synq_overflow; 
 
-        u32     tso_deferred;
-
 /* Receiver side RTT estimation */
         struct {
                 u32     rtt;
@@ -412,6 +410,8 @@ struct tcp_sock {
 /* TCP MD5 Signagure Option information */
         struct tcp_md5sig_info  *md5sig_info;
 #endif
+
+        int                     linger2;
 };
 
 static inline struct tcp_sock *tcp_sk(const struct sock *sk)
diff --git a/include/linux/tipc_config.h b/include/linux/tipc_config.h
index b0c916d1f375..2bc6fa4adeb5 100644
--- a/include/linux/tipc_config.h
+++ b/include/linux/tipc_config.h
@@ -2,7 +2,7 @@
  * include/linux/tipc_config.h: Include file for TIPC configuration interface
  * 
  * Copyright (c) 2003-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2007, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -136,6 +136,14 @@
 #define  TIPC_CMD_SET_NETID         0x800B    /* tx unsigned, rx none */
 
 /*
+ * Reserved commands:
+ * May not be issued by any process.
+ * Used internally by TIPC.
+ */
+
+#define  TIPC_CMD_NOT_NET_ADMIN     0xC001    /* tx none, rx none */
+
+/*
  * TLV types defined for TIPC
  */
 
diff --git a/include/linux/wanrouter.h b/include/linux/wanrouter.h
index 3add87465b1f..e0aa39612eba 100644
--- a/include/linux/wanrouter.h
+++ b/include/linux/wanrouter.h
@@ -522,7 +522,7 @@ extern int wanrouter_proc_init(void);
 extern void wanrouter_proc_cleanup(void);
 extern int wanrouter_proc_add(struct wan_device *wandev);
 extern int wanrouter_proc_delete(struct wan_device *wandev);
-extern int wanrouter_ioctl( struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg);
+extern long wanrouter_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 
 /* Public Data */
 /* list of registered devices */
diff --git a/include/linux/wireless.h b/include/linux/wireless.h
index 0a9b5b41ed67..4a95a0e5eeca 100644
--- a/include/linux/wireless.h
+++ b/include/linux/wireless.h
@@ -611,6 +611,7 @@
 #define IW_ENCODE_ALG_WEP       1
 #define IW_ENCODE_ALG_TKIP      2
 #define IW_ENCODE_ALG_CCMP      3
+#define IW_ENCODE_ALG_PMK       4
 /* struct iw_encode_ext ->ext_flags */
 #define IW_ENCODE_EXT_TX_SEQ_VALID      0x00000001
 #define IW_ENCODE_EXT_RX_SEQ_VALID      0x00000002
@@ -630,6 +631,7 @@
 #define IW_ENC_CAPA_WPA2        0x00000002
 #define IW_ENC_CAPA_CIPHER_TKIP 0x00000004
 #define IW_ENC_CAPA_CIPHER_CCMP 0x00000008
+#define IW_ENC_CAPA_4WAY_HANDSHAKE      0x00000010
 
 /* Event capability macros - in (struct iw_range *)->event_capa
  * Because we have more than 32 possible events, we use an array of
diff --git a/include/net/ieee80211.h b/include/net/ieee80211.h
index 529816bfbc52..b31399e1fd83 100644
--- a/include/net/ieee80211.h
+++ b/include/net/ieee80211.h
@@ -1262,9 +1262,6 @@ extern int ieee80211_set_encryption(struct ieee80211_device *ieee);
 /* ieee80211_tx.c */
 extern int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev);
 extern void ieee80211_txb_free(struct ieee80211_txb *);
-extern int ieee80211_tx_frame(struct ieee80211_device *ieee,
-                              struct ieee80211_hdr *frame, int hdr_len,
-                              int total_len, int encrypt_mpdu);
 
 /* ieee80211_rx.c */
 extern void ieee80211_rx_any(struct ieee80211_device *ieee,
@@ -1312,14 +1309,6 @@ extern int ieee80211_wx_set_encodeext(struct ieee80211_device *ieee,
 extern int ieee80211_wx_get_encodeext(struct ieee80211_device *ieee,
                                       struct iw_request_info *info,
                                       union iwreq_data *wrqu, char *extra);
-extern int ieee80211_wx_set_auth(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 union iwreq_data *wrqu,
-                                 char *extra);
-extern int ieee80211_wx_get_auth(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 union iwreq_data *wrqu,
-                                 char *extra);
 
 static inline void ieee80211_increment_scans(struct ieee80211_device *ieee)
 {
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index 6512d85f11b3..3780592ebe8e 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -19,7 +19,6 @@
 struct ip6_tnl {
         struct ip6_tnl *next;   /* next tunnel in list */
         struct net_device *dev; /* virtual device associated with tunnel */
-        struct net_device_stats stat;   /* statistics for tunnel device */
         int recursion;          /* depth of hard_start_xmit recursion */
         struct ip6_tnl_parm parms;      /* tunnel configuration parameters */
         struct flowi fl;        /* flowi template for xmit */
diff --git a/include/net/ipip.h b/include/net/ipip.h
index 633ed4def8e3..a85bda64b852 100644
--- a/include/net/ipip.h
+++ b/include/net/ipip.h
@@ -11,7 +11,6 @@ struct ip_tunnel
 {
         struct ip_tunnel        *next;
         struct net_device       *dev;
-        struct net_device_stats stat;
 
         int                     recursion;      /* Depth of hard_start_xmit recursion */
         int                     err_count;      /* Number of arrived ICMP errors */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index dae3f9ec1154..1196de85f8db 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -98,6 +98,18 @@ struct ieee80211_ht_bss_info {
 };
 
 /**
+ * enum ieee80211_max_queues - maximum number of queues
+ *
+ * @IEEE80211_MAX_QUEUES: Maximum number of regular device queues.
+ * @IEEE80211_MAX_AMPDU_QUEUES: Maximum number of queues usable
+ *      for A-MPDU operation.
+ */
+enum ieee80211_max_queues {
+        IEEE80211_MAX_QUEUES =          16,
+        IEEE80211_MAX_AMPDU_QUEUES =    16,
+};
+
+/**
  * struct ieee80211_tx_queue_params - transmit queue configuration
  *
  * The information provided in this structure is required for QoS
@@ -117,58 +129,18 @@ struct ieee80211_tx_queue_params {
 };
 
 /**
- * struct ieee80211_tx_queue_stats_data - transmit queue statistics
+ * struct ieee80211_tx_queue_stats - transmit queue statistics
  *
  * @len: number of packets in queue
  * @limit: queue length limit
  * @count: number of frames sent
  */
-struct ieee80211_tx_queue_stats_data {
+struct ieee80211_tx_queue_stats {
         unsigned int len;
         unsigned int limit;
         unsigned int count;
 };
 
-/**
- * enum ieee80211_tx_queue - transmit queue number
- *
- * These constants are used with some callbacks that take a
- * queue number to set parameters for a queue.
- *
- * @IEEE80211_TX_QUEUE_DATA0: data queue 0
- * @IEEE80211_TX_QUEUE_DATA1: data queue 1
- * @IEEE80211_TX_QUEUE_DATA2: data queue 2
- * @IEEE80211_TX_QUEUE_DATA3: data queue 3
- * @IEEE80211_TX_QUEUE_DATA4: data queue 4
- * @IEEE80211_TX_QUEUE_SVP: ??
- * @NUM_TX_DATA_QUEUES: number of data queues
- * @IEEE80211_TX_QUEUE_AFTER_BEACON: transmit queue for frames to be
- *      sent after a beacon
- * @IEEE80211_TX_QUEUE_BEACON: transmit queue for beacon frames
- * @NUM_TX_DATA_QUEUES_AMPDU: adding more queues for A-MPDU
- */
-enum ieee80211_tx_queue {
-        IEEE80211_TX_QUEUE_DATA0,
-        IEEE80211_TX_QUEUE_DATA1,
-        IEEE80211_TX_QUEUE_DATA2,
-        IEEE80211_TX_QUEUE_DATA3,
-        IEEE80211_TX_QUEUE_DATA4,
-        IEEE80211_TX_QUEUE_SVP,
-
-        NUM_TX_DATA_QUEUES,
-
-/* due to stupidity in the sub-ioctl userspace interface, the items in
- * this struct need to have fixed values. As soon as it is removed, we can
- * fix these entries. */
-        IEEE80211_TX_QUEUE_AFTER_BEACON = 6,
-        IEEE80211_TX_QUEUE_BEACON = 7,
-        NUM_TX_DATA_QUEUES_AMPDU = 16
-};
-
-struct ieee80211_tx_queue_stats {
-        struct ieee80211_tx_queue_stats_data data[NUM_TX_DATA_QUEUES_AMPDU];
-};
-
 struct ieee80211_low_level_stats {
         unsigned int dot11ACKFailureCount;
         unsigned int dot11RTSFailureCount;
@@ -229,91 +201,128 @@ struct ieee80211_bss_conf {
 };
 
 /**
- * enum mac80211_tx_control_flags - flags to describe Tx configuration for
- *                                  the Tx frame
- *
- * These flags are used with the @flags member of &ieee80211_tx_control
- *
- * @IEEE80211_TXCTL_REQ_TX_STATUS: request TX status callback for this frame.
- * @IEEE80211_TXCTL_DO_NOT_ENCRYPT: send this frame without encryption;
- *                                  e.g., for EAPOL frame
- * @IEEE80211_TXCTL_USE_RTS_CTS: use RTS-CTS before sending frame
- * @IEEE80211_TXCTL_USE_CTS_PROTECT: use CTS protection for the frame (e.g.,
- *                                   for combined 802.11g / 802.11b networks)
- * @IEEE80211_TXCTL_NO_ACK: tell the low level not to wait for an ack
- * @IEEE80211_TXCTL_RATE_CTRL_PROBE
- * @EEE80211_TXCTL_CLEAR_PS_FILT: clear powersave filter
- *                                 for destination station
- * @IEEE80211_TXCTL_REQUEUE:
- * @IEEE80211_TXCTL_FIRST_FRAGMENT: this is a first fragment of the frame
- * @IEEE80211_TXCTL_LONG_RETRY_LIMIT: this frame should be send using the
- *                                    through set_retry_limit configured long
- *                                    retry value
- * @IEEE80211_TXCTL_EAPOL_FRAME: internal to mac80211
- * @IEEE80211_TXCTL_SEND_AFTER_DTIM: send this frame after DTIM beacon
- * @IEEE80211_TXCTL_AMPDU: this frame should be sent as part of an A-MPDU
- * @IEEE80211_TXCTL_OFDM_HT: this frame can be sent in HT OFDM rates. number
- *                           of streams when this flag is on can be extracted
- *                           from antenna_sel_tx, so if 1 antenna is marked
- *                           use SISO, 2 antennas marked use MIMO, n antennas
- *                           marked use MIMO_n.
- * @IEEE80211_TXCTL_GREEN_FIELD: use green field protection for this frame
- * @IEEE80211_TXCTL_40_MHZ_WIDTH: send this frame using 40 Mhz channel width
- * @IEEE80211_TXCTL_DUP_DATA: duplicate data frame on both 20 Mhz channels
- * @IEEE80211_TXCTL_SHORT_GI: send this frame using short guard interval
+ * enum mac80211_tx_flags - flags to transmission information/status
+ *
+ * These flags are used with the @flags member of &ieee80211_tx_info
+ *
+ * @IEEE80211_TX_CTL_REQ_TX_STATUS: request TX status callback for this frame.
+ * @IEEE80211_TX_CTL_DO_NOT_ENCRYPT: send this frame without encryption;
+ *      e.g., for EAPOL frame
+ * @IEEE80211_TX_CTL_USE_RTS_CTS: use RTS-CTS before sending frame
+ * @IEEE80211_TX_CTL_USE_CTS_PROTECT: use CTS protection for the frame (e.g.,
+ *      for combined 802.11g / 802.11b networks)
+ * @IEEE80211_TX_CTL_NO_ACK: tell the low level not to wait for an ack
+ * @IEEE80211_TX_CTL_RATE_CTRL_PROBE
+ * @IEEE80211_TX_CTL_CLEAR_PS_FILT: clear powersave filter for destination
+ *      station
+ * @IEEE80211_TX_CTL_REQUEUE:
+ * @IEEE80211_TX_CTL_FIRST_FRAGMENT: this is a first fragment of the frame
+ * @IEEE80211_TX_CTL_LONG_RETRY_LIMIT: this frame should be send using the
+ *      through set_retry_limit configured long retry value
+ * @IEEE80211_TX_CTL_EAPOL_FRAME: internal to mac80211
+ * @IEEE80211_TX_CTL_SEND_AFTER_DTIM: send this frame after DTIM beacon
+ * @IEEE80211_TX_CTL_AMPDU: this frame should be sent as part of an A-MPDU
+ * @IEEE80211_TX_CTL_OFDM_HT: this frame can be sent in HT OFDM rates. number
+ *      of streams when this flag is on can be extracted from antenna_sel_tx,
+ *      so if 1 antenna is marked use SISO, 2 antennas marked use MIMO, n
+ *      antennas marked use MIMO_n.
+ * @IEEE80211_TX_CTL_GREEN_FIELD: use green field protection for this frame
+ * @IEEE80211_TX_CTL_40_MHZ_WIDTH: send this frame using 40 Mhz channel width
+ * @IEEE80211_TX_CTL_DUP_DATA: duplicate data frame on both 20 Mhz channels
+ * @IEEE80211_TX_CTL_SHORT_GI: send this frame using short guard interval
+ * @IEEE80211_TX_STAT_TX_FILTERED: The frame was not transmitted
+ *      because the destination STA was in powersave mode.
+ * @IEEE80211_TX_STAT_ACK: Frame was acknowledged
+ * @IEEE80211_TX_STAT_AMPDU: The frame was aggregated, so status
+ *      is for the whole aggregation.
  */
 enum mac80211_tx_control_flags {
-        IEEE80211_TXCTL_REQ_TX_STATUS           = (1<<0),
-        IEEE80211_TXCTL_DO_NOT_ENCRYPT          = (1<<1),
-        IEEE80211_TXCTL_USE_RTS_CTS             = (1<<2),
-        IEEE80211_TXCTL_USE_CTS_PROTECT         = (1<<3),
-        IEEE80211_TXCTL_NO_ACK                  = (1<<4),
-        IEEE80211_TXCTL_RATE_CTRL_PROBE         = (1<<5),
-        IEEE80211_TXCTL_CLEAR_PS_FILT           = (1<<6),
-        IEEE80211_TXCTL_REQUEUE                 = (1<<7),
-        IEEE80211_TXCTL_FIRST_FRAGMENT          = (1<<8),
-        IEEE80211_TXCTL_SHORT_PREAMBLE          = (1<<9),
-        IEEE80211_TXCTL_LONG_RETRY_LIMIT        = (1<<10),
-        IEEE80211_TXCTL_EAPOL_FRAME             = (1<<11),
-        IEEE80211_TXCTL_SEND_AFTER_DTIM         = (1<<12),
-        IEEE80211_TXCTL_AMPDU                   = (1<<13),
-        IEEE80211_TXCTL_OFDM_HT                 = (1<<14),
-        IEEE80211_TXCTL_GREEN_FIELD             = (1<<15),
-        IEEE80211_TXCTL_40_MHZ_WIDTH            = (1<<16),
-        IEEE80211_TXCTL_DUP_DATA                = (1<<17),
-        IEEE80211_TXCTL_SHORT_GI                = (1<<18),
+        IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
+        IEEE80211_TX_CTL_DO_NOT_ENCRYPT         = BIT(1),
+        IEEE80211_TX_CTL_USE_RTS_CTS            = BIT(2),
+        IEEE80211_TX_CTL_USE_CTS_PROTECT        = BIT(3),
+        IEEE80211_TX_CTL_NO_ACK                 = BIT(4),
+        IEEE80211_TX_CTL_RATE_CTRL_PROBE        = BIT(5),
+        IEEE80211_TX_CTL_CLEAR_PS_FILT          = BIT(6),
+        IEEE80211_TX_CTL_REQUEUE                = BIT(7),
+        IEEE80211_TX_CTL_FIRST_FRAGMENT         = BIT(8),
+        IEEE80211_TX_CTL_SHORT_PREAMBLE         = BIT(9),
+        IEEE80211_TX_CTL_LONG_RETRY_LIMIT       = BIT(10),
+        IEEE80211_TX_CTL_EAPOL_FRAME            = BIT(11),
+        IEEE80211_TX_CTL_SEND_AFTER_DTIM        = BIT(12),
+        IEEE80211_TX_CTL_AMPDU                  = BIT(13),
+        IEEE80211_TX_CTL_OFDM_HT                = BIT(14),
+        IEEE80211_TX_CTL_GREEN_FIELD            = BIT(15),
+        IEEE80211_TX_CTL_40_MHZ_WIDTH           = BIT(16),
+        IEEE80211_TX_CTL_DUP_DATA               = BIT(17),
+        IEEE80211_TX_CTL_SHORT_GI               = BIT(18),
+        IEEE80211_TX_CTL_INJECTED               = BIT(19),
+        IEEE80211_TX_STAT_TX_FILTERED           = BIT(20),
+        IEEE80211_TX_STAT_ACK                   = BIT(21),
+        IEEE80211_TX_STAT_AMPDU                 = BIT(22),
 };
 
-/* Transmit control fields. This data structure is passed to low-level driver
- * with each TX frame. The low-level driver is responsible for configuring
- * the hardware to use given values (depending on what is supported). */
 
-struct ieee80211_tx_control {
-        struct ieee80211_vif *vif;
-        struct ieee80211_rate *tx_rate;
-
-        /* Transmit rate for RTS/CTS frame */
-        struct ieee80211_rate *rts_cts_rate;
-
-        /* retry rate for the last retries */
-        struct ieee80211_rate *alt_retry_rate;
-
-        u32 flags;              /* tx control flags defined above */
-        u8 key_idx;             /* keyidx from hw->set_key(), undefined if
-                                 * IEEE80211_TXCTL_DO_NOT_ENCRYPT is set */
-        u8 retry_limit;         /* 1 = only first attempt, 2 = one retry, ..
-                                 * This could be used when set_retry_limit
-                                 * is not implemented by the driver */
-        u8 antenna_sel_tx;      /* 0 = default/diversity, otherwise bit
-                                 * position represents antenna number used */
-        u8 icv_len;             /* length of the ICV/MIC field in octets */
-        u8 iv_len;              /* length of the IV field in octets */
-        u8 queue;               /* hardware queue to use for this frame;
-                                 * 0 = highest, hw->queues-1 = lowest */
-        u16 aid;                /* Station AID */
-        int type;       /* internal */
+#define IEEE80211_TX_INFO_DRIVER_DATA_SIZE \
+        (sizeof(((struct sk_buff *)0)->cb) - 8)
+#define IEEE80211_TX_INFO_DRIVER_DATA_PTRS \
+        (IEEE80211_TX_INFO_DRIVER_DATA_SIZE / sizeof(void *))
+
+/**
+ * struct ieee80211_tx_info - skb transmit information
+ *
+ * This structure is placed in skb->cb for three uses:
+ *  (1) mac80211 TX control - mac80211 tells the driver what to do
+ *  (2) driver internal use (if applicable)
+ *  (3) TX status information - driver tells mac80211 what happened
+ *
+ * @flags: transmit info flags, defined above
+ * @retry_count: number of retries
+ * @excessive_retries: set to 1 if the frame was retried many times
+ *      but not acknowledged
+ * @ampdu_ack_len: number of aggregated frames.
+ *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
+ * @ampdu_ack_map: block ack bit map for the aggregation.
+ *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
+ * @ack_signal: signal strength of the ACK frame
+ */
+struct ieee80211_tx_info {
+        /* common information */
+        u32 flags;
+        u8 band;
+        s8 tx_rate_idx;
+        u8 antenna_sel_tx;
+
+        /* 1 byte hole */
+
+        union {
+                struct {
+                        struct ieee80211_vif *vif;
+                        struct ieee80211_key_conf *hw_key;
+                        unsigned long jiffies;
+                        int ifindex;
+                        u16 aid;
+                        s8 rts_cts_rate_idx, alt_retry_rate_idx;
+                        u8 retry_limit;
+                        u8 icv_len;
+                        u8 iv_len;
+                } control;
+                struct {
+                        u64 ampdu_ack_map;
+                        int ack_signal;
+                        u8 retry_count;
+                        bool excessive_retries;
+                        u8 ampdu_ack_len;
+                } status;
+                void *driver_data[IEEE80211_TX_INFO_DRIVER_DATA_PTRS];
+        };
 };
 
+static inline struct ieee80211_tx_info *IEEE80211_SKB_CB(struct sk_buff *skb)
+{
+        return (struct ieee80211_tx_info *)skb->cb;
+}
+
 
 /**
  * enum mac80211_rx_flags - receive flags
@@ -353,13 +362,16 @@ enum mac80211_rx_flags {
  * The low-level driver should provide this information (the subset
  * supported by hardware) to the 802.11 code with each received
  * frame.
+ *
  * @mactime: value in microseconds of the 64-bit Time Synchronization Function
  *      (TSF) timer when the first data symbol (MPDU) arrived at the hardware.
  * @band: the active band when this frame was received
  * @freq: frequency the radio was tuned to when receiving this frame, in MHz
- * @ssi: signal strength when receiving this frame
- * @signal: used as 'qual' in statistics reporting
- * @noise: PHY noise when receiving this frame
+ * @signal: signal strength when receiving this frame, either in dBm, in dB or
+ *      unspecified depending on the hardware capabilities flags
+ *      @IEEE80211_HW_SIGNAL_*
+ * @noise: noise when receiving this frame, in dBm.
+ * @qual: overall signal quality indication, in percent (0-100).
  * @antenna: antenna used
  * @rate_idx: index of data rate into band's supported rates
  * @flag: %RX_FLAG_*
@@ -368,64 +380,15 @@ struct ieee80211_rx_status {
         u64 mactime;
         enum ieee80211_band band;
         int freq;
-        int ssi;
         int signal;
         int noise;
+        int qual;
         int antenna;
         int rate_idx;
         int flag;
 };
 
 /**
- * enum ieee80211_tx_status_flags - transmit status flags
- *
- * Status flags to indicate various transmit conditions.
- *
- * @IEEE80211_TX_STATUS_TX_FILTERED: The frame was not transmitted
- *      because the destination STA was in powersave mode.
- * @IEEE80211_TX_STATUS_ACK: Frame was acknowledged
- * @IEEE80211_TX_STATUS_AMPDU: The frame was aggregated, so status
- *      is for the whole aggregation.
- */
-enum ieee80211_tx_status_flags {
-        IEEE80211_TX_STATUS_TX_FILTERED = 1<<0,
-        IEEE80211_TX_STATUS_ACK         = 1<<1,
-        IEEE80211_TX_STATUS_AMPDU       = 1<<2,
-};
-
-/**
- * struct ieee80211_tx_status - transmit status
- *
- * As much information as possible should be provided for each transmitted
- * frame with ieee80211_tx_status().
- *
- * @control: a copy of the &struct ieee80211_tx_control passed to the driver
- *      in the tx() callback.
- * @flags: transmit status flags, defined above
- * @retry_count: number of retries
- * @excessive_retries: set to 1 if the frame was retried many times
- *      but not acknowledged
- * @ampdu_ack_len: number of aggregated frames.
- *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
- * @ampdu_ack_map: block ack bit map for the aggregation.
- *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
- * @ack_signal: signal strength of the ACK frame
- * @queue_length: ?? REMOVE
- * @queue_number: ?? REMOVE
- */
-struct ieee80211_tx_status {
-        struct ieee80211_tx_control control;
-        u8 flags;
-        u8 retry_count;
-        bool excessive_retries;
-        u8 ampdu_ack_len;
-        u64 ampdu_ack_map;
-        int ack_signal;
-        int queue_length;
-        int queue_number;
-};
-
-/**
  * enum ieee80211_conf_flags - configuration flags
  *
  * Flags to define PHY configuration options
@@ -580,7 +543,6 @@ struct ieee80211_if_conf {
         u8 *ssid;
         size_t ssid_len;
         struct sk_buff *beacon;
-        struct ieee80211_tx_control *beacon_control;
 };
 
 /**
@@ -610,11 +572,14 @@ enum ieee80211_key_alg {
  * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
  *      the driver for a TKIP key if it requires Michael MIC
  *      generation in software.
+ * @IEEE80211_KEY_FLAG_PAIRWISE: Set by mac80211, this flag indicates
+ *      that the key is pairwise rather then a shared key.
  */
 enum ieee80211_key_flags {
         IEEE80211_KEY_FLAG_WMM_STA      = 1<<0,
         IEEE80211_KEY_FLAG_GENERATE_IV  = 1<<1,
         IEEE80211_KEY_FLAG_GENERATE_MMIC= 1<<2,
+        IEEE80211_KEY_FLAG_PAIRWISE     = 1<<3,
 };
 
 /**
@@ -721,6 +686,25 @@ enum ieee80211_tkip_key_type {
  * @IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE:
  *      Hardware is not capable of receiving frames with short preamble on
  *      the 2.4 GHz band.
+ *
+ * @IEEE80211_HW_SIGNAL_UNSPEC:
+ *      Hardware can provide signal values but we don't know its units. We
+ *      expect values between 0 and @max_signal.
+ *      If possible please provide dB or dBm instead.
+ *
+ * @IEEE80211_HW_SIGNAL_DB:
+ *      Hardware gives signal values in dB, decibel difference from an
+ *      arbitrary, fixed reference. We expect values between 0 and @max_signal.
+ *      If possible please provide dBm instead.
+ *
+ * @IEEE80211_HW_SIGNAL_DBM:
+ *      Hardware gives signal values in dBm, decibel difference from
+ *      one milliwatt. This is the preferred method since it is standardized
+ *      between different devices. @max_signal does not need to be set.
+ *
+ * @IEEE80211_HW_NOISE_DBM:
+ *      Hardware can provide noise (radio interference) values in units dBm,
+ *      decibel difference from one milliwatt.
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE           = 1<<0,
@@ -728,6 +712,10 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING        = 1<<2,
         IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE          = 1<<3,
         IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE      = 1<<4,
+        IEEE80211_HW_SIGNAL_UNSPEC                      = 1<<5,
+        IEEE80211_HW_SIGNAL_DB                          = 1<<6,
+        IEEE80211_HW_SIGNAL_DBM                         = 1<<7,
+        IEEE80211_HW_NOISE_DBM                          = 1<<8,
 };
 
 /**
@@ -758,15 +746,18 @@ enum ieee80211_hw_flags {
  *
  * @channel_change_time: time (in microseconds) it takes to change channels.
  *
- * @max_rssi: Maximum value for ssi in RX information, use
- *      negative numbers for dBm and 0 to indicate no support.
- *
- * @max_signal: like @max_rssi, but for the signal value.
- *
- * @max_noise: like @max_rssi, but for the noise value.
+ * @max_signal: Maximum value for signal (rssi) in RX information, used
+ *     only when @IEEE80211_HW_SIGNAL_UNSPEC or @IEEE80211_HW_SIGNAL_DB
  *
  * @queues: number of available hardware transmit queues for
- *      data packets. WMM/QoS requires at least four.
+ *      data packets. WMM/QoS requires at least four, these
+ *      queues need to have configurable access parameters.
+ *
+ * @ampdu_queues: number of available hardware transmit queues
+ *      for A-MPDU packets, these have no access parameters
+ *      because they're used only for A-MPDU frames. Note that
+ *      mac80211 will not currently use any of the regular queues
+ *      for aggregation.
  *
  * @rate_control_algorithm: rate control algorithm for this hardware.
  *      If unset (NULL), the default algorithm will be used. Must be
@@ -785,10 +776,8 @@ struct ieee80211_hw {
         unsigned int extra_tx_headroom;
         int channel_change_time;
         int vif_data_size;
-        u8 queues;
-        s8 max_rssi;
+        u16 queues, ampdu_queues;
         s8 max_signal;
-        s8 max_noise;
 };
 
 /**
@@ -813,6 +802,51 @@ static inline void SET_IEEE80211_PERM_ADDR(struct ieee80211_hw *hw, u8 *addr)
         memcpy(hw->wiphy->perm_addr, addr, ETH_ALEN);
 }
 
+static inline int ieee80211_num_regular_queues(struct ieee80211_hw *hw)
+{
+#ifdef CONFIG_MAC80211_QOS
+        return hw->queues;
+#else
+        return 1;
+#endif
+}
+
+static inline int ieee80211_num_queues(struct ieee80211_hw *hw)
+{
+#ifdef CONFIG_MAC80211_QOS
+        return hw->queues + hw->ampdu_queues;
+#else
+        return 1;
+#endif
+}
+
+static inline struct ieee80211_rate *
+ieee80211_get_tx_rate(const struct ieee80211_hw *hw,
+                      const struct ieee80211_tx_info *c)
+{
+        if (WARN_ON(c->tx_rate_idx < 0))
+                return NULL;
+        return &hw->wiphy->bands[c->band]->bitrates[c->tx_rate_idx];
+}
+
+static inline struct ieee80211_rate *
+ieee80211_get_rts_cts_rate(const struct ieee80211_hw *hw,
+                           const struct ieee80211_tx_info *c)
+{
+        if (c->control.rts_cts_rate_idx < 0)
+                return NULL;
+        return &hw->wiphy->bands[c->band]->bitrates[c->control.rts_cts_rate_idx];
+}
+
+static inline struct ieee80211_rate *
+ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
+                             const struct ieee80211_tx_info *c)
+{
+        if (c->control.alt_retry_rate_idx < 0)
+                return NULL;
+        return &hw->wiphy->bands[c->band]->bitrates[c->control.alt_retry_rate_idx];
+}
+
 /**
  * DOC: Hardware crypto acceleration
  *
@@ -970,8 +1004,10 @@ enum ieee80211_ampdu_mlme_action {
  * @tx: Handler that 802.11 module calls for each transmitted frame.
  *      skb contains the buffer starting from the IEEE 802.11 header.
  *      The low-level driver should send the frame out based on
- *      configuration in the TX control data. Must be implemented and
- *      atomic.
+ *      configuration in the TX control data. This handler should,
+ *      preferably, never fail and stop queues appropriately, more
+ *      importantly, however, it must never fail for A-MPDU-queues.
+ *      Must be implemented and atomic.
  *
  * @start: Called before the first netdevice attached to the hardware
  *      is enabled. This should turn on the hardware and must turn on
@@ -1063,15 +1099,13 @@ enum ieee80211_ampdu_mlme_action {
  *      of assocaited station or AP.
  *
  * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
- *      bursting) for a hardware TX queue. The @queue parameter uses the
- *      %IEEE80211_TX_QUEUE_* constants. Must be atomic.
+ *      bursting) for a hardware TX queue. Must be atomic.
  *
  * @get_tx_stats: Get statistics of the current TX queue status. This is used
  *      to get number of currently queued packets (queue length), maximum queue
  *      size (limit), and total number of packets sent using each TX queue
- *      (count). This information is used for WMM to find out which TX
- *      queues have room for more packets and by hostapd to provide
- *      statistics about the current queueing state to external programs.
+ *      (count). The 'stats' pointer points to an array that has hw->queues +
+ *      hw->ampdu_queues items.
  *
  * @get_tsf: Get the current TSF timer value from firmware/hardware. Currently,
  *      this is only used for IBSS mode debugging and, as such, is not a
@@ -1107,8 +1141,7 @@ enum ieee80211_ampdu_mlme_action {
  *      that TX/RX_STOP can pass NULL for this parameter.
  */
 struct ieee80211_ops {
-        int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb,
-                  struct ieee80211_tx_control *control);
+        int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
         int (*start)(struct ieee80211_hw *hw);
         void (*stop)(struct ieee80211_hw *hw);
         int (*add_interface)(struct ieee80211_hw *hw,
@@ -1145,15 +1178,14 @@ struct ieee80211_ops {
                                u32 short_retry, u32 long_retr);
         void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         enum sta_notify_cmd, const u8 *addr);
-        int (*conf_tx)(struct ieee80211_hw *hw, int queue,
+        int (*conf_tx)(struct ieee80211_hw *hw, u16 queue,
                        const struct ieee80211_tx_queue_params *params);
         int (*get_tx_stats)(struct ieee80211_hw *hw,
                             struct ieee80211_tx_queue_stats *stats);
         u64 (*get_tsf)(struct ieee80211_hw *hw);
         void (*reset_tsf)(struct ieee80211_hw *hw);
         int (*beacon_update)(struct ieee80211_hw *hw,
-                             struct sk_buff *skb,
-                             struct ieee80211_tx_control *control);
+                             struct sk_buff *skb);
         int (*tx_last_beacon)(struct ieee80211_hw *hw);
         int (*ampdu_action)(struct ieee80211_hw *hw,
                             enum ieee80211_ampdu_mlme_action action,
@@ -1349,13 +1381,9 @@ void ieee80211_rx_irqsafe(struct ieee80211_hw *hw,
  *
  * @hw: the hardware the frame was transmitted by
  * @skb: the frame that was transmitted, owned by mac80211 after this call
- * @status: status information for this frame; the status pointer need not
- *      be valid after this function returns and is not freed by mac80211,
- *      it is recommended that it points to a stack area
  */
 void ieee80211_tx_status(struct ieee80211_hw *hw,
-                         struct sk_buff *skb,
-                         struct ieee80211_tx_status *status);
+                         struct sk_buff *skb);
 
 /**
  * ieee80211_tx_status_irqsafe - irq-safe transmit status callback
@@ -1368,13 +1396,9 @@ void ieee80211_tx_status(struct ieee80211_hw *hw,
  *
  * @hw: the hardware the frame was transmitted by
  * @skb: the frame that was transmitted, owned by mac80211 after this call
- * @status: status information for this frame; the status pointer need not
- *      be valid after this function returns and is not freed by mac80211,
- *      it is recommended that it points to a stack area
  */
 void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
-                                 struct sk_buff *skb,
-                                 struct ieee80211_tx_status *status);
+                                 struct sk_buff *skb);
 
 /**
  * ieee80211_beacon_get - beacon generation function
@@ -1390,8 +1414,7 @@ void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
  * is responsible of freeing it.
  */
 struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
-                                     struct ieee80211_vif *vif,
-                                     struct ieee80211_tx_control *control);
+                                     struct ieee80211_vif *vif);
 
 /**
  * ieee80211_rts_get - RTS frame generation function
@@ -1399,7 +1422,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  * @frame: pointer to the frame that is going to be protected by the RTS.
  * @frame_len: the frame length (in octets).
- * @frame_txctl: &struct ieee80211_tx_control of the frame.
+ * @frame_txctl: &struct ieee80211_tx_info of the frame.
  * @rts: The buffer where to store the RTS frame.
  *
  * If the RTS frames are generated by the host system (i.e., not in
@@ -1409,7 +1432,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
  */
 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        const void *frame, size_t frame_len,
-                       const struct ieee80211_tx_control *frame_txctl,
+                       const struct ieee80211_tx_info *frame_txctl,
                        struct ieee80211_rts *rts);
 
 /**
@@ -1417,7 +1440,7 @@ void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  * @frame_len: the length of the frame that is going to be protected by the RTS.
- * @frame_txctl: &struct ieee80211_tx_control of the frame.
+ * @frame_txctl: &struct ieee80211_tx_info of the frame.
  *
  * If the RTS is generated in firmware, but the host system must provide
  * the duration field, the low-level driver uses this function to receive
@@ -1425,7 +1448,7 @@ void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  */
 __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif, size_t frame_len,
-                              const struct ieee80211_tx_control *frame_txctl);
+                              const struct ieee80211_tx_info *frame_txctl);
 
 /**
  * ieee80211_ctstoself_get - CTS-to-self frame generation function
@@ -1433,7 +1456,7 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  * @frame: pointer to the frame that is going to be protected by the CTS-to-self.
  * @frame_len: the frame length (in octets).
- * @frame_txctl: &struct ieee80211_tx_control of the frame.
+ * @frame_txctl: &struct ieee80211_tx_info of the frame.
  * @cts: The buffer where to store the CTS-to-self frame.
  *
  * If the CTS-to-self frames are generated by the host system (i.e., not in
@@ -1444,7 +1467,7 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
 void ieee80211_ctstoself_get(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif,
                              const void *frame, size_t frame_len,
-                             const struct ieee80211_tx_control *frame_txctl,
+                             const struct ieee80211_tx_info *frame_txctl,
                              struct ieee80211_cts *cts);
 
 /**
@@ -1452,7 +1475,7 @@ void ieee80211_ctstoself_get(struct ieee80211_hw *hw,
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  * @frame_len: the length of the frame that is going to be protected by the CTS-to-self.
- * @frame_txctl: &struct ieee80211_tx_control of the frame.
+ * @frame_txctl: &struct ieee80211_tx_info of the frame.
  *
  * If the CTS-to-self is generated in firmware, but the host system must provide
  * the duration field, the low-level driver uses this function to receive
@@ -1461,7 +1484,7 @@ void ieee80211_ctstoself_get(struct ieee80211_hw *hw,
 __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     size_t frame_len,
-                                    const struct ieee80211_tx_control *frame_txctl);
+                                    const struct ieee80211_tx_info *frame_txctl);
 
 /**
  * ieee80211_generic_frame_duration - Calculate the duration field for a frame
@@ -1500,8 +1523,7 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
  * use common code for all beacons.
  */
 struct sk_buff *
-ieee80211_get_buffered_bc(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                          struct ieee80211_tx_control *control);
+ieee80211_get_buffered_bc(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 
 /**
  * ieee80211_get_hdrlen_from_skb - get header length from data
@@ -1559,14 +1581,6 @@ void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue);
 void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue);
 
 /**
- * ieee80211_start_queues - start all queues
- * @hw: pointer to as obtained from ieee80211_alloc_hw().
- *
- * Drivers should use this function instead of netif_start_queue.
- */
-void ieee80211_start_queues(struct ieee80211_hw *hw);
-
-/**
  * ieee80211_stop_queues - stop all queues
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  *
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index aa540e6be502..8df751b3be55 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -201,8 +201,11 @@ extern void unregister_pernet_gen_device(int id, struct pernet_operations *);
 struct ctl_path;
 struct ctl_table;
 struct ctl_table_header;
+
 extern struct ctl_table_header *register_net_sysctl_table(struct net *net,
         const struct ctl_path *path, struct ctl_table *table);
+extern struct ctl_table_header *register_net_sysctl_rotable(
+        const struct ctl_path *path, struct ctl_table *table);
 extern void unregister_net_sysctl_table(struct ctl_table_header *header);
 
 #endif /* __NET_NET_NAMESPACE_H */
diff --git a/include/net/netfilter/ipv4/nf_conntrack_ipv4.h b/include/net/netfilter/ipv4/nf_conntrack_ipv4.h
index 9bf059817aec..7573d52a4346 100644
--- a/include/net/netfilter/ipv4/nf_conntrack_ipv4.h
+++ b/include/net/netfilter/ipv4/nf_conntrack_ipv4.h
@@ -9,8 +9,6 @@
 #ifndef _NF_CONNTRACK_IPV4_H
 #define _NF_CONNTRACK_IPV4_H
 
-/* Returns new sk_buff, or NULL */
-struct sk_buff *nf_ct_ipv4_ct_gather_frags(struct sk_buff *skb);
 
 extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4;
 
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 2dbd6c015b94..d77dec768dc2 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -223,6 +223,25 @@ static inline void nf_ct_refresh(struct nf_conn *ct,
         __nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);
 }
 
+extern void __nf_ct_kill_acct(struct nf_conn *ct,
+                                enum ip_conntrack_info ctinfo,
+                                const struct sk_buff *skb,
+                                int do_acct);
+
+/* kill conntrack and do accounting */
+static inline void nf_ct_kill_acct(struct nf_conn *ct,
+                                enum ip_conntrack_info ctinfo,
+                                const struct sk_buff *skb)
+{
+        __nf_ct_kill_acct(ct, ctinfo, skb, 1);
+}
+
+/* kill conntrack without accounting */
+static inline void nf_ct_kill(struct nf_conn *ct)
+{
+        __nf_ct_kill_acct(ct, 0, NULL, 0);
+}
+
 /* These are for NAT.  Icky. */
 /* Update TCP window tracking data when NAT mangles the packet */
 extern void nf_conntrack_tcp_update(const struct sk_buff *skb,
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 34ee348a2cf2..6ef90b5fafb3 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -36,6 +36,7 @@ struct netns_ipv4 {
         struct xt_table         *iptable_mangle;
         struct xt_table         *iptable_raw;
         struct xt_table         *arptable_filter;
+        struct xt_table         *iptable_security;
 #endif
 
         int sysctl_icmp_echo_ignore_all;
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index ac053be6c256..5bacd838e88b 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -35,6 +35,7 @@ struct netns_ipv6 {
         struct xt_table         *ip6table_filter;
         struct xt_table         *ip6table_mangle;
         struct xt_table         *ip6table_raw;
+        struct xt_table         *ip6table_security;
 #endif
         struct rt6_info         *ip6_null_entry;
         struct rt6_statistics   *rt6_stats;
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 90b1e8d23b16..5672d489e924 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -179,6 +179,8 @@ int sctp_eps_proc_init(void);
 void sctp_eps_proc_exit(void);
 int sctp_assocs_proc_init(void);
 void sctp_assocs_proc_exit(void);
+int sctp_remaddr_proc_init(void);
+void sctp_remaddr_proc_exit(void);
 
 
 /*
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 7f25195f9855..fbc27ac8a09e 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -300,6 +300,7 @@ struct sctp_sock {
 
         /* The default SACK delay timeout for new associations. */
         __u32 sackdelay;
+        __u32 sackfreq;
 
         /* Flags controlling Heartbeat, SACK delay, and Path MTU Discovery. */
         __u32 param_flags;
@@ -946,6 +947,7 @@ struct sctp_transport {
 
         /* SACK delay timeout */
         unsigned long sackdelay;
+        __u32 sackfreq;
 
         /* When was the last time (in jiffies) that we heard from this
          * transport?  We use this to pick new active and retran paths.
@@ -1553,6 +1555,7 @@ struct sctp_association {
                  *             : SACK's are not delayed (see Section 6).
                  */
                 __u8    sack_needed;     /* Do we need to sack the peer? */
+                __u32   sack_cnt;
 
                 /* These are capabilities which our peer advertised.  */
                 __u8    ecn_capable;     /* Can peer do ECN? */
@@ -1662,6 +1665,7 @@ struct sctp_association {
 
         /* SACK delay timeout */
         unsigned long sackdelay;
+        __u32 sackfreq;
 
 
         unsigned long timeouts[SCTP_NUM_TIMEOUT_TYPES];
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 9619b9d35c9e..f205b10f0ab9 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -93,8 +93,9 @@ enum sctp_optname {
 #define SCTP_STATUS SCTP_STATUS
         SCTP_GET_PEER_ADDR_INFO,
 #define SCTP_GET_PEER_ADDR_INFO SCTP_GET_PEER_ADDR_INFO
-        SCTP_DELAYED_ACK_TIME,
-#define SCTP_DELAYED_ACK_TIME SCTP_DELAYED_ACK_TIME
+        SCTP_DELAYED_ACK,
+#define SCTP_DELAYED_ACK_TIME SCTP_DELAYED_ACK
+#define SCTP_DELAYED_ACK SCTP_DELAYED_ACK
         SCTP_CONTEXT,   /* Receive Context */
 #define SCTP_CONTEXT SCTP_CONTEXT
         SCTP_FRAGMENT_INTERLEAVE,
@@ -136,12 +137,14 @@ enum sctp_optname {
 #define SCTP_GET_LOCAL_ADDRS_NUM_OLD    SCTP_GET_LOCAL_ADDRS_NUM_OLD
         SCTP_GET_LOCAL_ADDRS_OLD,       /* Get all local addresss. */
 #define SCTP_GET_LOCAL_ADDRS_OLD        SCTP_GET_LOCAL_ADDRS_OLD
-        SCTP_SOCKOPT_CONNECTX, /* CONNECTX requests. */
-#define SCTP_SOCKOPT_CONNECTX   SCTP_SOCKOPT_CONNECTX
+        SCTP_SOCKOPT_CONNECTX_OLD, /* CONNECTX old requests. */
+#define SCTP_SOCKOPT_CONNECTX_OLD       SCTP_SOCKOPT_CONNECTX_OLD
         SCTP_GET_PEER_ADDRS,    /* Get all peer addresss. */
 #define SCTP_GET_PEER_ADDRS     SCTP_GET_PEER_ADDRS
         SCTP_GET_LOCAL_ADDRS,   /* Get all local addresss. */
 #define SCTP_GET_LOCAL_ADDRS    SCTP_GET_LOCAL_ADDRS
+        SCTP_SOCKOPT_CONNECTX, /* CONNECTX requests. */
+#define SCTP_SOCKOPT_CONNECTX   SCTP_SOCKOPT_CONNECTX
 };
 
 /*
@@ -618,13 +621,26 @@ struct sctp_authkeyid {
 };
 
 
-/* 7.1.23. Delayed Ack Timer (SCTP_DELAYED_ACK_TIME)
+/*
+ * 7.1.23.  Get or set delayed ack timer (SCTP_DELAYED_SACK)
  *
- *   This options will get or set the delayed ack timer.  The time is set
- *   in milliseconds.  If the assoc_id is 0, then this sets or gets the
- *   endpoints default delayed ack timer value.  If the assoc_id field is
- *   non-zero, then the set or get effects the specified association.
+ * This option will effect the way delayed acks are performed.  This
+ * option allows you to get or set the delayed ack time, in
+ * milliseconds.  It also allows changing the delayed ack frequency.
+ * Changing the frequency to 1 disables the delayed sack algorithm.  If
+ * the assoc_id is 0, then this sets or gets the endpoints default
+ * values.  If the assoc_id field is non-zero, then the set or get
+ * effects the specified association for the one to many model (the
+ * assoc_id field is ignored by the one to one model).  Note that if
+ * sack_delay or sack_freq are 0 when setting this option, then the
+ * current values will remain unchanged.
  */
+struct sctp_sack_info {
+        sctp_assoc_t    sack_assoc_id;
+        uint32_t        sack_delay;
+        uint32_t        sack_freq;
+};
+
 struct sctp_assoc_value {
     sctp_assoc_t            assoc_id;
     uint32_t                assoc_value;
diff --git a/include/net/tipc/tipc_port.h b/include/net/tipc/tipc_port.h
index 11105bcc4457..9923e41a8215 100644
--- a/include/net/tipc/tipc_port.h
+++ b/include/net/tipc/tipc_port.h
@@ -84,7 +84,8 @@ struct tipc_port {
 u32 tipc_createport_raw(void *usr_handle,
                         u32 (*dispatcher)(struct tipc_port *, struct sk_buff *),
                         void (*wakeup)(struct tipc_port *),
-                        const u32 importance);
+                        const u32 importance,
+                        struct tipc_port **tp_ptr);
 
 int tipc_reject_msg(struct sk_buff *buf, u32 err);
 
diff --git a/include/net/wireless.h b/include/net/wireless.h
index 667b4080d30f..9324f8dd183e 100644
--- a/include/net/wireless.h
+++ b/include/net/wireless.h
@@ -39,12 +39,18 @@ enum ieee80211_band {
  *      on this channel.
  * @IEEE80211_CHAN_NO_IBSS: IBSS is not allowed on this channel.
  * @IEEE80211_CHAN_RADAR: Radar detection is required on this channel.
+ * @IEEE80211_CHAN_NO_FAT_ABOVE: extension channel above this channel
+ *      is not permitted.
+ * @IEEE80211_CHAN_NO_FAT_BELOW: extension channel below this channel
+ *      is not permitted.
  */
 enum ieee80211_channel_flags {
         IEEE80211_CHAN_DISABLED         = 1<<0,
         IEEE80211_CHAN_PASSIVE_SCAN     = 1<<1,
         IEEE80211_CHAN_NO_IBSS          = 1<<2,
         IEEE80211_CHAN_RADAR            = 1<<3,
+        IEEE80211_CHAN_NO_FAT_ABOVE     = 1<<4,
+        IEEE80211_CHAN_NO_FAT_BELOW     = 1<<5,
 };
 
 /**