17 files changed, 415 insertions, 72 deletions

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index b1bb817d1427..4b501b48ce86 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -18,6 +18,22 @@
 #include <linux/types.h>
 #include <asm/byteorder.h>
 
+/*
+ * DS bit usage
+ *
+ * TA = transmitter address
+ * RA = receiver address
+ * DA = destination address
+ * SA = source address
+ *
+ * ToDS    FromDS  A1(RA)  A2(TA)  A3      A4      Use
+ * -----------------------------------------------------------------
+ *  0       0       DA      SA      BSSID   -       IBSS/DLS
+ *  0       1       DA      BSSID   SA      -       AP -> STA
+ *  1       0       BSSID   SA      DA      -       AP <- STA
+ *  1       1       RA      TA      DA      SA      unspecified (WDS)
+ */
+
 #define FCS_LEN 4
 
 #define IEEE80211_FCTL_VERS             0x0003
@@ -851,6 +867,7 @@ struct ieee80211_ht_info {
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
 #define WLAN_AUTH_SHARED_KEY 1
+#define WLAN_AUTH_FT 2
 #define WLAN_AUTH_LEAP 128
 
 #define WLAN_AUTH_CHALLENGE_LEN 128
diff --git a/include/linux/if_frad.h b/include/linux/if_frad.h
index 60e16a551dd6..673f2209453d 100644
--- a/include/linux/if_frad.h
+++ b/include/linux/if_frad.h
@@ -153,7 +153,6 @@ struct frhdr
 
 struct dlci_local
 {
-   struct net_device_stats stats;
    struct net_device      *master;
    struct net_device      *slave;
    struct dlci_conf       config;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index be3ebd7e8ce5..1b55952a17f6 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -32,6 +32,7 @@
 #ifdef __KERNEL__
 #include <linux/timer.h>
 #include <linux/delay.h>
+#include <linux/mm.h>
 #include <asm/atomic.h>
 #include <asm/cache.h>
 #include <asm/byteorder.h>
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index adbc50a20ec2..7b1a652066c0 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -437,6 +437,29 @@ extern void xt_free_table_info(struct xt_table_info *info);
 extern void xt_table_entry_swap_rcu(struct xt_table_info *old,
                                     struct xt_table_info *new);
 
+/*
+ * This helper is performance critical and must be inlined
+ */
+static inline unsigned long ifname_compare_aligned(const char *_a,
+                                                   const char *_b,
+                                                   const char *_mask)
+{
+        const unsigned long *a = (const unsigned long *)_a;
+        const unsigned long *b = (const unsigned long *)_b;
+        const unsigned long *mask = (const unsigned long *)_mask;
+        unsigned long ret;
+
+        ret = (a[0] ^ b[0]) & mask[0];
+        if (IFNAMSIZ > sizeof(unsigned long))
+                ret |= (a[1] ^ b[1]) & mask[1];
+        if (IFNAMSIZ > 2 * sizeof(unsigned long))
+                ret |= (a[2] ^ b[2]) & mask[2];
+        if (IFNAMSIZ > 3 * sizeof(unsigned long))
+                ret |= (a[3] ^ b[3]) & mask[3];
+        BUILD_BUG_ON(IFNAMSIZ > 4 * sizeof(unsigned long));
+        return ret;
+}
+
 #ifdef CONFIG_COMPAT
 #include <net/compat.h>
 
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index f33aa08dd9b3..cbe8ce3bf486 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -142,6 +142,12 @@
  *      %NL80211_ATTR_IE. If the command succeeds, the requested data will be
  *      added to all specified management frames generated by
  *      kernel/firmware/driver.
+ *      Note: This command has been removed and it is only reserved at this
+ *      point to avoid re-using existing command number. The functionality this
+ *      command was planned for has been provided with cleaner design with the
+ *      option to specify additional IEs in NL80211_CMD_TRIGGER_SCAN,
+ *      NL80211_CMD_AUTHENTICATE, NL80211_CMD_ASSOCIATE,
+ *      NL80211_CMD_DEAUTHENTICATE, and NL80211_CMD_DISASSOCIATE.
  *
  * @NL80211_CMD_GET_SCAN: get scan results
  * @NL80211_CMD_TRIGGER_SCAN: trigger a new scan with the given parameters
@@ -161,6 +167,38 @@
  *      %NL80211_REG_TYPE_COUNTRY the alpha2 to which we have moved on
  *      to (%NL80211_ATTR_REG_ALPHA2).
  *
+ * @NL80211_CMD_AUTHENTICATE: authentication request and notification.
+ *      This command is used both as a command (request to authenticate) and
+ *      as an event on the "mlme" multicast group indicating completion of the
+ *      authentication process.
+ *      When used as a command, %NL80211_ATTR_IFINDEX is used to identify the
+ *      interface. %NL80211_ATTR_MAC is used to specify PeerSTAAddress (and
+ *      BSSID in case of station mode). %NL80211_ATTR_SSID is used to specify
+ *      the SSID (mainly for association, but is included in authentication
+ *      request, too, to help BSS selection. %NL80211_ATTR_WIPHY_FREQ is used
+ *      to specify the frequence of the channel in MHz. %NL80211_ATTR_AUTH_TYPE
+ *      is used to specify the authentication type. %NL80211_ATTR_IE is used to
+ *      define IEs (VendorSpecificInfo, but also including RSN IE and FT IEs)
+ *      to be added to the frame.
+ *      When used as an event, this reports reception of an Authentication
+ *      frame in station and IBSS modes when the local MLME processed the
+ *      frame, i.e., it was for the local STA and was received in correct
+ *      state. This is similar to MLME-AUTHENTICATE.confirm primitive in the
+ *      MLME SAP interface (kernel providing MLME, userspace SME). The
+ *      included NL80211_ATTR_FRAME attribute contains the management frame
+ *      (including both the header and frame body, but not FCS).
+ * @NL80211_CMD_ASSOCIATE: association request and notification; like
+ *      NL80211_CMD_AUTHENTICATE but for Association and Reassociation
+ *      (similar to MLME-ASSOCIATE.request, MLME-REASSOCIATE.request,
+ *      MLME-ASSOCIATE.confirm or MLME-REASSOCIATE.confirm primitives).
+ * @NL80211_CMD_DEAUTHENTICATE: deauthentication request and notification; like
+ *      NL80211_CMD_AUTHENTICATE but for Deauthentication frames (similar to
+ *      MLME-DEAUTHENTICATION.request and MLME-DEAUTHENTICATE.indication
+ *      primitives).
+ * @NL80211_CMD_DISASSOCIATE: disassociation request and notification; like
+ *      NL80211_CMD_AUTHENTICATE but for Disassociation frames (similar to
+ *      MLME-DISASSOCIATE.request and MLME-DISASSOCIATE.indication primitives).
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -206,7 +244,7 @@ enum nl80211_commands {
         NL80211_CMD_GET_MESH_PARAMS,
         NL80211_CMD_SET_MESH_PARAMS,
 
-        NL80211_CMD_SET_MGMT_EXTRA_IE,
+        NL80211_CMD_SET_MGMT_EXTRA_IE /* reserved; not used */,
 
         NL80211_CMD_GET_REG,
 
@@ -217,6 +255,11 @@ enum nl80211_commands {
 
         NL80211_CMD_REG_CHANGE,
 
+        NL80211_CMD_AUTHENTICATE,
+        NL80211_CMD_ASSOCIATE,
+        NL80211_CMD_DEAUTHENTICATE,
+        NL80211_CMD_DISASSOCIATE,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -230,8 +273,11 @@ enum nl80211_commands {
  */
 #define NL80211_CMD_SET_BSS NL80211_CMD_SET_BSS
 #define NL80211_CMD_SET_MGMT_EXTRA_IE NL80211_CMD_SET_MGMT_EXTRA_IE
-
 #define NL80211_CMD_REG_CHANGE NL80211_CMD_REG_CHANGE
+#define NL80211_CMD_AUTHENTICATE NL80211_CMD_AUTHENTICATE
+#define NL80211_CMD_ASSOCIATE NL80211_CMD_ASSOCIATE
+#define NL80211_CMD_DEAUTHENTICATE NL80211_CMD_DEAUTHENTICATE
+#define NL80211_CMD_DISASSOCIATE NL80211_CMD_DISASSOCIATE
 
 /**
  * enum nl80211_attrs - nl80211 netlink attributes
@@ -349,6 +395,19 @@ enum nl80211_commands {
  * @NL80211_ATTR_REG_TYPE: indicates the type of the regulatory domain currently
  *      set. This can be one of the nl80211_reg_type (%NL80211_REGDOM_TYPE_*)
  *
+ * @NL80211_ATTR_SUPPORTED_COMMANDS: wiphy attribute that specifies
+ *      an array of command numbers (i.e. a mapping index to command number)
+ *      that the driver for the given wiphy supports.
+ *
+ * @NL80211_ATTR_FRAME: frame data (binary attribute), including frame header
+ *      and body, but not FCS; used, e.g., with NL80211_CMD_AUTHENTICATE and
+ *      NL80211_CMD_ASSOCIATE events
+ * @NL80211_ATTR_SSID: SSID (binary attribute, 0..32 octets)
+ * @NL80211_ATTR_AUTH_TYPE: AuthenticationType, see &enum nl80211_auth_type,
+ *      represented as a u32
+ * @NL80211_ATTR_REASON_CODE: ReasonCode for %NL80211_CMD_DEAUTHENTICATE and
+ *      %NL80211_CMD_DISASSOCIATE, u16
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -426,6 +485,13 @@ enum nl80211_attrs {
         NL80211_ATTR_REG_INITIATOR,
         NL80211_ATTR_REG_TYPE,
 
+        NL80211_ATTR_SUPPORTED_COMMANDS,
+
+        NL80211_ATTR_FRAME,
+        NL80211_ATTR_SSID,
+        NL80211_ATTR_AUTH_TYPE,
+        NL80211_ATTR_REASON_CODE,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -445,6 +511,10 @@ enum nl80211_attrs {
 #define NL80211_ATTR_IE NL80211_ATTR_IE
 #define NL80211_ATTR_REG_INITIATOR NL80211_ATTR_REG_INITIATOR
 #define NL80211_ATTR_REG_TYPE NL80211_ATTR_REG_TYPE
+#define NL80211_ATTR_FRAME NL80211_ATTR_FRAME
+#define NL80211_ATTR_SSID NL80211_ATTR_SSID
+#define NL80211_ATTR_AUTH_TYPE NL80211_ATTR_AUTH_TYPE
+#define NL80211_ATTR_REASON_CODE NL80211_ATTR_REASON_CODE
 
 #define NL80211_MAX_SUPP_RATES                  32
 #define NL80211_MAX_SUPP_REG_RULES              32
@@ -978,4 +1048,18 @@ enum nl80211_bss {
         NL80211_BSS_MAX = __NL80211_BSS_AFTER_LAST - 1
 };
 
+/**
+ * enum nl80211_auth_type - AuthenticationType
+ *
+ * @NL80211_AUTHTYPE_OPEN_SYSTEM: Open System authentication
+ * @NL80211_AUTHTYPE_SHARED_KEY: Shared Key authentication (WEP only)
+ * @NL80211_AUTHTYPE_FT: Fast BSS Transition (IEEE 802.11r)
+ * @NL80211_AUTHTYPE_NETWORK_EAP: Network EAP (some Cisco APs and mainly LEAP)
+ */
+enum nl80211_auth_type {
+        NL80211_AUTHTYPE_OPEN_SYSTEM,
+        NL80211_AUTHTYPE_SHARED_KEY,
+        NL80211_AUTHTYPE_FT,
+        NL80211_AUTHTYPE_NETWORK_EAP,
+};
 #endif /* __LINUX_NL80211_H */
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 097f410edefa..05dfa7c4fb64 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2271,6 +2271,8 @@
 #define PCI_DEVICE_ID_KORENIX_JETCARDF0 0x1600
 #define PCI_DEVICE_ID_KORENIX_JETCARDF1 0x16ff
 
+#define PCI_VENDOR_ID_QMI               0x1a32
+
 #define PCI_VENDOR_ID_TEKRAM            0x1de1
 #define PCI_DEVICE_ID_TEKRAM_DC290      0xdc29
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 50f3fd9ff524..5389afdc1297 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -471,26 +471,6 @@ struct ieee80211_txq_params {
         u8 aifs;
 };
 
-/**
- * struct mgmt_extra_ie_params - Extra management frame IE parameters
- *
- * Used to add extra IE(s) into management frames. If the driver cannot add the
- * requested data into all management frames of the specified subtype that are
- * generated in kernel or firmware/hardware, it must reject the configuration
- * call. The IE data buffer is added to the end of the specified management
- * frame body after all other IEs. This addition is not applied to frames that
- * are injected through a monitor interface.
- *
- * @subtype: Management frame subtype
- * @ies: IE data buffer or %NULL to remove previous data
- * @ies_len: Length of @ies in octets
- */
-struct mgmt_extra_ie_params {
-        u8 subtype;
-        u8 *ies;
-        int ies_len;
-};
-
 /* from net/wireless.h */
 struct wiphy;
 
@@ -559,6 +539,7 @@ enum cfg80211_signal_type {
  *      is no guarantee that these are well-formed!)
  * @len_information_elements: total length of the information elements
  * @signal: signal strength value (type depends on the wiphy's signal_type)
+ * @hold: BSS should not expire
  * @free_priv: function pointer to free private data
  * @priv: private area for driver use, has at least wiphy->bss_priv_size bytes
  */
@@ -579,6 +560,105 @@ struct cfg80211_bss {
 };
 
 /**
+ * struct cfg80211_auth_request - Authentication request data
+ *
+ * This structure provides information needed to complete IEEE 802.11
+ * authentication.
+ * NOTE: This structure will likely change when more code from mac80211 is
+ * moved into cfg80211 so that non-mac80211 drivers can benefit from it, too.
+ * Before using this in a driver that does not use mac80211, it would be better
+ * to check the status of that work and better yet, volunteer to work on it.
+ *
+ * @chan: The channel to use or %NULL if not specified (auto-select based on
+ *      scan results)
+ * @peer_addr: The address of the peer STA (AP BSSID in infrastructure case);
+ *      this field is required to be present; if the driver wants to help with
+ *      BSS selection, it should use (yet to be added) MLME event to allow user
+ *      space SME to be notified of roaming candidate, so that the SME can then
+ *      use the authentication request with the recommended BSSID and whatever
+ *      other data may be needed for authentication/association
+ * @ssid: SSID or %NULL if not yet available
+ * @ssid_len: Length of ssid in octets
+ * @auth_type: Authentication type (algorithm)
+ * @ie: Extra IEs to add to Authentication frame or %NULL
+ * @ie_len: Length of ie buffer in octets
+ */
+struct cfg80211_auth_request {
+        struct ieee80211_channel *chan;
+        u8 *peer_addr;
+        const u8 *ssid;
+        size_t ssid_len;
+        enum nl80211_auth_type auth_type;
+        const u8 *ie;
+        size_t ie_len;
+};
+
+/**
+ * struct cfg80211_assoc_request - (Re)Association request data
+ *
+ * This structure provides information needed to complete IEEE 802.11
+ * (re)association.
+ * NOTE: This structure will likely change when more code from mac80211 is
+ * moved into cfg80211 so that non-mac80211 drivers can benefit from it, too.
+ * Before using this in a driver that does not use mac80211, it would be better
+ * to check the status of that work and better yet, volunteer to work on it.
+ *
+ * @chan: The channel to use or %NULL if not specified (auto-select based on
+ *      scan results)
+ * @peer_addr: The address of the peer STA (AP BSSID); this field is required
+ *      to be present and the STA must be in State 2 (authenticated) with the
+ *      peer STA
+ * @ssid: SSID
+ * @ssid_len: Length of ssid in octets
+ * @ie: Extra IEs to add to (Re)Association Request frame or %NULL
+ * @ie_len: Length of ie buffer in octets
+ */
+struct cfg80211_assoc_request {
+        struct ieee80211_channel *chan;
+        u8 *peer_addr;
+        const u8 *ssid;
+        size_t ssid_len;
+        const u8 *ie;
+        size_t ie_len;
+};
+
+/**
+ * struct cfg80211_deauth_request - Deauthentication request data
+ *
+ * This structure provides information needed to complete IEEE 802.11
+ * deauthentication.
+ *
+ * @peer_addr: The address of the peer STA (AP BSSID); this field is required
+ *      to be present and the STA must be authenticated with the peer STA
+ * @ie: Extra IEs to add to Deauthentication frame or %NULL
+ * @ie_len: Length of ie buffer in octets
+ */
+struct cfg80211_deauth_request {
+        u8 *peer_addr;
+        u16 reason_code;
+        const u8 *ie;
+        size_t ie_len;
+};
+
+/**
+ * struct cfg80211_disassoc_request - Disassociation request data
+ *
+ * This structure provides information needed to complete IEEE 802.11
+ * disassocation.
+ *
+ * @peer_addr: The address of the peer STA (AP BSSID); this field is required
+ *      to be present and the STA must be associated with the peer STA
+ * @ie: Extra IEs to add to Disassociation frame or %NULL
+ * @ie_len: Length of ie buffer in octets
+ */
+struct cfg80211_disassoc_request {
+        u8 *peer_addr;
+        u16 reason_code;
+        const u8 *ie;
+        size_t ie_len;
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -644,12 +724,15 @@ struct cfg80211_bss {
  *
  * @set_channel: Set channel
  *
- * @set_mgmt_extra_ie: Set extra IE data for management frames
- *
  * @scan: Request to do a scan. If returning zero, the scan request is given
  *      the driver, and will be valid until passed to cfg80211_scan_done().
  *      For scan results, call cfg80211_inform_bss(); you can call this outside
  *      the scan/scan_done bracket too.
+ *
+ * @auth: Request to authenticate with the specified peer
+ * @assoc: Request to (re)associate with the specified peer
+ * @deauth: Request to deauthenticate from the specified peer
+ * @disassoc: Request to disassociate from the specified peer
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy);
@@ -724,12 +807,17 @@ struct cfg80211_ops {
                                struct ieee80211_channel *chan,
                                enum nl80211_channel_type channel_type);
 
-        int     (*set_mgmt_extra_ie)(struct wiphy *wiphy,
-                                     struct net_device *dev,
-                                     struct mgmt_extra_ie_params *params);
-
         int     (*scan)(struct wiphy *wiphy, struct net_device *dev,
                         struct cfg80211_scan_request *request);
+
+        int     (*auth)(struct wiphy *wiphy, struct net_device *dev,
+                        struct cfg80211_auth_request *req);
+        int     (*assoc)(struct wiphy *wiphy, struct net_device *dev,
+                         struct cfg80211_assoc_request *req);
+        int     (*deauth)(struct wiphy *wiphy, struct net_device *dev,
+                          struct cfg80211_deauth_request *req);
+        int     (*disassoc)(struct wiphy *wiphy, struct net_device *dev,
+                            struct cfg80211_disassoc_request *req);
 };
 
 /* temporary wext handlers */
@@ -807,4 +895,67 @@ void cfg80211_put_bss(struct cfg80211_bss *bss);
  */
 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *bss);
 
+/**
+ * cfg80211_send_rx_auth - notification of processed authentication
+ * @dev: network device
+ * @buf: authentication frame (header + body)
+ * @len: length of the frame data
+ *
+ * This function is called whenever an authentication has been processed in
+ * station mode.
+ */
+void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
+
+/**
+ * cfg80211_send_rx_assoc - notification of processed association
+ * @dev: network device
+ * @buf: (re)association response frame (header + body)
+ * @len: length of the frame data
+ *
+ * This function is called whenever a (re)association response has been
+ * processed in station mode.
+ */
+void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len);
+
+/**
+ * cfg80211_send_rx_deauth - notification of processed deauthentication
+ * @dev: network device
+ * @buf: deauthentication frame (header + body)
+ * @len: length of the frame data
+ *
+ * This function is called whenever deauthentication has been processed in
+ * station mode.
+ */
+void cfg80211_send_rx_deauth(struct net_device *dev, const u8 *buf,
+                             size_t len);
+
+/**
+ * cfg80211_send_rx_disassoc - notification of processed disassociation
+ * @dev: network device
+ * @buf: disassociation response frame (header + body)
+ * @len: length of the frame data
+ *
+ * This function is called whenever disassociation has been processed in
+ * station mode.
+ */
+void cfg80211_send_rx_disassoc(struct net_device *dev, const u8 *buf,
+                               size_t len);
+
+/**
+ * cfg80211_hold_bss - exclude bss from expiration
+ * @bss: bss which should not expire
+ *
+ * In a case when the BSS is not updated but it shouldn't expire this
+ * function can be used to mark the BSS to be excluded from expiration.
+ */
+void cfg80211_hold_bss(struct cfg80211_bss *bss);
+
+/**
+ * cfg80211_unhold_bss - remove expiration exception from the BSS
+ * @bss: bss which can expire again
+ *
+ * This function marks the BSS to be expirable again.
+ */
+void cfg80211_unhold_bss(struct cfg80211_bss *bss);
+
 #endif /* __NET_CFG80211_H */
diff --git a/include/net/ethoc.h b/include/net/ethoc.h
new file mode 100644
index 000000000000..96f3789b27bc
--- /dev/null
+++ b/include/net/ethoc.h
@@ -0,0 +1,22 @@
+/*
+ * linux/include/net/ethoc.h
+ *
+ * Copyright (C) 2008-2009 Avionic Design GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Written by Thierry Reding <thierry.reding@avionic-design.de>
+ */
+
+#ifndef LINUX_NET_ETHOC_H
+#define LINUX_NET_ETHOC_H 1
+
+struct ethoc_platform_data {
+        u8 hwaddr[IFHWADDRLEN];
+        s8 phy_id;
+};
+
+#endif /* !LINUX_NET_ETHOC_H */
+
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index 384698cb773a..23c3f3d97779 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -230,8 +230,10 @@ enum ieee80211_radiotap_type {
                                                  * 802.11 header and payload
                                                  * (to 32-bit boundary)
                                                  */
+#define IEEE80211_RADIOTAP_F_BADFCS     0x40    /* bad FCS */
+
 /* For IEEE80211_RADIOTAP_RX_FLAGS */
-#define IEEE80211_RADIOTAP_F_RX_BADFCS  0x0001  /* frame failed crc check */
+#define IEEE80211_RADIOTAP_F_RX_BADPLCP 0x0002  /* frame has bad PLCP */
 
 /* For IEEE80211_RADIOTAP_TX_FLAGS */
 #define IEEE80211_RADIOTAP_F_TX_FAIL    0x0001  /* failed due to excessive
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 12a52efcd0d1..3b83a80e3fe0 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -93,12 +93,9 @@ struct ieee80211_ht_bss_info {
  * enum ieee80211_max_queues - maximum number of queues
  *
  * @IEEE80211_MAX_QUEUES: Maximum number of regular device queues.
- * @IEEE80211_MAX_AMPDU_QUEUES: Maximum number of queues usable
- *      for A-MPDU operation.
  */
 enum ieee80211_max_queues {
-        IEEE80211_MAX_QUEUES =          16,
-        IEEE80211_MAX_AMPDU_QUEUES =    16,
+        IEEE80211_MAX_QUEUES =          4,
 };
 
 /**
@@ -245,6 +242,12 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_RATE_CTRL_PROBE: internal to mac80211, can be
  *      set by rate control algorithms to indicate probe rate, will
  *      be cleared for fragmented frames (except on the last fragment)
+ * @IEEE80211_TX_INTFL_RCALGO: mac80211 internal flag, do not test or
+ *      set this flag in the driver; indicates that the rate control
+ *      algorithm was used and should be notified of TX status
+ * @IEEE80211_TX_INTFL_NEED_TXPROCESSING: completely internal to mac80211,
+ *      used to indicate that a pending frame requires TX processing before
+ *      it can be sent out.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -260,6 +263,8 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_STAT_AMPDU                 = BIT(10),
         IEEE80211_TX_STAT_AMPDU_NO_BACK         = BIT(11),
         IEEE80211_TX_CTL_RATE_CTRL_PROBE        = BIT(12),
+        IEEE80211_TX_INTFL_RCALGO               = BIT(13),
+        IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
 };
 
 /**
@@ -520,12 +525,6 @@ enum ieee80211_conf_flags {
         IEEE80211_CONF_PS               = (1<<1),
 };
 
-/* XXX: remove all this once drivers stop trying to use it */
-static inline int __deprecated __IEEE80211_CONF_SHORT_SLOT_TIME(void)
-{
-        return 0;
-}
-#define IEEE80211_CONF_SHORT_SLOT_TIME (__IEEE80211_CONF_SHORT_SLOT_TIME())
 
 /**
  * enum ieee80211_conf_changed - denotes which configuration changed
@@ -888,6 +887,10 @@ enum ieee80211_tkip_key_type {
  *
  * @IEEE80211_HW_MFP_CAPABLE:
  *      Hardware supports management frame protection (MFP, IEEE 802.11w).
+ *
+ * @IEEE80211_HW_BEACON_FILTER:
+ *      Hardware supports dropping of irrelevant beacon frames to
+ *      avoid waking up cpu.
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_RX_INCLUDES_FCS                    = 1<<1,
@@ -903,6 +906,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_PS_NULLFUNC_STACK                  = 1<<11,
         IEEE80211_HW_SUPPORTS_DYNAMIC_PS                = 1<<12,
         IEEE80211_HW_MFP_CAPABLE                        = 1<<13,
+        IEEE80211_HW_BEACON_FILTER                      = 1<<14,
 };
 
 /**
@@ -945,12 +949,6 @@ enum ieee80211_hw_flags {
  *      data packets. WMM/QoS requires at least four, these
  *      queues need to have configurable access parameters.
  *
- * @ampdu_queues: number of available hardware transmit queues
- *      for A-MPDU packets, these have no access parameters
- *      because they're used only for A-MPDU frames. Note that
- *      mac80211 will not currently use any of the regular queues
- *      for aggregation.
- *
  * @rate_control_algorithm: rate control algorithm for this hardware.
  *      If unset (NULL), the default algorithm will be used. Must be
  *      set before calling ieee80211_register_hw().
@@ -975,7 +973,6 @@ struct ieee80211_hw {
         int vif_data_size;
         int sta_data_size;
         u16 queues;
-        u16 ampdu_queues;
         u16 max_listen_interval;
         s8 max_signal;
         u8 max_rates;
@@ -1017,11 +1014,6 @@ static inline void SET_IEEE80211_PERM_ADDR(struct ieee80211_hw *hw, u8 *addr)
         memcpy(hw->wiphy->perm_addr, addr, ETH_ALEN);
 }
 
-static inline int ieee80211_num_regular_queues(struct ieee80211_hw *hw)
-{
-        return hw->queues;
-}
-
 static inline struct ieee80211_rate *
 ieee80211_get_tx_rate(const struct ieee80211_hw *hw,
                       const struct ieee80211_tx_info *c)
@@ -1132,6 +1124,24 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  */
 
 /**
+ * DOC: Beacon filter support
+ *
+ * Some hardware have beacon filter support to reduce host cpu wakeups
+ * which will reduce system power consumption. It usuallly works so that
+ * the firmware creates a checksum of the beacon but omits all constantly
+ * changing elements (TSF, TIM etc). Whenever the checksum changes the
+ * beacon is forwarded to the host, otherwise it will be just dropped. That
+ * way the host will only receive beacons where some relevant information
+ * (for example ERP protection or WMM settings) have changed.
+ *
+ * Beacon filter support is informed with %IEEE80211_HW_BEACON_FILTER flag.
+ * The driver needs to enable beacon filter support whenever power save is
+ * enabled, that is %IEEE80211_CONF_PS is set. When power save is enabled,
+ * the stack will not check for beacon miss at all and the driver needs to
+ * notify about complete loss of beacons with ieee80211_beacon_loss().
+ */
+
+/**
  * DOC: Frame filtering
  *
  * mac80211 requires to see many management frames for proper
@@ -1220,14 +1230,14 @@ enum ieee80211_filter_flags {
  * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation
  * @IEEE80211_AMPDU_TX_START: start Tx aggregation
  * @IEEE80211_AMPDU_TX_STOP: stop Tx aggregation
- * @IEEE80211_AMPDU_TX_RESUME: resume TX aggregation
+ * @IEEE80211_AMPDU_TX_OPERATIONAL: TX aggregation has become operational
  */
 enum ieee80211_ampdu_mlme_action {
         IEEE80211_AMPDU_RX_START,
         IEEE80211_AMPDU_RX_STOP,
         IEEE80211_AMPDU_TX_START,
         IEEE80211_AMPDU_TX_STOP,
-        IEEE80211_AMPDU_TX_RESUME,
+        IEEE80211_AMPDU_TX_OPERATIONAL,
 };
 
 /**
@@ -1318,11 +1328,13 @@ enum ieee80211_ampdu_mlme_action {
  *
  * @hw_scan: Ask the hardware to service the scan request, no need to start
  *      the scan state machine in stack. The scan must honour the channel
- *      configuration done by the regulatory agent in the wiphy's registered
- *      bands. When the scan finishes, ieee80211_scan_completed() must be
- *      called; note that it also must be called when the scan cannot finish
- *      because the hardware is turned off! Anything else is a bug!
- *      Returns a negative error code which will be seen in userspace.
+ *      configuration done by the regulatory agent in the wiphy's
+ *      registered bands. The hardware (or the driver) needs to make sure
+ *      that power save is disabled. When the scan finishes,
+ *      ieee80211_scan_completed() must be called; note that it also must
+ *      be called when the scan cannot finish because the hardware is
+ *      turned off! Anything else is a bug! Returns a negative error code
+ *      which will be seen in userspace.
  *
  * @sw_scan_start: Notifier function that is called just before a software scan
  *      is started. Can be NULL, if the driver doesn't need this notification.
@@ -1350,8 +1362,8 @@ enum ieee80211_ampdu_mlme_action {
  * @get_tx_stats: Get statistics of the current TX queue status. This is used
  *      to get number of currently queued packets (queue length), maximum queue
  *      size (limit), and total number of packets sent using each TX queue
- *      (count). The 'stats' pointer points to an array that has hw->queues +
- *      hw->ampdu_queues items.
+ *      (count). The 'stats' pointer points to an array that has hw->queues
+ *      items.
  *
  * @get_tsf: Get the current TSF timer value from firmware/hardware. Currently,
  *      this is only used for IBSS mode BSSID merging and debugging. Is not a
@@ -1979,6 +1991,16 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw, const u8 *ra,
 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_hw *hw,
                                          const u8 *addr);
 
+/**
+ * ieee80211_beacon_loss - inform hardware does not receive beacons
+ *
+ * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
+ *
+ * When beacon filtering is enabled with IEEE80211_HW_BEACON_FILTERING and
+ * IEEE80211_CONF_PS is set, the driver needs to inform whenever the
+ * hardware is not receiving beacons with this function.
+ */
+void ieee80211_beacon_loss(struct ieee80211_vif *vif);
 
 /* Rate control API */
 
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 4dfb793c3f15..6c3f964de9e1 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -91,8 +91,7 @@ struct nf_conn_help {
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 
-struct nf_conn
-{
+struct nf_conn {
         /* Usage count in here is 1 for hash table/destruct timer, 1 per skb,
            plus 1 for any connection(s) we are `master' for */
         struct nf_conntrack ct_general;
@@ -126,7 +125,6 @@ struct nf_conn
 #ifdef CONFIG_NET_NS
         struct net *ct_net;
 #endif
-        struct rcu_head rcu;
 };
 
 static inline struct nf_conn *
@@ -190,9 +188,13 @@ static inline void nf_ct_put(struct nf_conn *ct)
 extern int nf_ct_l3proto_try_module_get(unsigned short l3proto);
 extern void nf_ct_l3proto_module_put(unsigned short l3proto);
 
-extern struct hlist_head *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced);
-extern void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced,
-                                 unsigned int size);
+/*
+ * Allocate a hashtable of hlist_head (if nulls == 0),
+ * or hlist_nulls_head (if nulls == 1)
+ */
+extern void *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced, int nulls);
+
+extern void nf_ct_free_hashtable(void *hash, int vmalloced, unsigned int size);
 
 extern struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple);
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index 66d65a7caa39..ee2a4b369a04 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -14,6 +14,8 @@
 
 struct module;
 
+#define NF_CT_HELPER_NAME_LEN   16
+
 struct nf_conntrack_helper
 {
         struct hlist_node hnode;        /* Internal use. */
diff --git a/include/net/netfilter/nf_conntrack_l3proto.h b/include/net/netfilter/nf_conntrack_l3proto.h
index 0378676c3dd8..9f99d36d5de9 100644
--- a/include/net/netfilter/nf_conntrack_l3proto.h
+++ b/include/net/netfilter/nf_conntrack_l3proto.h
@@ -53,10 +53,17 @@ struct nf_conntrack_l3proto
         int (*tuple_to_nlattr)(struct sk_buff *skb,
                                const struct nf_conntrack_tuple *t);
 
+        /*
+         * Calculate size of tuple nlattr
+         */
+        int (*nlattr_tuple_size)(void);
+
         int (*nlattr_to_tuple)(struct nlattr *tb[],
                                struct nf_conntrack_tuple *t);
         const struct nla_policy *nla_policy;
 
+        size_t nla_size;
+
 #ifdef CONFIG_SYSCTL
         struct ctl_table_header *ctl_table_header;
         struct ctl_path         *ctl_table_path;
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index b01070bf2f84..ba32ed7bdabe 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -64,16 +64,22 @@ struct nf_conntrack_l4proto
         /* convert protoinfo to nfnetink attributes */
         int (*to_nlattr)(struct sk_buff *skb, struct nlattr *nla,
                          const struct nf_conn *ct);
+        /* Calculate protoinfo nlattr size */
+        int (*nlattr_size)(void);
 
         /* convert nfnetlink attributes to protoinfo */
         int (*from_nlattr)(struct nlattr *tb[], struct nf_conn *ct);
 
         int (*tuple_to_nlattr)(struct sk_buff *skb,
                                const struct nf_conntrack_tuple *t);
+        /* Calculate tuple nlattr size */
+        int (*nlattr_tuple_size)(void);
         int (*nlattr_to_tuple)(struct nlattr *tb[],
                                struct nf_conntrack_tuple *t);
         const struct nla_policy *nla_policy;
 
+        size_t nla_size;
+
 #ifdef CONFIG_SYSCTL
         struct ctl_table_header **ctl_table_header;
         struct ctl_table        *ctl_table;
@@ -107,6 +113,7 @@ extern int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
                                       const struct nf_conntrack_tuple *tuple);
 extern int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
                                       struct nf_conntrack_tuple *t);
+extern int nf_ct_port_nlattr_tuple_size(void);
 extern const struct nla_policy nf_ct_port_nla_policy[];
 
 #ifdef CONFIG_SYSCTL
diff --git a/include/net/netfilter/nf_conntrack_tuple.h b/include/net/netfilter/nf_conntrack_tuple.h
index f2f6aa73dc10..2628c154d40e 100644
--- a/include/net/netfilter/nf_conntrack_tuple.h
+++ b/include/net/netfilter/nf_conntrack_tuple.h
@@ -12,6 +12,7 @@
 
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/nf_conntrack_tuple_common.h>
+#include <linux/list_nulls.h>
 
 /* A `tuple' is a structure containing the information to uniquely
   identify a connection.  ie. if two packets have the same tuple, they
@@ -146,9 +147,8 @@ static inline void nf_ct_dump_tuple(const struct nf_conntrack_tuple *t)
         ((enum ip_conntrack_dir)(h)->tuple.dst.dir)
 
 /* Connections have two entries in the hash table: one for each way */
-struct nf_conntrack_tuple_hash
-{
-        struct hlist_node hnode;
+struct nf_conntrack_tuple_hash {
+        struct hlist_nulls_node hnnode;
         struct nf_conntrack_tuple tuple;
 };
 
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 8a6150a3f4c7..eddb50289d6d 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -230,6 +230,7 @@ extern int		nla_validate(struct nlattr *head, int len, int maxtype,
 extern int              nla_parse(struct nlattr *tb[], int maxtype,
                                   struct nlattr *head, int len,
                                   const struct nla_policy *policy);
+extern int              nla_policy_len(const struct nla_policy *, int);
 extern struct nlattr *  nla_find(struct nlattr *head, int len, int attrtype);
 extern size_t           nla_strlcpy(char *dst, const struct nlattr *nla,
                                     size_t dstsize);
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index f4498a62881b..9dc58402bc09 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -2,6 +2,7 @@
 #define __NETNS_CONNTRACK_H
 
 #include <linux/list.h>
+#include <linux/list_nulls.h>
 #include <asm/atomic.h>
 
 struct ctl_table_header;
@@ -10,9 +11,9 @@ struct nf_conntrack_ecache;
 struct netns_ct {
         atomic_t                count;
         unsigned int            expect_count;
-        struct hlist_head       *hash;
+        struct hlist_nulls_head *hash;
         struct hlist_head       *expect_hash;
-        struct hlist_head       unconfirmed;
+        struct hlist_nulls_head unconfirmed;
         struct ip_conntrack_stat *stat;
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
         struct nf_conntrack_ecache *ecache;