Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:
 "Here is my initial pull request for the networking subsystem during
  this merge window:

   1) Support for ESN in AH (RFC 4302) from Fan Du.

   2) Add full kernel doc for ethtool command structures, from Ben
      Hutchings.

   3) Add BCM7xxx PHY driver, from Florian Fainelli.

   4) Export computed TCP rate information in netlink socket dumps, from
      Eric Dumazet.

   5) Allow IPSEC SA to be dumped partially using a filter, from Nicolas
      Dichtel.

   6) Convert many drivers to pci_enable_msix_range(), from Alexander
      Gordeev.

   7) Record SKB timestamps more efficiently, from Eric Dumazet.

   8) Switch to microsecond resolution for TCP round trip times, also
      from Eric Dumazet.

   9) Clean up and fix 6lowpan fragmentation handling by making use of
      the existing inet_frag api for it's implementation.

  10) Add TX grant mapping to xen-netback driver, from Zoltan Kiss.

  11) Auto size SKB lengths when composing netlink messages based upon
      past message sizes used, from Eric Dumazet.

  12) qdisc dumps can take a long time, add a cond_resched(), From Eric
      Dumazet.

  13) Sanitize netpoll core and drivers wrt.  SKB handling semantics.
      Get rid of never-used-in-tree netpoll RX handling.  From Eric W
      Biederman.

  14) Support inter-address-family and namespace changing in VTI tunnel
      driver(s).  From Steffen Klassert.

  15) Add Altera TSE driver, from Vince Bridgers.

  16) Optimizing csum_replace2() so that it doesn't adjust the checksum
      by checksumming the entire header, from Eric Dumazet.

  17) Expand BPF internal implementation for faster interpreting, more
      direct translations into JIT'd code, and much cleaner uses of BPF
      filtering in non-socket ocntexts.  From Daniel Borkmann and Alexei
      Starovoitov"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1976 commits)
  netpoll: Use skb_irq_freeable to make zap_completion_queue safe.
  net: Add a test to see if a skb is freeable in irq context
  qlcnic: Fix build failure due to undefined reference to `vxlan_get_rx_port'
  net: ptp: move PTP classifier in its own file
  net: sxgbe: make "core_ops" static
  net: sxgbe: fix logical vs bitwise operation
  net: sxgbe: sxgbe_mdio_register() frees the bus
  Call efx_set_channels() before efx->type->dimension_resources()
  xen-netback: disable rogue vif in kthread context
  net/mlx4: Set proper build dependancy with vxlan
  be2net: fix build dependency on VxLAN
  mac802154: make csma/cca parameters per-wpan
  mac802154: allow only one WPAN to be up at any given time
  net: filter: minor: fix kdoc in __sk_run_filter
  netlink: don't compare the nul-termination in nla_strcmp
  can: c_can: Avoid led toggling for every packet.
  can: c_can: Simplify TX interrupt cleanup
  can: c_can: Store dlc private
  can: c_can: Reduce register access
  can: c_can: Make the code readable
  ...

49 files changed, 1478 insertions, 289 deletions

diff --git a/include/net/6lowpan.h b/include/net/6lowpan.h
new file mode 100644
index 000000000000..f7d372b7d4ff
--- /dev/null
+++ b/include/net/6lowpan.h
@@ -0,0 +1,434 @@
+/*
+ * Copyright 2011, Siemens AG
+ * written by Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ */
+
+/*
+ * Based on patches from Jon Smirl <jonsmirl@gmail.com>
+ * Copyright (c) 2011 Jon Smirl <jonsmirl@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/* Jon's code is based on 6lowpan implementation for Contiki which is:
+ * Copyright (c) 2008, Swedish Institute of Computer Science.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef __6LOWPAN_H__
+#define __6LOWPAN_H__
+
+#include <net/ipv6.h>
+
+#define UIP_802154_SHORTADDR_LEN        2  /* compressed ipv6 address length */
+#define UIP_IPH_LEN                     40 /* ipv6 fixed header size */
+#define UIP_PROTO_UDP                   17 /* ipv6 next header value for UDP */
+#define UIP_FRAGH_LEN                   8  /* ipv6 fragment header size */
+
+/*
+ * ipv6 address based on mac
+ * second bit-flip (Universe/Local) is done according RFC2464
+ */
+#define is_addr_mac_addr_based(a, m) \
+        ((((a)->s6_addr[8])  == (((m)[0]) ^ 0x02)) &&   \
+         (((a)->s6_addr[9])  == (m)[1]) &&              \
+         (((a)->s6_addr[10]) == (m)[2]) &&              \
+         (((a)->s6_addr[11]) == (m)[3]) &&              \
+         (((a)->s6_addr[12]) == (m)[4]) &&              \
+         (((a)->s6_addr[13]) == (m)[5]) &&              \
+         (((a)->s6_addr[14]) == (m)[6]) &&              \
+         (((a)->s6_addr[15]) == (m)[7]))
+
+/* ipv6 address is unspecified */
+#define is_addr_unspecified(a)          \
+        ((((a)->s6_addr32[0]) == 0) &&  \
+         (((a)->s6_addr32[1]) == 0) &&  \
+         (((a)->s6_addr32[2]) == 0) &&  \
+         (((a)->s6_addr32[3]) == 0))
+
+/* compare ipv6 addresses prefixes */
+#define ipaddr_prefixcmp(addr1, addr2, length) \
+        (memcmp(addr1, addr2, length >> 3) == 0)
+
+/* local link, i.e. FE80::/10 */
+#define is_addr_link_local(a) (((a)->s6_addr16[0]) == htons(0xFE80))
+
+/*
+ * check whether we can compress the IID to 16 bits,
+ * it's possible for unicast adresses with first 49 bits are zero only.
+ */
+#define lowpan_is_iid_16_bit_compressable(a)    \
+        ((((a)->s6_addr16[4]) == 0) &&          \
+         (((a)->s6_addr[10]) == 0) &&           \
+         (((a)->s6_addr[11]) == 0xff) &&        \
+         (((a)->s6_addr[12]) == 0xfe) &&        \
+         (((a)->s6_addr[13]) == 0))
+
+/* multicast address */
+#define is_addr_mcast(a) (((a)->s6_addr[0]) == 0xFF)
+
+/* check whether the 112-bit gid of the multicast address is mappable to: */
+
+/* 9 bits, for FF02::1 (all nodes) and FF02::2 (all routers) addresses only. */
+#define lowpan_is_mcast_addr_compressable(a)    \
+        ((((a)->s6_addr16[1]) == 0) &&          \
+         (((a)->s6_addr16[2]) == 0) &&          \
+         (((a)->s6_addr16[3]) == 0) &&          \
+         (((a)->s6_addr16[4]) == 0) &&          \
+         (((a)->s6_addr16[5]) == 0) &&          \
+         (((a)->s6_addr16[6]) == 0) &&          \
+         (((a)->s6_addr[14])  == 0) &&          \
+         ((((a)->s6_addr[15]) == 1) || (((a)->s6_addr[15]) == 2)))
+
+/* 48 bits, FFXX::00XX:XXXX:XXXX */
+#define lowpan_is_mcast_addr_compressable48(a)  \
+        ((((a)->s6_addr16[1]) == 0) &&          \
+         (((a)->s6_addr16[2]) == 0) &&          \
+         (((a)->s6_addr16[3]) == 0) &&          \
+         (((a)->s6_addr16[4]) == 0) &&          \
+         (((a)->s6_addr[10]) == 0))
+
+/* 32 bits, FFXX::00XX:XXXX */
+#define lowpan_is_mcast_addr_compressable32(a)  \
+        ((((a)->s6_addr16[1]) == 0) &&          \
+         (((a)->s6_addr16[2]) == 0) &&          \
+         (((a)->s6_addr16[3]) == 0) &&          \
+         (((a)->s6_addr16[4]) == 0) &&          \
+         (((a)->s6_addr16[5]) == 0) &&          \
+         (((a)->s6_addr[12]) == 0))
+
+/* 8 bits, FF02::00XX */
+#define lowpan_is_mcast_addr_compressable8(a)   \
+        ((((a)->s6_addr[1])  == 2) &&           \
+         (((a)->s6_addr16[1]) == 0) &&          \
+         (((a)->s6_addr16[2]) == 0) &&          \
+         (((a)->s6_addr16[3]) == 0) &&          \
+         (((a)->s6_addr16[4]) == 0) &&          \
+         (((a)->s6_addr16[5]) == 0) &&          \
+         (((a)->s6_addr16[6]) == 0) &&          \
+         (((a)->s6_addr[14]) == 0))
+
+#define lowpan_is_addr_broadcast(a)     \
+        ((((a)[0]) == 0xFF) &&  \
+         (((a)[1]) == 0xFF) &&  \
+         (((a)[2]) == 0xFF) &&  \
+         (((a)[3]) == 0xFF) &&  \
+         (((a)[4]) == 0xFF) &&  \
+         (((a)[5]) == 0xFF) &&  \
+         (((a)[6]) == 0xFF) &&  \
+         (((a)[7]) == 0xFF))
+
+#define LOWPAN_DISPATCH_IPV6    0x41 /* 01000001 = 65 */
+#define LOWPAN_DISPATCH_HC1     0x42 /* 01000010 = 66 */
+#define LOWPAN_DISPATCH_IPHC    0x60 /* 011xxxxx = ... */
+#define LOWPAN_DISPATCH_FRAG1   0xc0 /* 11000xxx */
+#define LOWPAN_DISPATCH_FRAGN   0xe0 /* 11100xxx */
+
+#define LOWPAN_DISPATCH_MASK    0xf8 /* 11111000 */
+
+#define LOWPAN_FRAG_TIMEOUT     (HZ * 60)       /* time-out 60 sec */
+
+#define LOWPAN_FRAG1_HEAD_SIZE  0x4
+#define LOWPAN_FRAGN_HEAD_SIZE  0x5
+
+/*
+ * According IEEE802.15.4 standard:
+ *   - MTU is 127 octets
+ *   - maximum MHR size is 37 octets
+ *   - MFR size is 2 octets
+ *
+ * so minimal payload size that we may guarantee is:
+ *   MTU - MHR - MFR = 88 octets
+ */
+#define LOWPAN_FRAG_SIZE        88
+
+/*
+ * Values of fields within the IPHC encoding first byte
+ * (C stands for compressed and I for inline)
+ */
+#define LOWPAN_IPHC_TF          0x18
+
+#define LOWPAN_IPHC_FL_C        0x10
+#define LOWPAN_IPHC_TC_C        0x08
+#define LOWPAN_IPHC_NH_C        0x04
+#define LOWPAN_IPHC_TTL_1       0x01
+#define LOWPAN_IPHC_TTL_64      0x02
+#define LOWPAN_IPHC_TTL_255     0x03
+#define LOWPAN_IPHC_TTL_I       0x00
+
+
+/* Values of fields within the IPHC encoding second byte */
+#define LOWPAN_IPHC_CID         0x80
+
+#define LOWPAN_IPHC_ADDR_00     0x00
+#define LOWPAN_IPHC_ADDR_01     0x01
+#define LOWPAN_IPHC_ADDR_02     0x02
+#define LOWPAN_IPHC_ADDR_03     0x03
+
+#define LOWPAN_IPHC_SAC         0x40
+#define LOWPAN_IPHC_SAM         0x30
+
+#define LOWPAN_IPHC_SAM_BIT     4
+
+#define LOWPAN_IPHC_M           0x08
+#define LOWPAN_IPHC_DAC         0x04
+#define LOWPAN_IPHC_DAM_00      0x00
+#define LOWPAN_IPHC_DAM_01      0x01
+#define LOWPAN_IPHC_DAM_10      0x02
+#define LOWPAN_IPHC_DAM_11      0x03
+
+#define LOWPAN_IPHC_DAM_BIT     0
+/*
+ * LOWPAN_UDP encoding (works together with IPHC)
+ */
+#define LOWPAN_NHC_UDP_MASK             0xF8
+#define LOWPAN_NHC_UDP_ID               0xF0
+#define LOWPAN_NHC_UDP_CHECKSUMC        0x04
+#define LOWPAN_NHC_UDP_CHECKSUMI        0x00
+
+#define LOWPAN_NHC_UDP_4BIT_PORT        0xF0B0
+#define LOWPAN_NHC_UDP_4BIT_MASK        0xFFF0
+#define LOWPAN_NHC_UDP_8BIT_PORT        0xF000
+#define LOWPAN_NHC_UDP_8BIT_MASK        0xFF00
+
+/* values for port compression, _with checksum_ ie bit 5 set to 0 */
+#define LOWPAN_NHC_UDP_CS_P_00  0xF0 /* all inline */
+#define LOWPAN_NHC_UDP_CS_P_01  0xF1 /* source 16bit inline,
+                                        dest = 0xF0 + 8 bit inline */
+#define LOWPAN_NHC_UDP_CS_P_10  0xF2 /* source = 0xF0 + 8bit inline,
+                                        dest = 16 bit inline */
+#define LOWPAN_NHC_UDP_CS_P_11  0xF3 /* source & dest = 0xF0B + 4bit inline */
+#define LOWPAN_NHC_UDP_CS_C     0x04 /* checksum elided */
+
+#ifdef DEBUG
+/* print data in line */
+static inline void raw_dump_inline(const char *caller, char *msg,
+                                   unsigned char *buf, int len)
+{
+        if (msg)
+                pr_debug("%s():%s: ", caller, msg);
+
+        print_hex_dump_debug("", DUMP_PREFIX_NONE, 16, 1, buf, len, false);
+}
+
+/* print data in a table format:
+ *
+ * addr: xx xx xx xx xx xx
+ * addr: xx xx xx xx xx xx
+ * ...
+ */
+static inline void raw_dump_table(const char *caller, char *msg,
+                                  unsigned char *buf, int len)
+{
+        if (msg)
+                pr_debug("%s():%s:\n", caller, msg);
+
+        print_hex_dump_debug("\t", DUMP_PREFIX_OFFSET, 16, 1, buf, len, false);
+}
+#else
+static inline void raw_dump_table(const char *caller, char *msg,
+                                  unsigned char *buf, int len) { }
+static inline void raw_dump_inline(const char *caller, char *msg,
+                                   unsigned char *buf, int len) { }
+#endif
+
+static inline int lowpan_fetch_skb_u8(struct sk_buff *skb, u8 *val)
+{
+        if (unlikely(!pskb_may_pull(skb, 1)))
+                return -EINVAL;
+
+        *val = skb->data[0];
+        skb_pull(skb, 1);
+
+        return 0;
+}
+
+static inline int lowpan_fetch_skb_u16(struct sk_buff *skb, u16 *val)
+{
+        if (unlikely(!pskb_may_pull(skb, 2)))
+                return -EINVAL;
+
+        *val = (skb->data[0] << 8) | skb->data[1];
+        skb_pull(skb, 2);
+
+        return 0;
+}
+
+static inline bool lowpan_fetch_skb(struct sk_buff *skb,
+                void *data, const unsigned int len)
+{
+        if (unlikely(!pskb_may_pull(skb, len)))
+                return true;
+
+        skb_copy_from_linear_data(skb, data, len);
+        skb_pull(skb, len);
+
+        return false;
+}
+
+static inline void lowpan_push_hc_data(u8 **hc_ptr, const void *data,
+                                       const size_t len)
+{
+        memcpy(*hc_ptr, data, len);
+        *hc_ptr += len;
+}
+
+static inline u8 lowpan_addr_mode_size(const u8 addr_mode)
+{
+        static const u8 addr_sizes[] = {
+                [LOWPAN_IPHC_ADDR_00] = 16,
+                [LOWPAN_IPHC_ADDR_01] = 8,
+                [LOWPAN_IPHC_ADDR_02] = 2,
+                [LOWPAN_IPHC_ADDR_03] = 0,
+        };
+        return addr_sizes[addr_mode];
+}
+
+static inline u8 lowpan_next_hdr_size(const u8 h_enc, u16 *uncomp_header)
+{
+        u8 ret = 1;
+
+        if ((h_enc & LOWPAN_NHC_UDP_MASK) == LOWPAN_NHC_UDP_ID) {
+                *uncomp_header += sizeof(struct udphdr);
+
+                switch (h_enc & LOWPAN_NHC_UDP_CS_P_11) {
+                case LOWPAN_NHC_UDP_CS_P_00:
+                        ret += 4;
+                        break;
+                case LOWPAN_NHC_UDP_CS_P_01:
+                case LOWPAN_NHC_UDP_CS_P_10:
+                        ret += 3;
+                        break;
+                case LOWPAN_NHC_UDP_CS_P_11:
+                        ret++;
+                        break;
+                default:
+                        break;
+                }
+
+                if (!(h_enc & LOWPAN_NHC_UDP_CS_C))
+                        ret += 2;
+        }
+
+        return ret;
+}
+
+/**
+ *      lowpan_uncompress_size - returns skb->len size with uncompressed header
+ *      @skb: sk_buff with 6lowpan header inside
+ *      @datagram_offset: optional to get the datagram_offset value
+ *
+ *      Returns the skb->len with uncompressed header
+ */
+static inline u16
+lowpan_uncompress_size(const struct sk_buff *skb, u16 *dgram_offset)
+{
+        u16 ret = 2, uncomp_header = sizeof(struct ipv6hdr);
+        u8 iphc0, iphc1, h_enc;
+
+        iphc0 = skb_network_header(skb)[0];
+        iphc1 = skb_network_header(skb)[1];
+
+        switch ((iphc0 & LOWPAN_IPHC_TF) >> 3) {
+        case 0:
+                ret += 4;
+                break;
+        case 1:
+                ret += 3;
+                break;
+        case 2:
+                ret++;
+                break;
+        default:
+                break;
+        }
+
+        if (!(iphc0 & LOWPAN_IPHC_NH_C))
+                ret++;
+
+        if (!(iphc0 & 0x03))
+                ret++;
+
+        ret += lowpan_addr_mode_size((iphc1 & LOWPAN_IPHC_SAM) >>
+                                     LOWPAN_IPHC_SAM_BIT);
+
+        if (iphc1 & LOWPAN_IPHC_M) {
+                switch ((iphc1 & LOWPAN_IPHC_DAM_11) >>
+                        LOWPAN_IPHC_DAM_BIT) {
+                case LOWPAN_IPHC_DAM_00:
+                        ret += 16;
+                        break;
+                case LOWPAN_IPHC_DAM_01:
+                        ret += 6;
+                        break;
+                case LOWPAN_IPHC_DAM_10:
+                        ret += 4;
+                        break;
+                case LOWPAN_IPHC_DAM_11:
+                        ret++;
+                        break;
+                default:
+                        break;
+                }
+        } else {
+                ret += lowpan_addr_mode_size((iphc1 & LOWPAN_IPHC_DAM_11) >>
+                                             LOWPAN_IPHC_DAM_BIT);
+        }
+
+        if (iphc0 & LOWPAN_IPHC_NH_C) {
+                h_enc = skb_network_header(skb)[ret];
+                ret += lowpan_next_hdr_size(h_enc, &uncomp_header);
+        }
+
+        if (dgram_offset)
+                *dgram_offset = uncomp_header;
+
+        return skb->len + uncomp_header - ret;
+}
+
+typedef int (*skb_delivery_cb)(struct sk_buff *skb, struct net_device *dev);
+
+int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
+                const u8 *saddr, const u8 saddr_type, const u8 saddr_len,
+                const u8 *daddr, const u8 daddr_type, const u8 daddr_len,
+                u8 iphc0, u8 iphc1, skb_delivery_cb skb_deliver);
+int lowpan_header_compress(struct sk_buff *skb, struct net_device *dev,
+                        unsigned short type, const void *_daddr,
+                        const void *_saddr, unsigned int len);
+
+#endif /* __6LOWPAN_H__ */
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 788d8378e587..3ee4c92afd1b 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -89,7 +89,7 @@ struct tc_action_ops {
         struct module           *owner;
         int     (*act)(struct sk_buff *, const struct tc_action *, struct tcf_result *);
         int     (*dump)(struct sk_buff *, struct tc_action *, int, int);
-        int     (*cleanup)(struct tc_action *, int bind);
+        void    (*cleanup)(struct tc_action *, int bind);
         int     (*lookup)(struct tc_action *, u32);
         int     (*init)(struct net *net, struct nlattr *nla,
                         struct nlattr *est, struct tc_action *act, int ovr,
@@ -98,20 +98,18 @@ struct tc_action_ops {
 };
 
 int tcf_hash_search(struct tc_action *a, u32 index);
-void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo);
-int tcf_hash_release(struct tcf_common *p, int bind,
-                     struct tcf_hashinfo *hinfo);
+void tcf_hash_destroy(struct tc_action *a);
+int tcf_hash_release(struct tc_action *a, int bind);
 u32 tcf_hash_new_index(struct tcf_hashinfo *hinfo);
-struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a,
-                                  int bind);
-struct tcf_common *tcf_hash_create(u32 index, struct nlattr *est,
-                                   struct tc_action *a, int size,
-                                   int bind);
-void tcf_hash_insert(struct tcf_common *p, struct tcf_hashinfo *hinfo);
+int tcf_hash_check(u32 index, struct tc_action *a, int bind);
+int tcf_hash_create(u32 index, struct nlattr *est, struct tc_action *a,
+                    int size, int bind);
+void tcf_hash_cleanup(struct tc_action *a, struct nlattr *est);
+void tcf_hash_insert(struct tc_action *a);
 
-int tcf_register_action(struct tc_action_ops *a);
+int tcf_register_action(struct tc_action_ops *a, unsigned int mask);
 int tcf_unregister_action(struct tc_action_ops *a);
-void tcf_action_destroy(struct list_head *actions, int bind);
+int tcf_action_destroy(struct list_head *actions, int bind);
 int tcf_action_exec(struct sk_buff *skb, const struct list_head *actions,
                     struct tcf_result *res);
 int tcf_action_init(struct net *net, struct nlattr *nla,
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 50e39a8822b4..933a9f22a05f 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -314,7 +314,7 @@ static inline bool ipv6_addr_is_multicast(const struct in6_addr *addr)
 static inline bool ipv6_addr_is_ll_all_nodes(const struct in6_addr *addr)
 {
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
-        __u64 *p = (__u64 *)addr;
+        __be64 *p = (__be64 *)addr;
         return ((p[0] ^ cpu_to_be64(0xff02000000000000UL)) | (p[1] ^ cpu_to_be64(1))) == 0UL;
 #else
         return ((addr->s6_addr32[0] ^ htonl(0xff020000)) |
@@ -326,7 +326,7 @@ static inline bool ipv6_addr_is_ll_all_nodes(const struct in6_addr *addr)
 static inline bool ipv6_addr_is_ll_all_routers(const struct in6_addr *addr)
 {
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
-        __u64 *p = (__u64 *)addr;
+        __be64 *p = (__be64 *)addr;
         return ((p[0] ^ cpu_to_be64(0xff02000000000000UL)) | (p[1] ^ cpu_to_be64(2))) == 0UL;
 #else
         return ((addr->s6_addr32[0] ^ htonl(0xff020000)) |
@@ -343,7 +343,7 @@ static inline bool ipv6_addr_is_isatap(const struct in6_addr *addr)
 static inline bool ipv6_addr_is_solict_mult(const struct in6_addr *addr)
 {
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
-        __u64 *p = (__u64 *)addr;
+        __be64 *p = (__be64 *)addr;
         return ((p[0] ^ cpu_to_be64(0xff02000000000000UL)) |
                 ((p[1] ^ cpu_to_be64(0x00000001ff000000UL)) &
                  cpu_to_be64(0xffffffffff000000UL))) == 0UL;
diff --git a/include/net/af_ieee802154.h b/include/net/af_ieee802154.h
index 75e64c7a2960..f79ae2aa76d6 100644
--- a/include/net/af_ieee802154.h
+++ b/include/net/af_ieee802154.h
@@ -36,7 +36,7 @@ enum {
 /* address length, octets */
 #define IEEE802154_ADDR_LEN     8
 
-struct ieee802154_addr {
+struct ieee802154_addr_sa {
         int addr_type;
         u16 pan_id;
         union {
@@ -51,7 +51,7 @@ struct ieee802154_addr {
 
 struct sockaddr_ieee802154 {
         sa_family_t family; /* AF_IEEE802154 */
-        struct ieee802154_addr addr;
+        struct ieee802154_addr_sa addr;
 };
 
 /* get/setsockopt */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index f4f9ee466791..904777c1cd24 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -65,6 +65,7 @@ struct bt_security {
 #define BT_SECURITY_LOW         1
 #define BT_SECURITY_MEDIUM      2
 #define BT_SECURITY_HIGH        3
+#define BT_SECURITY_FIPS        4
 
 #define BT_DEFER_SETUP  7
 
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 66c1cd87bfe7..be150cf8cd43 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -117,11 +117,18 @@ enum {
         HCI_SERVICE_CACHE,
         HCI_DEBUG_KEYS,
         HCI_DUT_MODE,
+        HCI_FORCE_SC,
+        HCI_FORCE_STATIC_ADDR,
         HCI_UNREGISTER,
         HCI_USER_CHANNEL,
 
         HCI_LE_SCAN,
         HCI_SSP_ENABLED,
+        HCI_SC_ENABLED,
+        HCI_SC_ONLY,
+        HCI_PRIVACY,
+        HCI_RPA_EXPIRED,
+        HCI_RPA_RESOLVING,
         HCI_HS_ENABLED,
         HCI_LE_ENABLED,
         HCI_ADVERTISING,
@@ -133,6 +140,7 @@ enum {
         HCI_FAST_CONNECTABLE,
         HCI_BREDR_ENABLED,
         HCI_6LOWPAN_ENABLED,
+        HCI_LE_SCAN_INTERRUPTED,
 };
 
 /* A mask for the flags that are supposed to remain when a reset happens
@@ -175,6 +183,8 @@ enum {
 #define HCI_CMD_TIMEOUT         msecs_to_jiffies(2000)  /* 2 seconds */
 #define HCI_ACL_TX_TIMEOUT      msecs_to_jiffies(45000) /* 45 seconds */
 #define HCI_AUTO_OFF_TIMEOUT    msecs_to_jiffies(2000)  /* 2 seconds */
+#define HCI_POWER_OFF_TIMEOUT   msecs_to_jiffies(5000)  /* 5 seconds */
+#define HCI_LE_CONN_TIMEOUT     msecs_to_jiffies(20000) /* 20 seconds */
 
 /* HCI data types */
 #define HCI_COMMAND_PKT         0x01
@@ -282,10 +292,14 @@ enum {
 #define LMP_SYNC_TRAIN  0x04
 #define LMP_SYNC_SCAN   0x08
 
+#define LMP_SC          0x01
+#define LMP_PING        0x02
+
 /* Host features */
 #define LMP_HOST_SSP            0x01
 #define LMP_HOST_LE             0x02
 #define LMP_HOST_LE_BREDR       0x04
+#define LMP_HOST_SC             0x08
 
 /* Connection modes */
 #define HCI_CM_ACTIVE   0x0000
@@ -307,6 +321,7 @@ enum {
 #define HCI_LM_TRUSTED  0x0008
 #define HCI_LM_RELIABLE 0x0010
 #define HCI_LM_SECURE   0x0020
+#define HCI_LM_FIPS     0x0040
 
 /* Authentication types */
 #define HCI_AT_NO_BONDING               0x00
@@ -327,17 +342,24 @@ enum {
 #define HCI_LK_LOCAL_UNIT               0x01
 #define HCI_LK_REMOTE_UNIT              0x02
 #define HCI_LK_DEBUG_COMBINATION        0x03
-#define HCI_LK_UNAUTH_COMBINATION       0x04
-#define HCI_LK_AUTH_COMBINATION         0x05
+#define HCI_LK_UNAUTH_COMBINATION_P192  0x04
+#define HCI_LK_AUTH_COMBINATION_P192    0x05
 #define HCI_LK_CHANGED_COMBINATION      0x06
+#define HCI_LK_UNAUTH_COMBINATION_P256  0x07
+#define HCI_LK_AUTH_COMBINATION_P256    0x08
 /* The spec doesn't define types for SMP keys, the _MASTER suffix is implied */
 #define HCI_SMP_STK                     0x80
 #define HCI_SMP_STK_SLAVE               0x81
 #define HCI_SMP_LTK                     0x82
 #define HCI_SMP_LTK_SLAVE               0x83
 
+/* Long Term Key types */
+#define HCI_LTK_UNAUTH                  0x00
+#define HCI_LTK_AUTH                    0x01
+
 /* ---- HCI Error Codes ---- */
 #define HCI_ERROR_AUTH_FAILURE          0x05
+#define HCI_ERROR_MEMORY_EXCEEDED       0x07
 #define HCI_ERROR_CONNECTION_TIMEOUT    0x08
 #define HCI_ERROR_REJ_BAD_ADDR          0x0f
 #define HCI_ERROR_REMOTE_USER_TERM      0x13
@@ -660,6 +682,15 @@ struct hci_rp_set_csb {
 
 #define HCI_OP_START_SYNC_TRAIN         0x0443
 
+#define HCI_OP_REMOTE_OOB_EXT_DATA_REPLY        0x0445
+struct hci_cp_remote_oob_ext_data_reply {
+        bdaddr_t bdaddr;
+        __u8     hash192[16];
+        __u8     randomizer192[16];
+        __u8     hash256[16];
+        __u8     randomizer256[16];
+} __packed;
+
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
         __le16   handle;
@@ -933,6 +964,26 @@ struct hci_rp_write_sync_train_params {
         __le16  sync_train_int;
 } __packed;
 
+#define HCI_OP_READ_SC_SUPPORT          0x0c79
+struct hci_rp_read_sc_support {
+        __u8    status;
+        __u8    support;
+} __packed;
+
+#define HCI_OP_WRITE_SC_SUPPORT         0x0c7a
+struct hci_cp_write_sc_support {
+        __u8    support;
+} __packed;
+
+#define HCI_OP_READ_LOCAL_OOB_EXT_DATA  0x0c7d
+struct hci_rp_read_local_oob_ext_data {
+        __u8     status;
+        __u8     hash192[16];
+        __u8     randomizer192[16];
+        __u8     hash256[16];
+        __u8     randomizer256[16];
+} __packed;
+
 #define HCI_OP_READ_LOCAL_VERSION       0x1001
 struct hci_rp_read_local_version {
         __u8     status;
@@ -1133,6 +1184,9 @@ struct hci_cp_le_set_scan_enable {
         __u8     filter_dup;
 } __packed;
 
+#define HCI_LE_USE_PEER_ADDR            0x00
+#define HCI_LE_USE_WHITELIST            0x01
+
 #define HCI_OP_LE_CREATE_CONN           0x200d
 struct hci_cp_le_create_conn {
         __le16   scan_interval;
@@ -1157,6 +1211,20 @@ struct hci_rp_le_read_white_list_size {
         __u8    size;
 } __packed;
 
+#define HCI_OP_LE_CLEAR_WHITE_LIST      0x2010
+
+#define HCI_OP_LE_ADD_TO_WHITE_LIST     0x2011
+struct hci_cp_le_add_to_white_list {
+        __u8     bdaddr_type;
+        bdaddr_t bdaddr;
+} __packed;
+
+#define HCI_OP_LE_DEL_FROM_WHITE_LIST   0x2012
+struct hci_cp_le_del_from_white_list {
+        __u8     bdaddr_type;
+        bdaddr_t bdaddr;
+} __packed;
+
 #define HCI_OP_LE_CONN_UPDATE           0x2013
 struct hci_cp_le_conn_update {
         __le16   handle;
@@ -1171,7 +1239,7 @@ struct hci_cp_le_conn_update {
 #define HCI_OP_LE_START_ENC             0x2019
 struct hci_cp_le_start_enc {
         __le16  handle;
-        __u8    rand[8];
+        __le64  rand;
         __le16  ediv;
         __u8    ltk[16];
 } __packed;
@@ -1583,7 +1651,7 @@ struct hci_ev_le_conn_complete {
 #define HCI_EV_LE_LTK_REQ               0x05
 struct hci_ev_le_ltk_req {
         __le16  handle;
-        __u8    random[8];
+        __le64  rand;
         __le16  ediv;
 } __packed;
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index f2f0cf5865c4..5f8bc05694ac 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -91,6 +91,13 @@ struct bt_uuid {
         u8 svc_hint;
 };
 
+struct smp_csrk {
+        bdaddr_t bdaddr;
+        u8 bdaddr_type;
+        u8 master;
+        u8 val[16];
+};
+
 struct smp_ltk {
         struct list_head list;
         bdaddr_t bdaddr;
@@ -99,9 +106,17 @@ struct smp_ltk {
         u8 type;
         u8 enc_size;
         __le16 ediv;
-        u8 rand[8];
+        __le64 rand;
         u8 val[16];
-} __packed;
+};
+
+struct smp_irk {
+        struct list_head list;
+        bdaddr_t rpa;
+        bdaddr_t bdaddr;
+        u8 addr_type;
+        u8 val[16];
+};
 
 struct link_key {
         struct list_head list;
@@ -114,12 +129,17 @@ struct link_key {
 struct oob_data {
         struct list_head list;
         bdaddr_t bdaddr;
-        u8 hash[16];
-        u8 randomizer[16];
+        u8 hash192[16];
+        u8 randomizer192[16];
+        u8 hash256[16];
+        u8 randomizer256[16];
 };
 
 #define HCI_MAX_SHORT_NAME_LENGTH       10
 
+/* Default LE RPA expiry time, 15 minutes */
+#define HCI_DEFAULT_RPA_TIMEOUT         (15 * 60)
+
 struct amp_assoc {
         __u16   len;
         __u16   offset;
@@ -141,8 +161,9 @@ struct hci_dev {
         __u8            bus;
         __u8            dev_type;
         bdaddr_t        bdaddr;
+        bdaddr_t        random_addr;
         bdaddr_t        static_addr;
-        __u8            own_addr_type;
+        __u8            adv_addr_type;
         __u8            dev_name[HCI_MAX_NAME_LENGTH];
         __u8            short_name[HCI_MAX_SHORT_NAME_LENGTH];
         __u8            eir[HCI_MAX_EIR_LENGTH];
@@ -167,6 +188,8 @@ struct hci_dev {
         __u16           page_scan_interval;
         __u16           page_scan_window;
         __u8            page_scan_type;
+        __u8            le_adv_channel_map;
+        __u8            le_scan_type;
         __u16           le_scan_interval;
         __u16           le_scan_window;
         __u16           le_conn_min_interval;
@@ -257,19 +280,21 @@ struct hci_dev {
         __u32                   req_status;
         __u32                   req_result;
 
-        struct list_head        mgmt_pending;
+        struct crypto_blkcipher *tfm_aes;
 
         struct discovery_state  discovery;
         struct hci_conn_hash    conn_hash;
-        struct list_head        blacklist;
 
+        struct list_head        mgmt_pending;
+        struct list_head        blacklist;
         struct list_head        uuids;
-
         struct list_head        link_keys;
-
         struct list_head        long_term_keys;
-
+        struct list_head        identity_resolving_keys;
         struct list_head        remote_oob_data;
+        struct list_head        le_white_list;
+        struct list_head        le_conn_params;
+        struct list_head        pend_le_conns;
 
         struct hci_dev_stats    stat;
 
@@ -291,6 +316,11 @@ struct hci_dev {
         __u8                    scan_rsp_data[HCI_MAX_AD_LENGTH];
         __u8                    scan_rsp_data_len;
 
+        __u8                    irk[16];
+        __u32                   rpa_timeout;
+        struct delayed_work     rpa_expired;
+        bdaddr_t                rpa;
+
         int (*open)(struct hci_dev *hdev);
         int (*close)(struct hci_dev *hdev);
         int (*flush)(struct hci_dev *hdev);
@@ -310,6 +340,10 @@ struct hci_conn {
         __u8            dst_type;
         bdaddr_t        src;
         __u8            src_type;
+        bdaddr_t        init_addr;
+        __u8            init_addr_type;
+        bdaddr_t        resp_addr;
+        __u8            resp_addr_type;
         __u16           handle;
         __u16           state;
         __u8            mode;
@@ -332,6 +366,8 @@ struct hci_conn {
         __u8            passkey_entered;
         __u16           disc_timeout;
         __u16           setting;
+        __u16           le_conn_min_interval;
+        __u16           le_conn_max_interval;
         unsigned long   flags;
 
         __u8            remote_cap;
@@ -347,6 +383,7 @@ struct hci_conn {
         struct delayed_work disc_work;
         struct delayed_work auto_accept_work;
         struct delayed_work idle_work;
+        struct delayed_work le_conn_timeout;
 
         struct device   dev;
 
@@ -372,6 +409,22 @@ struct hci_chan {
         __u8            state;
 };
 
+struct hci_conn_params {
+        struct list_head list;
+
+        bdaddr_t addr;
+        u8 addr_type;
+
+        u16 conn_min_interval;
+        u16 conn_max_interval;
+
+        enum {
+                HCI_AUTO_CONN_DISABLED,
+                HCI_AUTO_CONN_ALWAYS,
+                HCI_AUTO_CONN_LINK_LOSS,
+        } auto_connect;
+};
+
 extern struct list_head hci_dev_list;
 extern struct list_head hci_cb_list;
 extern rwlock_t hci_dev_list_lock;
@@ -446,6 +499,8 @@ enum {
         HCI_CONN_LE_SMP_PEND,
         HCI_CONN_MGMT_CONNECTED,
         HCI_CONN_SSP_ENABLED,
+        HCI_CONN_SC_ENABLED,
+        HCI_CONN_AES_CCM,
         HCI_CONN_POWER_SAVE,
         HCI_CONN_REMOTE_OOB,
         HCI_CONN_6LOWPAN,
@@ -458,6 +513,13 @@ static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
                test_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 }
 
+static inline bool hci_conn_sc_enabled(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        return test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
+               test_bit(HCI_CONN_SC_ENABLED, &conn->flags);
+}
+
 static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
@@ -521,6 +583,13 @@ static inline unsigned int hci_conn_num(struct hci_dev *hdev, __u8 type)
         }
 }
 
+static inline unsigned int hci_conn_count(struct hci_dev *hdev)
+{
+        struct hci_conn_hash *c = &hdev->conn_hash;
+
+        return c->acl_num + c->amp_num + c->sco_num + c->le_num;
+}
+
 static inline struct hci_conn *hci_conn_hash_lookup_handle(struct hci_dev *hdev,
                                                                 __u16 handle)
 {
@@ -594,8 +663,10 @@ void hci_chan_del(struct hci_chan *chan);
 void hci_chan_list_flush(struct hci_conn *conn);
 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle);
 
-struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
-                             __u8 dst_type, __u8 sec_level, __u8 auth_type);
+struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
+                                u8 dst_type, u8 sec_level, u8 auth_type);
+struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
+                                 u8 sec_level, u8 auth_type);
 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
                                  __u16 setting);
 int hci_conn_check_link_mode(struct hci_conn *conn);
@@ -606,6 +677,8 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 
 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
 
+void hci_le_conn_failed(struct hci_conn *conn, u8 status);
+
 /*
  * hci_conn_get() and hci_conn_put() are used to control the life-time of an
  * "hci_conn" object. They do not guarantee that the hci_conn object is running,
@@ -737,31 +810,64 @@ int hci_inquiry(void __user *arg);
 
 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
                                          bdaddr_t *bdaddr, u8 type);
-int hci_blacklist_clear(struct hci_dev *hdev);
 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 
-int hci_uuids_clear(struct hci_dev *hdev);
+struct bdaddr_list *hci_white_list_lookup(struct hci_dev *hdev,
+                                          bdaddr_t *bdaddr, u8 type);
+void hci_white_list_clear(struct hci_dev *hdev);
+int hci_white_list_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
+int hci_white_list_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
+
+struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
+                                               bdaddr_t *addr, u8 addr_type);
+int hci_conn_params_add(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type,
+                        u8 auto_connect, u16 conn_min_interval,
+                        u16 conn_max_interval);
+void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type);
+void hci_conn_params_clear(struct hci_dev *hdev);
+
+struct bdaddr_list *hci_pend_le_conn_lookup(struct hci_dev *hdev,
+                                            bdaddr_t *addr, u8 addr_type);
+void hci_pend_le_conn_add(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type);
+void hci_pend_le_conn_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type);
+void hci_pend_le_conns_clear(struct hci_dev *hdev);
+
+void hci_update_background_scan(struct hci_dev *hdev);
 
-int hci_link_keys_clear(struct hci_dev *hdev);
+void hci_uuids_clear(struct hci_dev *hdev);
+
+void hci_link_keys_clear(struct hci_dev *hdev);
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                      bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
-struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
-int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
-                int new_key, u8 authenticated, u8 tk[16], u8 enc_size,
-                __le16 ediv, u8 rand[8]);
+struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, __le64 rand,
+                             bool master);
+struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                            u8 addr_type, u8 type, u8 authenticated,
+                            u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand);
 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                     u8 addr_type);
-int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr);
-int hci_smp_ltks_clear(struct hci_dev *hdev);
+                                     u8 addr_type, bool master);
+int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type);
+void hci_smp_ltks_clear(struct hci_dev *hdev);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
-int hci_remote_oob_data_clear(struct hci_dev *hdev);
+struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa);
+struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                     u8 addr_type);
+struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                            u8 addr_type, u8 val[16], bdaddr_t *rpa);
+void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type);
+void hci_smp_irks_clear(struct hci_dev *hdev);
+
+void hci_remote_oob_data_clear(struct hci_dev *hdev);
 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
-                                                        bdaddr_t *bdaddr);
-int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
-                                                                u8 *randomizer);
+                                          bdaddr_t *bdaddr);
+int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                            u8 *hash, u8 *randomizer);
+int hci_add_remote_oob_ext_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                u8 *hash192, u8 *randomizer192,
+                                u8 *hash256, u8 *randomizer256);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
@@ -803,9 +909,12 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define lmp_csb_slave_capable(dev)  ((dev)->features[2][0] & LMP_CSB_SLAVE)
 #define lmp_sync_train_capable(dev) ((dev)->features[2][0] & LMP_SYNC_TRAIN)
 #define lmp_sync_scan_capable(dev)  ((dev)->features[2][0] & LMP_SYNC_SCAN)
+#define lmp_sc_capable(dev)         ((dev)->features[2][1] & LMP_SC)
+#define lmp_ping_capable(dev)       ((dev)->features[2][1] & LMP_PING)
 
 /* ----- Host capabilities ----- */
 #define lmp_host_ssp_capable(dev)  ((dev)->features[1][0] & LMP_HOST_SSP)
+#define lmp_host_sc_capable(dev)   ((dev)->features[1][0] & LMP_HOST_SC)
 #define lmp_host_le_capable(dev)   (!!((dev)->features[1][0] & LMP_HOST_LE))
 #define lmp_host_le_br_capable(dev) (!!((dev)->features[1][0] & LMP_HOST_LE_BREDR))
 
@@ -1019,6 +1128,26 @@ static inline bool eir_has_data_type(u8 *data, size_t data_len, u8 type)
         return false;
 }
 
+static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type)
+{
+        if (addr_type != 0x01)
+                return false;
+
+        if ((bdaddr->b[5] & 0xc0) == 0x40)
+               return true;
+
+        return false;
+}
+
+static inline struct smp_irk *hci_get_irk(struct hci_dev *hdev,
+                                          bdaddr_t *bdaddr, u8 addr_type)
+{
+        if (!hci_bdaddr_is_rpa(bdaddr, addr_type))
+                return NULL;
+
+        return hci_find_irk_by_rpa(hdev, bdaddr);
+}
+
 int hci_register_cb(struct hci_cb *hcb);
 int hci_unregister_cb(struct hci_cb *hcb);
 
@@ -1040,6 +1169,9 @@ void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
                     const void *param, u8 event);
 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status);
 
+void hci_req_add_le_scan_disable(struct hci_request *req);
+void hci_req_add_le_passive_scan(struct hci_request *req);
+
 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
                                const void *param, u32 timeout);
 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
@@ -1085,6 +1217,7 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered);
 void mgmt_discoverable_timeout(struct hci_dev *hdev);
 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable);
 void mgmt_connectable(struct hci_dev *hdev, u8 connectable);
+void mgmt_advertising(struct hci_dev *hdev, u8 advertising);
 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status);
 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
                        bool persistent);
@@ -1092,7 +1225,8 @@ void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
                            u8 *dev_class);
 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                              u8 link_type, u8 addr_type, u8 reason);
+                              u8 link_type, u8 addr_type, u8 reason,
+                              bool mgmt_connected);
 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
                             u8 link_type, u8 addr_type, u8 status);
 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
@@ -1103,7 +1237,7 @@ void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                       u8 status);
 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                              u8 link_type, u8 addr_type, __le32 value,
+                              u8 link_type, u8 addr_type, u32 value,
                               u8 confirm_hint);
 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                      u8 link_type, u8 addr_type, u8 status);
@@ -1122,11 +1256,13 @@ void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                       u8 addr_type, u8 status);
 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status);
 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
+void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
                                     u8 status);
 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status);
-void mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
-                                             u8 *randomizer, u8 status);
+void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
+                                       u8 *randomizer192, u8 *hash256,
+                                       u8 *randomizer256, u8 status);
 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
                        u8 ssp, u8 *eir, u16 eir_len);
@@ -1135,8 +1271,12 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
 void mgmt_discovering(struct hci_dev *hdev, u8 discovering);
 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
-void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent);
+void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent);
+void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk);
+void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
+                   bool persistent);
 void mgmt_reenable_advertising(struct hci_dev *hdev);
+void mgmt_smp_complete(struct hci_conn *conn, bool complete);
 
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
@@ -1168,9 +1308,14 @@ struct hci_sec_filter {
 
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
-void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
+void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
                                                         __u8 ltk[16]);
 
+int hci_update_random_address(struct hci_request *req, bool require_privacy,
+                              u8 *own_addr_type);
+void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                               u8 *bdaddr_type);
+
 #define SCO_AIRMODE_MASK       0x0003
 #define SCO_AIRMODE_CVSD       0x0000
 #define SCO_AIRMODE_TRANSP     0x0003
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index dbc4a89984ca..4abdcb220e3a 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -91,6 +91,7 @@ struct l2cap_conninfo {
 #define L2CAP_LM_TRUSTED        0x0008
 #define L2CAP_LM_RELIABLE       0x0010
 #define L2CAP_LM_SECURE         0x0020
+#define L2CAP_LM_FIPS           0x0040
 
 /* L2CAP command codes */
 #define L2CAP_COMMAND_REJ       0x01
@@ -623,6 +624,9 @@ struct l2cap_conn {
         __u32                   rx_len;
         __u8                    tx_ident;
 
+        struct sk_buff_head     pending_rx;
+        struct work_struct      pending_rx_work;
+
         __u8                    disc_reason;
 
         struct delayed_work     security_timer;
@@ -647,7 +651,7 @@ struct l2cap_user {
 #define L2CAP_CHAN_RAW                  1
 #define L2CAP_CHAN_CONN_LESS            2
 #define L2CAP_CHAN_CONN_ORIENTED        3
-#define L2CAP_CHAN_CONN_FIX_A2MP        4
+#define L2CAP_CHAN_FIXED                4
 
 /* ----- L2CAP socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
@@ -853,7 +857,6 @@ static inline long l2cap_chan_no_get_sndtimeo(struct l2cap_chan *chan)
 }
 
 extern bool disable_ertm;
-extern bool enable_lecoc;
 
 int l2cap_init_sockets(void);
 void l2cap_cleanup_sockets(void);
@@ -878,6 +881,7 @@ int l2cap_ertm_init(struct l2cap_chan *chan);
 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
 void l2cap_chan_del(struct l2cap_chan *chan, int err);
+void l2cap_conn_update_id_addr(struct hci_conn *hcon);
 void l2cap_send_conn_req(struct l2cap_chan *chan);
 void l2cap_move_start(struct l2cap_chan *chan);
 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 518c5c84e39a..d4b571c2f9fd 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -94,6 +94,9 @@ struct mgmt_rp_read_index_list {
 #define MGMT_SETTING_HS                 0x00000100
 #define MGMT_SETTING_LE                 0x00000200
 #define MGMT_SETTING_ADVERTISING        0x00000400
+#define MGMT_SETTING_SECURE_CONN        0x00000800
+#define MGMT_SETTING_DEBUG_KEYS         0x00001000
+#define MGMT_SETTING_PRIVACY            0x00002000
 
 #define MGMT_OP_READ_INFO               0x0004
 #define MGMT_READ_INFO_SIZE             0
@@ -180,11 +183,11 @@ struct mgmt_cp_load_link_keys {
 
 struct mgmt_ltk_info {
         struct mgmt_addr_info addr;
-        __u8    authenticated;
+        __u8    type;
         __u8    master;
         __u8    enc_size;
         __le16  ediv;
-        __u8    rand[8];
+        __le64  rand;
         __u8    val[16];
 } __packed;
 
@@ -294,6 +297,12 @@ struct mgmt_rp_read_local_oob_data {
         __u8    hash[16];
         __u8    randomizer[16];
 } __packed;
+struct mgmt_rp_read_local_oob_ext_data {
+        __u8    hash192[16];
+        __u8    randomizer192[16];
+        __u8    hash256[16];
+        __u8    randomizer256[16];
+} __packed;
 
 #define MGMT_OP_ADD_REMOTE_OOB_DATA     0x0021
 struct mgmt_cp_add_remote_oob_data {
@@ -302,6 +311,14 @@ struct mgmt_cp_add_remote_oob_data {
         __u8    randomizer[16];
 } __packed;
 #define MGMT_ADD_REMOTE_OOB_DATA_SIZE   (MGMT_ADDR_INFO_SIZE + 32)
+struct mgmt_cp_add_remote_oob_ext_data {
+        struct mgmt_addr_info addr;
+        __u8    hash192[16];
+        __u8    randomizer192[16];
+        __u8    hash256[16];
+        __u8    randomizer256[16];
+} __packed;
+#define MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE (MGMT_ADDR_INFO_SIZE + 64)
 
 #define MGMT_OP_REMOVE_REMOTE_OOB_DATA  0x0022
 struct mgmt_cp_remove_remote_oob_data {
@@ -369,6 +386,29 @@ struct mgmt_cp_set_scan_params {
 } __packed;
 #define MGMT_SET_SCAN_PARAMS_SIZE       4
 
+#define MGMT_OP_SET_SECURE_CONN         0x002D
+
+#define MGMT_OP_SET_DEBUG_KEYS          0x002E
+
+#define MGMT_OP_SET_PRIVACY             0x002F
+struct mgmt_cp_set_privacy {
+        __u8 privacy;
+        __u8 irk[16];
+} __packed;
+#define MGMT_SET_PRIVACY_SIZE           17
+
+struct mgmt_irk_info {
+        struct mgmt_addr_info addr;
+        __u8 val[16];
+} __packed;
+
+#define MGMT_OP_LOAD_IRKS               0x0030
+struct mgmt_cp_load_irks {
+        __le16 irk_count;
+        struct mgmt_irk_info irks[0];
+} __packed;
+#define MGMT_LOAD_IRKS_SIZE             2
+
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
         __le16  opcode;
@@ -504,3 +544,22 @@ struct mgmt_ev_passkey_notify {
         __le32  passkey;
         __u8    entered;
 } __packed;
+
+#define MGMT_EV_NEW_IRK                 0x0018
+struct mgmt_ev_new_irk {
+        __u8     store_hint;
+        bdaddr_t rpa;
+        struct mgmt_irk_info irk;
+} __packed;
+
+struct mgmt_csrk_info {
+        struct mgmt_addr_info addr;
+        __u8 master;
+        __u8 val[16];
+} __packed;
+
+#define MGMT_EV_NEW_CSRK                0x0019
+struct mgmt_ev_new_csrk {
+        __u8 store_hint;
+        struct mgmt_csrk_info key;
+} __packed;
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 486213a1aed8..2611cc389d7d 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -238,9 +238,11 @@ int  rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst,
                                                                 u8 channel);
 int  rfcomm_dlc_close(struct rfcomm_dlc *d, int reason);
 int  rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb);
+void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb);
 int  rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig);
 int  rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig);
 void rfcomm_dlc_accept(struct rfcomm_dlc *d);
+struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel);
 
 #define rfcomm_dlc_lock(d)     spin_lock(&d->lock)
 #define rfcomm_dlc_unlock(d)   spin_unlock(&d->lock)
@@ -295,6 +297,7 @@ struct rfcomm_conninfo {
 #define RFCOMM_LM_TRUSTED       0x0008
 #define RFCOMM_LM_RELIABLE      0x0010
 #define RFCOMM_LM_SECURE        0x0020
+#define RFCOMM_LM_FIPS          0x0040
 
 #define rfcomm_pi(sk) ((struct rfcomm_pinfo *) sk)
 
@@ -323,11 +326,16 @@ int  rfcomm_connect_ind(struct rfcomm_session *s, u8 channel,
 #define RFCOMMGETDEVINFO        _IOR('R', 211, int)
 #define RFCOMMSTEALDLC          _IOW('R', 220, int)
 
+/* rfcomm_dev.flags bit definitions */
 #define RFCOMM_REUSE_DLC      0
 #define RFCOMM_RELEASE_ONHUP  1
 #define RFCOMM_HANGUP_NOW     2
 #define RFCOMM_TTY_ATTACHED   3
-#define RFCOMM_TTY_RELEASED   4
+#define RFCOMM_DEFUNCT_BIT4   4   /* don't reuse this bit - userspace visible */
+
+/* rfcomm_dev.status bit definitions */
+#define RFCOMM_DEV_RELEASED   0
+#define RFCOMM_TTY_OWNED      1
 
 struct rfcomm_dev_req {
         s16      dev_id;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index b1f84b05c67e..f3539a15c411 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -151,6 +151,7 @@ enum ieee80211_channel_flags {
  * @dfs_state: current state of this channel. Only relevant if radar is required
  *      on this channel.
  * @dfs_state_entered: timestamp (jiffies) when the dfs state was entered.
+ * @dfs_cac_ms: DFS CAC time in milliseconds, this is valid for DFS channels.
  */
 struct ieee80211_channel {
         enum ieee80211_band band;
@@ -165,6 +166,7 @@ struct ieee80211_channel {
         int orig_mag, orig_mpwr;
         enum nl80211_dfs_state dfs_state;
         unsigned long dfs_state_entered;
+        unsigned int dfs_cac_ms;
 };
 
 /**
@@ -1394,10 +1396,12 @@ struct cfg80211_scan_request {
 /**
  * struct cfg80211_match_set - sets of attributes to match
  *
- * @ssid: SSID to be matched
+ * @ssid: SSID to be matched; may be zero-length for no match (RSSI only)
+ * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
  */
 struct cfg80211_match_set {
         struct cfg80211_ssid ssid;
+        s32 rssi_thold;
 };
 
 /**
@@ -1420,7 +1424,8 @@ struct cfg80211_match_set {
  * @dev: the interface
  * @scan_start: start time of the scheduled scan
  * @channels: channels to scan
- * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
+ * @min_rssi_thold: for drivers only supporting a single threshold, this
+ *      contains the minimum over all matchsets
  */
 struct cfg80211_sched_scan_request {
         struct cfg80211_ssid *ssids;
@@ -1433,7 +1438,7 @@ struct cfg80211_sched_scan_request {
         u32 flags;
         struct cfg80211_match_set *match_sets;
         int n_match_sets;
-        s32 rssi_thold;
+        s32 min_rssi_thold;
 
         /* internal */
         struct wiphy *wiphy;
@@ -1701,8 +1706,14 @@ struct cfg80211_ibss_params {
  *
  * @channel: The channel to use or %NULL if not specified (auto-select based
  *      on scan results)
+ * @channel_hint: The channel of the recommended BSS for initial connection or
+ *      %NULL if not specified
  * @bssid: The AP BSSID or %NULL if not specified (auto-select based on scan
  *      results)
+ * @bssid_hint: The recommended AP BSSID for initial connection to the BSS or
+ *      %NULL if not specified. Unlike the @bssid parameter, the driver is
+ *      allowed to ignore this @bssid_hint if it has knowledge of a better BSS
+ *      to use.
  * @ssid: SSID
  * @ssid_len: Length of ssid in octets
  * @auth_type: Authentication type (algorithm)
@@ -1725,11 +1736,13 @@ struct cfg80211_ibss_params {
  */
 struct cfg80211_connect_params {
         struct ieee80211_channel *channel;
-        u8 *bssid;
-        u8 *ssid;
+        struct ieee80211_channel *channel_hint;
+        const u8 *bssid;
+        const u8 *bssid_hint;
+        const u8 *ssid;
         size_t ssid_len;
         enum nl80211_auth_type auth_type;
-        u8 *ie;
+        const u8 *ie;
         size_t ie_len;
         bool privacy;
         enum nl80211_mfp mfp;
@@ -1768,6 +1781,7 @@ struct cfg80211_bitrate_mask {
                 u32 legacy;
                 u8 ht_mcs[IEEE80211_HT_MCS_MASK_LEN];
                 u16 vht_mcs[NL80211_VHT_NSS_MAX];
+                enum nl80211_txrate_gi gi;
         } control[IEEE80211_NUM_BANDS];
 };
 /**
@@ -2194,7 +2208,12 @@ struct cfg80211_qos_map {
  * @set_cqm_txe_config: Configure connection quality monitor TX error
  *      thresholds.
  * @sched_scan_start: Tell the driver to start a scheduled scan.
- * @sched_scan_stop: Tell the driver to stop an ongoing scheduled scan.
+ * @sched_scan_stop: Tell the driver to stop an ongoing scheduled scan. This
+ *      call must stop the scheduled scan and be ready for starting a new one
+ *      before it returns, i.e. @sched_scan_start may be called immediately
+ *      after that again and should not fail in that case. The driver should
+ *      not call cfg80211_sched_scan_stopped() for a requested stop (when this
+ *      method returns 0.)
  *
  * @mgmt_frame_register: Notify driver that a management frame type was
  *      registered. Note that this callback may not sleep, and cannot run
@@ -2453,7 +2472,8 @@ struct cfg80211_ops {
 
         int     (*tdls_mgmt)(struct wiphy *wiphy, struct net_device *dev,
                              u8 *peer, u8 action_code,  u8 dialog_token,
-                             u16 status_code, const u8 *buf, size_t len);
+                             u16 status_code, u32 peer_capability,
+                             const u8 *buf, size_t len);
         int     (*tdls_oper)(struct wiphy *wiphy, struct net_device *dev,
                              u8 *peer, enum nl80211_tdls_operation oper);
 
@@ -2485,7 +2505,8 @@ struct cfg80211_ops {
 
         int     (*start_radar_detection)(struct wiphy *wiphy,
                                          struct net_device *dev,
-                                         struct cfg80211_chan_def *chandef);
+                                         struct cfg80211_chan_def *chandef,
+                                         u32 cac_time_ms);
         int     (*update_ft_ies)(struct wiphy *wiphy, struct net_device *dev,
                                  struct cfg80211_update_ft_ies_params *ftie);
         int     (*crit_proto_start)(struct wiphy *wiphy,
@@ -2598,9 +2619,12 @@ struct ieee80211_iface_limit {
  *      only in special cases.
  * @radar_detect_widths: bitmap of channel widths supported for radar detection
  *
- * These examples can be expressed as follows:
+ * With this structure the driver can describe which interface
+ * combinations it supports concurrently.
+ *
+ * Examples:
  *
- * Allow #STA <= 1, #AP <= 1, matching BI, channels = 1, 2 total:
+ * 1. Allow #STA <= 1, #AP <= 1, matching BI, channels = 1, 2 total:
  *
  *  struct ieee80211_iface_limit limits1[] = {
  *      { .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
@@ -2614,7 +2638,7 @@ struct ieee80211_iface_limit {
  *  };
  *
  *
- * Allow #{AP, P2P-GO} <= 8, channels = 1, 8 total:
+ * 2. Allow #{AP, P2P-GO} <= 8, channels = 1, 8 total:
  *
  *  struct ieee80211_iface_limit limits2[] = {
  *      { .max = 8, .types = BIT(NL80211_IFTYPE_AP) |
@@ -2628,7 +2652,8 @@ struct ieee80211_iface_limit {
  *  };
  *
  *
- * Allow #STA <= 1, #{P2P-client,P2P-GO} <= 3 on two channels, 4 total.
+ * 3. Allow #STA <= 1, #{P2P-client,P2P-GO} <= 3 on two channels, 4 total.
+ *
  * This allows for an infrastructure connection and three P2P connections.
  *
  *  struct ieee80211_iface_limit limits3[] = {
@@ -2778,7 +2803,7 @@ struct wiphy_vendor_command {
  * @perm_addr: permanent MAC address of this device
  * @addr_mask: If the device supports multiple MAC addresses by masking,
  *      set this to a mask with variable bits set to 1, e.g. if the last
- *      four bits are variable then set it to 00:...:00:0f. The actual
+ *      four bits are variable then set it to 00-00-00-00-00-0f. The actual
  *      variable bits shall be determined by the interfaces added, with
  *      interfaces not matching the mask being rejected to be brought up.
  * @n_addresses: number of addresses in @addresses.
@@ -2875,6 +2900,11 @@ struct wiphy_vendor_command {
  * @n_vendor_commands: number of vendor commands
  * @vendor_events: array of vendor events supported by the hardware
  * @n_vendor_events: number of vendor events
+ *
+ * @max_ap_assoc_sta: maximum number of associated stations supported in AP mode
+ *      (including P2P GO) or 0 to indicate no such limit is advertised. The
+ *      driver is allowed to advertise a theoretical limit that it can reach in
+ *      some cases, but may not always reach.
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -2990,6 +3020,8 @@ struct wiphy {
         const struct nl80211_vendor_cmd_info *vendor_events;
         int n_vendor_commands, n_vendor_events;
 
+        u16 max_ap_assoc_sta;
+
         char priv[0] __aligned(NETDEV_ALIGN);
 };
 
@@ -3127,8 +3159,8 @@ struct cfg80211_cached_keys;
  * @identifier: (private) Identifier used in nl80211 to identify this
  *      wireless device if it has no netdev
  * @current_bss: (private) Used by the internal configuration code
- * @channel: (private) Used by the internal configuration code to track
- *      the user-set AP, monitor and WDS channel
+ * @chandef: (private) Used by the internal configuration code to track
+ *      the user-set channel definition.
  * @preset_chandef: (private) Used by the internal configuration code to
  *      track the channel to be used for AP later
  * @bssid: (private) Used by the internal configuration code
@@ -3151,6 +3183,7 @@ struct cfg80211_cached_keys;
  * @p2p_started: true if this is a P2P Device that has been started
  * @cac_started: true if DFS channel availability check has been started
  * @cac_start_time: timestamp (jiffies) when the dfs state was entered.
+ * @cac_time_ms: CAC time in ms
  * @ps: powersave mode is enabled
  * @ps_timeout: dynamic powersave timeout
  * @ap_unexpected_nlportid: (private) netlink port ID of application
@@ -3192,9 +3225,7 @@ struct wireless_dev {
 
         struct cfg80211_internal_bss *current_bss; /* associated / joined */
         struct cfg80211_chan_def preset_chandef;
-
-        /* for AP and mesh channel tracking */
-        struct ieee80211_channel *channel;
+        struct cfg80211_chan_def chandef;
 
         bool ibss_fixed;
         bool ibss_dfs_possible;
@@ -3208,6 +3239,7 @@ struct wireless_dev {
 
         bool cac_started;
         unsigned long cac_start_time;
+        unsigned int cac_time_ms;
 
 #ifdef CONFIG_CFG80211_WEXT
         /* wext data */
@@ -3640,7 +3672,7 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
  * cfg80211_inform_bss_width_frame - inform cfg80211 of a received BSS frame
  *
  * @wiphy: the wiphy reporting the BSS
- * @channel: The channel the frame was received on
+ * @rx_channel: The channel the frame was received on
  * @scan_width: width of the control channel
  * @mgmt: the management frame (probe response or beacon)
  * @len: length of the management frame
@@ -3655,18 +3687,18 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
  */
 struct cfg80211_bss * __must_check
 cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
-                                struct ieee80211_channel *channel,
+                                struct ieee80211_channel *rx_channel,
                                 enum nl80211_bss_scan_width scan_width,
                                 struct ieee80211_mgmt *mgmt, size_t len,
                                 s32 signal, gfp_t gfp);
 
 static inline struct cfg80211_bss * __must_check
 cfg80211_inform_bss_frame(struct wiphy *wiphy,
-                          struct ieee80211_channel *channel,
+                          struct ieee80211_channel *rx_channel,
                           struct ieee80211_mgmt *mgmt, size_t len,
                           s32 signal, gfp_t gfp)
 {
-        return cfg80211_inform_bss_width_frame(wiphy, channel,
+        return cfg80211_inform_bss_width_frame(wiphy, rx_channel,
                                                NL80211_BSS_CHAN_WIDTH_20,
                                                mgmt, len, signal, gfp);
 }
@@ -3675,7 +3707,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
  * cfg80211_inform_bss - inform cfg80211 of a new BSS
  *
  * @wiphy: the wiphy reporting the BSS
- * @channel: The channel the frame was received on
+ * @rx_channel: The channel the frame was received on
  * @scan_width: width of the control channel
  * @bssid: the BSSID of the BSS
  * @tsf: the TSF sent by the peer in the beacon/probe response (or 0)
@@ -3694,7 +3726,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
  */
 struct cfg80211_bss * __must_check
 cfg80211_inform_bss_width(struct wiphy *wiphy,
-                          struct ieee80211_channel *channel,
+                          struct ieee80211_channel *rx_channel,
                           enum nl80211_bss_scan_width scan_width,
                           const u8 *bssid, u64 tsf, u16 capability,
                           u16 beacon_interval, const u8 *ie, size_t ielen,
@@ -3702,12 +3734,12 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
 
 static inline struct cfg80211_bss * __must_check
 cfg80211_inform_bss(struct wiphy *wiphy,
-                    struct ieee80211_channel *channel,
+                    struct ieee80211_channel *rx_channel,
                     const u8 *bssid, u64 tsf, u16 capability,
                     u16 beacon_interval, const u8 *ie, size_t ielen,
                     s32 signal, gfp_t gfp)
 {
-        return cfg80211_inform_bss_width(wiphy, channel,
+        return cfg80211_inform_bss_width(wiphy, rx_channel,
                                          NL80211_BSS_CHAN_WIDTH_20,
                                          bssid, tsf, capability,
                                          beacon_interval, ie, ielen, signal,
@@ -3876,6 +3908,7 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
  *
  * @dev: network device
  * @bssid: the BSSID of the IBSS joined
+ * @channel: the channel of the IBSS joined
  * @gfp: allocation flags
  *
  * This function notifies cfg80211 that the device joined an IBSS or
@@ -3885,7 +3918,8 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
  * with the locally generated beacon -- this guarantees that there is
  * always a scan result for this IBSS. cfg80211 will handle the rest.
  */
-void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
+void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
+                          struct ieee80211_channel *channel, gfp_t gfp);
 
 /**
  * cfg80211_notify_new_candidate - notify cfg80211 of a new mesh peer candidate
diff --git a/include/net/checksum.h b/include/net/checksum.h
index 37a0e24adbe7..a28f4e0f6251 100644
--- a/include/net/checksum.h
+++ b/include/net/checksum.h
@@ -69,6 +69,19 @@ static inline __wsum csum_sub(__wsum csum, __wsum addend)
         return csum_add(csum, ~addend);
 }
 
+static inline __sum16 csum16_add(__sum16 csum, __be16 addend)
+{
+        u16 res = (__force u16)csum;
+
+        res += (__force u16)addend;
+        return (__force __sum16)(res + (res < (__force u16)addend));
+}
+
+static inline __sum16 csum16_sub(__sum16 csum, __be16 addend)
+{
+        return csum16_add(csum, ~addend);
+}
+
 static inline __wsum
 csum_block_add(__wsum csum, __wsum csum2, int offset)
 {
@@ -112,9 +125,15 @@ static inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to)
         *sum = csum_fold(csum_partial(diff, sizeof(diff), ~csum_unfold(*sum)));
 }
 
-static inline void csum_replace2(__sum16 *sum, __be16 from, __be16 to)
+/* Implements RFC 1624 (Incremental Internet Checksum)
+ * 3. Discussion states :
+ *     HC' = ~(~HC + ~m + m')
+ *  m : old value of a 16bit field
+ *  m' : new value of a 16bit field
+ */
+static inline void csum_replace2(__sum16 *sum, __be16 old, __be16 new)
 {
-        csum_replace4(sum, (__force __be32)from, (__force __be32)to);
+        *sum = ~csum16_add(csum16_sub(~(*sum), old), new);
 }
 
 struct sk_buff;
diff --git a/include/net/dst.h b/include/net/dst.h
index 77eb53fabfb0..46ed958e0c6e 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -54,10 +54,9 @@ struct dst_entry {
 #define DST_NOHASH              0x0008
 #define DST_NOCACHE             0x0010
 #define DST_NOCOUNT             0x0020
-#define DST_NOPEER              0x0040
-#define DST_FAKE_RTABLE         0x0080
-#define DST_XFRM_TUNNEL         0x0100
-#define DST_XFRM_QUEUE          0x0200
+#define DST_FAKE_RTABLE         0x0040
+#define DST_XFRM_TUNNEL         0x0080
+#define DST_XFRM_QUEUE          0x0100
 
         unsigned short          pending_confirm;
 
@@ -109,9 +108,11 @@ struct dst_entry {
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
 extern const u32 dst_default_metrics[];
 
-#define DST_METRICS_READ_ONLY   0x1UL
+#define DST_METRICS_READ_ONLY           0x1UL
+#define DST_METRICS_FORCE_OVERWRITE     0x2UL
+#define DST_METRICS_FLAGS               0x3UL
 #define __DST_METRICS_PTR(Y)    \
-        ((u32 *)((Y) & ~DST_METRICS_READ_ONLY))
+        ((u32 *)((Y) & ~DST_METRICS_FLAGS))
 #define DST_METRICS_PTR(X)      __DST_METRICS_PTR((X)->_metrics)
 
 static inline bool dst_metrics_read_only(const struct dst_entry *dst)
@@ -119,6 +120,11 @@ static inline bool dst_metrics_read_only(const struct dst_entry *dst)
         return dst->_metrics & DST_METRICS_READ_ONLY;
 }
 
+static inline void dst_metrics_set_force_overwrite(struct dst_entry *dst)
+{
+        dst->_metrics |= DST_METRICS_FORCE_OVERWRITE;
+}
+
 void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old);
 
 static inline void dst_destroy_metrics_generic(struct dst_entry *dst)
diff --git a/include/net/flow.h b/include/net/flow.h
index d23e7fa2042e..64fd24836650 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -218,9 +218,11 @@ struct flow_cache_object *flow_cache_lookup(struct net *net,
                                             const struct flowi *key, u16 family,
                                             u8 dir, flow_resolve_t resolver,
                                             void *ctx);
+int flow_cache_init(struct net *net);
+void flow_cache_fini(struct net *net);
 
-void flow_cache_flush(void);
-void flow_cache_flush_deferred(void);
+void flow_cache_flush(struct net *net);
+void flow_cache_flush_deferred(struct net *net);
 extern atomic_t flow_cache_genid;
 
 #endif
diff --git a/include/net/flowcache.h b/include/net/flowcache.h
new file mode 100644
index 000000000000..c8f665ec6e0d
--- /dev/null
+++ b/include/net/flowcache.h
@@ -0,0 +1,25 @@
+#ifndef _NET_FLOWCACHE_H
+#define _NET_FLOWCACHE_H
+
+#include <linux/interrupt.h>
+#include <linux/types.h>
+#include <linux/timer.h>
+#include <linux/notifier.h>
+
+struct flow_cache_percpu {
+        struct hlist_head               *hash_table;
+        int                             hash_count;
+        u32                             hash_rnd;
+        int                             hash_rnd_recalc;
+        struct tasklet_struct           flush_tasklet;
+};
+
+struct flow_cache {
+        u32                             hash_shift;
+        struct flow_cache_percpu __percpu *percpu;
+        struct notifier_block           hotcpu_notifier;
+        int                             low_watermark;
+        int                             high_watermark;
+        struct timer_list               rnd_timer;
+};
+#endif  /* _NET_FLOWCACHE_H */
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index 8b5b71433297..b0fd9476c538 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -316,6 +316,10 @@ enum ieee80211_radiotap_type {
 #define IEEE80211_RADIOTAP_VHT_FLAG_LDPC_EXTRA_OFDM_SYM         0x10
 #define IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED                  0x20
 
+#define IEEE80211_RADIOTAP_CODING_LDPC_USER0                    0x01
+#define IEEE80211_RADIOTAP_CODING_LDPC_USER1                    0x02
+#define IEEE80211_RADIOTAP_CODING_LDPC_USER2                    0x04
+#define IEEE80211_RADIOTAP_CODING_LDPC_USER3                    0x08
 
 /* helpers */
 static inline int ieee80211_get_radiotap_len(unsigned char *data)
diff --git a/include/net/ieee802154.h b/include/net/ieee802154.h
index ee59f8b188dd..c7ae0ac528dc 100644
--- a/include/net/ieee802154.h
+++ b/include/net/ieee802154.h
@@ -42,22 +42,42 @@
             (((x) << IEEE802154_FC_TYPE_SHIFT) & IEEE802154_FC_TYPE_MASK)); \
         } while (0)
 
-#define IEEE802154_FC_SECEN             (1 << 3)
-#define IEEE802154_FC_FRPEND            (1 << 4)
-#define IEEE802154_FC_ACK_REQ           (1 << 5)
-#define IEEE802154_FC_INTRA_PAN         (1 << 6)
+#define IEEE802154_FC_SECEN_SHIFT       3
+#define IEEE802154_FC_SECEN             (1 << IEEE802154_FC_SECEN_SHIFT)
+#define IEEE802154_FC_FRPEND_SHIFT      4
+#define IEEE802154_FC_FRPEND            (1 << IEEE802154_FC_FRPEND_SHIFT)
+#define IEEE802154_FC_ACK_REQ_SHIFT     5
+#define IEEE802154_FC_ACK_REQ           (1 << IEEE802154_FC_ACK_REQ_SHIFT)
+#define IEEE802154_FC_INTRA_PAN_SHIFT   6
+#define IEEE802154_FC_INTRA_PAN         (1 << IEEE802154_FC_INTRA_PAN_SHIFT)
 
 #define IEEE802154_FC_SAMODE_SHIFT      14
 #define IEEE802154_FC_SAMODE_MASK       (3 << IEEE802154_FC_SAMODE_SHIFT)
 #define IEEE802154_FC_DAMODE_SHIFT      10
 #define IEEE802154_FC_DAMODE_MASK       (3 << IEEE802154_FC_DAMODE_SHIFT)
 
+#define IEEE802154_FC_VERSION_SHIFT     12
+#define IEEE802154_FC_VERSION_MASK      (3 << IEEE802154_FC_VERSION_SHIFT)
+#define IEEE802154_FC_VERSION(x)        ((x & IEEE802154_FC_VERSION_MASK) >> IEEE802154_FC_VERSION_SHIFT)
+
 #define IEEE802154_FC_SAMODE(x)         \
         (((x) & IEEE802154_FC_SAMODE_MASK) >> IEEE802154_FC_SAMODE_SHIFT)
 
 #define IEEE802154_FC_DAMODE(x)         \
         (((x) & IEEE802154_FC_DAMODE_MASK) >> IEEE802154_FC_DAMODE_SHIFT)
 
+#define IEEE802154_SCF_SECLEVEL_MASK            7
+#define IEEE802154_SCF_SECLEVEL_SHIFT           0
+#define IEEE802154_SCF_SECLEVEL(x)              (x & IEEE802154_SCF_SECLEVEL_MASK)
+#define IEEE802154_SCF_KEY_ID_MODE_SHIFT        3
+#define IEEE802154_SCF_KEY_ID_MODE_MASK         (3 << IEEE802154_SCF_KEY_ID_MODE_SHIFT)
+#define IEEE802154_SCF_KEY_ID_MODE(x)           \
+        ((x & IEEE802154_SCF_KEY_ID_MODE_MASK) >> IEEE802154_SCF_KEY_ID_MODE_SHIFT)
+
+#define IEEE802154_SCF_KEY_IMPLICIT             0
+#define IEEE802154_SCF_KEY_INDEX                1
+#define IEEE802154_SCF_KEY_SHORT_INDEX          2
+#define IEEE802154_SCF_KEY_HW_INDEX             3
 
 /* MAC footer size */
 #define IEEE802154_MFR_SIZE     2 /* 2 octets */
diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
index 8196d5d40359..5a719ca892f4 100644
--- a/include/net/ieee802154_netdev.h
+++ b/include/net/ieee802154_netdev.h
@@ -28,6 +28,164 @@
 #define IEEE802154_NETDEVICE_H
 
 #include <net/af_ieee802154.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+
+struct ieee802154_sechdr {
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        u8 level:3,
+           key_id_mode:2,
+           reserved:3;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+        u8 reserved:3,
+           key_id_mode:2,
+           level:3;
+#else
+#error  "Please fix <asm/byteorder.h>"
+#endif
+        u8 key_id;
+        __le32 frame_counter;
+        union {
+                __le32 short_src;
+                __le64 extended_src;
+        };
+};
+
+struct ieee802154_addr {
+        u8 mode;
+        __le16 pan_id;
+        union {
+                __le16 short_addr;
+                __le64 extended_addr;
+        };
+};
+
+struct ieee802154_hdr_fc {
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        u16 type:3,
+            security_enabled:1,
+            frame_pending:1,
+            ack_request:1,
+            intra_pan:1,
+            reserved:3,
+            dest_addr_mode:2,
+            version:2,
+            source_addr_mode:2;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+        u16 reserved:1,
+            intra_pan:1,
+            ack_request:1,
+            frame_pending:1,
+            security_enabled:1,
+            type:3,
+            source_addr_mode:2,
+            version:2,
+            dest_addr_mode:2,
+            reserved2:2;
+#else
+#error  "Please fix <asm/byteorder.h>"
+#endif
+};
+
+struct ieee802154_hdr {
+        struct ieee802154_hdr_fc fc;
+        u8 seq;
+        struct ieee802154_addr source;
+        struct ieee802154_addr dest;
+        struct ieee802154_sechdr sec;
+};
+
+/* pushes hdr onto the skb. fields of hdr->fc that can be calculated from
+ * the contents of hdr will be, and the actual value of those bits in
+ * hdr->fc will be ignored. this includes the INTRA_PAN bit and the frame
+ * version, if SECEN is set.
+ */
+int ieee802154_hdr_push(struct sk_buff *skb, const struct ieee802154_hdr *hdr);
+
+/* pulls the entire 802.15.4 header off of the skb, including the security
+ * header, and performs pan id decompression
+ */
+int ieee802154_hdr_pull(struct sk_buff *skb, struct ieee802154_hdr *hdr);
+
+/* parses the frame control, sequence number of address fields in a given skb
+ * and stores them into hdr, performing pan id decompression and length checks
+ * to be suitable for use in header_ops.parse
+ */
+int ieee802154_hdr_peek_addrs(const struct sk_buff *skb,
+                              struct ieee802154_hdr *hdr);
+
+static inline int ieee802154_hdr_length(struct sk_buff *skb)
+{
+        struct ieee802154_hdr hdr;
+        int len = ieee802154_hdr_pull(skb, &hdr);
+
+        if (len > 0)
+                skb_push(skb, len);
+
+        return len;
+}
+
+static inline bool ieee802154_addr_equal(const struct ieee802154_addr *a1,
+                                         const struct ieee802154_addr *a2)
+{
+        if (a1->pan_id != a2->pan_id || a1->mode != a2->mode)
+                return false;
+
+        if ((a1->mode == IEEE802154_ADDR_LONG &&
+             a1->extended_addr != a2->extended_addr) ||
+            (a1->mode == IEEE802154_ADDR_SHORT &&
+             a1->short_addr != a2->short_addr))
+                return false;
+
+        return true;
+}
+
+static inline __le64 ieee802154_devaddr_from_raw(const void *raw)
+{
+        u64 temp;
+
+        memcpy(&temp, raw, IEEE802154_ADDR_LEN);
+        return (__force __le64)swab64(temp);
+}
+
+static inline void ieee802154_devaddr_to_raw(void *raw, __le64 addr)
+{
+        u64 temp = swab64((__force u64)addr);
+
+        memcpy(raw, &temp, IEEE802154_ADDR_LEN);
+}
+
+static inline void ieee802154_addr_from_sa(struct ieee802154_addr *a,
+                                           const struct ieee802154_addr_sa *sa)
+{
+        a->mode = sa->addr_type;
+        a->pan_id = cpu_to_le16(sa->pan_id);
+
+        switch (a->mode) {
+        case IEEE802154_ADDR_SHORT:
+                a->short_addr = cpu_to_le16(sa->short_addr);
+                break;
+        case IEEE802154_ADDR_LONG:
+                a->extended_addr = ieee802154_devaddr_from_raw(sa->hwaddr);
+                break;
+        }
+}
+
+static inline void ieee802154_addr_to_sa(struct ieee802154_addr_sa *sa,
+                                         const struct ieee802154_addr *a)
+{
+        sa->addr_type = a->mode;
+        sa->pan_id = le16_to_cpu(a->pan_id);
+
+        switch (a->mode) {
+        case IEEE802154_ADDR_SHORT:
+                sa->short_addr = le16_to_cpu(a->short_addr);
+                break;
+        case IEEE802154_ADDR_LONG:
+                ieee802154_devaddr_to_raw(sa->hwaddr, a->extended_addr);
+                break;
+        }
+}
 
 /*
  * A control block of skb passed between the ARPHRD_IEEE802154 device
@@ -35,10 +193,10 @@
  */
 struct ieee802154_mac_cb {
         u8 lqi;
-        struct ieee802154_addr sa;
-        struct ieee802154_addr da;
         u8 flags;
         u8 seq;
+        struct ieee802154_addr source;
+        struct ieee802154_addr dest;
 };
 
 static inline struct ieee802154_mac_cb *mac_cb(struct sk_buff *skb)
@@ -50,23 +208,17 @@ static inline struct ieee802154_mac_cb *mac_cb(struct sk_buff *skb)
 
 #define MAC_CB_FLAG_ACKREQ              (1 << 3)
 #define MAC_CB_FLAG_SECEN               (1 << 4)
-#define MAC_CB_FLAG_INTRAPAN            (1 << 5)
 
-static inline int mac_cb_is_ackreq(struct sk_buff *skb)
+static inline bool mac_cb_is_ackreq(struct sk_buff *skb)
 {
         return mac_cb(skb)->flags & MAC_CB_FLAG_ACKREQ;
 }
 
-static inline int mac_cb_is_secen(struct sk_buff *skb)
+static inline bool mac_cb_is_secen(struct sk_buff *skb)
 {
         return mac_cb(skb)->flags & MAC_CB_FLAG_SECEN;
 }
 
-static inline int mac_cb_is_intrapan(struct sk_buff *skb)
-{
-        return mac_cb(skb)->flags & MAC_CB_FLAG_INTRAPAN;
-}
-
 static inline int mac_cb_type(struct sk_buff *skb)
 {
         return mac_cb(skb)->flags & MAC_CB_FLAG_TYPEMASK;
@@ -77,6 +229,18 @@ static inline int mac_cb_type(struct sk_buff *skb)
 #define IEEE802154_MAC_SCAN_PASSIVE     2
 #define IEEE802154_MAC_SCAN_ORPHAN      3
 
+struct ieee802154_mac_params {
+        s8 transmit_power;
+        u8 min_be;
+        u8 max_be;
+        u8 csma_retries;
+        s8 frame_retries;
+
+        bool lbt;
+        u8 cca_mode;
+        s32 cca_ed_level;
+};
+
 struct wpan_phy;
 /*
  * This should be located at net_device->ml_priv
@@ -92,7 +256,7 @@ struct ieee802154_mlme_ops {
                         u8 channel, u8 page, u8 cap);
         int (*assoc_resp)(struct net_device *dev,
                         struct ieee802154_addr *addr,
-                        u16 short_addr, u8 status);
+                        __le16 short_addr, u8 status);
         int (*disassoc_req)(struct net_device *dev,
                         struct ieee802154_addr *addr,
                         u8 reason);
@@ -103,6 +267,11 @@ struct ieee802154_mlme_ops {
         int (*scan_req)(struct net_device *dev,
                         u8 type, u32 channels, u8 page, u8 duration);
 
+        int (*set_mac_params)(struct net_device *dev,
+                              const struct ieee802154_mac_params *params);
+        void (*get_mac_params)(struct net_device *dev,
+                               struct ieee802154_mac_params *params);
+
         /* The fields below are required. */
 
         struct wpan_phy *(*get_phy)(const struct net_device *dev);
@@ -111,8 +280,8 @@ struct ieee802154_mlme_ops {
          * FIXME: these should become the part of PIB/MIB interface.
          * However we still don't have IB interface of any kind
          */
-        u16 (*get_pan_id)(const struct net_device *dev);
-        u16 (*get_short_addr)(const struct net_device *dev);
+        __le16 (*get_pan_id)(const struct net_device *dev);
+        __le16 (*get_short_addr)(const struct net_device *dev);
         u8 (*get_dsn)(const struct net_device *dev);
 };
 
diff --git a/include/net/ip.h b/include/net/ip.h
index 23be0fd37937..25064c28e059 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -187,6 +187,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
 #define NET_INC_STATS(net, field)       SNMP_INC_STATS((net)->mib.net_statistics, field)
 #define NET_INC_STATS_BH(net, field)    SNMP_INC_STATS_BH((net)->mib.net_statistics, field)
 #define NET_INC_STATS_USER(net, field)  SNMP_INC_STATS_USER((net)->mib.net_statistics, field)
+#define NET_ADD_STATS(net, field, adnd) SNMP_ADD_STATS((net)->mib.net_statistics, field, adnd)
 #define NET_ADD_STATS_BH(net, field, adnd) SNMP_ADD_STATS_BH((net)->mib.net_statistics, field, adnd)
 #define NET_ADD_STATS_USER(net, field, adnd) SNMP_ADD_STATS_USER((net)->mib.net_statistics, field, adnd)
 
@@ -266,7 +267,8 @@ int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
 
 static inline bool ip_sk_accept_pmtu(const struct sock *sk)
 {
-        return inet_sk(sk)->pmtudisc != IP_PMTUDISC_INTERFACE;
+        return inet_sk(sk)->pmtudisc != IP_PMTUDISC_INTERFACE &&
+               inet_sk(sk)->pmtudisc != IP_PMTUDISC_OMIT;
 }
 
 static inline bool ip_sk_use_pmtu(const struct sock *sk)
@@ -274,6 +276,12 @@ static inline bool ip_sk_use_pmtu(const struct sock *sk)
         return inet_sk(sk)->pmtudisc < IP_PMTUDISC_PROBE;
 }
 
+static inline bool ip_sk_local_df(const struct sock *sk)
+{
+        return inet_sk(sk)->pmtudisc < IP_PMTUDISC_DO ||
+               inet_sk(sk)->pmtudisc == IP_PMTUDISC_OMIT;
+}
+
 static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
                                                     bool forwarding)
 {
@@ -489,7 +497,8 @@ int ip_options_rcv_srr(struct sk_buff *skb);
 
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb);
 void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb);
-int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc);
+int ip_cmsg_send(struct net *net, struct msghdr *msg,
+                 struct ipcm_cookie *ipc, bool allow_ipv6);
 int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                   unsigned int optlen);
 int ip_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index aca0c2709fd6..9bcb220bd4ad 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -284,7 +284,8 @@ struct fib6_node *fib6_locate(struct fib6_node *root,
 void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
                     void *arg);
 
-int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info);
+int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info,
+             struct nlattr *mx, int mx_len);
 
 int fib6_del(struct rt6_info *rt, struct nl_info *info);
 
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 017badb1aec7..3c3bb184eb8f 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -51,6 +51,11 @@ static inline unsigned int rt6_flags2srcprefs(int flags)
         return (flags >> 3) & 7;
 }
 
+static inline bool rt6_need_strict(const struct in6_addr *daddr)
+{
+        return ipv6_addr_type(daddr) &
+                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
+}
 
 void ip6_route_input(struct sk_buff *skb);
 
@@ -171,7 +176,14 @@ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
 
 static inline bool ip6_sk_accept_pmtu(const struct sock *sk)
 {
-        return inet6_sk(sk)->pmtudisc != IPV6_PMTUDISC_INTERFACE;
+        return inet6_sk(sk)->pmtudisc != IPV6_PMTUDISC_INTERFACE &&
+               inet6_sk(sk)->pmtudisc != IPV6_PMTUDISC_OMIT;
+}
+
+static inline bool ip6_sk_local_df(const struct sock *sk)
+{
+        return inet6_sk(sk)->pmtudisc < IPV6_PMTUDISC_DO ||
+               inet6_sk(sk)->pmtudisc == IPV6_PMTUDISC_OMIT;
 }
 
 static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 703b1f1456fc..8248e3909fdf 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -66,10 +66,6 @@
  *
  * Secondly, when the hardware handles fragmentation, the frame handed to
  * the driver from mac80211 is the MSDU, not the MPDU.
- *
- * Finally, for received frames, the driver is able to indicate that it has
- * filled a radiotap header and put that in front of the frame; if it does
- * not do so then mac80211 may add this under certain circumstances.
  */
 
 /**
@@ -701,11 +697,11 @@ struct ieee80211_tx_info {
                 } control;
                 struct {
                         struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
-                        int ack_signal;
+                        s32 ack_signal;
                         u8 ampdu_ack_len;
                         u8 ampdu_len;
                         u8 antenna;
-                        /* 21 bytes free */
+                        void *status_driver_data[21 / sizeof(void *)];
                 } status;
                 struct {
                         struct ieee80211_tx_rate driver_rates[
@@ -808,9 +804,6 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  * @RX_FLAG_HT: HT MCS was used and rate_idx is MCS index
  * @RX_FLAG_VHT: VHT MCS was used and rate_index is MCS index
  * @RX_FLAG_40MHZ: HT40 (40 MHz) was used
- * @RX_FLAG_80MHZ: 80 MHz was used
- * @RX_FLAG_80P80MHZ: 80+80 MHz was used
- * @RX_FLAG_160MHZ: 160 MHz was used
  * @RX_FLAG_SHORT_GI: Short guard interval was used
  * @RX_FLAG_NO_SIGNAL_VAL: The signal strength value is not present.
  *      Valid only for data frames (mainly A-MPDU)
@@ -830,6 +823,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  *      on this subframe
  * @RX_FLAG_AMPDU_DELIM_CRC_KNOWN: The delimiter CRC field is known (the CRC
  *      is stored in the @ampdu_delimiter_crc field)
+ * @RX_FLAG_LDPC: LDPC was used
  * @RX_FLAG_STBC_MASK: STBC 2 bit bitmask. 1 - Nss=1, 2 - Nss=2, 3 - Nss=3
  * @RX_FLAG_10MHZ: 10 MHz (half channel) was used
  * @RX_FLAG_5MHZ: 5 MHz (quarter channel) was used
@@ -866,9 +860,7 @@ enum mac80211_rx_flags {
         RX_FLAG_AMPDU_DELIM_CRC_KNOWN   = BIT(20),
         RX_FLAG_MACTIME_END             = BIT(21),
         RX_FLAG_VHT                     = BIT(22),
-        RX_FLAG_80MHZ                   = BIT(23),
-        RX_FLAG_80P80MHZ                = BIT(24),
-        RX_FLAG_160MHZ                  = BIT(25),
+        RX_FLAG_LDPC                    = BIT(23),
         RX_FLAG_STBC_MASK               = BIT(26) | BIT(27),
         RX_FLAG_10MHZ                   = BIT(28),
         RX_FLAG_5MHZ                    = BIT(29),
@@ -878,6 +870,23 @@ enum mac80211_rx_flags {
 #define RX_FLAG_STBC_SHIFT              26
 
 /**
+ * enum mac80211_rx_vht_flags - receive VHT flags
+ *
+ * These flags are used with the @vht_flag member of
+ *      &struct ieee80211_rx_status.
+ * @RX_VHT_FLAG_80MHZ: 80 MHz was used
+ * @RX_VHT_FLAG_80P80MHZ: 80+80 MHz was used
+ * @RX_VHT_FLAG_160MHZ: 160 MHz was used
+ * @RX_VHT_FLAG_BF: packet was beamformed
+ */
+enum mac80211_rx_vht_flags {
+        RX_VHT_FLAG_80MHZ               = BIT(0),
+        RX_VHT_FLAG_80P80MHZ            = BIT(1),
+        RX_VHT_FLAG_160MHZ              = BIT(2),
+        RX_VHT_FLAG_BF                  = BIT(3),
+};
+
+/**
  * struct ieee80211_rx_status - receive status
  *
  * The low-level driver should provide this information (the subset
@@ -902,26 +911,19 @@ enum mac80211_rx_flags {
  *      HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
  * @vht_nss: number of streams (VHT only)
  * @flag: %RX_FLAG_*
+ * @vht_flag: %RX_VHT_FLAG_*
  * @rx_flags: internal RX flags for mac80211
  * @ampdu_reference: A-MPDU reference number, must be a different value for
  *      each A-MPDU but the same for each subframe within one A-MPDU
  * @ampdu_delimiter_crc: A-MPDU delimiter CRC
- * @vendor_radiotap_bitmap: radiotap vendor namespace presence bitmap
- * @vendor_radiotap_len: radiotap vendor namespace length
- * @vendor_radiotap_align: radiotap vendor namespace alignment. Note
- *      that the actual data must be at the start of the SKB data
- *      already.
- * @vendor_radiotap_oui: radiotap vendor namespace OUI
- * @vendor_radiotap_subns: radiotap vendor sub namespace
  */
 struct ieee80211_rx_status {
         u64 mactime;
         u32 device_timestamp;
         u32 ampdu_reference;
         u32 flag;
-        u32 vendor_radiotap_bitmap;
-        u16 vendor_radiotap_len;
         u16 freq;
+        u8 vht_flag;
         u8 rate_idx;
         u8 vht_nss;
         u8 rx_flags;
@@ -931,9 +933,6 @@ struct ieee80211_rx_status {
         u8 chains;
         s8 chain_signal[IEEE80211_MAX_CHAINS];
         u8 ampdu_delimiter_crc;
-        u8 vendor_radiotap_align;
-        u8 vendor_radiotap_oui[3];
-        u8 vendor_radiotap_subns;
 };
 
 /**
@@ -1506,8 +1505,6 @@ struct ieee80211_tx_control {
  * @IEEE80211_HW_CONNECTION_MONITOR:
  *      The hardware performs its own connection monitoring, including
  *      periodic keep-alives to the AP and probing the AP on beacon loss.
- *      When this flag is set, signaling beacon-loss will cause an immediate
- *      change to disassociated state.
  *
  * @IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC:
  *      This device needs to get data from beacon before association (i.e.
@@ -1643,10 +1640,6 @@ enum ieee80211_hw_flags {
  *      the hw can report back.
  * @max_rate_tries: maximum number of tries for each stage
  *
- * @napi_weight: weight used for NAPI polling.  You must specify an
- *      appropriate value here if a napi_poll operation is provided
- *      by your driver.
- *
  * @max_rx_aggregation_subframes: maximum buffer size (number of
  *      sub-frames) to be used for A-MPDU block ack receiver
  *      aggregation.
@@ -1700,7 +1693,6 @@ struct ieee80211_hw {
         int vif_data_size;
         int sta_data_size;
         int chanctx_data_size;
-        int napi_weight;
         u16 queues;
         u16 max_listen_interval;
         s8 max_signal;
@@ -2470,6 +2462,7 @@ enum ieee80211_roc_type {
  *      This process will continue until sched_scan_stop is called.
  *
  * @sched_scan_stop: Tell the hardware to stop an ongoing scheduled scan.
+ *      In this case, ieee80211_sched_scan_stopped() must not be called.
  *
  * @sw_scan_start: Notifier function that is called just before a software scan
  *      is started. Can be NULL, if the driver doesn't need this notification.
@@ -2623,8 +2616,6 @@ enum ieee80211_roc_type {
  *      callback. They must then call ieee80211_chswitch_done() to indicate
  *      completion of the channel switch.
  *
- * @napi_poll: Poll Rx queue for incoming data frames.
- *
  * @set_antenna: Set antenna configuration (tx_ant, rx_ant) on the device.
  *      Parameters are bitmaps of allowed antennas to use for TX/RX. Drivers may
  *      reject TX/RX mask combinations they cannot support by returning -EINVAL
@@ -2750,11 +2741,13 @@ enum ieee80211_roc_type {
  * @channel_switch_beacon: Starts a channel switch to a new channel.
  *      Beacons are modified to include CSA or ECSA IEs before calling this
  *      function. The corresponding count fields in these IEs must be
- *      decremented, and when they reach zero the driver must call
+ *      decremented, and when they reach 1 the driver must call
  *      ieee80211_csa_finish(). Drivers which use ieee80211_beacon_get()
  *      get the csa counter decremented by mac80211, but must check if it is
- *      zero using ieee80211_csa_is_complete() after the beacon has been
+ *      1 using ieee80211_csa_is_complete() after the beacon has been
  *      transmitted and then call ieee80211_csa_finish().
+ *      If the CSA count starts as zero or 1, this function will not be called,
+ *      since there won't be any time to beacon before the switch anyway.
  *
  * @join_ibss: Join an IBSS (on an IBSS interface); this is called after all
  *      information in bss_conf is set up and the beacon can be retrieved. A
@@ -2817,7 +2810,7 @@ struct ieee80211_ops {
                                 struct ieee80211_vif *vif,
                                 struct cfg80211_sched_scan_request *req,
                                 struct ieee80211_sched_scan_ies *ies);
-        void (*sched_scan_stop)(struct ieee80211_hw *hw,
+        int (*sched_scan_stop)(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif);
         void (*sw_scan_start)(struct ieee80211_hw *hw);
         void (*sw_scan_complete)(struct ieee80211_hw *hw);
@@ -2881,7 +2874,6 @@ struct ieee80211_ops {
         void (*flush)(struct ieee80211_hw *hw, u32 queues, bool drop);
         void (*channel_switch)(struct ieee80211_hw *hw,
                                struct ieee80211_channel_switch *ch_switch);
-        int (*napi_poll)(struct ieee80211_hw *hw, int budget);
         int (*set_antenna)(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant);
         int (*get_antenna)(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant);
 
@@ -3163,21 +3155,21 @@ void ieee80211_free_hw(struct ieee80211_hw *hw);
  */
 void ieee80211_restart_hw(struct ieee80211_hw *hw);
 
-/** ieee80211_napi_schedule - schedule NAPI poll
- *
- * Use this function to schedule NAPI polling on a device.
- *
- * @hw: the hardware to start polling
- */
-void ieee80211_napi_schedule(struct ieee80211_hw *hw);
-
-/** ieee80211_napi_complete - complete NAPI polling
- *
- * Use this function to finish NAPI polling on a device.
+/**
+ * ieee80211_napi_add - initialize mac80211 NAPI context
+ * @hw: the hardware to initialize the NAPI context on
+ * @napi: the NAPI context to initialize
+ * @napi_dev: dummy NAPI netdevice, here to not waste the space if the
+ *      driver doesn't use NAPI
+ * @poll: poll function
+ * @weight: default weight
  *
- * @hw: the hardware to stop polling
+ * See also netif_napi_add().
  */
-void ieee80211_napi_complete(struct ieee80211_hw *hw);
+void ieee80211_napi_add(struct ieee80211_hw *hw, struct napi_struct *napi,
+                        struct net_device *napi_dev,
+                        int (*poll)(struct napi_struct *, int),
+                        int weight);
 
 /**
  * ieee80211_rx - receive frame
@@ -3452,13 +3444,13 @@ static inline struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
  * After a channel switch announcement was scheduled and the counter in this
- * announcement hit zero, this function must be called by the driver to
+ * announcement hits 1, this function must be called by the driver to
  * notify mac80211 that the channel can be changed.
  */
 void ieee80211_csa_finish(struct ieee80211_vif *vif);
 
 /**
- * ieee80211_csa_is_complete - find out if counters reached zero
+ * ieee80211_csa_is_complete - find out if counters reached 1
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
  * This function returns whether the channel switch counters reached zero.
@@ -4451,7 +4443,6 @@ struct ieee80211_tx_rate_control {
 };
 
 struct rate_control_ops {
-        struct module *module;
         const char *name;
         void *(*alloc)(struct ieee80211_hw *hw, struct dentry *debugfsdir);
         void (*free)(void *priv);
@@ -4553,8 +4544,8 @@ int rate_control_set_rates(struct ieee80211_hw *hw,
                            struct ieee80211_sta *pubsta,
                            struct ieee80211_sta_rates *rates);
 
-int ieee80211_rate_control_register(struct rate_control_ops *ops);
-void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
+int ieee80211_rate_control_register(const struct rate_control_ops *ops);
+void ieee80211_rate_control_unregister(const struct rate_control_ops *ops);
 
 static inline bool
 conf_is_ht20(struct ieee80211_conf *conf)
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index 807d6b7a943f..a591053cae63 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -20,6 +20,7 @@
 #define NET_MAC802154_H
 
 #include <net/af_ieee802154.h>
+#include <linux/skbuff.h>
 
 /* General MAC frame format:
  *  2 bytes: Frame Control
@@ -50,7 +51,7 @@ struct ieee802154_hw_addr_filt {
                                  * devices across independent networks.
                                  */
         __le16  short_addr;
-        u8      ieee_addr[IEEE802154_ADDR_LEN];
+        __le64  ieee_addr;
         u8      pan_coord;
 };
 
@@ -113,6 +114,32 @@ struct ieee802154_dev {
  *        Set radio for listening on specific address.
  *        Set the device for listening on specified address.
  *        Returns either zero, or negative errno.
+ *
+ * set_txpower:
+ *        Set radio transmit power in dB. Called with pib_lock held.
+ *        Returns either zero, or negative errno.
+ *
+ * set_lbt
+ *        Enables or disables listen before talk on the device. Called with
+ *        pib_lock held.
+ *        Returns either zero, or negative errno.
+ *
+ * set_cca_mode
+ *        Sets the CCA mode used by the device. Called with pib_lock held.
+ *        Returns either zero, or negative errno.
+ *
+ * set_cca_ed_level
+ *        Sets the CCA energy detection threshold in dBm. Called with pib_lock
+ *        held.
+ *        Returns either zero, or negative errno.
+ *
+ * set_csma_params
+ *        Sets the CSMA parameter set for the PHY. Called with pib_lock held.
+ *        Returns either zero, or negative errno.
+ *
+ * set_frame_retries
+ *        Sets the retransmission attempt limit. Called with pib_lock held.
+ *        Returns either zero, or negative errno.
  */
 struct ieee802154_ops {
         struct module   *owner;
@@ -127,8 +154,16 @@ struct ieee802154_ops {
         int             (*set_hw_addr_filt)(struct ieee802154_dev *dev,
                                           struct ieee802154_hw_addr_filt *filt,
                                             unsigned long changed);
-        int             (*ieee_addr)(struct ieee802154_dev *dev,
-                                     u8 addr[IEEE802154_ADDR_LEN]);
+        int             (*ieee_addr)(struct ieee802154_dev *dev, __le64 addr);
+        int             (*set_txpower)(struct ieee802154_dev *dev, int db);
+        int             (*set_lbt)(struct ieee802154_dev *dev, bool on);
+        int             (*set_cca_mode)(struct ieee802154_dev *dev, u8 mode);
+        int             (*set_cca_ed_level)(struct ieee802154_dev *dev,
+                                            s32 level);
+        int             (*set_csma_params)(struct ieee802154_dev *dev,
+                                           u8 min_be, u8 max_be, u8 retries);
+        int             (*set_frame_retries)(struct ieee802154_dev *dev,
+                                             s8 retries);
 };
 
 /* Basic interface to register ieee802154 device */
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 991dcd94cbbf..79387f73f875 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -15,6 +15,7 @@
 #include <net/netns/packet.h>
 #include <net/netns/ipv4.h>
 #include <net/netns/ipv6.h>
+#include <net/netns/ieee802154_6lowpan.h>
 #include <net/netns/sctp.h>
 #include <net/netns/dccp.h>
 #include <net/netns/netfilter.h>
@@ -90,6 +91,9 @@ struct net {
 #if IS_ENABLED(CONFIG_IPV6)
         struct netns_ipv6       ipv6;
 #endif
+#if IS_ENABLED(CONFIG_IEEE802154_6LOWPAN)
+        struct netns_ieee802154_lowpan  ieee802154_lowpan;
+#endif
 #if defined(CONFIG_IP_SCTP) || defined(CONFIG_IP_SCTP_MODULE)
         struct netns_sctp       sctp;
 #endif
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index b2ac6246b7e0..37252f71a380 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -73,10 +73,17 @@ struct nf_conn_help {
 
 struct nf_conn {
         /* Usage count in here is 1 for hash table/destruct timer, 1 per skb,
-           plus 1 for any connection(s) we are `master' for */
+         * plus 1 for any connection(s) we are `master' for
+         *
+         * Hint, SKB address this struct and refcnt via skb->nfct and
+         * helpers nf_conntrack_get() and nf_conntrack_put().
+         * Helper nf_ct_put() equals nf_conntrack_put() by dec refcnt,
+         * beware nf_ct_get() is different and don't inc refcnt.
+         */
         struct nf_conntrack ct_general;
 
-        spinlock_t lock;
+        spinlock_t      lock;
+        u16             cpu;
 
         /* XXX should I move this to the tail ? - Y.K */
         /* These are my tuples; original and reply */
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 15308b8eb5b5..cc0c18827602 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -77,6 +77,13 @@ print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
             const struct nf_conntrack_l3proto *l3proto,
             const struct nf_conntrack_l4proto *proto);
 
-extern spinlock_t nf_conntrack_lock ;
+#ifdef CONFIG_LOCKDEP
+# define CONNTRACK_LOCKS 8
+#else
+# define CONNTRACK_LOCKS 1024
+#endif
+extern spinlock_t nf_conntrack_locks[CONNTRACK_LOCKS];
+
+extern spinlock_t nf_conntrack_expect_lock;
 
 #endif /* _NF_CONNTRACK_CORE_H */
diff --git a/include/net/netfilter/nf_conntrack_labels.h b/include/net/netfilter/nf_conntrack_labels.h
index c985695283b3..dec6336bf850 100644
--- a/include/net/netfilter/nf_conntrack_labels.h
+++ b/include/net/netfilter/nf_conntrack_labels.h
@@ -7,6 +7,8 @@
 
 #include <uapi/linux/netfilter/xt_connlabel.h>
 
+#define NF_CT_LABELS_MAX_SIZE ((XT_CONNLABEL_MAXBIT + 1) / BITS_PER_BYTE)
+
 struct nf_conn_labels {
         u8 words;
         unsigned long bits[];
@@ -29,7 +31,7 @@ static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct)
         u8 words;
 
         words = ACCESS_ONCE(net->ct.label_words);
-        if (words == 0 || WARN_ON_ONCE(words > 8))
+        if (words == 0)
                 return NULL;
 
         cl_ext = nf_ct_ext_add_length(ct, NF_CT_EXT_LABELS,
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index e7e14ffe0f6a..e6bc14d8fa9a 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -3,6 +3,7 @@
 
 #include <linux/list.h>
 #include <linux/netfilter.h>
+#include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netlink.h>
@@ -288,7 +289,8 @@ struct nft_expr_ops {
         int                             (*init)(const struct nft_ctx *ctx,
                                                 const struct nft_expr *expr,
                                                 const struct nlattr * const tb[]);
-        void                            (*destroy)(const struct nft_expr *expr);
+        void                            (*destroy)(const struct nft_ctx *ctx,
+                                                   const struct nft_expr *expr);
         int                             (*dump)(struct sk_buff *skb,
                                                 const struct nft_expr *expr);
         int                             (*validate)(const struct nft_ctx *ctx,
@@ -325,13 +327,15 @@ static inline void *nft_expr_priv(const struct nft_expr *expr)
  *      @handle: rule handle
  *      @genmask: generation mask
  *      @dlen: length of expression data
+ *      @ulen: length of user data (used for comments)
  *      @data: expression data
  */
 struct nft_rule {
         struct list_head                list;
-        u64                             handle:46,
+        u64                             handle:42,
                                         genmask:2,
-                                        dlen:16;
+                                        dlen:12,
+                                        ulen:8;
         unsigned char                   data[]
                 __attribute__((aligned(__alignof__(struct nft_expr))));
 };
@@ -340,19 +344,13 @@ struct nft_rule {
  *      struct nft_rule_trans - nf_tables rule update in transaction
  *
  *      @list: used internally
+ *      @ctx: rule context
  *      @rule: rule that needs to be updated
- *      @chain: chain that this rule belongs to
- *      @table: table for which this chain applies
- *      @nlh: netlink header of the message that contain this update
- *      @family: family expressesed as AF_*
  */
 struct nft_rule_trans {
         struct list_head                list;
+        struct nft_ctx                  ctx;
         struct nft_rule                 *rule;
-        const struct nft_chain          *chain;
-        const struct nft_table          *table;
-        const struct nlmsghdr           *nlh;
-        u8                              family;
 };
 
 static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule)
@@ -370,6 +368,11 @@ static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule)
         return (struct nft_expr *)&rule->data[rule->dlen];
 }
 
+static inline void *nft_userdata(const struct nft_rule *rule)
+{
+        return (void *)&rule->data[rule->dlen];
+}
+
 /*
  * The last pointer isn't really necessary, but the compiler isn't able to
  * determine that the result of nft_expr_last() is always the same since it
@@ -521,6 +524,9 @@ void nft_unregister_chain_type(const struct nf_chain_type *);
 int nft_register_expr(struct nft_expr_type *);
 void nft_unregister_expr(struct nft_expr_type *);
 
+#define nft_dereference(p)                                      \
+        nfnl_dereference(p, NFNL_SUBSYS_NFTABLES)
+
 #define MODULE_ALIAS_NFT_FAMILY(family) \
         MODULE_ALIAS("nft-afinfo-" __stringify(family))
 
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index fbcc7fa536dc..773cce308bc6 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -5,6 +5,7 @@
 #include <linux/list_nulls.h>
 #include <linux/atomic.h>
 #include <linux/netfilter/nf_conntrack_tcp.h>
+#include <linux/seqlock.h>
 
 struct ctl_table_header;
 struct nf_conntrack_ecache;
@@ -62,6 +63,13 @@ struct nf_ip_net {
 #endif
 };
 
+struct ct_pcpu {
+        spinlock_t              lock;
+        struct hlist_nulls_head unconfirmed;
+        struct hlist_nulls_head dying;
+        struct hlist_nulls_head tmpl;
+};
+
 struct netns_ct {
         atomic_t                count;
         unsigned int            expect_count;
@@ -83,12 +91,11 @@ struct netns_ct {
         int                     sysctl_checksum;
 
         unsigned int            htable_size;
+        seqcount_t              generation;
         struct kmem_cache       *nf_conntrack_cachep;
         struct hlist_nulls_head *hash;
         struct hlist_head       *expect_hash;
-        struct hlist_nulls_head unconfirmed;
-        struct hlist_nulls_head dying;
-        struct hlist_nulls_head tmpl;
+        struct ct_pcpu __percpu *pcpu_lists;
         struct ip_conntrack_stat __percpu *stat;
         struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb;
         struct nf_exp_event_notifier __rcu *nf_expect_event_cb;
diff --git a/include/net/netns/ieee802154_6lowpan.h b/include/net/netns/ieee802154_6lowpan.h
new file mode 100644
index 000000000000..079030c853d8
--- /dev/null
+++ b/include/net/netns/ieee802154_6lowpan.h
@@ -0,0 +1,22 @@
+/*
+ * ieee802154 6lowpan in net namespaces
+ */
+
+#include <net/inet_frag.h>
+
+#ifndef __NETNS_IEEE802154_6LOWPAN_H__
+#define __NETNS_IEEE802154_6LOWPAN_H__
+
+struct netns_sysctl_lowpan {
+#ifdef CONFIG_SYSCTL
+        struct ctl_table_header *frags_hdr;
+#endif
+};
+
+struct netns_ieee802154_lowpan {
+        struct netns_sysctl_lowpan sysctl;
+        struct netns_frags      frags;
+        u16                     max_dsize;
+};
+
+#endif
diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
index 1006a265beb3..3492434baf88 100644
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -6,6 +6,7 @@
 #include <linux/workqueue.h>
 #include <linux/xfrm.h>
 #include <net/dst_ops.h>
+#include <net/flowcache.h>
 
 struct ctl_table_header;
 
@@ -58,9 +59,17 @@ struct netns_xfrm {
         struct dst_ops          xfrm6_dst_ops;
 #endif
         spinlock_t xfrm_state_lock;
-        spinlock_t xfrm_policy_sk_bundle_lock;
         rwlock_t xfrm_policy_lock;
         struct mutex xfrm_cfg_mutex;
+
+        /* flow cache part */
+        struct flow_cache       flow_cache_global;
+        atomic_t                flow_cache_genid;
+        struct list_head        flow_cache_gc_list;
+        spinlock_t              flow_cache_gc_lock;
+        struct work_struct      flow_cache_gc_work;
+        struct work_struct      flow_cache_flush_work;
+        struct mutex            flow_flush_sem;
 };
 
 #endif
diff --git a/include/net/nfc/digital.h b/include/net/nfc/digital.h
index 81af21e9bcd4..7655cfe27c34 100644
--- a/include/net/nfc/digital.h
+++ b/include/net/nfc/digital.h
@@ -35,6 +35,7 @@ enum {
         NFC_DIGITAL_RF_TECH_106A = 0,
         NFC_DIGITAL_RF_TECH_212F,
         NFC_DIGITAL_RF_TECH_424F,
+        NFC_DIGITAL_RF_TECH_ISO15693,
 
         NFC_DIGITAL_RF_TECH_LAST,
 };
@@ -50,6 +51,7 @@ enum {
 
         NFC_DIGITAL_FRAMING_NFCA_T1T,
         NFC_DIGITAL_FRAMING_NFCA_T2T,
+        NFC_DIGITAL_FRAMING_NFCA_T4T,
         NFC_DIGITAL_FRAMING_NFCA_NFC_DEP,
 
         NFC_DIGITAL_FRAMING_NFCF,
@@ -57,6 +59,9 @@ enum {
         NFC_DIGITAL_FRAMING_NFCF_NFC_DEP,
         NFC_DIGITAL_FRAMING_NFC_DEP_ACTIVATED,
 
+        NFC_DIGITAL_FRAMING_ISO15693_INVENTORY,
+        NFC_DIGITAL_FRAMING_ISO15693_T5T,
+
         NFC_DIGITAL_FRAMING_LAST,
 };
 
@@ -204,6 +209,8 @@ struct nfc_digital_dev {
         u8 curr_rf_tech;
         u8 curr_nfc_dep_pni;
 
+        u16 target_fsc;
+
         int (*skb_check_crc)(struct sk_buff *skb);
         void (*skb_add_crc)(struct sk_buff *skb);
 };
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index e80894bca1d0..2e8b40c16274 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -111,6 +111,9 @@ struct nfc_target {
         u8 sensf_res[NFC_SENSF_RES_MAXSIZE];
         u8 hci_reader_gate;
         u8 logical_idx;
+        u8 is_iso15693;
+        u8 iso15693_dsfid;
+        u8 iso15693_uid[NFC_ISO15693_UID_MAXSIZE];
 };
 
 /**
diff --git a/include/net/nl802154.h b/include/net/nl802154.h
index 99d2ba1c7e03..b23548e04098 100644
--- a/include/net/nl802154.h
+++ b/include/net/nl802154.h
@@ -52,7 +52,7 @@ int ieee802154_nl_assoc_indic(struct net_device *dev,
  * Note: This is in section 7.3.2 of the IEEE 802.15.4 document.
  */
 int ieee802154_nl_assoc_confirm(struct net_device *dev,
-                u16 short_addr, u8 status);
+                __le16 short_addr, u8 status);
 
 /**
  * ieee802154_nl_disassoc_indic - Notify userland of disassociation.
@@ -111,8 +111,8 @@ int ieee802154_nl_scan_confirm(struct net_device *dev,
  * Note: This API cannot indicate a beacon frame for a coordinator
  *       operating in long addressing mode.
  */
-int ieee802154_nl_beacon_indic(struct net_device *dev, u16 panid,
-                u16 coord_addr);
+int ieee802154_nl_beacon_indic(struct net_device *dev, __le16 panid,
+                __le16 coord_addr);
 
 /**
  * ieee802154_nl_start_confirm - Notify userland of completion of start.
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index b07cdc9fa454..75fc1f5a948d 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -155,6 +155,7 @@ struct ieee80211_reg_rule {
         struct ieee80211_freq_range freq_range;
         struct ieee80211_power_rule power_rule;
         u32 flags;
+        u32 dfs_cac_ms;
 };
 
 struct ieee80211_regdomain {
@@ -172,14 +173,18 @@ struct ieee80211_regdomain {
 #define DBM_TO_MBM(gain) ((gain) * 100)
 #define MBM_TO_DBM(gain) ((gain) / 100)
 
-#define REG_RULE(start, end, bw, gain, eirp, reg_flags) \
-{                                                       \
-        .freq_range.start_freq_khz = MHZ_TO_KHZ(start), \
-        .freq_range.end_freq_khz = MHZ_TO_KHZ(end),     \
-        .freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw), \
-        .power_rule.max_antenna_gain = DBI_TO_MBI(gain),\
-        .power_rule.max_eirp = DBM_TO_MBM(eirp),        \
-        .flags = reg_flags,                             \
+#define REG_RULE_EXT(start, end, bw, gain, eirp, dfs_cac, reg_flags)    \
+{                                                                       \
+        .freq_range.start_freq_khz = MHZ_TO_KHZ(start),                 \
+        .freq_range.end_freq_khz = MHZ_TO_KHZ(end),                     \
+        .freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw),                 \
+        .power_rule.max_antenna_gain = DBI_TO_MBI(gain),                \
+        .power_rule.max_eirp = DBM_TO_MBM(eirp),                        \
+        .flags = reg_flags,                                             \
+        .dfs_cac_ms = dfs_cac,                                          \
 }
 
+#define REG_RULE(start, end, bw, gain, eirp, reg_flags) \
+        REG_RULE_EXT(start, end, bw, gain, eirp, 0, reg_flags)
+
 #endif
diff --git a/include/net/route.h b/include/net/route.h
index 9d1f423d5944..b17cf28f996e 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -191,7 +191,6 @@ unsigned int inet_dev_addr_type(struct net *net, const struct net_device *dev,
 void ip_rt_multicast_event(struct in_device *);
 int ip_rt_ioctl(struct net *, unsigned int cmd, void __user *arg);
 void ip_rt_get_source(u8 *src, struct sk_buff *skb, struct rtable *rt);
-int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb);
 
 struct in_ifaddr;
 void fib_add_ifaddr(struct in_ifaddr *);
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 661e45d38051..72240e5ac2c4 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -140,7 +140,7 @@ struct net_device *rtnl_create_link(struct net *net, char *ifname,
                                     struct nlattr *tb[]);
 int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm);
 
-extern const struct nla_policy ifla_policy[IFLA_MAX+1];
+int rtnl_nla_parse_ifla(struct nlattr **tb, const struct nlattr *head, int len);
 
 #define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)
 
diff --git a/include/net/sock.h b/include/net/sock.h
index b9586a137cad..06a5668f05c9 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -862,9 +862,9 @@ static inline void sock_rps_save_rxhash(struct sock *sk,
                                         const struct sk_buff *skb)
 {
 #ifdef CONFIG_RPS
-        if (unlikely(sk->sk_rxhash != skb->rxhash)) {
+        if (unlikely(sk->sk_rxhash != skb->hash)) {
                 sock_rps_reset_flow(sk);
-                sk->sk_rxhash = skb->rxhash;
+                sk->sk_rxhash = skb->hash;
         }
 #endif
 }
@@ -1621,33 +1621,6 @@ void sk_common_release(struct sock *sk);
 /* Initialise core socket variables */
 void sock_init_data(struct socket *sock, struct sock *sk);
 
-void sk_filter_release_rcu(struct rcu_head *rcu);
-
-/**
- *      sk_filter_release - release a socket filter
- *      @fp: filter to remove
- *
- *      Remove a filter from a socket and release its resources.
- */
-
-static inline void sk_filter_release(struct sk_filter *fp)
-{
-        if (atomic_dec_and_test(&fp->refcnt))
-                call_rcu(&fp->rcu, sk_filter_release_rcu);
-}
-
-static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
-{
-        atomic_sub(sk_filter_size(fp->len), &sk->sk_omem_alloc);
-        sk_filter_release(fp);
-}
-
-static inline void sk_filter_charge(struct sock *sk, struct sk_filter *fp)
-{
-        atomic_inc(&fp->refcnt);
-        atomic_add(sk_filter_size(fp->len), &sk->sk_omem_alloc);
-}
-
 /*
  * Socket reference counting postulates.
  *
@@ -2256,8 +2229,12 @@ void sock_net_set(struct sock *sk, struct net *net)
  */
 static inline void sk_change_net(struct sock *sk, struct net *net)
 {
-        put_net(sock_net(sk));
-        sock_net_set(sk, hold_net(net));
+        struct net *current_net = sock_net(sk);
+
+        if (!net_eq(current_net, net)) {
+                put_net(current_net);
+                sock_net_set(sk, hold_net(net));
+        }
 }
 
 static inline struct sock *skb_steal_sock(struct sk_buff *skb)
diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h
index 9e8710be7a04..fa8f5fac65e9 100644
--- a/include/net/tc_act/tc_csum.h
+++ b/include/net/tc_act/tc_csum.h
@@ -9,7 +9,7 @@ struct tcf_csum {
 
         u32 update_flags;
 };
-#define to_tcf_csum(pc) \
-        container_of(pc,struct tcf_csum,common)
+#define to_tcf_csum(a) \
+        container_of(a->priv,struct tcf_csum,common)
 
 #endif /* __NET_TC_CSUM_H */
diff --git a/include/net/tc_act/tc_defact.h b/include/net/tc_act/tc_defact.h
index 65f024b80958..9763dcbb9bc3 100644
--- a/include/net/tc_act/tc_defact.h
+++ b/include/net/tc_act/tc_defact.h
@@ -8,7 +8,7 @@ struct tcf_defact {
         u32                     tcfd_datalen;
         void                    *tcfd_defdata;
 };
-#define to_defact(pc) \
-        container_of(pc, struct tcf_defact, common)
+#define to_defact(a) \
+        container_of(a->priv, struct tcf_defact, common)
 
 #endif /* __NET_TC_DEF_H */
diff --git a/include/net/tc_act/tc_gact.h b/include/net/tc_act/tc_gact.h
index 9e3f6767b80e..9fc9b578908a 100644
--- a/include/net/tc_act/tc_gact.h
+++ b/include/net/tc_act/tc_gact.h
@@ -11,7 +11,7 @@ struct tcf_gact {
         int                     tcfg_paction;
 #endif
 };
-#define to_gact(pc) \
-        container_of(pc, struct tcf_gact, common)
+#define to_gact(a) \
+        container_of(a->priv, struct tcf_gact, common)
 
 #endif /* __NET_TC_GACT_H */
diff --git a/include/net/tc_act/tc_ipt.h b/include/net/tc_act/tc_ipt.h
index f7d25dfcc4b7..c0f4193f432c 100644
--- a/include/net/tc_act/tc_ipt.h
+++ b/include/net/tc_act/tc_ipt.h
@@ -11,7 +11,7 @@ struct tcf_ipt {
         char                    *tcfi_tname;
         struct xt_entry_target  *tcfi_t;
 };
-#define to_ipt(pc) \
-        container_of(pc, struct tcf_ipt, common)
+#define to_ipt(a) \
+        container_of(a->priv, struct tcf_ipt, common)
 
 #endif /* __NET_TC_IPT_H */
diff --git a/include/net/tc_act/tc_mirred.h b/include/net/tc_act/tc_mirred.h
index cfe2943690ff..4dd77a1c106b 100644
--- a/include/net/tc_act/tc_mirred.h
+++ b/include/net/tc_act/tc_mirred.h
@@ -11,7 +11,7 @@ struct tcf_mirred {
         struct net_device       *tcfm_dev;
         struct list_head        tcfm_list;
 };
-#define to_mirred(pc) \
-        container_of(pc, struct tcf_mirred, common)
+#define to_mirred(a) \
+        container_of(a->priv, struct tcf_mirred, common)
 
 #endif /* __NET_TC_MIR_H */
diff --git a/include/net/tc_act/tc_nat.h b/include/net/tc_act/tc_nat.h
index 4a691f34d703..63d8e9ca9d99 100644
--- a/include/net/tc_act/tc_nat.h
+++ b/include/net/tc_act/tc_nat.h
@@ -13,9 +13,9 @@ struct tcf_nat {
         u32 flags;
 };
 
-static inline struct tcf_nat *to_tcf_nat(struct tcf_common *pc)
+static inline struct tcf_nat *to_tcf_nat(struct tc_action *a)
 {
-        return container_of(pc, struct tcf_nat, common);
+        return container_of(a->priv, struct tcf_nat, common);
 }
 
 #endif /* __NET_TC_NAT_H */
diff --git a/include/net/tc_act/tc_pedit.h b/include/net/tc_act/tc_pedit.h
index e6f6e15956f5..5b80998879c7 100644
--- a/include/net/tc_act/tc_pedit.h
+++ b/include/net/tc_act/tc_pedit.h
@@ -9,7 +9,7 @@ struct tcf_pedit {
         unsigned char           tcfp_flags;
         struct tc_pedit_key     *tcfp_keys;
 };
-#define to_pedit(pc) \
-        container_of(pc, struct tcf_pedit, common)
+#define to_pedit(a) \
+        container_of(a->priv, struct tcf_pedit, common)
 
 #endif /* __NET_TC_PED_H */
diff --git a/include/net/tc_act/tc_skbedit.h b/include/net/tc_act/tc_skbedit.h
index dd5d86fab030..0df9a0db4a8e 100644
--- a/include/net/tc_act/tc_skbedit.h
+++ b/include/net/tc_act/tc_skbedit.h
@@ -29,7 +29,7 @@ struct tcf_skbedit {
         u16                     queue_mapping;
         /* XXX: 16-bit pad here? */
 };
-#define to_skbedit(pc) \
-        container_of(pc, struct tcf_skbedit, common)
+#define to_skbedit(a) \
+        container_of(a->priv, struct tcf_skbedit, common)
 
 #endif /* __NET_TC_SKBEDIT_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 743accec6c76..87d877408188 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -31,6 +31,7 @@
 #include <linux/crypto.h>
 #include <linux/cryptohash.h>
 #include <linux/kref.h>
+#include <linux/ktime.h>
 
 #include <net/inet_connection_sock.h>
 #include <net/inet_timewait_sock.h>
@@ -478,7 +479,6 @@ int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                              struct ip_options *opt);
 #ifdef CONFIG_SYN_COOKIES
-#include <linux/ktime.h>
 
 /* Syncookies use a monotonic timer which increments every 60 seconds.
  * This counter is used both as a hash input and partially encoded into
@@ -620,7 +620,7 @@ static inline void tcp_bound_rto(const struct sock *sk)
 
 static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
 {
-        return (tp->srtt >> 3) + tp->rttvar;
+        return usecs_to_jiffies((tp->srtt_us >> 3) + tp->rttvar_us);
 }
 
 static inline void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)
@@ -657,6 +657,11 @@ static inline u32 tcp_rto_min(struct sock *sk)
         return rto_min;
 }
 
+static inline u32 tcp_rto_min_us(struct sock *sk)
+{
+        return jiffies_to_usecs(tcp_rto_min(sk));
+}
+
 /* Compute the actual receive window we are currently advertising.
  * Rcv_nxt can be after the window if our peer push more data
  * than the offered window.
@@ -779,7 +784,6 @@ enum tcp_ca_event {
 #define TCP_CA_BUF_MAX  (TCP_CA_NAME_MAX*TCP_CA_MAX)
 
 #define TCP_CONG_NON_RESTRICTED 0x1
-#define TCP_CONG_RTT_STAMP      0x2
 
 struct tcp_congestion_ops {
         struct list_head        list;
@@ -792,8 +796,6 @@ struct tcp_congestion_ops {
 
         /* return slow start threshold (required) */
         u32 (*ssthresh)(struct sock *sk);
-        /* lower bound for congestion window (optional) */
-        u32 (*min_cwnd)(const struct sock *sk);
         /* do new cwnd calculation (required) */
         void (*cong_avoid)(struct sock *sk, u32 ack, u32 acked, u32 in_flight);
         /* call before changing ca_state (optional) */
@@ -828,7 +830,6 @@ void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w);
 extern struct tcp_congestion_ops tcp_init_congestion_ops;
 u32 tcp_reno_ssthresh(struct sock *sk);
 void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 acked, u32 in_flight);
-u32 tcp_reno_min_cwnd(const struct sock *sk);
 extern struct tcp_congestion_ops tcp_reno;
 
 static inline void tcp_set_ca_state(struct sock *sk, const u8 ca_state)
diff --git a/include/net/wpan-phy.h b/include/net/wpan-phy.h
index b52bda8d13b1..10ab0fc6d4f7 100644
--- a/include/net/wpan-phy.h
+++ b/include/net/wpan-phy.h
@@ -37,15 +37,22 @@ struct wpan_phy {
         struct mutex pib_lock;
 
         /*
-         * This is a PIB according to 802.15.4-2006.
+         * This is a PIB according to 802.15.4-2011.
          * We do not provide timing-related variables, as they
          * aren't used outside of driver
          */
         u8 current_channel;
         u8 current_page;
         u32 channels_supported[32];
-        u8 transmit_power;
+        s8 transmit_power;
         u8 cca_mode;
+        u8 min_be;
+        u8 max_be;
+        u8 csma_retries;
+        s8 frame_retries;
+
+        bool lbt;
+        s32 cca_ed_level;
 
         struct device dev;
         int idx;
@@ -54,6 +61,14 @@ struct wpan_phy {
                                         const char *name, int type);
         void (*del_iface)(struct wpan_phy *phy, struct net_device *dev);
 
+        int (*set_txpower)(struct wpan_phy *phy, int db);
+        int (*set_lbt)(struct wpan_phy *phy, bool on);
+        int (*set_cca_mode)(struct wpan_phy *phy, u8 cca_mode);
+        int (*set_cca_ed_level)(struct wpan_phy *phy, int level);
+        int (*set_csma_params)(struct wpan_phy *phy, u8 min_be, u8 max_be,
+                               u8 retries);
+        int (*set_frame_retries)(struct wpan_phy *phy, s8 retries);
+
         char priv[0] __attribute__((__aligned__(NETDEV_ALIGN)));
 };
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index fb5654a8ca3c..32682ae47b3f 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -118,11 +118,10 @@
 struct xfrm_state_walk {
         struct list_head        all;
         u8                      state;
-        union {
-                u8              dying;
-                u8              proto;
-        };
+        u8                      dying;
+        u8                      proto;
         u32                     seq;
+        struct xfrm_address_filter *filter;
 };
 
 /* Full description of state of transformer. */
@@ -350,6 +349,16 @@ int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
 void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
 
+struct xfrm_input_afinfo {
+        unsigned int            family;
+        struct module           *owner;
+        int                     (*callback)(struct sk_buff *skb, u8 protocol,
+                                            int err);
+};
+
+int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo);
+int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo);
+
 void xfrm_state_delete_tunnel(struct xfrm_state *x);
 
 struct xfrm_type {
@@ -594,21 +603,33 @@ struct xfrm_mgr {
                                            const struct xfrm_migrate *m,
                                            int num_bundles,
                                            const struct xfrm_kmaddress *k);
+        bool                    (*is_alive)(const struct km_event *c);
 };
 
 int xfrm_register_km(struct xfrm_mgr *km);
 int xfrm_unregister_km(struct xfrm_mgr *km);
 
+struct xfrm_tunnel_skb_cb {
+        union {
+                struct inet_skb_parm h4;
+                struct inet6_skb_parm h6;
+        } header;
+
+        union {
+                struct ip_tunnel *ip4;
+                struct ip6_tnl *ip6;
+        } tunnel;
+};
+
+#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
+
 /*
  * This structure is used for the duration where packets are being
  * transformed by IPsec.  As soon as the packet leaves IPsec the
  * area beyond the generic IP part may be overwritten.
  */
 struct xfrm_skb_cb {
-        union {
-                struct inet_skb_parm h4;
-                struct inet6_skb_parm h6;
-        } header;
+        struct xfrm_tunnel_skb_cb header;
 
         /* Sequence number for replay protection. */
         union {
@@ -630,10 +651,7 @@ struct xfrm_skb_cb {
  * to transmit header information to the mode input/output functions.
  */
 struct xfrm_mode_skb_cb {
-        union {
-                struct inet_skb_parm h4;
-                struct inet6_skb_parm h6;
-        } header;
+        struct xfrm_tunnel_skb_cb header;
 
         /* Copied from header for IPv4, always set to zero and DF for IPv6. */
         __be16 id;
@@ -665,10 +683,7 @@ struct xfrm_mode_skb_cb {
  * related information.
  */
 struct xfrm_spi_skb_cb {
-        union {
-                struct inet_skb_parm h4;
-                struct inet6_skb_parm h6;
-        } header;
+        struct xfrm_tunnel_skb_cb header;
 
         unsigned int daddroff;
         unsigned int family;
@@ -1347,18 +1362,34 @@ struct xfrm_algo_desc {
         struct sadb_alg desc;
 };
 
-/* XFRM tunnel handlers.  */
-struct xfrm_tunnel {
+/* XFRM protocol handlers.  */
+struct xfrm4_protocol {
         int (*handler)(struct sk_buff *skb);
+        int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
+                             int encap_type);
+        int (*cb_handler)(struct sk_buff *skb, int err);
         int (*err_handler)(struct sk_buff *skb, u32 info);
 
-        struct xfrm_tunnel __rcu *next;
+        struct xfrm4_protocol __rcu *next;
+        int priority;
+};
+
+struct xfrm6_protocol {
+        int (*handler)(struct sk_buff *skb);
+        int (*cb_handler)(struct sk_buff *skb, int err);
+        int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                           u8 type, u8 code, int offset, __be32 info);
+
+        struct xfrm6_protocol __rcu *next;
         int priority;
 };
 
-struct xfrm_tunnel_notifier {
+/* XFRM tunnel handlers.  */
+struct xfrm_tunnel {
         int (*handler)(struct sk_buff *skb);
-        struct xfrm_tunnel_notifier __rcu *next;
+        int (*err_handler)(struct sk_buff *skb, u32 info);
+
+        struct xfrm_tunnel __rcu *next;
         int priority;
 };
 
@@ -1375,11 +1406,14 @@ void xfrm4_init(void);
 int xfrm_state_init(struct net *net);
 void xfrm_state_fini(struct net *net);
 void xfrm4_state_init(void);
+void xfrm4_protocol_init(void);
 #ifdef CONFIG_XFRM
 int xfrm6_init(void);
 void xfrm6_fini(void);
 int xfrm6_state_init(void);
 void xfrm6_state_fini(void);
+int xfrm6_protocol_init(void);
+void xfrm6_protocol_fini(void);
 #else
 static inline int xfrm6_init(void)
 {
@@ -1405,7 +1439,8 @@ static inline void xfrm_sysctl_fini(struct net *net)
 }
 #endif
 
-void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
+void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
+                          struct xfrm_address_filter *filter);
 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
                     int (*func)(struct xfrm_state *, int, void*), void *);
 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
@@ -1497,20 +1532,22 @@ int xfrm4_rcv(struct sk_buff *skb);
 
 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
 {
-        return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
+        XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+        XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+        return xfrm_input(skb, nexthdr, spi, 0);
 }
 
 int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
 int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
 int xfrm4_output(struct sk_buff *skb);
 int xfrm4_output_finish(struct sk_buff *skb);
+int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
+int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
+int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
-int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler);
-int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler);
-int xfrm6_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler);
-int xfrm6_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler);
 int xfrm6_extract_header(struct sk_buff *skb);
 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
@@ -1519,6 +1556,9 @@ int xfrm6_rcv(struct sk_buff *skb);
 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                      xfrm_address_t *saddr, u8 proto);
 void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
+int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
+int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
+int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
 __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
@@ -1646,6 +1686,20 @@ static inline int xfrm_aevent_is_on(struct net *net)
         rcu_read_unlock();
         return ret;
 }
+
+static inline int xfrm_acquire_is_on(struct net *net)
+{
+        struct sock *nlsk;
+        int ret = 0;
+
+        rcu_read_lock();
+        nlsk = rcu_dereference(net->xfrm.nlsk);
+        if (nlsk)
+                ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
+        rcu_read_unlock();
+
+        return ret;
+}
 #endif
 
 static inline int aead_len(struct xfrm_algo_aead *alg)
@@ -1748,4 +1802,24 @@ static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
         return ret;
 }
 
+static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
+                                    unsigned int family)
+{
+        bool tunnel = false;
+
+        switch(family) {
+        case AF_INET:
+                if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
+                        tunnel = true;
+                break;
+        case AF_INET6:
+                if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
+                        tunnel = true;
+                break;
+        }
+        if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL))
+                return -EINVAL;
+
+        return 0;
+}
 #endif  /* _NET_XFRM_H */