Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:

 1) More iov_iter conversion work from Al Viro.

    [ The "crypto: switch af_alg_make_sg() to iov_iter" commit was
      wrong, and this pull actually adds an extra commit on top of the
      branch I'm pulling to fix that up, so that the pre-merge state is
      ok.   - Linus ]

 2) Various optimizations to the ipv4 forwarding information base trie
    lookup implementation.  From Alexander Duyck.

 3) Remove sock_iocb altogether, from CHristoph Hellwig.

 4) Allow congestion control algorithm selection via routing metrics.
    From Daniel Borkmann.

 5) Make ipv4 uncached route list per-cpu, from Eric Dumazet.

 6) Handle rfs hash collisions more gracefully, also from Eric Dumazet.

 7) Add xmit_more support to r8169, e1000, and e1000e drivers.  From
    Florian Westphal.

 8) Transparent Ethernet Bridging support for GRO, from Jesse Gross.

 9) Add BPF packet actions to packet scheduler, from Jiri Pirko.

10) Add support for uniqu flow IDs to openvswitch, from Joe Stringer.

11) New NetCP ethernet driver, from Muralidharan Karicheri and Wingman
    Kwok.

12) More sanely handle out-of-window dupacks, which can result in
    serious ACK storms.  From Neal Cardwell.

13) Various rhashtable bug fixes and enhancements, from Herbert Xu,
    Patrick McHardy, and Thomas Graf.

14) Support xmit_more in be2net, from Sathya Perla.

15) Group Policy extensions for vxlan, from Thomas Graf.

16) Remove Checksum Offload support for vxlan, from Tom Herbert.

17) Like ipv4, support lockless transmit over ipv6 UDP sockets.  From
    Vlad Yasevich.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1494+1 commits)
  crypto: fix af_alg_make_sg() conversion to iov_iter
  ipv4: Namespecify TCP PMTU mechanism
  i40e: Fix for stats init function call in Rx setup
  tcp: don't include Fast Open option in SYN-ACK on pure SYN-data
  openvswitch: Only set TUNNEL_VXLAN_OPT if VXLAN-GBP metadata is set
  ipv6: Make __ipv6_select_ident static
  ipv6: Fix fragment id assignment on LE arches.
  bridge: Fix inability to add non-vlan fdb entry
  net: Mellanox: Delete unnecessary checks before the function call "vunmap"
  cxgb4: Add support in cxgb4 to get expansion rom version via ethtool
  ethtool: rename reserved1 memeber in ethtool_drvinfo for expansion ROM version
  net: dsa: Remove redundant phy_attach()
  IB/mlx4: Reset flow support for IB kernel ULPs
  IB/mlx4: Always use the correct port for mirrored multicast attachments
  net/bonding: Fix potential bad memory access during bonding events
  tipc: remove tipc_snprintf
  tipc: nl compat add noop and remove legacy nl framework
  tipc: convert legacy nl stats show to nl compat
  tipc: convert legacy nl net id get to nl compat
  tipc: convert legacy nl net id set to nl compat
  ...

109 files changed, 2259 insertions, 665 deletions

diff --git a/include/clocksource/arm_arch_timer.h b/include/clocksource/arm_arch_timer.h
index 6d26b40cbf5d..9916d0e4eff5 100644
--- a/include/clocksource/arm_arch_timer.h
+++ b/include/clocksource/arm_arch_timer.h
@@ -16,7 +16,7 @@
 #ifndef __CLKSOURCE_ARM_ARCH_TIMER_H
 #define __CLKSOURCE_ARM_ARCH_TIMER_H
 
-#include <linux/clocksource.h>
+#include <linux/timecounter.h>
 #include <linux/types.h>
 
 #define ARCH_TIMER_CTRL_ENABLE          (1 << 0)
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index cd62bf4289e9..88ea64e9a91c 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -67,8 +67,7 @@ int af_alg_unregister_type(const struct af_alg_type *type);
 int af_alg_release(struct socket *sock);
 int af_alg_accept(struct sock *sk, struct socket *newsock);
 
-int af_alg_make_sg(struct af_alg_sgl *sgl, void __user *addr, int len,
-                   int write);
+int af_alg_make_sg(struct af_alg_sgl *sgl, struct iov_iter *iter, int len);
 void af_alg_free_sg(struct af_alg_sgl *sgl);
 
 int af_alg_cmsg_send(struct msghdr *msg, struct af_alg_control *con);
diff --git a/include/dt-bindings/clock/rk3288-cru.h b/include/dt-bindings/clock/rk3288-cru.h
index f60ce72a2b2c..1c34c24efe08 100644
--- a/include/dt-bindings/clock/rk3288-cru.h
+++ b/include/dt-bindings/clock/rk3288-cru.h
@@ -81,6 +81,9 @@
 #define SCLK_SDIO1_SAMPLE       120
 #define SCLK_EMMC_SAMPLE        121
 
+#define SCLK_MAC                151
+#define SCLK_MACREF_OUT         152
+
 #define DCLK_VOP0               190
 #define DCLK_VOP1               191
 
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index eb1c6a47b67f..994739da827f 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -318,6 +318,7 @@ struct bcma_bus {
         const struct bcma_host_ops *ops;
 
         enum bcma_hosttype hosttype;
+        bool host_is_pcie2; /* Used for BCMA_HOSTTYPE_PCI only */
         union {
                 /* Pointer to the PCI bus (only for BCMA_HOSTTYPE_PCI) */
                 struct pci_dev *host_pci;
diff --git a/include/linux/bcma/bcma_driver_pci.h b/include/linux/bcma/bcma_driver_pci.h
index 0333e605ea0d..3f809ae372c4 100644
--- a/include/linux/bcma/bcma_driver_pci.h
+++ b/include/linux/bcma/bcma_driver_pci.h
@@ -223,6 +223,7 @@ struct bcma_drv_pci_host {
 
 struct bcma_drv_pci {
         struct bcma_device *core;
+        u8 early_setup_done:1;
         u8 setup_done:1;
         u8 hostmode:1;
 
@@ -237,6 +238,7 @@ struct bcma_drv_pci {
 #define pcicore_write16(pc, offset, val)        bcma_write16((pc)->core, offset, val)
 #define pcicore_write32(pc, offset, val)        bcma_write32((pc)->core, offset, val)
 
+extern void bcma_core_pci_early_init(struct bcma_drv_pci *pc);
 extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
 extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
                                  struct bcma_device *core, bool enable);
diff --git a/include/linux/bcma/bcma_regs.h b/include/linux/bcma/bcma_regs.h
index e64ae7bf80a1..ebd5c1fcdea4 100644
--- a/include/linux/bcma/bcma_regs.h
+++ b/include/linux/bcma/bcma_regs.h
@@ -64,6 +64,8 @@
 #define  BCMA_PCI_GPIO_XTAL             0x40    /* PCI config space GPIO 14 for Xtal powerup */
 #define  BCMA_PCI_GPIO_PLL              0x80    /* PCI config space GPIO 15 for PLL powerdown */
 
+#define BCMA_PCIE2_BAR0_WIN2            0x70
+
 /* SiliconBackplane Address Map.
  * All regions may not exist on all chips.
  */
diff --git a/include/linux/bcma/bcma_soc.h b/include/linux/bcma/bcma_soc.h
index f24d245f8394..1b5fc0c3b1b5 100644
--- a/include/linux/bcma/bcma_soc.h
+++ b/include/linux/bcma/bcma_soc.h
@@ -5,8 +5,6 @@
 
 struct bcma_soc {
         struct bcma_bus bus;
-        struct bcma_device core_cc;
-        struct bcma_device core_mips;
 };
 
 int __init bcma_host_soc_register(struct bcma_soc *soc);
diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
index abcafaa20b86..9c78d15d33e4 100644
--- a/include/linux/clocksource.h
+++ b/include/linux/clocksource.h
@@ -18,8 +18,6 @@
 #include <asm/div64.h>
 #include <asm/io.h>
 
-/* clocksource cycle base type */
-typedef u64 cycle_t;
 struct clocksource;
 struct module;
 
@@ -28,106 +26,6 @@ struct module;
 #endif
 
 /**
- * struct cyclecounter - hardware abstraction for a free running counter
- *      Provides completely state-free accessors to the underlying hardware.
- *      Depending on which hardware it reads, the cycle counter may wrap
- *      around quickly. Locking rules (if necessary) have to be defined
- *      by the implementor and user of specific instances of this API.
- *
- * @read:               returns the current cycle value
- * @mask:               bitmask for two's complement
- *                      subtraction of non 64 bit counters,
- *                      see CLOCKSOURCE_MASK() helper macro
- * @mult:               cycle to nanosecond multiplier
- * @shift:              cycle to nanosecond divisor (power of two)
- */
-struct cyclecounter {
-        cycle_t (*read)(const struct cyclecounter *cc);
-        cycle_t mask;
-        u32 mult;
-        u32 shift;
-};
-
-/**
- * struct timecounter - layer above a %struct cyclecounter which counts nanoseconds
- *      Contains the state needed by timecounter_read() to detect
- *      cycle counter wrap around. Initialize with
- *      timecounter_init(). Also used to convert cycle counts into the
- *      corresponding nanosecond counts with timecounter_cyc2time(). Users
- *      of this code are responsible for initializing the underlying
- *      cycle counter hardware, locking issues and reading the time
- *      more often than the cycle counter wraps around. The nanosecond
- *      counter will only wrap around after ~585 years.
- *
- * @cc:                 the cycle counter used by this instance
- * @cycle_last:         most recent cycle counter value seen by
- *                      timecounter_read()
- * @nsec:               continuously increasing count
- */
-struct timecounter {
-        const struct cyclecounter *cc;
-        cycle_t cycle_last;
-        u64 nsec;
-};
-
-/**
- * cyclecounter_cyc2ns - converts cycle counter cycles to nanoseconds
- * @cc:         Pointer to cycle counter.
- * @cycles:     Cycles
- *
- * XXX - This could use some mult_lxl_ll() asm optimization. Same code
- * as in cyc2ns, but with unsigned result.
- */
-static inline u64 cyclecounter_cyc2ns(const struct cyclecounter *cc,
-                                      cycle_t cycles)
-{
-        u64 ret = (u64)cycles;
-        ret = (ret * cc->mult) >> cc->shift;
-        return ret;
-}
-
-/**
- * timecounter_init - initialize a time counter
- * @tc:                 Pointer to time counter which is to be initialized/reset
- * @cc:                 A cycle counter, ready to be used.
- * @start_tstamp:       Arbitrary initial time stamp.
- *
- * After this call the current cycle register (roughly) corresponds to
- * the initial time stamp. Every call to timecounter_read() increments
- * the time stamp counter by the number of elapsed nanoseconds.
- */
-extern void timecounter_init(struct timecounter *tc,
-                             const struct cyclecounter *cc,
-                             u64 start_tstamp);
-
-/**
- * timecounter_read - return nanoseconds elapsed since timecounter_init()
- *                    plus the initial time stamp
- * @tc:          Pointer to time counter.
- *
- * In other words, keeps track of time since the same epoch as
- * the function which generated the initial time stamp.
- */
-extern u64 timecounter_read(struct timecounter *tc);
-
-/**
- * timecounter_cyc2time - convert a cycle counter to same
- *                        time base as values returned by
- *                        timecounter_read()
- * @tc:         Pointer to time counter.
- * @cycle_tstamp:       a value returned by tc->cc->read()
- *
- * Cycle counts that are converted correctly as long as they
- * fall into the interval [-1/2 max cycle count, +1/2 max cycle count],
- * with "max cycle count" == cs->mask+1.
- *
- * This allows conversion of cycle counter values which were generated
- * in the past.
- */
-extern u64 timecounter_cyc2time(struct timecounter *tc,
-                                cycle_t cycle_tstamp);
-
-/**
  * struct clocksource - hardware abstraction for a free running counter
  *      Provides mostly state-free accessors to the underlying hardware.
  *      This is the structure used for system time.
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 41c891d05f04..1d869d185a0d 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -52,6 +52,10 @@ struct net_device *alloc_etherdev_mqs(int sizeof_priv, unsigned int txqs,
 #define alloc_etherdev(sizeof_priv) alloc_etherdev_mq(sizeof_priv, 1)
 #define alloc_etherdev_mq(sizeof_priv, count) alloc_etherdev_mqs(sizeof_priv, count, count)
 
+struct sk_buff **eth_gro_receive(struct sk_buff **head,
+                                 struct sk_buff *skb);
+int eth_gro_complete(struct sk_buff *skb, int nhoff);
+
 /* Reserved Ethernet Addresses per IEEE 802.1Q */
 static const u8 eth_reserved_addr_base[ETH_ALEN] __aligned(2) =
 { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
diff --git a/include/linux/fec.h b/include/linux/fec.h
index bcff455d1d53..1454a503622d 100644
--- a/include/linux/fec.h
+++ b/include/linux/fec.h
@@ -19,6 +19,7 @@
 struct fec_platform_data {
         phy_interface_t phy;
         unsigned char mac[ETH_ALEN];
+        void (*sleep_mode_enable)(int enabled);
 };
 
 #endif
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 4f4eea8a6288..b9c7897dc566 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1017,6 +1017,15 @@ struct ieee80211_mmie {
         u8 mic[8];
 } __packed;
 
+/* Management MIC information element (IEEE 802.11w) for GMAC and CMAC-256 */
+struct ieee80211_mmie_16 {
+        u8 element_id;
+        u8 length;
+        __le16 key_id;
+        u8 sequence_number[6];
+        u8 mic[16];
+} __packed;
+
 struct ieee80211_vendor_ie {
         u8 element_id;
         u8 len;
@@ -1994,9 +2003,15 @@ enum ieee80211_key_len {
         WLAN_KEY_LEN_WEP40 = 5,
         WLAN_KEY_LEN_WEP104 = 13,
         WLAN_KEY_LEN_CCMP = 16,
+        WLAN_KEY_LEN_CCMP_256 = 32,
         WLAN_KEY_LEN_TKIP = 32,
         WLAN_KEY_LEN_AES_CMAC = 16,
         WLAN_KEY_LEN_SMS4 = 32,
+        WLAN_KEY_LEN_GCMP = 16,
+        WLAN_KEY_LEN_GCMP_256 = 32,
+        WLAN_KEY_LEN_BIP_CMAC_256 = 32,
+        WLAN_KEY_LEN_BIP_GMAC_128 = 16,
+        WLAN_KEY_LEN_BIP_GMAC_256 = 32,
 };
 
 #define IEEE80211_WEP_IV_LEN            4
@@ -2004,9 +2019,16 @@ enum ieee80211_key_len {
 #define IEEE80211_CCMP_HDR_LEN          8
 #define IEEE80211_CCMP_MIC_LEN          8
 #define IEEE80211_CCMP_PN_LEN           6
+#define IEEE80211_CCMP_256_HDR_LEN      8
+#define IEEE80211_CCMP_256_MIC_LEN      16
+#define IEEE80211_CCMP_256_PN_LEN       6
 #define IEEE80211_TKIP_IV_LEN           8
 #define IEEE80211_TKIP_ICV_LEN          4
 #define IEEE80211_CMAC_PN_LEN           6
+#define IEEE80211_GMAC_PN_LEN           6
+#define IEEE80211_GCMP_HDR_LEN          8
+#define IEEE80211_GCMP_MIC_LEN          16
+#define IEEE80211_GCMP_PN_LEN           6
 
 /* Public action codes */
 enum ieee80211_pub_actioncode {
@@ -2230,6 +2252,11 @@ enum ieee80211_sa_query_action {
 #define WLAN_CIPHER_SUITE_WEP104        0x000FAC05
 #define WLAN_CIPHER_SUITE_AES_CMAC      0x000FAC06
 #define WLAN_CIPHER_SUITE_GCMP          0x000FAC08
+#define WLAN_CIPHER_SUITE_GCMP_256      0x000FAC09
+#define WLAN_CIPHER_SUITE_CCMP_256      0x000FAC0A
+#define WLAN_CIPHER_SUITE_BIP_GMAC_128  0x000FAC0B
+#define WLAN_CIPHER_SUITE_BIP_GMAC_256  0x000FAC0C
+#define WLAN_CIPHER_SUITE_BIP_CMAC_256  0x000FAC0D
 
 #define WLAN_CIPHER_SUITE_SMS4          0x00147201
 
diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
index 0a8ce762a47f..a57bca2ea97e 100644
--- a/include/linux/if_bridge.h
+++ b/include/linux/if_bridge.h
@@ -50,24 +50,6 @@ extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __use
 typedef int br_should_route_hook_t(struct sk_buff *skb);
 extern br_should_route_hook_t __rcu *br_should_route_hook;
 
-#if IS_ENABLED(CONFIG_BRIDGE)
-int br_fdb_external_learn_add(struct net_device *dev,
-                              const unsigned char *addr, u16 vid);
-int br_fdb_external_learn_del(struct net_device *dev,
-                              const unsigned char *addr, u16 vid);
-#else
-static inline int br_fdb_external_learn_add(struct net_device *dev,
-                                            const unsigned char *addr, u16 vid)
-{
-        return 0;
-}
-static inline int br_fdb_external_learn_del(struct net_device *dev,
-                                            const unsigned char *addr, u16 vid)
-{
-        return 0;
-}
-#endif
-
 #if IS_ENABLED(CONFIG_BRIDGE) && IS_ENABLED(CONFIG_BRIDGE_IGMP_SNOOPING)
 int br_multicast_list_adjacent(struct net_device *dev,
                                struct list_head *br_ip_list);
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 960e666c51e4..b11b28a30b9e 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -78,9 +78,9 @@ static inline bool is_vlan_dev(struct net_device *dev)
         return dev->priv_flags & IFF_802_1Q_VLAN;
 }
 
-#define vlan_tx_tag_present(__skb)      ((__skb)->vlan_tci & VLAN_TAG_PRESENT)
-#define vlan_tx_tag_get(__skb)          ((__skb)->vlan_tci & ~VLAN_TAG_PRESENT)
-#define vlan_tx_tag_get_id(__skb)       ((__skb)->vlan_tci & VLAN_VID_MASK)
+#define skb_vlan_tag_present(__skb)     ((__skb)->vlan_tci & VLAN_TAG_PRESENT)
+#define skb_vlan_tag_get(__skb)         ((__skb)->vlan_tci & ~VLAN_TAG_PRESENT)
+#define skb_vlan_tag_get_id(__skb)      ((__skb)->vlan_tci & VLAN_VID_MASK)
 
 /**
  *      struct vlan_pcpu_stats - VLAN percpu rx/tx stats
@@ -376,7 +376,7 @@ static inline struct sk_buff *vlan_insert_tag_set_proto(struct sk_buff *skb,
 static inline struct sk_buff *__vlan_hwaccel_push_inside(struct sk_buff *skb)
 {
         skb = vlan_insert_tag_set_proto(skb, skb->vlan_proto,
-                                        vlan_tx_tag_get(skb));
+                                        skb_vlan_tag_get(skb));
         if (likely(skb))
                 skb->vlan_tci = 0;
         return skb;
@@ -393,7 +393,7 @@ static inline struct sk_buff *__vlan_hwaccel_push_inside(struct sk_buff *skb)
  */
 static inline struct sk_buff *vlan_hwaccel_push_inside(struct sk_buff *skb)
 {
-        if (vlan_tx_tag_present(skb))
+        if (skb_vlan_tag_present(skb))
                 skb = __vlan_hwaccel_push_inside(skb);
         return skb;
 }
@@ -442,8 +442,8 @@ static inline int __vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)
 static inline int __vlan_hwaccel_get_tag(const struct sk_buff *skb,
                                          u16 *vlan_tci)
 {
-        if (vlan_tx_tag_present(skb)) {
-                *vlan_tci = vlan_tx_tag_get(skb);
+        if (skb_vlan_tag_present(skb)) {
+                *vlan_tci = skb_vlan_tag_get(skb);
                 return 0;
         } else {
                 *vlan_tci = 0;
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index c694e7baa621..4d5169f5d7d1 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -52,6 +52,7 @@ struct ipv6_devconf {
         __s32           force_tllao;
         __s32           ndisc_notify;
         __s32           suppress_frag_ndisc;
+        __s32           accept_ra_mtu;
         void            *sysctl;
 };
 
@@ -124,6 +125,12 @@ struct ipv6_mc_socklist;
 struct ipv6_ac_socklist;
 struct ipv6_fl_socklist;
 
+struct inet6_cork {
+        struct ipv6_txoptions *opt;
+        u8 hop_limit;
+        u8 tclass;
+};
+
 /**
  * struct ipv6_pinfo - ipv6 private area
  *
@@ -216,11 +223,7 @@ struct ipv6_pinfo {
         struct ipv6_txoptions   *opt;
         struct sk_buff          *pktoptions;
         struct sk_buff          *rxpmtu;
-        struct {
-                struct ipv6_txoptions *opt;
-                u8 hop_limit;
-                u8 tclass;
-        } cork;
+        struct inet6_cork       cork;
 };
 
 /* WARNING: don't change the layout of the members in {raw,udp,tcp}6_sock! */
diff --git a/include/linux/list_nulls.h b/include/linux/list_nulls.h
index 5d10ae364b5e..f266661d2666 100644
--- a/include/linux/list_nulls.h
+++ b/include/linux/list_nulls.h
@@ -1,6 +1,9 @@
 #ifndef _LINUX_LIST_NULLS_H
 #define _LINUX_LIST_NULLS_H
 
+#include <linux/poison.h>
+#include <linux/const.h>
+
 /*
  * Special version of lists, where end of list is not a NULL pointer,
  * but a 'nulls' marker, which can have many different values.
@@ -21,8 +24,9 @@ struct hlist_nulls_head {
 struct hlist_nulls_node {
         struct hlist_nulls_node *next, **pprev;
 };
+#define NULLS_MARKER(value) (1UL | (((long)value) << 1))
 #define INIT_HLIST_NULLS_HEAD(ptr, nulls) \
-        ((ptr)->first = (struct hlist_nulls_node *) (1UL | (((long)nulls) << 1)))
+        ((ptr)->first = (struct hlist_nulls_node *) NULLS_MARKER(nulls))
 
 #define hlist_nulls_entry(ptr, type, member) container_of(ptr,type,member)
 /**
diff --git a/include/linux/mlx4/cmd.h b/include/linux/mlx4/cmd.h
index 64d25941b329..7b6d4e9ff603 100644
--- a/include/linux/mlx4/cmd.h
+++ b/include/linux/mlx4/cmd.h
@@ -71,6 +71,7 @@ enum {
 
         /*master notify fw on finish for slave's flr*/
         MLX4_CMD_INFORM_FLR_DONE = 0x5b,
+        MLX4_CMD_VIRT_PORT_MAP   = 0x5c,
         MLX4_CMD_GET_OP_REQ      = 0x59,
 
         /* TPT commands */
@@ -165,9 +166,15 @@ enum {
 };
 
 enum {
-        MLX4_CMD_TIME_CLASS_A   = 10000,
-        MLX4_CMD_TIME_CLASS_B   = 10000,
-        MLX4_CMD_TIME_CLASS_C   = 10000,
+        MLX4_CMD_TIME_CLASS_A   = 60000,
+        MLX4_CMD_TIME_CLASS_B   = 60000,
+        MLX4_CMD_TIME_CLASS_C   = 60000,
+};
+
+enum {
+        /* virtual to physical port mapping opcode modifiers */
+        MLX4_GET_PORT_VIRT2PHY = 0x0,
+        MLX4_SET_PORT_VIRT2PHY = 0x1,
 };
 
 enum {
@@ -279,6 +286,8 @@ int mlx4_get_vf_config(struct mlx4_dev *dev, int port, int vf, struct ifla_vf_in
 int mlx4_set_vf_link_state(struct mlx4_dev *dev, int port, int vf, int link_state);
 int mlx4_config_dev_retrieval(struct mlx4_dev *dev,
                               struct mlx4_config_dev_params *params);
+void mlx4_cmd_wake_completions(struct mlx4_dev *dev);
+void mlx4_report_internal_err_comm_event(struct mlx4_dev *dev);
 /*
  * mlx4_get_slave_default_vlan -
  * return true if VST ( default vlan)
@@ -288,5 +297,6 @@ bool mlx4_get_slave_default_vlan(struct mlx4_dev *dev, int port, int slave,
                                  u16 *vlan, u8 *qos);
 
 #define MLX4_COMM_GET_IF_REV(cmd_chan_ver) (u8)((cmd_chan_ver) >> 8)
+#define COMM_CHAN_EVENT_INTERNAL_ERR (1 << 17)
 
 #endif /* MLX4_CMD_H */
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 5f3a9aa7225d..e4ebff7e9d02 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -42,7 +42,7 @@
 
 #include <linux/atomic.h>
 
-#include <linux/clocksource.h>
+#include <linux/timecounter.h>
 
 #define MAX_MSIX_P_PORT         17
 #define MAX_MSIX                64
@@ -70,6 +70,7 @@ enum {
         MLX4_FLAG_SLAVE         = 1 << 3,
         MLX4_FLAG_SRIOV         = 1 << 4,
         MLX4_FLAG_OLD_REG_MAC   = 1 << 6,
+        MLX4_FLAG_BONDED        = 1 << 7
 };
 
 enum {
@@ -200,7 +201,9 @@ enum {
         MLX4_DEV_CAP_FLAG2_CONFIG_DEV           = 1LL <<  16,
         MLX4_DEV_CAP_FLAG2_SYS_EQS              = 1LL <<  17,
         MLX4_DEV_CAP_FLAG2_80_VFS               = 1LL <<  18,
-        MLX4_DEV_CAP_FLAG2_FS_A0                = 1LL <<  19
+        MLX4_DEV_CAP_FLAG2_FS_A0                = 1LL <<  19,
+        MLX4_DEV_CAP_FLAG2_RECOVERABLE_ERROR_EVENT = 1LL << 20,
+        MLX4_DEV_CAP_FLAG2_PORT_REMAP           = 1LL <<  21
 };
 
 enum {
@@ -208,6 +211,10 @@ enum {
         MLX4_QUERY_FUNC_FLAGS_A0_RES_QP         = 1LL << 1
 };
 
+enum {
+        MLX4_VF_CAP_FLAG_RESET                  = 1 << 0
+};
+
 /* bit enums for an 8-bit flags field indicating special use
  * QPs which require special handling in qp_reserve_range.
  * Currently, this only includes QPs used by the ETH interface,
@@ -248,9 +255,14 @@ enum {
         MLX4_BMME_FLAG_TYPE_2_WIN       = 1 <<  9,
         MLX4_BMME_FLAG_RESERVED_LKEY    = 1 << 10,
         MLX4_BMME_FLAG_FAST_REG_WR      = 1 << 11,
+        MLX4_BMME_FLAG_PORT_REMAP       = 1 << 24,
         MLX4_BMME_FLAG_VSD_INIT2RTR     = 1 << 28,
 };
 
+enum {
+        MLX4_FLAG_PORT_REMAP            = MLX4_BMME_FLAG_PORT_REMAP
+};
+
 enum mlx4_event {
         MLX4_EVENT_TYPE_COMP               = 0x00,
         MLX4_EVENT_TYPE_PATH_MIG           = 0x01,
@@ -276,6 +288,7 @@ enum mlx4_event {
         MLX4_EVENT_TYPE_FATAL_WARNING      = 0x1b,
         MLX4_EVENT_TYPE_FLR_EVENT          = 0x1c,
         MLX4_EVENT_TYPE_PORT_MNG_CHG_EVENT = 0x1d,
+        MLX4_EVENT_TYPE_RECOVERABLE_ERROR_EVENT  = 0x3e,
         MLX4_EVENT_TYPE_NONE               = 0xff,
 };
 
@@ -285,6 +298,11 @@ enum {
 };
 
 enum {
+        MLX4_RECOVERABLE_ERROR_EVENT_SUBTYPE_BAD_CABLE          = 1,
+        MLX4_RECOVERABLE_ERROR_EVENT_SUBTYPE_UNSUPPORTED_CABLE  = 2,
+};
+
+enum {
         MLX4_FATAL_WARNING_SUBTYPE_WARMING = 0,
 };
 
@@ -411,6 +429,16 @@ enum {
         MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK        = 1 << 4,
 };
 
+enum {
+        MLX4_DEVICE_STATE_UP                    = 1 << 0,
+        MLX4_DEVICE_STATE_INTERNAL_ERROR        = 1 << 1,
+};
+
+enum {
+        MLX4_INTERFACE_STATE_UP         = 1 << 0,
+        MLX4_INTERFACE_STATE_DELETION   = 1 << 1,
+};
+
 #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
                              MLX4_EQ_PORT_INFO_MSTR_SM_LID_CHANGE_MASK)
 
@@ -535,6 +563,7 @@ struct mlx4_caps {
         u8                      alloc_res_qp_mask;
         u32                     dmfs_high_rate_qpn_base;
         u32                     dmfs_high_rate_qpn_range;
+        u32                     vf_caps;
 };
 
 struct mlx4_buf_list {
@@ -660,6 +689,8 @@ struct mlx4_cq {
                 void (*comp)(struct mlx4_cq *);
                 void            *priv;
         } tasklet_ctx;
+        int             reset_notify_added;
+        struct list_head        reset_notify;
 };
 
 struct mlx4_qp {
@@ -744,8 +775,23 @@ struct mlx4_vf_dev {
         u8                      n_ports;
 };
 
-struct mlx4_dev {
+struct mlx4_dev_persistent {
         struct pci_dev         *pdev;
+        struct mlx4_dev        *dev;
+        int                     nvfs[MLX4_MAX_PORTS + 1];
+        int                     num_vfs;
+        enum mlx4_port_type curr_port_type[MLX4_MAX_PORTS + 1];
+        enum mlx4_port_type curr_port_poss_type[MLX4_MAX_PORTS + 1];
+        struct work_struct      catas_work;
+        struct workqueue_struct *catas_wq;
+        struct mutex    device_state_mutex; /* protect HW state */
+        u8              state;
+        struct mutex    interface_state_mutex; /* protect SW state */
+        u8      interface_state;
+};
+
+struct mlx4_dev {
+        struct mlx4_dev_persistent *persist;
         unsigned long           flags;
         unsigned long           num_slaves;
         struct mlx4_caps        caps;
@@ -754,13 +800,11 @@ struct mlx4_dev {
         struct radix_tree_root  qp_table_tree;
         u8                      rev_id;
         char                    board_id[MLX4_BOARD_ID_LEN];
-        int                     num_vfs;
         int                     numa_node;
         int                     oper_log_mgm_entry_size;
         u64                     regid_promisc_array[MLX4_MAX_PORTS + 1];
         u64                     regid_allmulti_array[MLX4_MAX_PORTS + 1];
         struct mlx4_vf_dev     *dev_vfs;
-        int                     nvfs[MLX4_MAX_PORTS + 1];
 };
 
 struct mlx4_eqe {
@@ -832,6 +876,11 @@ struct mlx4_eqe {
                                 } __packed tbl_change_info;
                         } params;
                 } __packed port_mgmt_change;
+                struct {
+                        u8 reserved[3];
+                        u8 port;
+                        u32 reserved1[5];
+                } __packed bad_cable;
         }                       event;
         u8                      slave_id;
         u8                      reserved3[2];
@@ -1338,6 +1387,8 @@ int mlx4_phys_to_slave_port(struct mlx4_dev *dev, int slave, int port);
 int mlx4_get_base_gid_ix(struct mlx4_dev *dev, int slave, int port);
 
 int mlx4_config_vxlan_port(struct mlx4_dev *dev, __be16 udp_port);
+int mlx4_disable_rx_port_check(struct mlx4_dev *dev, bool dis);
+int mlx4_virt2phy_port_map(struct mlx4_dev *dev, u32 port1, u32 port2);
 int mlx4_vf_smi_enabled(struct mlx4_dev *dev, int slave, int port);
 int mlx4_vf_get_enable_smi_admin(struct mlx4_dev *dev, int slave, int port);
 int mlx4_vf_set_enable_smi_admin(struct mlx4_dev *dev, int slave, int port,
diff --git a/include/linux/mlx4/driver.h b/include/linux/mlx4/driver.h
index 022055c8fb26..9553a73d2049 100644
--- a/include/linux/mlx4/driver.h
+++ b/include/linux/mlx4/driver.h
@@ -49,6 +49,10 @@ enum mlx4_dev_event {
         MLX4_DEV_EVENT_SLAVE_SHUTDOWN,
 };
 
+enum {
+        MLX4_INTFF_BONDING      = 1 << 0
+};
+
 struct mlx4_interface {
         void *                  (*add)   (struct mlx4_dev *dev);
         void                    (*remove)(struct mlx4_dev *dev, void *context);
@@ -57,11 +61,26 @@ struct mlx4_interface {
         void *                  (*get_dev)(struct mlx4_dev *dev, void *context, u8 port);
         struct list_head        list;
         enum mlx4_protocol      protocol;
+        int                     flags;
 };
 
 int mlx4_register_interface(struct mlx4_interface *intf);
 void mlx4_unregister_interface(struct mlx4_interface *intf);
 
+int mlx4_bond(struct mlx4_dev *dev);
+int mlx4_unbond(struct mlx4_dev *dev);
+static inline int mlx4_is_bonded(struct mlx4_dev *dev)
+{
+        return !!(dev->flags & MLX4_FLAG_BONDED);
+}
+
+struct mlx4_port_map {
+        u8      port1;
+        u8      port2;
+};
+
+int mlx4_port_map_set(struct mlx4_dev *dev, struct mlx4_port_map *v2p);
+
 void *mlx4_get_protocol_dev(struct mlx4_dev *dev, enum mlx4_protocol proto, int port);
 
 static inline u64 mlx4_mac_to_u64(u8 *addr)
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index 467ccdf94c98..2bbc62aa818a 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -96,6 +96,7 @@ enum {
         MLX4_QP_BIT_RRE                         = 1 << 15,
         MLX4_QP_BIT_RWE                         = 1 << 14,
         MLX4_QP_BIT_RAE                         = 1 << 13,
+        MLX4_QP_BIT_FPP                         = 1 <<  3,
         MLX4_QP_BIT_RIC                         = 1 <<  4,
 };
 
diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
index 0f01fe065424..996807963716 100644
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -24,13 +24,15 @@
  * Vendors and devices.  Sort key: vendor first, device next.
  */
 #define SDIO_VENDOR_ID_BROADCOM                 0x02d0
-#define SDIO_DEVICE_ID_BROADCOM_43143           43143
+#define SDIO_DEVICE_ID_BROADCOM_43143           0xa887
 #define SDIO_DEVICE_ID_BROADCOM_43241           0x4324
 #define SDIO_DEVICE_ID_BROADCOM_4329            0x4329
 #define SDIO_DEVICE_ID_BROADCOM_4330            0x4330
 #define SDIO_DEVICE_ID_BROADCOM_4334            0x4334
+#define SDIO_DEVICE_ID_BROADCOM_43340           0xa94c
+#define SDIO_DEVICE_ID_BROADCOM_43341           0xa94d
 #define SDIO_DEVICE_ID_BROADCOM_4335_4339       0x4335
-#define SDIO_DEVICE_ID_BROADCOM_43362           43362
+#define SDIO_DEVICE_ID_BROADCOM_43362           0xa962
 #define SDIO_DEVICE_ID_BROADCOM_4354            0x4354
 
 #define SDIO_VENDOR_ID_INTEL                    0x0089
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 8e30685affeb..7d59dc6ab789 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -66,6 +66,7 @@ enum {
         NETIF_F_HW_VLAN_STAG_FILTER_BIT,/* Receive filtering on VLAN STAGs */
         NETIF_F_HW_L2FW_DOFFLOAD_BIT,   /* Allow L2 Forwarding in Hardware */
         NETIF_F_BUSY_POLL_BIT,          /* Busy poll */
+        NETIF_F_HW_SWITCH_OFFLOAD_BIT,  /* HW switch offload */
 
         /*
          * Add your fresh new feature above and remember to update
@@ -124,6 +125,7 @@ enum {
 #define NETIF_F_HW_VLAN_STAG_TX __NETIF_F(HW_VLAN_STAG_TX)
 #define NETIF_F_HW_L2FW_DOFFLOAD        __NETIF_F(HW_L2FW_DOFFLOAD)
 #define NETIF_F_BUSY_POLL       __NETIF_F(BUSY_POLL)
+#define NETIF_F_HW_SWITCH_OFFLOAD       __NETIF_F(HW_SWITCH_OFFLOAD)
 
 /* Features valid for ethtool to change */
 /* = all defined minus driver/device-class-related */
@@ -159,7 +161,9 @@ enum {
  */
 #define NETIF_F_ONE_FOR_ALL     (NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ROBUST | \
                                  NETIF_F_SG | NETIF_F_HIGHDMA |         \
-                                 NETIF_F_FRAGLIST | NETIF_F_VLAN_CHALLENGED)
+                                 NETIF_F_FRAGLIST | NETIF_F_VLAN_CHALLENGED | \
+                                 NETIF_F_HW_SWITCH_OFFLOAD)
+
 /*
  * If one device doesn't support one of these features, then disable it
  * for all in netdev_increment_features.
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 52fd8e8694cf..d115256ed5a2 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -51,6 +51,7 @@
 #include <linux/netdev_features.h>
 #include <linux/neighbour.h>
 #include <uapi/linux/netdevice.h>
+#include <uapi/linux/if_bonding.h>
 
 struct netpoll_info;
 struct device;
@@ -643,39 +644,40 @@ struct rps_dev_flow_table {
 /*
  * The rps_sock_flow_table contains mappings of flows to the last CPU
  * on which they were processed by the application (set in recvmsg).
+ * Each entry is a 32bit value. Upper part is the high order bits
+ * of flow hash, lower part is cpu number.
+ * rps_cpu_mask is used to partition the space, depending on number of
+ * possible cpus : rps_cpu_mask = roundup_pow_of_two(nr_cpu_ids) - 1
+ * For example, if 64 cpus are possible, rps_cpu_mask = 0x3f,
+ * meaning we use 32-6=26 bits for the hash.
  */
 struct rps_sock_flow_table {
-        unsigned int mask;
-        u16 ents[0];
+        u32     mask;
+
+        u32     ents[0] ____cacheline_aligned_in_smp;
 };
-#define RPS_SOCK_FLOW_TABLE_SIZE(_num) (sizeof(struct rps_sock_flow_table) + \
-    ((_num) * sizeof(u16)))
+#define RPS_SOCK_FLOW_TABLE_SIZE(_num) (offsetof(struct rps_sock_flow_table, ents[_num]))
 
 #define RPS_NO_CPU 0xffff
 
+extern u32 rps_cpu_mask;
+extern struct rps_sock_flow_table __rcu *rps_sock_flow_table;
+
 static inline void rps_record_sock_flow(struct rps_sock_flow_table *table,
                                         u32 hash)
 {
         if (table && hash) {
-                unsigned int cpu, index = hash & table->mask;
+                unsigned int index = hash & table->mask;
+                u32 val = hash & ~rps_cpu_mask;
 
                 /* We only give a hint, preemption can change cpu under us */
-                cpu = raw_smp_processor_id();
+                val |= raw_smp_processor_id();
 
-                if (table->ents[index] != cpu)
-                        table->ents[index] = cpu;
+                if (table->ents[index] != val)
+                        table->ents[index] = val;
         }
 }
 
-static inline void rps_reset_sock_flow(struct rps_sock_flow_table *table,
-                                       u32 hash)
-{
-        if (table && hash)
-                table->ents[hash & table->mask] = RPS_NO_CPU;
-}
-
-extern struct rps_sock_flow_table __rcu *rps_sock_flow_table;
-
 #ifdef CONFIG_RFS_ACCEL
 bool rps_may_expire_flow(struct net_device *dev, u16 rxq_index, u32 flow_id,
                          u16 filter_id);
@@ -1154,13 +1156,15 @@ struct net_device_ops {
                                                 int idx);
 
         int                     (*ndo_bridge_setlink)(struct net_device *dev,
-                                                      struct nlmsghdr *nlh);
+                                                      struct nlmsghdr *nlh,
+                                                      u16 flags);
         int                     (*ndo_bridge_getlink)(struct sk_buff *skb,
                                                       u32 pid, u32 seq,
                                                       struct net_device *dev,
                                                       u32 filter_mask);
         int                     (*ndo_bridge_dellink)(struct net_device *dev,
-                                                      struct nlmsghdr *nlh);
+                                                      struct nlmsghdr *nlh,
+                                                      u16 flags);
         int                     (*ndo_change_carrier)(struct net_device *dev,
                                                       bool new_carrier);
         int                     (*ndo_get_phys_port_id)(struct net_device *dev,
@@ -1514,6 +1518,8 @@ struct net_device {
         struct list_head        napi_list;
         struct list_head        unreg_list;
         struct list_head        close_list;
+        struct list_head        ptype_all;
+        struct list_head        ptype_specific;
 
         struct {
                 struct list_head upper;
@@ -1969,7 +1975,7 @@ struct offload_callbacks {
         struct sk_buff          *(*gso_segment)(struct sk_buff *skb,
                                                 netdev_features_t features);
         struct sk_buff          **(*gro_receive)(struct sk_buff **head,
-                                               struct sk_buff *skb);
+                                                 struct sk_buff *skb);
         int                     (*gro_complete)(struct sk_buff *skb, int nhoff);
 };
 
@@ -1979,10 +1985,21 @@ struct packet_offload {
         struct list_head         list;
 };
 
+struct udp_offload;
+
+struct udp_offload_callbacks {
+        struct sk_buff          **(*gro_receive)(struct sk_buff **head,
+                                                 struct sk_buff *skb,
+                                                 struct udp_offload *uoff);
+        int                     (*gro_complete)(struct sk_buff *skb,
+                                                int nhoff,
+                                                struct udp_offload *uoff);
+};
+
 struct udp_offload {
         __be16                   port;
         u8                       ipproto;
-        struct offload_callbacks callbacks;
+        struct udp_offload_callbacks callbacks;
 };
 
 /* often modified stats are per cpu, other are shared (netdev->stats) */
@@ -2041,6 +2058,7 @@ struct pcpu_sw_netstats {
 #define NETDEV_RESEND_IGMP      0x0016
 #define NETDEV_PRECHANGEMTU     0x0017 /* notify before mtu change happened */
 #define NETDEV_CHANGEINFODATA   0x0018
+#define NETDEV_BONDING_INFO     0x0019
 
 int register_netdevice_notifier(struct notifier_block *nb);
 int unregister_netdevice_notifier(struct notifier_block *nb);
@@ -2303,6 +2321,21 @@ do {									\
                                            compute_pseudo(skb, proto)); \
 } while (0)
 
+static inline void skb_gro_remcsum_process(struct sk_buff *skb, void *ptr,
+                                           int start, int offset)
+{
+        __wsum delta;
+
+        BUG_ON(!NAPI_GRO_CB(skb)->csum_valid);
+
+        delta = remcsum_adjust(ptr, NAPI_GRO_CB(skb)->csum, start, offset);
+
+        /* Adjust skb->csum since we changed the packet */
+        skb->csum = csum_add(skb->csum, delta);
+        NAPI_GRO_CB(skb)->csum = csum_add(NAPI_GRO_CB(skb)->csum, delta);
+}
+
+
 static inline int dev_hard_header(struct sk_buff *skb, struct net_device *dev,
                                   unsigned short type,
                                   const void *daddr, const void *saddr,
@@ -3464,6 +3497,19 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
 struct sk_buff *skb_mac_gso_segment(struct sk_buff *skb,
                                     netdev_features_t features);
 
+struct netdev_bonding_info {
+        ifslave slave;
+        ifbond  master;
+};
+
+struct netdev_notifier_bonding_info {
+        struct netdev_notifier_info info; /* must be first */
+        struct netdev_bonding_info  bonding_info;
+};
+
+void netdev_bonding_info_change(struct net_device *dev,
+                                struct netdev_bonding_info *bonding_info);
+
 static inline
 struct sk_buff *skb_gso_segment(struct sk_buff *skb, netdev_features_t features)
 {
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 22af8f8f5802..685809835b5c 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -327,6 +327,8 @@ struct phy_c45_device_ids {
  * c45_ids: 802.3-c45 Device Identifers if is_c45.
  * is_c45:  Set to true if this phy uses clause 45 addressing.
  * is_internal: Set to true if this phy is internal to a MAC.
+ * has_fixups: Set to true if this phy has fixups/quirks.
+ * suspended: Set to true if this phy has been suspended successfully.
  * state: state of the PHY for management purposes
  * dev_flags: Device-specific flags used by the PHY driver.
  * addr: Bus address of PHY
@@ -364,6 +366,7 @@ struct phy_device {
         bool is_c45;
         bool is_internal;
         bool has_fixups;
+        bool suspended;
 
         enum phy_state state;
 
@@ -565,6 +568,15 @@ struct phy_driver {
         void (*write_mmd_indirect)(struct phy_device *dev, int ptrad,
                                    int devnum, int regnum, u32 val);
 
+        /* Get the size and type of the eeprom contained within a plug-in
+         * module */
+        int (*module_info)(struct phy_device *dev,
+                           struct ethtool_modinfo *modinfo);
+
+        /* Get the eeprom information from the plug-in module */
+        int (*module_eeprom)(struct phy_device *dev,
+                             struct ethtool_eeprom *ee, u8 *data);
+
         struct device_driver driver;
 };
 #define to_phy_driver(d) container_of(d, struct phy_driver, driver)
diff --git a/include/linux/platform_data/irda-sa11x0.h b/include/linux/platform_data/irda-sa11x0.h
new file mode 100644
index 000000000000..38f77b5e56cf
--- /dev/null
+++ b/include/linux/platform_data/irda-sa11x0.h
@@ -0,0 +1,20 @@
+/*
+ *  arch/arm/include/asm/mach/irda.h
+ *
+ *  Copyright (C) 2004 Russell King.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef __ASM_ARM_MACH_IRDA_H
+#define __ASM_ARM_MACH_IRDA_H
+
+struct irda_platform_data {
+        int (*startup)(struct device *);
+        void (*shutdown)(struct device *);
+        int (*set_power)(struct device *, unsigned int state);
+        void (*set_speed)(struct device *, unsigned int speed);
+};
+
+#endif
diff --git a/include/linux/platform_data/st21nfca.h b/include/linux/platform_data/st21nfca.h
index 5087fff96d86..cc2bdafb0c69 100644
--- a/include/linux/platform_data/st21nfca.h
+++ b/include/linux/platform_data/st21nfca.h
@@ -26,6 +26,8 @@
 struct st21nfca_nfc_platform_data {
         unsigned int gpio_ena;
         unsigned int irq_polarity;
+        bool is_ese_present;
+        bool is_uicc_present;
 };
 
 #endif /* _ST21NFCA_HCI_H_ */
diff --git a/include/linux/platform_data/st21nfcb.h b/include/linux/platform_data/st21nfcb.h
index c3b432f5b63e..b023373d9874 100644
--- a/include/linux/platform_data/st21nfcb.h
+++ b/include/linux/platform_data/st21nfcb.h
@@ -19,8 +19,6 @@
 #ifndef _ST21NFCB_NCI_H_
 #define _ST21NFCB_NCI_H_
 
-#include <linux/i2c.h>
-
 #define ST21NFCB_NCI_DRIVER_NAME "st21nfcb_nci"
 
 struct st21nfcb_nfc_platform_data {
@@ -28,4 +26,4 @@ struct st21nfcb_nfc_platform_data {
         unsigned int irq_polarity;
 };
 
-#endif /* _ST21NFCA_HCI_H_ */
+#endif /* _ST21NFCB_NCI_H_ */
diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index b93fd89b2e5e..58851275fed9 100644
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -18,16 +18,45 @@
 #ifndef _LINUX_RHASHTABLE_H
 #define _LINUX_RHASHTABLE_H
 
-#include <linux/rculist.h>
+#include <linux/compiler.h>
+#include <linux/list_nulls.h>
+#include <linux/workqueue.h>
+#include <linux/mutex.h>
+
+/*
+ * The end of the chain is marked with a special nulls marks which has
+ * the following format:
+ *
+ * +-------+-----------------------------------------------------+-+
+ * | Base  |                      Hash                           |1|
+ * +-------+-----------------------------------------------------+-+
+ *
+ * Base (4 bits) : Reserved to distinguish between multiple tables.
+ *                 Specified via &struct rhashtable_params.nulls_base.
+ * Hash (27 bits): Full hash (unmasked) of first element added to bucket
+ * 1 (1 bit)     : Nulls marker (always set)
+ *
+ * The remaining bits of the next pointer remain unused for now.
+ */
+#define RHT_BASE_BITS           4
+#define RHT_HASH_BITS           27
+#define RHT_BASE_SHIFT          RHT_HASH_BITS
 
 struct rhash_head {
         struct rhash_head __rcu         *next;
 };
 
-#define INIT_HASH_HEAD(ptr) ((ptr)->next = NULL)
-
+/**
+ * struct bucket_table - Table of hash buckets
+ * @size: Number of hash buckets
+ * @locks_mask: Mask to apply before accessing locks[]
+ * @locks: Array of spinlocks protecting individual buckets
+ * @buckets: size * hash buckets
+ */
 struct bucket_table {
         size_t                          size;
+        unsigned int                    locks_mask;
+        spinlock_t                      *locks;
         struct rhash_head __rcu         *buckets[];
 };
 
@@ -45,11 +74,16 @@ struct rhashtable;
  * @hash_rnd: Seed to use while hashing
  * @max_shift: Maximum number of shifts while expanding
  * @min_shift: Minimum number of shifts while shrinking
+ * @nulls_base: Base value to generate nulls marker
+ * @locks_mul: Number of bucket locks to allocate per cpu (default: 128)
  * @hashfn: Function to hash key
  * @obj_hashfn: Function to hash object
  * @grow_decision: If defined, may return true if table should expand
  * @shrink_decision: If defined, may return true if table should shrink
- * @mutex_is_held: Must return true if protecting mutex is held
+ *
+ * Note: when implementing the grow and shrink decision function, min/max
+ * shift must be enforced, otherwise, resizing watermarks they set may be
+ * useless.
  */
 struct rhashtable_params {
         size_t                  nelem_hint;
@@ -59,36 +93,95 @@ struct rhashtable_params {
         u32                     hash_rnd;
         size_t                  max_shift;
         size_t                  min_shift;
+        u32                     nulls_base;
+        size_t                  locks_mul;
         rht_hashfn_t            hashfn;
         rht_obj_hashfn_t        obj_hashfn;
         bool                    (*grow_decision)(const struct rhashtable *ht,
                                                  size_t new_size);
         bool                    (*shrink_decision)(const struct rhashtable *ht,
                                                    size_t new_size);
-#ifdef CONFIG_PROVE_LOCKING
-        int                     (*mutex_is_held)(void *parent);
-        void                    *parent;
-#endif
 };
 
 /**
  * struct rhashtable - Hash table handle
  * @tbl: Bucket table
+ * @future_tbl: Table under construction during expansion/shrinking
  * @nelems: Number of elements in table
  * @shift: Current size (1 << shift)
  * @p: Configuration parameters
+ * @run_work: Deferred worker to expand/shrink asynchronously
+ * @mutex: Mutex to protect current/future table swapping
+ * @walkers: List of active walkers
+ * @being_destroyed: True if table is set up for destruction
  */
 struct rhashtable {
         struct bucket_table __rcu       *tbl;
-        size_t                          nelems;
-        size_t                          shift;
+        struct bucket_table __rcu       *future_tbl;
+        atomic_t                        nelems;
+        atomic_t                        shift;
         struct rhashtable_params        p;
+        struct work_struct              run_work;
+        struct mutex                    mutex;
+        struct list_head                walkers;
+        bool                            being_destroyed;
+};
+
+/**
+ * struct rhashtable_walker - Hash table walker
+ * @list: List entry on list of walkers
+ * @resize: Resize event occured
+ */
+struct rhashtable_walker {
+        struct list_head list;
+        bool resize;
 };
 
+/**
+ * struct rhashtable_iter - Hash table iterator, fits into netlink cb
+ * @ht: Table to iterate through
+ * @p: Current pointer
+ * @walker: Associated rhashtable walker
+ * @slot: Current slot
+ * @skip: Number of entries to skip in slot
+ */
+struct rhashtable_iter {
+        struct rhashtable *ht;
+        struct rhash_head *p;
+        struct rhashtable_walker *walker;
+        unsigned int slot;
+        unsigned int skip;
+};
+
+static inline unsigned long rht_marker(const struct rhashtable *ht, u32 hash)
+{
+        return NULLS_MARKER(ht->p.nulls_base + hash);
+}
+
+#define INIT_RHT_NULLS_HEAD(ptr, ht, hash) \
+        ((ptr) = (typeof(ptr)) rht_marker(ht, hash))
+
+static inline bool rht_is_a_nulls(const struct rhash_head *ptr)
+{
+        return ((unsigned long) ptr & 1);
+}
+
+static inline unsigned long rht_get_nulls_value(const struct rhash_head *ptr)
+{
+        return ((unsigned long) ptr) >> 1;
+}
+
 #ifdef CONFIG_PROVE_LOCKING
-int lockdep_rht_mutex_is_held(const struct rhashtable *ht);
+int lockdep_rht_mutex_is_held(struct rhashtable *ht);
+int lockdep_rht_bucket_is_held(const struct bucket_table *tbl, u32 hash);
 #else
-static inline int lockdep_rht_mutex_is_held(const struct rhashtable *ht)
+static inline int lockdep_rht_mutex_is_held(struct rhashtable *ht)
+{
+        return 1;
+}
+
+static inline int lockdep_rht_bucket_is_held(const struct bucket_table *tbl,
+                                             u32 hash)
 {
         return 1;
 }
@@ -96,13 +189,8 @@ static inline int lockdep_rht_mutex_is_held(const struct rhashtable *ht)
 
 int rhashtable_init(struct rhashtable *ht, struct rhashtable_params *params);
 
-u32 rhashtable_hashfn(const struct rhashtable *ht, const void *key, u32 len);
-u32 rhashtable_obj_hashfn(const struct rhashtable *ht, void *ptr);
-
 void rhashtable_insert(struct rhashtable *ht, struct rhash_head *node);
 bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *node);
-void rhashtable_remove_pprev(struct rhashtable *ht, struct rhash_head *obj,
-                             struct rhash_head __rcu **pprev);
 
 bool rht_grow_above_75(const struct rhashtable *ht, size_t new_size);
 bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size);
@@ -110,11 +198,23 @@ bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size);
 int rhashtable_expand(struct rhashtable *ht);
 int rhashtable_shrink(struct rhashtable *ht);
 
-void *rhashtable_lookup(const struct rhashtable *ht, const void *key);
-void *rhashtable_lookup_compare(const struct rhashtable *ht, u32 hash,
+void *rhashtable_lookup(struct rhashtable *ht, const void *key);
+void *rhashtable_lookup_compare(struct rhashtable *ht, const void *key,
                                 bool (*compare)(void *, void *), void *arg);
 
-void rhashtable_destroy(const struct rhashtable *ht);
+bool rhashtable_lookup_insert(struct rhashtable *ht, struct rhash_head *obj);
+bool rhashtable_lookup_compare_insert(struct rhashtable *ht,
+                                      struct rhash_head *obj,
+                                      bool (*compare)(void *, void *),
+                                      void *arg);
+
+int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter);
+void rhashtable_walk_exit(struct rhashtable_iter *iter);
+int rhashtable_walk_start(struct rhashtable_iter *iter) __acquires(RCU);
+void *rhashtable_walk_next(struct rhashtable_iter *iter);
+void rhashtable_walk_stop(struct rhashtable_iter *iter) __releases(RCU);
+
+void rhashtable_destroy(struct rhashtable *ht);
 
 #define rht_dereference(p, ht) \
         rcu_dereference_protected(p, lockdep_rht_mutex_is_held(ht))
@@ -122,92 +222,146 @@ void rhashtable_destroy(const struct rhashtable *ht);
 #define rht_dereference_rcu(p, ht) \
         rcu_dereference_check(p, lockdep_rht_mutex_is_held(ht))
 
-#define rht_entry(ptr, type, member) container_of(ptr, type, member)
-#define rht_entry_safe(ptr, type, member) \
-({ \
-        typeof(ptr) __ptr = (ptr); \
-           __ptr ? rht_entry(__ptr, type, member) : NULL; \
-})
+#define rht_dereference_bucket(p, tbl, hash) \
+        rcu_dereference_protected(p, lockdep_rht_bucket_is_held(tbl, hash))
+
+#define rht_dereference_bucket_rcu(p, tbl, hash) \
+        rcu_dereference_check(p, lockdep_rht_bucket_is_held(tbl, hash))
 
-#define rht_next_entry_safe(pos, ht, member) \
-({ \
-        pos ? rht_entry_safe(rht_dereference((pos)->member.next, ht), \
-                             typeof(*(pos)), member) : NULL; \
-})
+#define rht_entry(tpos, pos, member) \
+        ({ tpos = container_of(pos, typeof(*tpos), member); 1; })
+
+/**
+ * rht_for_each_continue - continue iterating over hash chain
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @head:       the previous &struct rhash_head to continue from
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ */
+#define rht_for_each_continue(pos, head, tbl, hash) \
+        for (pos = rht_dereference_bucket(head, tbl, hash); \
+             !rht_is_a_nulls(pos); \
+             pos = rht_dereference_bucket((pos)->next, tbl, hash))
 
 /**
  * rht_for_each - iterate over hash chain
- * @pos:        &struct rhash_head to use as a loop cursor.
- * @head:       head of the hash chain (struct rhash_head *)
- * @ht:         pointer to your struct rhashtable
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
  */
-#define rht_for_each(pos, head, ht) \
-        for (pos = rht_dereference(head, ht); \
-             pos; \
-             pos = rht_dereference((pos)->next, ht))
+#define rht_for_each(pos, tbl, hash) \
+        rht_for_each_continue(pos, (tbl)->buckets[hash], tbl, hash)
+
+/**
+ * rht_for_each_entry_continue - continue iterating over hash chain
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @head:       the previous &struct rhash_head to continue from
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ * @member:     name of the &struct rhash_head within the hashable struct.
+ */
+#define rht_for_each_entry_continue(tpos, pos, head, tbl, hash, member) \
+        for (pos = rht_dereference_bucket(head, tbl, hash);             \
+             (!rht_is_a_nulls(pos)) && rht_entry(tpos, pos, member);    \
+             pos = rht_dereference_bucket((pos)->next, tbl, hash))
 
 /**
  * rht_for_each_entry - iterate over hash chain of given type
- * @pos:        type * to use as a loop cursor.
- * @head:       head of the hash chain (struct rhash_head *)
- * @ht:         pointer to your struct rhashtable
- * @member:     name of the rhash_head within the hashable struct.
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ * @member:     name of the &struct rhash_head within the hashable struct.
  */
-#define rht_for_each_entry(pos, head, ht, member) \
-        for (pos = rht_entry_safe(rht_dereference(head, ht), \
-                                   typeof(*(pos)), member); \
-             pos; \
-             pos = rht_next_entry_safe(pos, ht, member))
+#define rht_for_each_entry(tpos, pos, tbl, hash, member)                \
+        rht_for_each_entry_continue(tpos, pos, (tbl)->buckets[hash],    \
+                                    tbl, hash, member)
 
 /**
  * rht_for_each_entry_safe - safely iterate over hash chain of given type
- * @pos:        type * to use as a loop cursor.
- * @n:          type * to use for temporary next object storage
- * @head:       head of the hash chain (struct rhash_head *)
- * @ht:         pointer to your struct rhashtable
- * @member:     name of the rhash_head within the hashable struct.
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @next:       the &struct rhash_head to use as next in loop cursor.
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ * @member:     name of the &struct rhash_head within the hashable struct.
  *
  * This hash chain list-traversal primitive allows for the looped code to
  * remove the loop cursor from the list.
  */
-#define rht_for_each_entry_safe(pos, n, head, ht, member)               \
-        for (pos = rht_entry_safe(rht_dereference(head, ht), \
-                                  typeof(*(pos)), member), \
-             n = rht_next_entry_safe(pos, ht, member); \
-             pos; \
-             pos = n, \
-             n = rht_next_entry_safe(pos, ht, member))
+#define rht_for_each_entry_safe(tpos, pos, next, tbl, hash, member)         \
+        for (pos = rht_dereference_bucket((tbl)->buckets[hash], tbl, hash), \
+             next = !rht_is_a_nulls(pos) ?                                  \
+                       rht_dereference_bucket(pos->next, tbl, hash) : NULL; \
+             (!rht_is_a_nulls(pos)) && rht_entry(tpos, pos, member);        \
+             pos = next,                                                    \
+             next = !rht_is_a_nulls(pos) ?                                  \
+                       rht_dereference_bucket(pos->next, tbl, hash) : NULL)
+
+/**
+ * rht_for_each_rcu_continue - continue iterating over rcu hash chain
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @head:       the previous &struct rhash_head to continue from
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ *
+ * This hash chain list-traversal primitive may safely run concurrently with
+ * the _rcu mutation primitives such as rhashtable_insert() as long as the
+ * traversal is guarded by rcu_read_lock().
+ */
+#define rht_for_each_rcu_continue(pos, head, tbl, hash)                 \
+        for (({barrier(); }),                                           \
+             pos = rht_dereference_bucket_rcu(head, tbl, hash);         \
+             !rht_is_a_nulls(pos);                                      \
+             pos = rcu_dereference_raw(pos->next))
 
 /**
  * rht_for_each_rcu - iterate over rcu hash chain
- * @pos:        &struct rhash_head to use as a loop cursor.
- * @head:       head of the hash chain (struct rhash_head *)
- * @ht:         pointer to your struct rhashtable
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ *
+ * This hash chain list-traversal primitive may safely run concurrently with
+ * the _rcu mutation primitives such as rhashtable_insert() as long as the
+ * traversal is guarded by rcu_read_lock().
+ */
+#define rht_for_each_rcu(pos, tbl, hash)                                \
+        rht_for_each_rcu_continue(pos, (tbl)->buckets[hash], tbl, hash)
+
+/**
+ * rht_for_each_entry_rcu_continue - continue iterating over rcu hash chain
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @head:       the previous &struct rhash_head to continue from
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ * @member:     name of the &struct rhash_head within the hashable struct.
  *
  * This hash chain list-traversal primitive may safely run concurrently with
- * the _rcu fkht mutation primitives such as rht_insert() as long as the
+ * the _rcu mutation primitives such as rhashtable_insert() as long as the
  * traversal is guarded by rcu_read_lock().
  */
-#define rht_for_each_rcu(pos, head, ht) \
-        for (pos = rht_dereference_rcu(head, ht); \
-             pos; \
-             pos = rht_dereference_rcu((pos)->next, ht))
+#define rht_for_each_entry_rcu_continue(tpos, pos, head, tbl, hash, member) \
+        for (({barrier(); }),                                               \
+             pos = rht_dereference_bucket_rcu(head, tbl, hash);             \
+             (!rht_is_a_nulls(pos)) && rht_entry(tpos, pos, member);        \
+             pos = rht_dereference_bucket_rcu(pos->next, tbl, hash))
 
 /**
  * rht_for_each_entry_rcu - iterate over rcu hash chain of given type
- * @pos:        type * to use as a loop cursor.
- * @head:       head of the hash chain (struct rhash_head *)
- * @member:     name of the rhash_head within the hashable struct.
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct rhash_head to use as a loop cursor.
+ * @tbl:        the &struct bucket_table
+ * @hash:       the hash value / bucket index
+ * @member:     name of the &struct rhash_head within the hashable struct.
  *
  * This hash chain list-traversal primitive may safely run concurrently with
- * the _rcu fkht mutation primitives such as rht_insert() as long as the
+ * the _rcu mutation primitives such as rhashtable_insert() as long as the
  * traversal is guarded by rcu_read_lock().
  */
-#define rht_for_each_entry_rcu(pos, head, member) \
-        for (pos = rht_entry_safe(rcu_dereference_raw(head), \
-                                  typeof(*(pos)), member); \
-             pos; \
-             pos = rht_entry_safe(rcu_dereference_raw((pos)->member.next), \
-                                  typeof(*(pos)), member))
+#define rht_for_each_entry_rcu(tpos, pos, tbl, hash, member)            \
+        rht_for_each_entry_rcu_continue(tpos, pos, (tbl)->buckets[hash],\
+                                        tbl, hash, member)
 
 #endif /* _LINUX_RHASHTABLE_H */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 85ab7d72b54c..1bb36edb66b9 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -626,8 +626,11 @@ struct sk_buff {
         __u32                   hash;
         __be16                  vlan_proto;
         __u16                   vlan_tci;
-#ifdef CONFIG_NET_RX_BUSY_POLL
-        unsigned int    napi_id;
+#if defined(CONFIG_NET_RX_BUSY_POLL) || defined(CONFIG_XPS)
+        union {
+                unsigned int    napi_id;
+                unsigned int    sender_cpu;
+        };
 #endif
 #ifdef CONFIG_NETWORK_SECMARK
         __u32                   secmark;
@@ -2484,19 +2487,18 @@ static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
 }
 
 static inline int skb_add_data(struct sk_buff *skb,
-                               char __user *from, int copy)
+                               struct iov_iter *from, int copy)
 {
         const int off = skb->len;
 
         if (skb->ip_summed == CHECKSUM_NONE) {
-                int err = 0;
-                __wsum csum = csum_and_copy_from_user(from, skb_put(skb, copy),
-                                                            copy, 0, &err);
-                if (!err) {
+                __wsum csum = 0;
+                if (csum_and_copy_from_iter(skb_put(skb, copy), copy,
+                                            &csum, from) == copy) {
                         skb->csum = csum_block_add(skb->csum, csum, off);
                         return 0;
                 }
-        } else if (!copy_from_user(skb_put(skb, copy), from, copy))
+        } else if (copy_from_iter(skb_put(skb, copy), copy, from) == copy)
                 return 0;
 
         __skb_trim(skb, off);
@@ -2693,8 +2695,7 @@ int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci);
 
 static inline int memcpy_from_msg(void *data, struct msghdr *msg, int len)
 {
-        /* XXX: stripping const */
-        return memcpy_fromiovec(data, (struct iovec *)msg->msg_iter.iov, len);
+        return copy_from_iter(data, len, &msg->msg_iter) == len ? 0 : -EFAULT;
 }
 
 static inline int memcpy_to_msg(struct msghdr *msg, void *data, int len)
@@ -3071,7 +3072,7 @@ static inline __wsum null_compute_pseudo(struct sk_buff *skb, int proto)
 
 #define skb_checksum_validate_zero_check(skb, proto, check,             \
                                          compute_pseudo)                \
-        __skb_checksum_validate_(skb, proto, true, true, check, compute_pseudo)
+        __skb_checksum_validate(skb, proto, true, true, check, compute_pseudo)
 
 #define skb_checksum_simple_validate(skb)                               \
         __skb_checksum_validate(skb, 0, true, false, 0, null_compute_pseudo)
@@ -3096,6 +3097,27 @@ do {									\
                                        compute_pseudo(skb, proto));     \
 } while (0)
 
+/* Update skbuf and packet to reflect the remote checksum offload operation.
+ * When called, ptr indicates the starting point for skb->csum when
+ * ip_summed is CHECKSUM_COMPLETE. If we need create checksum complete
+ * here, skb_postpull_rcsum is done so skb->csum start is ptr.
+ */
+static inline void skb_remcsum_process(struct sk_buff *skb, void *ptr,
+                                       int start, int offset)
+{
+        __wsum delta;
+
+         if (unlikely(skb->ip_summed != CHECKSUM_COMPLETE)) {
+                __skb_checksum_complete(skb);
+                skb_postpull_rcsum(skb, skb->data, ptr - (void *)skb->data);
+        }
+
+        delta = remcsum_adjust(ptr, skb->csum, start, offset);
+
+        /* Adjust skb->csum since we changed the packet */
+        skb->csum = csum_add(skb->csum, delta);
+}
+
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 void nf_conntrack_destroy(struct nf_conntrack *nfct);
 static inline void nf_conntrack_put(struct nf_conntrack *nfct)
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 6e49a14365dc..5c19cba34dce 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -318,13 +318,6 @@ struct ucred {
 /* IPX options */
 #define IPX_TYPE        1
 
-extern int csum_partial_copy_fromiovecend(unsigned char *kdata, 
-                                          struct iovec *iov, 
-                                          int offset, 
-                                          unsigned int len, __wsum *csump);
-extern unsigned long iov_pages(const struct iovec *iov, int offset,
-                               unsigned long nr_segs);
-
 extern int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr);
 extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
 
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index 262ba4ef9a8e..3e18379dfa6f 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -190,6 +190,8 @@ static inline void do_raw_spin_unlock(raw_spinlock_t *lock) __releases(lock)
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 # define raw_spin_lock_nested(lock, subclass) \
         _raw_spin_lock_nested(lock, subclass)
+# define raw_spin_lock_bh_nested(lock, subclass) \
+        _raw_spin_lock_bh_nested(lock, subclass)
 
 # define raw_spin_lock_nest_lock(lock, nest_lock)                       \
          do {                                                           \
@@ -205,6 +207,7 @@ static inline void do_raw_spin_unlock(raw_spinlock_t *lock) __releases(lock)
 # define raw_spin_lock_nested(lock, subclass)           \
         _raw_spin_lock(((void)(subclass), (lock)))
 # define raw_spin_lock_nest_lock(lock, nest_lock)       _raw_spin_lock(lock)
+# define raw_spin_lock_bh_nested(lock, subclass)        _raw_spin_lock_bh(lock)
 #endif
 
 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
@@ -324,6 +327,11 @@ do {								\
         raw_spin_lock_nested(spinlock_check(lock), subclass);   \
 } while (0)
 
+#define spin_lock_bh_nested(lock, subclass)                     \
+do {                                                            \
+        raw_spin_lock_bh_nested(spinlock_check(lock), subclass);\
+} while (0)
+
 #define spin_lock_nest_lock(lock, nest_lock)                            \
 do {                                                                    \
         raw_spin_lock_nest_lock(spinlock_check(lock), nest_lock);       \
diff --git a/include/linux/spinlock_api_smp.h b/include/linux/spinlock_api_smp.h
index 42dfab89e740..5344268e6e62 100644
--- a/include/linux/spinlock_api_smp.h
+++ b/include/linux/spinlock_api_smp.h
@@ -22,6 +22,8 @@ int in_lock_functions(unsigned long addr);
 void __lockfunc _raw_spin_lock(raw_spinlock_t *lock)            __acquires(lock);
 void __lockfunc _raw_spin_lock_nested(raw_spinlock_t *lock, int subclass)
                                                                 __acquires(lock);
+void __lockfunc _raw_spin_lock_bh_nested(raw_spinlock_t *lock, int subclass)
+                                                                __acquires(lock);
 void __lockfunc
 _raw_spin_lock_nest_lock(raw_spinlock_t *lock, struct lockdep_map *map)
                                                                 __acquires(lock);
diff --git a/include/linux/spinlock_api_up.h b/include/linux/spinlock_api_up.h
index d0d188861ad6..d3afef9d8dbe 100644
--- a/include/linux/spinlock_api_up.h
+++ b/include/linux/spinlock_api_up.h
@@ -57,6 +57,7 @@
 
 #define _raw_spin_lock(lock)                    __LOCK(lock)
 #define _raw_spin_lock_nested(lock, subclass)   __LOCK(lock)
+#define _raw_spin_lock_bh_nested(lock, subclass) __LOCK(lock)
 #define _raw_read_lock(lock)                    __LOCK(lock)
 #define _raw_write_lock(lock)                   __LOCK(lock)
 #define _raw_spin_lock_bh(lock)                 __LOCK_BH(lock)
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index f7b9100686c3..c0f707ac192b 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -173,6 +173,7 @@
 #define SSB_SPROMSIZE_BYTES_R123        (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
 #define SSB_SPROMSIZE_BYTES_R4          (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
 #define SSB_SPROMSIZE_WORDS_R10         230
+#define SSB_SPROMSIZE_WORDS_R11         234
 #define SSB_SPROM_BASE1                 0x1000
 #define SSB_SPROM_BASE31                0x0800
 #define SSB_SPROM_REVISION              0x007E
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 67309ece0772..1a7adb411647 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -115,6 +115,7 @@ struct tcp_request_sock {
         u32                             rcv_isn;
         u32                             snt_isn;
         u32                             snt_synack; /* synack sent time */
+        u32                             last_oow_ack_time; /* last SYNACK */
         u32                             rcv_nxt; /* the ack # by SYNACK. For
                                                   * FastOpen it's the seq#
                                                   * after data-in-SYN.
@@ -152,6 +153,7 @@ struct tcp_sock {
         u32     snd_sml;        /* Last byte of the most recently transmitted small packet */
         u32     rcv_tstamp;     /* timestamp of last received ACK (for keepalives) */
         u32     lsndtime;       /* timestamp of last sent data packet (for restart window) */
+        u32     last_oow_ack_time;  /* timestamp of last out-of-window ACK */
 
         u32     tsoffset;       /* timestamp offset */
 
@@ -340,6 +342,10 @@ struct tcp_timewait_sock {
         u32                       tw_rcv_wnd;
         u32                       tw_ts_offset;
         u32                       tw_ts_recent;
+
+        /* The time we sent the last out-of-window ACK: */
+        u32                       tw_last_oow_ack_time;
+
         long                      tw_ts_recent_stamp;
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_md5sig_key     *tw_md5_key;
diff --git a/include/linux/timecounter.h b/include/linux/timecounter.h
new file mode 100644
index 000000000000..4382035a75bb
--- /dev/null
+++ b/include/linux/timecounter.h
@@ -0,0 +1,139 @@
+/*
+ * linux/include/linux/timecounter.h
+ *
+ * based on code that migrated away from
+ * linux/include/linux/clocksource.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#ifndef _LINUX_TIMECOUNTER_H
+#define _LINUX_TIMECOUNTER_H
+
+#include <linux/types.h>
+
+/* simplify initialization of mask field */
+#define CYCLECOUNTER_MASK(bits) (cycle_t)((bits) < 64 ? ((1ULL<<(bits))-1) : -1)
+
+/**
+ * struct cyclecounter - hardware abstraction for a free running counter
+ *      Provides completely state-free accessors to the underlying hardware.
+ *      Depending on which hardware it reads, the cycle counter may wrap
+ *      around quickly. Locking rules (if necessary) have to be defined
+ *      by the implementor and user of specific instances of this API.
+ *
+ * @read:               returns the current cycle value
+ * @mask:               bitmask for two's complement
+ *                      subtraction of non 64 bit counters,
+ *                      see CYCLECOUNTER_MASK() helper macro
+ * @mult:               cycle to nanosecond multiplier
+ * @shift:              cycle to nanosecond divisor (power of two)
+ */
+struct cyclecounter {
+        cycle_t (*read)(const struct cyclecounter *cc);
+        cycle_t mask;
+        u32 mult;
+        u32 shift;
+};
+
+/**
+ * struct timecounter - layer above a %struct cyclecounter which counts nanoseconds
+ *      Contains the state needed by timecounter_read() to detect
+ *      cycle counter wrap around. Initialize with
+ *      timecounter_init(). Also used to convert cycle counts into the
+ *      corresponding nanosecond counts with timecounter_cyc2time(). Users
+ *      of this code are responsible for initializing the underlying
+ *      cycle counter hardware, locking issues and reading the time
+ *      more often than the cycle counter wraps around. The nanosecond
+ *      counter will only wrap around after ~585 years.
+ *
+ * @cc:                 the cycle counter used by this instance
+ * @cycle_last:         most recent cycle counter value seen by
+ *                      timecounter_read()
+ * @nsec:               continuously increasing count
+ * @mask:               bit mask for maintaining the 'frac' field
+ * @frac:               accumulated fractional nanoseconds
+ */
+struct timecounter {
+        const struct cyclecounter *cc;
+        cycle_t cycle_last;
+        u64 nsec;
+        u64 mask;
+        u64 frac;
+};
+
+/**
+ * cyclecounter_cyc2ns - converts cycle counter cycles to nanoseconds
+ * @cc:         Pointer to cycle counter.
+ * @cycles:     Cycles
+ * @mask:       bit mask for maintaining the 'frac' field
+ * @frac:       pointer to storage for the fractional nanoseconds.
+ */
+static inline u64 cyclecounter_cyc2ns(const struct cyclecounter *cc,
+                                      cycle_t cycles, u64 mask, u64 *frac)
+{
+        u64 ns = (u64) cycles;
+
+        ns = (ns * cc->mult) + *frac;
+        *frac = ns & mask;
+        return ns >> cc->shift;
+}
+
+/**
+ * timecounter_adjtime - Shifts the time of the clock.
+ * @delta:      Desired change in nanoseconds.
+ */
+static inline void timecounter_adjtime(struct timecounter *tc, s64 delta)
+{
+        tc->nsec += delta;
+}
+
+/**
+ * timecounter_init - initialize a time counter
+ * @tc:                 Pointer to time counter which is to be initialized/reset
+ * @cc:                 A cycle counter, ready to be used.
+ * @start_tstamp:       Arbitrary initial time stamp.
+ *
+ * After this call the current cycle register (roughly) corresponds to
+ * the initial time stamp. Every call to timecounter_read() increments
+ * the time stamp counter by the number of elapsed nanoseconds.
+ */
+extern void timecounter_init(struct timecounter *tc,
+                             const struct cyclecounter *cc,
+                             u64 start_tstamp);
+
+/**
+ * timecounter_read - return nanoseconds elapsed since timecounter_init()
+ *                    plus the initial time stamp
+ * @tc:          Pointer to time counter.
+ *
+ * In other words, keeps track of time since the same epoch as
+ * the function which generated the initial time stamp.
+ */
+extern u64 timecounter_read(struct timecounter *tc);
+
+/**
+ * timecounter_cyc2time - convert a cycle counter to same
+ *                        time base as values returned by
+ *                        timecounter_read()
+ * @tc:         Pointer to time counter.
+ * @cycle_tstamp:       a value returned by tc->cc->read()
+ *
+ * Cycle counts that are converted correctly as long as they
+ * fall into the interval [-1/2 max cycle count, +1/2 max cycle count],
+ * with "max cycle count" == cs->mask+1.
+ *
+ * This allows conversion of cycle counter values which were generated
+ * in the past.
+ */
+extern u64 timecounter_cyc2time(struct timecounter *tc,
+                                cycle_t cycle_tstamp);
+
+#endif
diff --git a/include/linux/types.h b/include/linux/types.h
index a0bb7048687f..62323825cff9 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -213,5 +213,8 @@ struct callback_head {
 };
 #define rcu_head callback_head
 
+/* clocksource cycle base type */
+typedef u64 cycle_t;
+
 #endif /*  __ASSEMBLY__ */
 #endif /* _LINUX_TYPES_H */
diff --git a/include/linux/udp.h b/include/linux/udp.h
index ee3277593222..247cfdcc4b08 100644
--- a/include/linux/udp.h
+++ b/include/linux/udp.h
@@ -49,11 +49,7 @@ struct udp_sock {
         unsigned int     corkflag;      /* Cork is required */
         __u8             encap_type;    /* Is this an Encapsulation socket? */
         unsigned char    no_check6_tx:1,/* Send zero UDP6 checksums on TX? */
-                         no_check6_rx:1,/* Allow zero UDP6 checksums on RX? */
-                         convert_csum:1;/* On receive, convert checksum
-                                         * unnecessary to checksum complete
-                                         * if possible.
-                                         */
+                         no_check6_rx:1;/* Allow zero UDP6 checksums on RX? */
         /*
          * Following member retains the information to create a UDP header
          * when the socket is uncorked.
@@ -102,16 +98,6 @@ static inline bool udp_get_no_check6_rx(struct sock *sk)
         return udp_sk(sk)->no_check6_rx;
 }
 
-static inline void udp_set_convert_csum(struct sock *sk, bool val)
-{
-        udp_sk(sk)->convert_csum = val;
-}
-
-static inline bool udp_get_convert_csum(struct sock *sk)
-{
-        return udp_sk(sk)->convert_csum;
-}
-
 #define udp_portaddr_for_each_entry(__sk, node, list) \
         hlist_nulls_for_each_entry(__sk, node, list, __sk_common.skc_portaddr_node)
 
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 1c5e453f7ea9..3e0cb4ea3905 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -135,10 +135,4 @@ static inline void iov_iter_reexpand(struct iov_iter *i, size_t count)
 size_t csum_and_copy_to_iter(void *addr, size_t bytes, __wsum *csum, struct iov_iter *i);
 size_t csum_and_copy_from_iter(void *addr, size_t bytes, __wsum *csum, struct iov_iter *i);
 
-int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len);
-int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
-                        int offset, int len);
-int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
-                      int offset, int len);
-
 #endif
diff --git a/include/linux/vmw_vmci_api.h b/include/linux/vmw_vmci_api.h
index 5691f752ce8f..63df3a2a8ce5 100644
--- a/include/linux/vmw_vmci_api.h
+++ b/include/linux/vmw_vmci_api.h
@@ -74,7 +74,7 @@ ssize_t vmci_qpair_dequeue(struct vmci_qp *qpair,
 ssize_t vmci_qpair_peek(struct vmci_qp *qpair, void *buf, size_t buf_size,
                         int mode);
 ssize_t vmci_qpair_enquev(struct vmci_qp *qpair,
-                          void *iov, size_t iov_size, int mode);
+                          struct msghdr *msg, size_t iov_size, int mode);
 ssize_t vmci_qpair_dequev(struct vmci_qp *qpair,
                           struct msghdr *msg, size_t iov_size, int mode);
 ssize_t vmci_qpair_peekv(struct vmci_qp *qpair, struct msghdr *msg, size_t iov_size,
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index d13573bb879e..80456f72d70a 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -62,6 +62,9 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg);
 
 int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
                   const struct net_device *dev, int strict);
+int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
+                            const struct net_device *dev, int strict,
+                            u32 banned_flags);
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr);
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 58695ffeb138..e00455aab18c 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -273,7 +273,7 @@ struct l2cap_ctrl {
 
 struct hci_dev;
 
-typedef void (*hci_req_complete_t)(struct hci_dev *hdev, u8 status);
+typedef void (*hci_req_complete_t)(struct hci_dev *hdev, u8 status, u16 opcode);
 
 struct hci_req_ctrl {
         bool                    start;
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 40129b3838b2..8e54f825153c 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -102,6 +102,28 @@ enum {
          */
         HCI_QUIRK_FIXUP_BUFFER_SIZE,
 
+        /* When this quirk is set, then a controller that does not
+         * indicate support for Inquiry Result with RSSI is assumed to
+         * support it anyway. Some early Bluetooth 1.2 controllers had
+         * wrongly configured local features that will require forcing
+         * them to enable this mode. Getting RSSI information with the
+         * inquiry responses is preferred since it allows for a better
+         * user expierence.
+         *
+         * This quirk must be set before hci_register_dev is called.
+         */
+        HCI_QUIRK_FIXUP_INQUIRY_MODE,
+
+        /* When this quirk is set, then the HCI Read Local Supported
+         * Commands command is not supported. In general Bluetooth 1.2
+         * and later controllers should support this command. However
+         * some controllers indicate Bluetooth 1.2 support, but do
+         * not support this command.
+         *
+         * This quirk must be set before hci_register_dev is called.
+         */
+        HCI_QUIRK_BROKEN_LOCAL_COMMANDS,
+
         /* When this quirk is set, then no stored link key handling
          * is performed. This is mainly due to the fact that the
          * HCI Delete Stored Link Key command is advertised, but
@@ -162,8 +184,7 @@ enum {
  */
 enum {
         HCI_DUT_MODE,
-        HCI_FORCE_SC,
-        HCI_FORCE_LESC,
+        HCI_FORCE_BREDR_SMP,
         HCI_FORCE_STATIC_ADDR,
 };
 
@@ -343,6 +364,7 @@ enum {
 #define HCI_LE_ENCRYPTION               0x01
 #define HCI_LE_CONN_PARAM_REQ_PROC      0x02
 #define HCI_LE_PING                     0x10
+#define HCI_LE_DATA_LEN_EXT             0x20
 #define HCI_LE_EXT_SCAN_POLICY          0x80
 
 /* Connection modes */
@@ -833,11 +855,26 @@ struct hci_cp_set_event_flt {
 #define HCI_CONN_SETUP_AUTO_OFF 0x01
 #define HCI_CONN_SETUP_AUTO_ON  0x02
 
+#define HCI_OP_READ_STORED_LINK_KEY     0x0c0d
+struct hci_cp_read_stored_link_key {
+        bdaddr_t bdaddr;
+        __u8     read_all;
+} __packed;
+struct hci_rp_read_stored_link_key {
+        __u8     status;
+        __u8     max_keys;
+        __u8     num_keys;
+} __packed;
+
 #define HCI_OP_DELETE_STORED_LINK_KEY   0x0c12
 struct hci_cp_delete_stored_link_key {
         bdaddr_t bdaddr;
         __u8     delete_all;
 } __packed;
+struct hci_rp_delete_stored_link_key {
+        __u8     status;
+        __u8     num_keys;
+} __packed;
 
 #define HCI_MAX_NAME_LENGTH             248
 
@@ -1371,6 +1408,39 @@ struct hci_cp_le_conn_param_req_neg_reply {
         __u8    reason;
 } __packed;
 
+#define HCI_OP_LE_SET_DATA_LEN          0x2022
+struct hci_cp_le_set_data_len {
+        __le16  handle;
+        __le16  tx_len;
+        __le16  tx_time;
+} __packed;
+struct hci_rp_le_set_data_len {
+        __u8    status;
+        __le16  handle;
+} __packed;
+
+#define HCI_OP_LE_READ_DEF_DATA_LEN     0x2023
+struct hci_rp_le_read_def_data_len {
+        __u8    status;
+        __le16  tx_len;
+        __le16  tx_time;
+} __packed;
+
+#define HCI_OP_LE_WRITE_DEF_DATA_LEN    0x2024
+struct hci_cp_le_write_def_data_len {
+        __le16  tx_len;
+        __le16  tx_time;
+} __packed;
+
+#define HCI_OP_LE_READ_MAX_DATA_LEN     0x202f
+struct hci_rp_le_read_max_data_len {
+        __u8    status;
+        __le16  tx_len;
+        __le16  tx_time;
+        __le16  rx_len;
+        __le16  rx_time;
+} __packed;
+
 /* ---- HCI Events ---- */
 #define HCI_EV_INQUIRY_COMPLETE         0x01
 
@@ -1796,6 +1866,15 @@ struct hci_ev_le_remote_conn_param_req {
         __le16 timeout;
 } __packed;
 
+#define HCI_EV_LE_DATA_LEN_CHANGE       0x07
+struct hci_ev_le_data_len_change {
+        __le16  handle;
+        __le16  tx_len;
+        __le16  tx_time;
+        __le16  rx_len;
+        __le16  rx_time;
+} __packed;
+
 #define HCI_EV_LE_DIRECT_ADV_REPORT     0x0B
 struct hci_ev_le_direct_adv_info {
         __u8     evt_type;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 3c7827005c25..52863c3e0b13 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -79,6 +79,8 @@ struct discovery_state {
         s8                      rssi;
         u16                     uuid_count;
         u8                      (*uuids)[16];
+        unsigned long           scan_start;
+        unsigned long           scan_duration;
 };
 
 struct hci_conn_hash {
@@ -145,6 +147,7 @@ struct oob_data {
         struct list_head list;
         bdaddr_t bdaddr;
         u8 bdaddr_type;
+        u8 present;
         u8 hash192[16];
         u8 rand192[16];
         u8 hash256[16];
@@ -205,6 +208,8 @@ struct hci_dev {
         __u16           lmp_subver;
         __u16           voice_setting;
         __u8            num_iac;
+        __u8            stored_max_keys;
+        __u8            stored_num_keys;
         __u8            io_capability;
         __s8            inq_tx_power;
         __u16           page_scan_interval;
@@ -220,10 +225,17 @@ struct hci_dev {
         __u16           le_conn_max_interval;
         __u16           le_conn_latency;
         __u16           le_supv_timeout;
+        __u16           le_def_tx_len;
+        __u16           le_def_tx_time;
+        __u16           le_max_tx_len;
+        __u16           le_max_tx_time;
+        __u16           le_max_rx_len;
+        __u16           le_max_rx_time;
         __u16           discov_interleaved_timeout;
         __u16           conn_info_min_age;
         __u16           conn_info_max_age;
         __u8            ssp_debug_mode;
+        __u8            hw_error_code;
         __u32           clock;
 
         __u16           devid_source;
@@ -285,6 +297,7 @@ struct hci_dev {
 
         struct work_struct      power_on;
         struct delayed_work     power_off;
+        struct work_struct      error_reset;
 
         __u16                   discov_timeout;
         struct delayed_work     discov_off;
@@ -343,6 +356,7 @@ struct hci_dev {
         unsigned long           dev_flags;
 
         struct delayed_work     le_scan_disable;
+        struct delayed_work     le_scan_restart;
 
         __s8                    adv_tx_power;
         __u8                    adv_data[HCI_MAX_AD_LENGTH];
@@ -361,6 +375,7 @@ struct hci_dev {
         int (*setup)(struct hci_dev *hdev);
         int (*send)(struct hci_dev *hdev, struct sk_buff *skb);
         void (*notify)(struct hci_dev *hdev, unsigned int evt);
+        void (*hw_error)(struct hci_dev *hdev, u8 code);
         int (*set_bdaddr)(struct hci_dev *hdev, const bdaddr_t *bdaddr);
 };
 
@@ -434,6 +449,7 @@ struct hci_conn {
         struct delayed_work le_conn_timeout;
 
         struct device   dev;
+        struct dentry   *debugfs;
 
         struct hci_dev  *hdev;
         void            *l2cap_data;
@@ -518,6 +534,8 @@ static inline void hci_discovery_filter_clear(struct hci_dev *hdev)
         hdev->discovery.uuid_count = 0;
         kfree(hdev->discovery.uuids);
         hdev->discovery.uuids = NULL;
+        hdev->discovery.scan_start = 0;
+        hdev->discovery.scan_duration = 0;
 }
 
 bool hci_discovery_active(struct hci_dev *hdev);
@@ -772,7 +790,6 @@ int hci_conn_check_link_mode(struct hci_conn *conn);
 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
                       bool initiator);
-int hci_conn_change_link_key(struct hci_conn *conn);
 int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 
 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
@@ -920,8 +937,6 @@ struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
                                                bdaddr_t *addr, u8 addr_type);
 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
                                             bdaddr_t *addr, u8 addr_type);
-int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type,
-                        u8 auto_connect);
 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type);
 void hci_conn_params_clear_all(struct hci_dev *hdev);
 void hci_conn_params_clear_disabled(struct hci_dev *hdev);
@@ -930,8 +945,6 @@ struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
                                                   bdaddr_t *addr,
                                                   u8 addr_type);
 
-void hci_update_background_scan(struct hci_dev *hdev);
-
 void hci_uuids_clear(struct hci_dev *hdev);
 
 void hci_link_keys_clear(struct hci_dev *hdev);
@@ -1014,8 +1027,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 
 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
-#define bredr_sc_enabled(dev) ((lmp_sc_capable(dev) || \
-                                test_bit(HCI_FORCE_SC, &(dev)->dbg_flags)) && \
+#define bredr_sc_enabled(dev) (lmp_sc_capable(dev) && \
                                test_bit(HCI_SC_ENABLED, &(dev)->dev_flags))
 
 /* ----- HCI protocols ----- */
@@ -1284,30 +1296,8 @@ static inline int hci_check_conn_params(u16 min, u16 max, u16 latency,
 int hci_register_cb(struct hci_cb *hcb);
 int hci_unregister_cb(struct hci_cb *hcb);
 
-struct hci_request {
-        struct hci_dev          *hdev;
-        struct sk_buff_head     cmd_q;
-
-        /* If something goes wrong when building the HCI request, the error
-         * value is stored in this field.
-         */
-        int                     err;
-};
-
-void hci_req_init(struct hci_request *req, struct hci_dev *hdev);
-int hci_req_run(struct hci_request *req, hci_req_complete_t complete);
-void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
-                 const void *param);
-void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
-                    const void *param, u8 event);
-void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status);
 bool hci_req_pending(struct hci_dev *hdev);
 
-void hci_req_add_le_scan_disable(struct hci_request *req);
-void hci_req_add_le_passive_scan(struct hci_request *req);
-
-void hci_update_page_scan(struct hci_dev *hdev, struct hci_request *req);
-
 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
                                const void *param, u32 timeout);
 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
@@ -1344,6 +1334,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event);
 #define DISCOV_INTERLEAVED_TIMEOUT      5120    /* msec */
 #define DISCOV_INTERLEAVED_INQUIRY_LEN  0x04
 #define DISCOV_BREDR_INQUIRY_LEN        0x08
+#define DISCOV_LE_RESTART_DELAY         msecs_to_jiffies(200)   /* msec */
 
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
 int mgmt_new_settings(struct hci_dev *hdev);
@@ -1388,7 +1379,6 @@ int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
 void mgmt_auth_failed(struct hci_conn *conn, u8 status);
 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status);
 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
-void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
                                     u8 status);
 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status);
@@ -1417,8 +1407,6 @@ u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
                                                         __u8 ltk[16]);
 
-int hci_update_random_address(struct hci_request *req, bool require_privacy,
-                              u8 *own_addr_type);
 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                u8 *bdaddr_type);
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index d1bb342d083f..2239a3753092 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -248,6 +248,7 @@ struct l2cap_conn_rsp {
 #define L2CAP_PSM_SDP           0x0001
 #define L2CAP_PSM_RFCOMM        0x0003
 #define L2CAP_PSM_3DSP          0x0021
+#define L2CAP_PSM_IPSP          0x0023 /* 6LoWPAN */
 
 /* channel identifier */
 #define L2CAP_CID_SIGNALING     0x0001
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 95c34d5180fa..e218a30f2061 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -301,10 +301,6 @@ struct mgmt_cp_user_passkey_neg_reply {
 #define MGMT_OP_READ_LOCAL_OOB_DATA     0x0020
 #define MGMT_READ_LOCAL_OOB_DATA_SIZE   0
 struct mgmt_rp_read_local_oob_data {
-        __u8    hash[16];
-        __u8    rand[16];
-} __packed;
-struct mgmt_rp_read_local_oob_ext_data {
         __u8    hash192[16];
         __u8    rand192[16];
         __u8    hash256[16];
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 578b83127af1..4190af53a46a 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -24,8 +24,6 @@
 #ifndef __RFCOMM_H
 #define __RFCOMM_H
 
-#define RFCOMM_PSM 3
-
 #define RFCOMM_CONN_TIMEOUT (HZ * 30)
 #define RFCOMM_DISC_TIMEOUT (HZ * 20)
 #define RFCOMM_AUTH_TIMEOUT (HZ * 25)
diff --git a/include/net/bond_3ad.h b/include/net/bond_3ad.h
index e01d903633ef..f04cdbb7848e 100644
--- a/include/net/bond_3ad.h
+++ b/include/net/bond_3ad.h
@@ -274,7 +274,6 @@ void bond_3ad_handle_link_change(struct slave *slave, char link);
 int  bond_3ad_get_active_agg_info(struct bonding *bond, struct ad_info *ad_info);
 int  __bond_3ad_get_active_agg_info(struct bonding *bond,
                                     struct ad_info *ad_info);
-int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev);
 int bond_3ad_lacpdu_recv(const struct sk_buff *skb, struct bonding *bond,
                          struct slave *slave);
 int bond_3ad_set_carrier(struct bonding *bond);
diff --git a/include/net/bonding.h b/include/net/bonding.h
index 983a94b86b95..fda6feeb6c1f 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -150,6 +150,12 @@ struct bond_parm_tbl {
         int mode;
 };
 
+struct netdev_notify_work {
+        struct delayed_work     work;
+        struct net_device       *dev;
+        struct netdev_bonding_info bonding_info;
+};
+
 struct slave {
         struct net_device *dev; /* first - useful for panic debug */
         struct bonding *bond; /* our master */
@@ -243,6 +249,8 @@ struct bonding {
 #define bond_slave_get_rtnl(dev) \
         ((struct slave *) rtnl_dereference(dev->rx_handler_data))
 
+void bond_queue_slave_event(struct slave *slave);
+
 struct bond_vlan_tag {
         __be16          vlan_proto;
         unsigned short  vlan_id;
@@ -315,6 +323,7 @@ static inline void bond_set_active_slave(struct slave *slave)
 {
         if (slave->backup) {
                 slave->backup = 0;
+                bond_queue_slave_event(slave);
                 rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
         }
 }
@@ -323,6 +332,7 @@ static inline void bond_set_backup_slave(struct slave *slave)
 {
         if (!slave->backup) {
                 slave->backup = 1;
+                bond_queue_slave_event(slave);
                 rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
         }
 }
@@ -336,6 +346,7 @@ static inline void bond_set_slave_state(struct slave *slave,
         slave->backup = slave_state;
         if (notify) {
                 rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
+                bond_queue_slave_event(slave);
                 slave->should_notify = 0;
         } else {
                 if (slave->should_notify)
@@ -490,6 +501,12 @@ static inline bool bond_is_slave_inactive(struct slave *slave)
         return slave->inactive;
 }
 
+static inline void bond_set_slave_link_state(struct slave *slave, int state)
+{
+        slave->link = state;
+        bond_queue_slave_event(slave);
+}
+
 static inline __be32 bond_confirm_addr(struct net_device *dev, __be32 dst, __be32 local)
 {
         struct in_device *in_dev;
@@ -525,6 +542,7 @@ void bond_sysfs_slave_del(struct slave *slave);
 int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev);
 int bond_release(struct net_device *bond_dev, struct net_device *slave_dev);
 u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb);
+int bond_set_carrier(struct bonding *bond);
 void bond_select_active_slave(struct bonding *bond);
 void bond_change_active_slave(struct bonding *bond, struct slave *new_active);
 void bond_create_debugfs(void);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 4ebb816241fa..64e09e1e8099 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -520,37 +520,41 @@ ieee80211_chandef_max_power(struct cfg80211_chan_def *chandef)
  *
  * @SURVEY_INFO_NOISE_DBM: noise (in dBm) was filled in
  * @SURVEY_INFO_IN_USE: channel is currently being used
- * @SURVEY_INFO_CHANNEL_TIME: channel active time (in ms) was filled in
- * @SURVEY_INFO_CHANNEL_TIME_BUSY: channel busy time was filled in
- * @SURVEY_INFO_CHANNEL_TIME_EXT_BUSY: extension channel busy time was filled in
- * @SURVEY_INFO_CHANNEL_TIME_RX: channel receive time was filled in
- * @SURVEY_INFO_CHANNEL_TIME_TX: channel transmit time was filled in
+ * @SURVEY_INFO_TIME: active time (in ms) was filled in
+ * @SURVEY_INFO_TIME_BUSY: busy time was filled in
+ * @SURVEY_INFO_TIME_EXT_BUSY: extension channel busy time was filled in
+ * @SURVEY_INFO_TIME_RX: receive time was filled in
+ * @SURVEY_INFO_TIME_TX: transmit time was filled in
+ * @SURVEY_INFO_TIME_SCAN: scan time was filled in
  *
  * Used by the driver to indicate which info in &struct survey_info
  * it has filled in during the get_survey().
  */
 enum survey_info_flags {
-        SURVEY_INFO_NOISE_DBM = 1<<0,
-        SURVEY_INFO_IN_USE = 1<<1,
-        SURVEY_INFO_CHANNEL_TIME = 1<<2,
-        SURVEY_INFO_CHANNEL_TIME_BUSY = 1<<3,
-        SURVEY_INFO_CHANNEL_TIME_EXT_BUSY = 1<<4,
-        SURVEY_INFO_CHANNEL_TIME_RX = 1<<5,
-        SURVEY_INFO_CHANNEL_TIME_TX = 1<<6,
+        SURVEY_INFO_NOISE_DBM           = BIT(0),
+        SURVEY_INFO_IN_USE              = BIT(1),
+        SURVEY_INFO_TIME                = BIT(2),
+        SURVEY_INFO_TIME_BUSY           = BIT(3),
+        SURVEY_INFO_TIME_EXT_BUSY       = BIT(4),
+        SURVEY_INFO_TIME_RX             = BIT(5),
+        SURVEY_INFO_TIME_TX             = BIT(6),
+        SURVEY_INFO_TIME_SCAN           = BIT(7),
 };
 
 /**
  * struct survey_info - channel survey response
  *
- * @channel: the channel this survey record reports, mandatory
+ * @channel: the channel this survey record reports, may be %NULL for a single
+ *      record to report global statistics
  * @filled: bitflag of flags from &enum survey_info_flags
  * @noise: channel noise in dBm. This and all following fields are
  *      optional
- * @channel_time: amount of time in ms the radio spent on the channel
- * @channel_time_busy: amount of time the primary channel was sensed busy
- * @channel_time_ext_busy: amount of time the extension channel was sensed busy
- * @channel_time_rx: amount of time the radio spent receiving data
- * @channel_time_tx: amount of time the radio spent transmitting data
+ * @time: amount of time in ms the radio was turn on (on the channel)
+ * @time_busy: amount of time the primary channel was sensed busy
+ * @time_ext_busy: amount of time the extension channel was sensed busy
+ * @time_rx: amount of time the radio spent receiving data
+ * @time_tx: amount of time the radio spent transmitting data
+ * @time_scan: amount of time the radio spent for scanning
  *
  * Used by dump_survey() to report back per-channel survey information.
  *
@@ -559,11 +563,12 @@ enum survey_info_flags {
  */
 struct survey_info {
         struct ieee80211_channel *channel;
-        u64 channel_time;
-        u64 channel_time_busy;
-        u64 channel_time_ext_busy;
-        u64 channel_time_rx;
-        u64 channel_time_tx;
+        u64 time;
+        u64 time_busy;
+        u64 time_ext_busy;
+        u64 time_rx;
+        u64 time_tx;
+        u64 time_scan;
         u32 filled;
         s8 noise;
 };
@@ -861,75 +866,6 @@ int cfg80211_check_station_change(struct wiphy *wiphy,
                                   enum cfg80211_station_type statype);
 
 /**
- * enum station_info_flags - station information flags
- *
- * Used by the driver to indicate which info in &struct station_info
- * it has filled in during get_station() or dump_station().
- *
- * @STATION_INFO_INACTIVE_TIME: @inactive_time filled
- * @STATION_INFO_RX_BYTES: @rx_bytes filled
- * @STATION_INFO_TX_BYTES: @tx_bytes filled
- * @STATION_INFO_RX_BYTES64: @rx_bytes filled with 64-bit value
- * @STATION_INFO_TX_BYTES64: @tx_bytes filled with 64-bit value
- * @STATION_INFO_LLID: @llid filled
- * @STATION_INFO_PLID: @plid filled
- * @STATION_INFO_PLINK_STATE: @plink_state filled
- * @STATION_INFO_SIGNAL: @signal filled
- * @STATION_INFO_TX_BITRATE: @txrate fields are filled
- *      (tx_bitrate, tx_bitrate_flags and tx_bitrate_mcs)
- * @STATION_INFO_RX_PACKETS: @rx_packets filled with 32-bit value
- * @STATION_INFO_TX_PACKETS: @tx_packets filled with 32-bit value
- * @STATION_INFO_TX_RETRIES: @tx_retries filled
- * @STATION_INFO_TX_FAILED: @tx_failed filled
- * @STATION_INFO_RX_DROP_MISC: @rx_dropped_misc filled
- * @STATION_INFO_SIGNAL_AVG: @signal_avg filled
- * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
- * @STATION_INFO_BSS_PARAM: @bss_param filled
- * @STATION_INFO_CONNECTED_TIME: @connected_time filled
- * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
- * @STATION_INFO_STA_FLAGS: @sta_flags filled
- * @STATION_INFO_BEACON_LOSS_COUNT: @beacon_loss_count filled
- * @STATION_INFO_T_OFFSET: @t_offset filled
- * @STATION_INFO_LOCAL_PM: @local_pm filled
- * @STATION_INFO_PEER_PM: @peer_pm filled
- * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
- * @STATION_INFO_CHAIN_SIGNAL: @chain_signal filled
- * @STATION_INFO_CHAIN_SIGNAL_AVG: @chain_signal_avg filled
- * @STATION_INFO_EXPECTED_THROUGHPUT: @expected_throughput filled
- */
-enum station_info_flags {
-        STATION_INFO_INACTIVE_TIME              = BIT(0),
-        STATION_INFO_RX_BYTES                   = BIT(1),
-        STATION_INFO_TX_BYTES                   = BIT(2),
-        STATION_INFO_LLID                       = BIT(3),
-        STATION_INFO_PLID                       = BIT(4),
-        STATION_INFO_PLINK_STATE                = BIT(5),
-        STATION_INFO_SIGNAL                     = BIT(6),
-        STATION_INFO_TX_BITRATE                 = BIT(7),
-        STATION_INFO_RX_PACKETS                 = BIT(8),
-        STATION_INFO_TX_PACKETS                 = BIT(9),
-        STATION_INFO_TX_RETRIES                 = BIT(10),
-        STATION_INFO_TX_FAILED                  = BIT(11),
-        STATION_INFO_RX_DROP_MISC               = BIT(12),
-        STATION_INFO_SIGNAL_AVG                 = BIT(13),
-        STATION_INFO_RX_BITRATE                 = BIT(14),
-        STATION_INFO_BSS_PARAM                  = BIT(15),
-        STATION_INFO_CONNECTED_TIME             = BIT(16),
-        STATION_INFO_ASSOC_REQ_IES              = BIT(17),
-        STATION_INFO_STA_FLAGS                  = BIT(18),
-        STATION_INFO_BEACON_LOSS_COUNT          = BIT(19),
-        STATION_INFO_T_OFFSET                   = BIT(20),
-        STATION_INFO_LOCAL_PM                   = BIT(21),
-        STATION_INFO_PEER_PM                    = BIT(22),
-        STATION_INFO_NONPEER_PM                 = BIT(23),
-        STATION_INFO_RX_BYTES64                 = BIT(24),
-        STATION_INFO_TX_BYTES64                 = BIT(25),
-        STATION_INFO_CHAIN_SIGNAL               = BIT(26),
-        STATION_INFO_CHAIN_SIGNAL_AVG           = BIT(27),
-        STATION_INFO_EXPECTED_THROUGHPUT        = BIT(28),
-};
-
-/**
  * enum station_info_rate_flags - bitrate info flags
  *
  * Used by the driver to indicate the specific rate transmission
@@ -937,22 +873,35 @@ enum station_info_flags {
  *
  * @RATE_INFO_FLAGS_MCS: mcs field filled with HT MCS
  * @RATE_INFO_FLAGS_VHT_MCS: mcs field filled with VHT MCS
- * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 MHz width transmission
- * @RATE_INFO_FLAGS_80_MHZ_WIDTH: 80 MHz width transmission
- * @RATE_INFO_FLAGS_80P80_MHZ_WIDTH: 80+80 MHz width transmission
- * @RATE_INFO_FLAGS_160_MHZ_WIDTH: 160 MHz width transmission
  * @RATE_INFO_FLAGS_SHORT_GI: 400ns guard interval
  * @RATE_INFO_FLAGS_60G: 60GHz MCS
  */
 enum rate_info_flags {
         RATE_INFO_FLAGS_MCS                     = BIT(0),
         RATE_INFO_FLAGS_VHT_MCS                 = BIT(1),
-        RATE_INFO_FLAGS_40_MHZ_WIDTH            = BIT(2),
-        RATE_INFO_FLAGS_80_MHZ_WIDTH            = BIT(3),
-        RATE_INFO_FLAGS_80P80_MHZ_WIDTH         = BIT(4),
-        RATE_INFO_FLAGS_160_MHZ_WIDTH           = BIT(5),
-        RATE_INFO_FLAGS_SHORT_GI                = BIT(6),
-        RATE_INFO_FLAGS_60G                     = BIT(7),
+        RATE_INFO_FLAGS_SHORT_GI                = BIT(2),
+        RATE_INFO_FLAGS_60G                     = BIT(3),
+};
+
+/**
+ * enum rate_info_bw - rate bandwidth information
+ *
+ * Used by the driver to indicate the rate bandwidth.
+ *
+ * @RATE_INFO_BW_5: 5 MHz bandwidth
+ * @RATE_INFO_BW_10: 10 MHz bandwidth
+ * @RATE_INFO_BW_20: 20 MHz bandwidth
+ * @RATE_INFO_BW_40: 40 MHz bandwidth
+ * @RATE_INFO_BW_80: 80 MHz bandwidth
+ * @RATE_INFO_BW_160: 160 MHz bandwidth
+ */
+enum rate_info_bw {
+        RATE_INFO_BW_5,
+        RATE_INFO_BW_10,
+        RATE_INFO_BW_20,
+        RATE_INFO_BW_40,
+        RATE_INFO_BW_80,
+        RATE_INFO_BW_160,
 };
 
 /**
@@ -964,12 +913,14 @@ enum rate_info_flags {
  * @mcs: mcs index if struct describes a 802.11n bitrate
  * @legacy: bitrate in 100kbit/s for 802.11abg
  * @nss: number of streams (VHT only)
+ * @bw: bandwidth (from &enum rate_info_bw)
  */
 struct rate_info {
         u8 flags;
         u8 mcs;
         u16 legacy;
         u8 nss;
+        u8 bw;
 };
 
 /**
@@ -1003,6 +954,24 @@ struct sta_bss_parameters {
         u16 beacon_interval;
 };
 
+/**
+ * struct cfg80211_tid_stats - per-TID statistics
+ * @filled: bitmap of flags using the bits of &enum nl80211_tid_stats to
+ *      indicate the relevant values in this struct are filled
+ * @rx_msdu: number of received MSDUs
+ * @tx_msdu: number of (attempted) transmitted MSDUs
+ * @tx_msdu_retries: number of retries (not counting the first) for
+ *      transmitted MSDUs
+ * @tx_msdu_failed: number of failed transmitted MSDUs
+ */
+struct cfg80211_tid_stats {
+        u32 filled;
+        u64 rx_msdu;
+        u64 tx_msdu;
+        u64 tx_msdu_retries;
+        u64 tx_msdu_failed;
+};
+
 #define IEEE80211_MAX_CHAINS    4
 
 /**
@@ -1010,11 +979,12 @@ struct sta_bss_parameters {
  *
  * Station information filled by driver for get_station() and dump_station.
  *
- * @filled: bitflag of flags from &enum station_info_flags
+ * @filled: bitflag of flags using the bits of &enum nl80211_sta_info to
+ *      indicate the relevant values in this struct for them
  * @connected_time: time(in secs) since a station is last connected
  * @inactive_time: time since last station activity (tx/rx) in milliseconds
- * @rx_bytes: bytes received from this station
- * @tx_bytes: bytes transmitted to this station
+ * @rx_bytes: bytes (size of MPDUs) received from this station
+ * @tx_bytes: bytes (size of MPDUs) transmitted to this station
  * @llid: mesh local link id
  * @plid: mesh peer link id
  * @plink_state: mesh peer link state
@@ -1027,10 +997,10 @@ struct sta_bss_parameters {
  * @chain_signal_avg: per-chain signal strength average in dBm
  * @txrate: current unicast bitrate from this station
  * @rxrate: current unicast bitrate to this station
- * @rx_packets: packets received from this station
- * @tx_packets: packets transmitted to this station
- * @tx_retries: cumulative retry counts
- * @tx_failed: number of failed transmissions (retries exceeded, no ACK)
+ * @rx_packets: packets (MSDUs & MMPDUs) received from this station
+ * @tx_packets: packets (MSDUs & MMPDUs) transmitted to this station
+ * @tx_retries: cumulative retry counts (MPDUs)
+ * @tx_failed: number of failed transmissions (MPDUs) (retries exceeded, no ACK)
  * @rx_dropped_misc:  Dropped for un-specified reason.
  * @bss_param: current BSS parameters
  * @generation: generation number for nl80211 dumps.
@@ -1050,6 +1020,11 @@ struct sta_bss_parameters {
  * @nonpeer_pm: non-peer mesh STA power save mode
  * @expected_throughput: expected throughput in kbps (including 802.11 headers)
  *      towards this station.
+ * @rx_beacon: number of beacons received from this peer
+ * @rx_beacon_signal_avg: signal strength average (in dBm) for beacons received
+ *      from this peer
+ * @pertid: per-TID statistics, see &struct cfg80211_tid_stats, using the last
+ *      (IEEE80211_NUM_TIDS) index for MSDUs not encapsulated in QoS-MPDUs.
  */
 struct station_info {
         u32 filled;
@@ -1090,10 +1065,9 @@ struct station_info {
 
         u32 expected_throughput;
 
-        /*
-         * Note: Add a new enum station_info_flags value for each new field and
-         * use it to check which fields are initialized.
-         */
+        u64 rx_beacon;
+        u8 rx_beacon_signal_avg;
+        struct cfg80211_tid_stats pertid[IEEE80211_NUM_TIDS + 1];
 };
 
 /**
@@ -1516,6 +1490,13 @@ struct cfg80211_match_set {
  * @mac_addr_mask: MAC address mask used with randomisation, bits that
  *      are 0 in the mask should be randomised, bits that are 1 should
  *      be taken from the @mac_addr
+ * @rcu_head: RCU callback used to free the struct
+ * @owner_nlportid: netlink portid of owner (if this should is a request
+ *      owned by a particular socket)
+ * @delay: delay in seconds to use before starting the first scan
+ *      cycle.  The driver may ignore this parameter and start
+ *      immediately (or at any other time), if this feature is not
+ *      supported.
  */
 struct cfg80211_sched_scan_request {
         struct cfg80211_ssid *ssids;
@@ -1529,6 +1510,7 @@ struct cfg80211_sched_scan_request {
         struct cfg80211_match_set *match_sets;
         int n_match_sets;
         s32 min_rssi_thold;
+        u32 delay;
 
         u8 mac_addr[ETH_ALEN] __aligned(2);
         u8 mac_addr_mask[ETH_ALEN] __aligned(2);
@@ -1537,6 +1519,8 @@ struct cfg80211_sched_scan_request {
         struct wiphy *wiphy;
         struct net_device *dev;
         unsigned long scan_start;
+        struct rcu_head rcu_head;
+        u32 owner_nlportid;
 
         /* keep last */
         struct ieee80211_channel *channels[0];
@@ -3011,6 +2995,8 @@ struct wiphy_vendor_command {
  * @regulatory_flags: wiphy regulatory flags, see
  *      &enum ieee80211_regulatory_flags
  * @features: features advertised to nl80211, see &enum nl80211_feature_flags.
+ * @ext_features: extended features advertised to nl80211, see
+ *      &enum nl80211_ext_feature_index.
  * @bss_priv_size: each BSS struct has private data allocated with it,
  *      this variable determines its size
  * @max_scan_ssids: maximum number of SSIDs the device can scan for in
@@ -3120,6 +3106,7 @@ struct wiphy {
         u16 max_acl_mac_addrs;
 
         u32 flags, regulatory_flags, features;
+        u8 ext_features[DIV_ROUND_UP(NUM_NL80211_EXT_FEATURES, 8)];
 
         u32 ap_sme_capa;
 
@@ -3808,6 +3795,34 @@ const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
 int regulatory_hint(struct wiphy *wiphy, const char *alpha2);
 
 /**
+ * regulatory_set_wiphy_regd - set regdom info for self managed drivers
+ * @wiphy: the wireless device we want to process the regulatory domain on
+ * @rd: the regulatory domain informatoin to use for this wiphy
+ *
+ * Set the regulatory domain information for self-managed wiphys, only they
+ * may use this function. See %REGULATORY_WIPHY_SELF_MANAGED for more
+ * information.
+ *
+ * Return: 0 on success. -EINVAL, -EPERM
+ */
+int regulatory_set_wiphy_regd(struct wiphy *wiphy,
+                              struct ieee80211_regdomain *rd);
+
+/**
+ * regulatory_set_wiphy_regd_sync_rtnl - set regdom for self-managed drivers
+ * @wiphy: the wireless device we want to process the regulatory domain on
+ * @rd: the regulatory domain information to use for this wiphy
+ *
+ * This functions requires the RTNL to be held and applies the new regdomain
+ * synchronously to this wiphy. For more details see
+ * regulatory_set_wiphy_regd().
+ *
+ * Return: 0 on success. -EINVAL, -EPERM
+ */
+int regulatory_set_wiphy_regd_sync_rtnl(struct wiphy *wiphy,
+                                        struct ieee80211_regdomain *rd);
+
+/**
  * wiphy_apply_custom_regulatory - apply a custom driver regulatory domain
  * @wiphy: the wireless device we want to process the regulatory domain on
  * @regd: the custom regulatory domain to use for this wiphy
@@ -4565,13 +4580,27 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
                       struct station_info *sinfo, gfp_t gfp);
 
 /**
+ * cfg80211_del_sta_sinfo - notify userspace about deletion of a station
+ * @dev: the netdev
+ * @mac_addr: the station's address
+ * @sinfo: the station information/statistics
+ * @gfp: allocation flags
+ */
+void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
+                            struct station_info *sinfo, gfp_t gfp);
+
+/**
  * cfg80211_del_sta - notify userspace about deletion of a station
  *
  * @dev: the netdev
  * @mac_addr: the station's address
  * @gfp: allocation flags
  */
-void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
+static inline void cfg80211_del_sta(struct net_device *dev,
+                                    const u8 *mac_addr, gfp_t gfp)
+{
+        cfg80211_del_sta_sinfo(dev, mac_addr, NULL, gfp);
+}
 
 /**
  * cfg80211_conn_failed - connection request failed notification
@@ -5033,6 +5062,42 @@ void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev,
  */
 void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy);
 
+/**
+ * wiphy_ext_feature_set - set the extended feature flag
+ *
+ * @wiphy: the wiphy to modify.
+ * @ftidx: extended feature bit index.
+ *
+ * The extended features are flagged in multiple bytes (see
+ * &struct wiphy.@ext_features)
+ */
+static inline void wiphy_ext_feature_set(struct wiphy *wiphy,
+                                         enum nl80211_ext_feature_index ftidx)
+{
+        u8 *ft_byte;
+
+        ft_byte = &wiphy->ext_features[ftidx / 8];
+        *ft_byte |= BIT(ftidx % 8);
+}
+
+/**
+ * wiphy_ext_feature_isset - check the extended feature flag
+ *
+ * @wiphy: the wiphy to modify.
+ * @ftidx: extended feature bit index.
+ *
+ * The extended features are flagged in multiple bytes (see
+ * &struct wiphy.@ext_features)
+ */
+static inline bool
+wiphy_ext_feature_isset(struct wiphy *wiphy,
+                        enum nl80211_ext_feature_index ftidx)
+{
+        u8 ft_byte;
+
+        ft_byte = wiphy->ext_features[ftidx / 8];
+        return (ft_byte & BIT(ftidx % 8)) != 0;
+}
 
 /* ethtool helper */
 void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info);
diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h
index 7f713acfa106..eeda67652766 100644
--- a/include/net/cfg802154.h
+++ b/include/net/cfg802154.h
@@ -25,6 +25,7 @@
 #include <net/nl802154.h>
 
 struct wpan_phy;
+struct wpan_phy_cca;
 
 struct cfg802154_ops {
         struct net_device * (*add_virtual_intf_deprecated)(struct wpan_phy *wpan_phy,
@@ -39,6 +40,8 @@ struct cfg802154_ops {
         int     (*del_virtual_intf)(struct wpan_phy *wpan_phy,
                                     struct wpan_dev *wpan_dev);
         int     (*set_channel)(struct wpan_phy *wpan_phy, u8 page, u8 channel);
+        int     (*set_cca_mode)(struct wpan_phy *wpan_phy,
+                                const struct wpan_phy_cca *cca);
         int     (*set_pan_id)(struct wpan_phy *wpan_phy,
                               struct wpan_dev *wpan_dev, __le16 pan_id);
         int     (*set_short_addr)(struct wpan_phy *wpan_phy,
@@ -56,6 +59,11 @@ struct cfg802154_ops {
                                 struct wpan_dev *wpan_dev, bool mode);
 };
 
+struct wpan_phy_cca {
+        enum nl802154_cca_modes mode;
+        enum nl802154_cca_opts opt;
+};
+
 struct wpan_phy {
         struct mutex pib_lock;
 
@@ -76,7 +84,7 @@ struct wpan_phy {
         u8 current_page;
         u32 channels_supported[IEEE802154_MAX_PAGE + 1];
         s8 transmit_power;
-        u8 cca_mode;
+        struct wpan_phy_cca cca;
 
         __le64 perm_extended_addr;
 
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 6c92415311ca..0574abd3db86 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -211,6 +211,23 @@ static inline struct nlmsghdr *genlmsg_nlhdr(void *user_hdr,
 }
 
 /**
+ * genlmsg_parse - parse attributes of a genetlink message
+ * @nlh: netlink message header
+ * @family: genetlink message family
+ * @tb: destination array with maxtype+1 elements
+ * @maxtype: maximum attribute type to be expected
+ * @policy: validation policy
+ * */
+static inline int genlmsg_parse(const struct nlmsghdr *nlh,
+                                const struct genl_family *family,
+                                struct nlattr *tb[], int maxtype,
+                                const struct nla_policy *policy)
+{
+        return nlmsg_parse(nlh, family->hdrsize + GENL_HDRLEN, tb, maxtype,
+                           policy);
+}
+
+/**
  * genl_dump_check_consistent - check if sequence is consistent and advertise if not
  * @cb: netlink callback structure that stores the sequence number
  * @user_hdr: user header as returned from genlmsg_put()
@@ -250,9 +267,9 @@ static inline void *genlmsg_put_reply(struct sk_buff *skb,
  * @skb: socket buffer the message is stored in
  * @hdr: user specific header
  */
-static inline int genlmsg_end(struct sk_buff *skb, void *hdr)
+static inline void genlmsg_end(struct sk_buff *skb, void *hdr)
 {
-        return nlmsg_end(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
+        nlmsg_end(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
 }
 
 /**
diff --git a/include/net/geneve.h b/include/net/geneve.h
index 112132cf8e2e..14fb8d3390b4 100644
--- a/include/net/geneve.h
+++ b/include/net/geneve.h
@@ -68,13 +68,12 @@ struct geneve_sock;
 typedef void (geneve_rcv_t)(struct geneve_sock *gs, struct sk_buff *skb);
 
 struct geneve_sock {
-        struct hlist_node       hlist;
+        struct list_head        list;
         geneve_rcv_t            *rcv;
         void                    *rcv_data;
-        struct work_struct      del_work;
         struct socket           *sock;
         struct rcu_head         rcu;
-        atomic_t                refcnt;
+        int                     refcnt;
         struct udp_offload      udp_offloads;
 };
 
@@ -91,7 +90,7 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
                     struct sk_buff *skb, __be32 src, __be32 dst, __u8 tos,
                     __u8 ttl, __be16 df, __be16 src_port, __be16 dst_port,
                     __be16 tun_flags, u8 vni[3], u8 opt_len, u8 *opt,
-                    bool xnet);
+                    bool csum, bool xnet);
 #endif /*ifdef CONFIG_INET */
 
 #endif /*ifdef__NET_GENEVE_H */
diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
index 734d9b5f577a..0f712c0bc0bf 100644
--- a/include/net/gro_cells.h
+++ b/include/net/gro_cells.h
@@ -8,25 +8,23 @@
 struct gro_cell {
         struct sk_buff_head     napi_skbs;
         struct napi_struct      napi;
-} ____cacheline_aligned_in_smp;
+};
 
 struct gro_cells {
-        unsigned int            gro_cells_mask;
-        struct gro_cell         *cells;
+        struct gro_cell __percpu        *cells;
 };
 
 static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *skb)
 {
-        struct gro_cell *cell = gcells->cells;
+        struct gro_cell *cell;
         struct net_device *dev = skb->dev;
 
-        if (!cell || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) {
+        if (!gcells->cells || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) {
                 netif_rx(skb);
                 return;
         }
 
-        if (skb_rx_queue_recorded(skb))
-                cell += skb_get_rx_queue(skb) & gcells->gro_cells_mask;
+        cell = this_cpu_ptr(gcells->cells);
 
         if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) {
                 atomic_long_inc(&dev->rx_dropped);
@@ -72,15 +70,12 @@ static inline int gro_cells_init(struct gro_cells *gcells, struct net_device *de
 {
         int i;
 
-        gcells->gro_cells_mask = roundup_pow_of_two(netif_get_num_default_rss_queues()) - 1;
-        gcells->cells = kcalloc(gcells->gro_cells_mask + 1,
-                                sizeof(struct gro_cell),
-                                GFP_KERNEL);
+        gcells->cells = alloc_percpu(struct gro_cell);
         if (!gcells->cells)
                 return -ENOMEM;
 
-        for (i = 0; i <= gcells->gro_cells_mask; i++) {
-                struct gro_cell *cell = gcells->cells + i;
+        for_each_possible_cpu(i) {
+                struct gro_cell *cell = per_cpu_ptr(gcells->cells, i);
 
                 skb_queue_head_init(&cell->napi_skbs);
                 netif_napi_add(dev, &cell->napi, gro_cell_poll, 64);
@@ -91,16 +86,16 @@ static inline int gro_cells_init(struct gro_cells *gcells, struct net_device *de
 
 static inline void gro_cells_destroy(struct gro_cells *gcells)
 {
-        struct gro_cell *cell = gcells->cells;
         int i;
 
-        if (!cell)
+        if (!gcells->cells)
                 return;
-        for (i = 0; i <= gcells->gro_cells_mask; i++,cell++) {
+        for_each_possible_cpu(i) {
+                struct gro_cell *cell = per_cpu_ptr(gcells->cells, i);
                 netif_napi_del(&cell->napi);
                 skb_queue_purge(&cell->napi_skbs);
         }
-        kfree(gcells->cells);
+        free_percpu(gcells->cells);
         gcells->cells = NULL;
 }
 
diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
index 83bb8a73d23c..94a297052442 100644
--- a/include/net/ieee802154_netdev.h
+++ b/include/net/ieee802154_netdev.h
@@ -28,6 +28,8 @@
 #include <linux/skbuff.h>
 #include <linux/ieee802154.h>
 
+#include <net/cfg802154.h>
+
 struct ieee802154_sechdr {
 #if defined(__LITTLE_ENDIAN_BITFIELD)
         u8 level:3,
@@ -337,7 +339,7 @@ struct ieee802154_mac_params {
         s8 frame_retries;
 
         bool lbt;
-        u8 cca_mode;
+        struct wpan_phy_cca cca;
         s32 cca_ed_level;
 };
 
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 848e85cb5c61..5976bdecf58b 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -98,7 +98,8 @@ struct inet_connection_sock {
         const struct tcp_congestion_ops *icsk_ca_ops;
         const struct inet_connection_sock_af_ops *icsk_af_ops;
         unsigned int              (*icsk_sync_mss)(struct sock *sk, u32 pmtu);
-        __u8                      icsk_ca_state;
+        __u8                      icsk_ca_state:7,
+                                  icsk_ca_dst_locked:1;
         __u8                      icsk_retransmits;
         __u8                      icsk_pending;
         __u8                      icsk_backoff;
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index a829b77523cf..eb16c7beed1e 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -16,7 +16,7 @@
 #ifndef _INET_SOCK_H
 #define _INET_SOCK_H
 
-
+#include <linux/bitops.h>
 #include <linux/kmemcheck.h>
 #include <linux/string.h>
 #include <linux/types.h>
@@ -184,6 +184,7 @@ struct inet_sock {
                                 mc_all:1,
                                 nodefrag:1;
         __u8                    rcv_tos;
+        __u8                    convert_csum;
         int                     uc_index;
         int                     mc_index;
         __be32                  mc_addr;
@@ -194,6 +195,16 @@ struct inet_sock {
 #define IPCORK_OPT      1       /* ip-options has been held in ipcork.opt */
 #define IPCORK_ALLFRAG  2       /* always fragment (for ipv6 for now) */
 
+/* cmsg flags for inet */
+#define IP_CMSG_PKTINFO         BIT(0)
+#define IP_CMSG_TTL             BIT(1)
+#define IP_CMSG_TOS             BIT(2)
+#define IP_CMSG_RECVOPTS        BIT(3)
+#define IP_CMSG_RETOPTS         BIT(4)
+#define IP_CMSG_PASSSEC         BIT(5)
+#define IP_CMSG_ORIGDSTADDR     BIT(6)
+#define IP_CMSG_CHECKSUM        BIT(7)
+
 static inline struct inet_sock *inet_sk(const struct sock *sk)
 {
         return (struct inet_sock *)sk;
@@ -250,4 +261,20 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
         return flags;
 }
 
+static inline void inet_inc_convert_csum(struct sock *sk)
+{
+        inet_sk(sk)->convert_csum++;
+}
+
+static inline void inet_dec_convert_csum(struct sock *sk)
+{
+        if (inet_sk(sk)->convert_csum > 0)
+                inet_sk(sk)->convert_csum--;
+}
+
+static inline bool inet_get_convert_csum(struct sock *sk)
+{
+        return !!inet_sk(sk)->convert_csum;
+}
+
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/ip.h b/include/net/ip.h
index 09cf5aebb283..025c61c0dffb 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -538,7 +538,7 @@ int ip_options_rcv_srr(struct sk_buff *skb);
  */
 
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb);
-void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb);
+void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, int offset);
 int ip_cmsg_send(struct net *net, struct msghdr *msg,
                  struct ipcm_cookie *ipc, bool allow_ipv6);
 int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
@@ -558,6 +558,11 @@ void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
 void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,
                     u32 info);
 
+static inline void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)
+{
+        ip_cmsg_recv_offset(msg, skb, 0);
+}
+
 bool icmp_global_allow(void);
 extern int sysctl_icmp_msgs_per_sec;
 extern int sysctl_icmp_msgs_burst;
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 8eea35d32a75..20e80fa7bbdd 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -74,6 +74,11 @@ struct fib6_node {
 #define FIB6_SUBTREE(fn)        ((fn)->subtree)
 #endif
 
+struct mx6_config {
+        const u32 *mx;
+        DECLARE_BITMAP(mx_valid, RTAX_MAX);
+};
+
 /*
  *      routing information
  *
@@ -291,9 +296,8 @@ struct fib6_node *fib6_locate(struct fib6_node *root,
 void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
                     void *arg);
 
-int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info,
-             struct nlattr *mx, int mx_len);
-
+int fib6_add(struct fib6_node *root, struct rt6_info *rt,
+             struct nl_info *info, struct mx6_config *mxc);
 int fib6_del(struct rt6_info *rt, struct nl_info *info);
 
 void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info);
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index 9326c41c2d7f..76c091b53dae 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -70,6 +70,7 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t, const struct in6_addr *laddr,
 __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw);
 __u32 ip6_tnl_get_cap(struct ip6_tnl *t, const struct in6_addr *laddr,
                              const struct in6_addr *raddr);
+struct net *ip6_tnl_get_link_net(const struct net_device *dev);
 
 static inline void ip6tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 09a819ee2151..5bd120e4bc0a 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -222,16 +222,19 @@ static inline struct fib_table *fib_new_table(struct net *net, u32 id)
 static inline int fib_lookup(struct net *net, const struct flowi4 *flp,
                              struct fib_result *res)
 {
-        struct fib_table *table;
+        int err = -ENETUNREACH;
+
+        rcu_read_lock();
+
+        if (!fib_table_lookup(fib_get_table(net, RT_TABLE_LOCAL), flp, res,
+                              FIB_LOOKUP_NOREF) ||
+            !fib_table_lookup(fib_get_table(net, RT_TABLE_MAIN), flp, res,
+                              FIB_LOOKUP_NOREF))
+                err = 0;
 
-        table = fib_get_table(net, RT_TABLE_LOCAL);
-        if (!fib_table_lookup(table, flp, res, FIB_LOOKUP_NOREF))
-                return 0;
+        rcu_read_unlock();
 
-        table = fib_get_table(net, RT_TABLE_MAIN);
-        if (!fib_table_lookup(table, flp, res, FIB_LOOKUP_NOREF))
-                return 0;
-        return -ENETUNREACH;
+        return err;
 }
 
 #else /* CONFIG_IP_MULTIPLE_TABLES */
@@ -247,20 +250,25 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp,
                              struct fib_result *res)
 {
         if (!net->ipv4.fib_has_custom_rules) {
+                int err = -ENETUNREACH;
+
+                rcu_read_lock();
+
                 res->tclassid = 0;
-                if (net->ipv4.fib_local &&
-                    !fib_table_lookup(net->ipv4.fib_local, flp, res,
-                                      FIB_LOOKUP_NOREF))
-                        return 0;
-                if (net->ipv4.fib_main &&
-                    !fib_table_lookup(net->ipv4.fib_main, flp, res,
-                                      FIB_LOOKUP_NOREF))
-                        return 0;
-                if (net->ipv4.fib_default &&
-                    !fib_table_lookup(net->ipv4.fib_default, flp, res,
-                                      FIB_LOOKUP_NOREF))
-                        return 0;
-                return -ENETUNREACH;
+                if ((net->ipv4.fib_local &&
+                     !fib_table_lookup(net->ipv4.fib_local, flp, res,
+                                       FIB_LOOKUP_NOREF)) ||
+                    (net->ipv4.fib_main &&
+                     !fib_table_lookup(net->ipv4.fib_main, flp, res,
+                                       FIB_LOOKUP_NOREF)) ||
+                    (net->ipv4.fib_default &&
+                     !fib_table_lookup(net->ipv4.fib_default, flp, res,
+                                       FIB_LOOKUP_NOREF)))
+                        err = 0;
+
+                rcu_read_unlock();
+
+                return err;
         }
         return __fib_lookup(net, flp, res);
 }
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 25a59eb388a6..2c47061a6954 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -97,7 +97,10 @@ struct ip_tunnel {
 #define TUNNEL_DONT_FRAGMENT    __cpu_to_be16(0x0100)
 #define TUNNEL_OAM              __cpu_to_be16(0x0200)
 #define TUNNEL_CRIT_OPT         __cpu_to_be16(0x0400)
-#define TUNNEL_OPTIONS_PRESENT  __cpu_to_be16(0x0800)
+#define TUNNEL_GENEVE_OPT       __cpu_to_be16(0x0800)
+#define TUNNEL_VXLAN_OPT        __cpu_to_be16(0x1000)
+
+#define TUNNEL_OPTIONS_PRESENT  (TUNNEL_GENEVE_OPT | TUNNEL_VXLAN_OPT)
 
 struct tnl_ptk_info {
         __be16 flags;
@@ -138,6 +141,7 @@ int ip_tunnel_encap_del_ops(const struct ip_tunnel_encap_ops *op,
 int ip_tunnel_init(struct net_device *dev);
 void ip_tunnel_uninit(struct net_device *dev);
 void  ip_tunnel_dellink(struct net_device *dev, struct list_head *head);
+struct net *ip_tunnel_get_link_net(const struct net_device *dev);
 int ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
                        struct rtnl_link_ops *ops, char *devname);
 
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 6e416f6d3e3c..4c9fe224d73b 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -671,8 +671,6 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
         return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
 }
 
-u32 __ipv6_select_ident(u32 hashrnd, struct in6_addr *dst,
-                        struct in6_addr *src);
 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
 void ipv6_proxy_select_ident(struct sk_buff *skb);
 
@@ -791,6 +789,25 @@ int ip6_push_pending_frames(struct sock *sk);
 
 void ip6_flush_pending_frames(struct sock *sk);
 
+int ip6_send_skb(struct sk_buff *skb);
+
+struct sk_buff *__ip6_make_skb(struct sock *sk, struct sk_buff_head *queue,
+                               struct inet_cork_full *cork,
+                               struct inet6_cork *v6_cork);
+struct sk_buff *ip6_make_skb(struct sock *sk,
+                             int getfrag(void *from, char *to, int offset,
+                                         int len, int odd, struct sk_buff *skb),
+                             void *from, int length, int transhdrlen,
+                             int hlimit, int tclass, struct ipv6_txoptions *opt,
+                             struct flowi6 *fl6, struct rt6_info *rt,
+                             unsigned int flags, int dontfrag);
+
+static inline struct sk_buff *ip6_finish_skb(struct sock *sk)
+{
+        return __ip6_make_skb(sk, &sk->sk_write_queue, &inet_sk(sk)->cork,
+                              &inet6_sk(sk)->cork);
+}
+
 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6);
 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
                                       const struct in6_addr *final_dst);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 29c7be8808d5..d52914b75331 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -376,6 +376,12 @@ enum ieee80211_rssi_event {
  * @ssid_len: Length of SSID given in @ssid.
  * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
  * @txpower: TX power in dBm
+ * @txpower_type: TX power adjustment used to control per packet Transmit
+ *      Power Control (TPC) in lower driver for the current vif. In particular
+ *      TPC is enabled if value passed in %txpower_type is
+ *      NL80211_TX_POWER_LIMITED (allow using less than specified from
+ *      userspace), whereas TPC is disabled if %txpower_type is set to
+ *      NL80211_TX_POWER_FIXED (use value configured from userspace)
  * @p2p_noa_attr: P2P NoA attribute for P2P powersave
  */
 struct ieee80211_bss_conf {
@@ -411,6 +417,7 @@ struct ieee80211_bss_conf {
         size_t ssid_len;
         bool hidden_ssid;
         int txpower;
+        enum nl80211_tx_power_setting txpower_type;
         struct ieee80211_p2p_noa_attr p2p_noa_attr;
 };
 
@@ -505,8 +512,11 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_DONTFRAG: Don't fragment this packet even if it
  *      would be fragmented by size (this is optional, only used for
  *      monitor injection).
- * @IEEE80211_TX_CTL_PS_RESPONSE: This frame is a response to a poll
- *      frame (PS-Poll or uAPSD).
+ * @IEEE80211_TX_STAT_NOACK_TRANSMITTED: A frame that was marked with
+ *      IEEE80211_TX_CTL_NO_ACK has been successfully transmitted without
+ *      any errors (like issues specific to the driver/HW).
+ *      This flag must not be set for frames that don't request no-ack
+ *      behaviour with IEEE80211_TX_CTL_NO_ACK.
  *
  * Note: If you have to add new flags to the enumeration, then don't
  *       forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
@@ -542,7 +552,7 @@ enum mac80211_tx_info_flags {
         IEEE80211_TX_STATUS_EOSP                = BIT(28),
         IEEE80211_TX_CTL_USE_MINRATE            = BIT(29),
         IEEE80211_TX_CTL_DONTFRAG               = BIT(30),
-        IEEE80211_TX_CTL_PS_RESPONSE            = BIT(31),
+        IEEE80211_TX_STAT_NOACK_TRANSMITTED     = BIT(31),
 };
 
 #define IEEE80211_TX_CTL_STBC_SHIFT             23
@@ -552,11 +562,14 @@ enum mac80211_tx_info_flags {
  *
  * @IEEE80211_TX_CTRL_PORT_CTRL_PROTO: this frame is a port control
  *      protocol frame (e.g. EAP)
+ * @IEEE80211_TX_CTRL_PS_RESPONSE: This frame is a response to a poll
+ *      frame (PS-Poll or uAPSD).
  *
  * These flags are used in tx_info->control.flags.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTRL_PORT_CTRL_PROTO       = BIT(0),
+        IEEE80211_TX_CTRL_PS_RESPONSE           = BIT(1),
 };
 
 /*
@@ -925,15 +938,13 @@ enum mac80211_rx_flags {
  * These flags are used with the @vht_flag member of
  *      &struct ieee80211_rx_status.
  * @RX_VHT_FLAG_80MHZ: 80 MHz was used
- * @RX_VHT_FLAG_80P80MHZ: 80+80 MHz was used
  * @RX_VHT_FLAG_160MHZ: 160 MHz was used
  * @RX_VHT_FLAG_BF: packet was beamformed
  */
 enum mac80211_rx_vht_flags {
         RX_VHT_FLAG_80MHZ               = BIT(0),
-        RX_VHT_FLAG_80P80MHZ            = BIT(1),
-        RX_VHT_FLAG_160MHZ              = BIT(2),
-        RX_VHT_FLAG_BF                  = BIT(3),
+        RX_VHT_FLAG_160MHZ              = BIT(1),
+        RX_VHT_FLAG_BF                  = BIT(2),
 };
 
 /**
@@ -1181,10 +1192,15 @@ struct ieee80211_channel_switch {
  *      monitoring on this virtual interface -- i.e. it can monitor
  *      connection quality related parameters, such as the RSSI level and
  *      provide notifications if configured trigger levels are reached.
+ * @IEEE80211_VIF_SUPPORTS_UAPSD: The device can do U-APSD for this
+ *      interface. This flag should be set during interface addition,
+ *      but may be set/cleared as late as authentication to an AP. It is
+ *      only valid for managed/station mode interfaces.
  */
 enum ieee80211_vif_flags {
         IEEE80211_VIF_BEACON_FILTER             = BIT(0),
         IEEE80211_VIF_SUPPORTS_CQM_RSSI         = BIT(1),
+        IEEE80211_VIF_SUPPORTS_UAPSD            = BIT(2),
 };
 
 /**
@@ -1270,19 +1286,22 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
  *
  * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
  *      driver to indicate that it requires IV generation for this
- *      particular key.
+ *      particular key. Setting this flag does not necessarily mean that SKBs
+ *      will have sufficient tailroom for ICV or MIC.
  * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
  *      the driver for a TKIP key if it requires Michael MIC
  *      generation in software.
  * @IEEE80211_KEY_FLAG_PAIRWISE: Set by mac80211, this flag indicates
  *      that the key is pairwise rather then a shared key.
  * @IEEE80211_KEY_FLAG_SW_MGMT_TX: This flag should be set by the driver for a
- *      CCMP key if it requires CCMP encryption of management frames (MFP) to
- *      be done in software.
+ *      CCMP/GCMP key if it requires CCMP/GCMP encryption of management frames
+ *      (MFP) to be done in software.
  * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
  *      if space should be prepared for the IV, but the IV
  *      itself should not be generated. Do not set together with
- *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
+ *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key. Setting this flag does
+ *      not necessarily mean that SKBs will have sufficient tailroom for ICV or
+ *      MIC.
  * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received
  *      management frames. The flag can help drivers that have a hardware
  *      crypto implementation that doesn't deal with management frames
@@ -1291,8 +1310,11 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
  *      RX, if your crypto engine can't deal with TX you can also set the
  *      %IEEE80211_KEY_FLAG_SW_MGMT_TX flag to encrypt such frames in SW.
  * @IEEE80211_KEY_FLAG_GENERATE_IV_MGMT: This flag should be set by the
- *      driver for a CCMP key to indicate that is requires IV generation
+ *      driver for a CCMP/GCMP key to indicate that is requires IV generation
  *      only for managment frames (MFP).
+ * @IEEE80211_KEY_FLAG_RESERVE_TAILROOM: This flag should be set by the
+ *      driver for a key to indicate that sufficient tailroom must always
+ *      be reserved for ICV or MIC, even when HW encryption is enabled.
  */
 enum ieee80211_key_flags {
         IEEE80211_KEY_FLAG_GENERATE_IV_MGMT     = BIT(0),
@@ -1302,6 +1324,7 @@ enum ieee80211_key_flags {
         IEEE80211_KEY_FLAG_SW_MGMT_TX           = BIT(4),
         IEEE80211_KEY_FLAG_PUT_IV_SPACE         = BIT(5),
         IEEE80211_KEY_FLAG_RX_MGMT              = BIT(6),
+        IEEE80211_KEY_FLAG_RESERVE_TAILROOM     = BIT(7),
 };
 
 /**
@@ -1580,11 +1603,6 @@ struct ieee80211_tx_control {
  * @IEEE80211_HW_MFP_CAPABLE:
  *      Hardware supports management frame protection (MFP, IEEE 802.11w).
  *
- * @IEEE80211_HW_SUPPORTS_UAPSD:
- *      Hardware supports Unscheduled Automatic Power Save Delivery
- *      (U-APSD) in managed mode. The mode is configured with
- *      conf_tx() operation.
- *
  * @IEEE80211_HW_REPORTS_TX_ACK_STATUS:
  *      Hardware can provide ack status reports of Tx frames to
  *      the stack.
@@ -1623,6 +1641,12 @@ struct ieee80211_tx_control {
  *      be created.  It is expected user-space will create vifs as
  *      desired (and thus have them named as desired).
  *
+ * @IEEE80211_HW_SW_CRYPTO_CONTROL: The driver wants to control which of the
+ *      crypto algorithms can be done in software - so don't automatically
+ *      try to fall back to it if hardware crypto fails, but do so only if
+ *      the driver returns 1. This also forces the driver to advertise its
+ *      supported cipher suites.
+ *
  * @IEEE80211_HW_QUEUE_CONTROL: The driver wants to control per-interface
  *      queue mapping in order to use different queues (not just one per AC)
  *      for different virtual interfaces. See the doc section on HW queue
@@ -1670,8 +1694,8 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_MFP_CAPABLE                        = 1<<13,
         IEEE80211_HW_WANT_MONITOR_VIF                   = 1<<14,
         IEEE80211_HW_NO_AUTO_VIF                        = 1<<15,
-        /* free slot */
-        IEEE80211_HW_SUPPORTS_UAPSD                     = 1<<17,
+        IEEE80211_HW_SW_CRYPTO_CONTROL                  = 1<<16,
+        /* free slots */
         IEEE80211_HW_REPORTS_TX_ACK_STATUS              = 1<<18,
         IEEE80211_HW_CONNECTION_MONITOR                 = 1<<19,
         IEEE80211_HW_QUEUE_CONTROL                      = 1<<20,
@@ -1945,6 +1969,11 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * added; if you return 0 then hw_key_idx must be assigned to the
  * hardware key index, you are free to use the full u8 range.
  *
+ * Note that in the case that the @IEEE80211_HW_SW_CRYPTO_CONTROL flag is
+ * set, mac80211 will not automatically fall back to software crypto if
+ * enabling hardware crypto failed. The set_key() call may also return the
+ * value 1 to permit this specific key/algorithm to be done in software.
+ *
  * When the cmd is %DISABLE_KEY then it must succeed.
  *
  * Note that it is permissible to not decrypt a frame even if a key
@@ -2023,7 +2052,7 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * enabled whenever user has enabled powersave.
  *
  * Driver informs U-APSD client support by enabling
- * %IEEE80211_HW_SUPPORTS_UAPSD flag. The mode is configured through the
+ * %IEEE80211_VIF_SUPPORTS_UAPSD flag. The mode is configured through the
  * uapsd parameter in conf_tx() operation. Hardware needs to send the QoS
  * Nullfunc frames and stay awake until the service period has ended. To
  * utilize U-APSD, dynamic powersave is disabled for voip AC and all frames
@@ -2696,6 +2725,14 @@ enum ieee80211_reconfig_type {
  *      is only used if the configured rate control algorithm actually uses
  *      the new rate table API, and is therefore optional. Must be atomic.
  *
+ * @sta_statistics: Get statistics for this station. For example with beacon
+ *      filtering, the statistics kept by mac80211 might not be accurate, so
+ *      let the driver pre-fill the statistics. The driver can fill most of
+ *      the values (indicating which by setting the filled bitmap), but not
+ *      all of them make sense - see the source for which ones are possible.
+ *      Statistics that the driver doesn't fill will be filled by mac80211.
+ *      The callback can sleep.
+ *
  * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
  *      bursting) for a hardware TX queue.
  *      Returns a negative error code on failure.
@@ -2856,9 +2893,6 @@ enum ieee80211_reconfig_type {
  * @get_et_strings:  Ethtool API to get a set of strings to describe stats
  *      and perhaps other supported types of ethtool data-sets.
  *
- * @get_rssi: Get current signal strength in dBm, the function is optional
- *      and can sleep.
- *
  * @mgd_prepare_tx: Prepare for transmitting a management frame for association
  *      before associated. In multi-channel scenarios, a virtual interface is
  *      bound to a channel before it is associated, but as it isn't associated
@@ -3059,6 +3093,10 @@ struct ieee80211_ops {
         void (*sta_rate_tbl_update)(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     struct ieee80211_sta *sta);
+        void (*sta_statistics)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta,
+                               struct station_info *sinfo);
         int (*conf_tx)(struct ieee80211_hw *hw,
                        struct ieee80211_vif *vif, u16 ac,
                        const struct ieee80211_tx_queue_params *params);
@@ -3126,8 +3164,6 @@ struct ieee80211_ops {
         void    (*get_et_strings)(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif,
                                   u32 sset, u8 *data);
-        int     (*get_rssi)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                            struct ieee80211_sta *sta, s8 *rssi_dbm);
 
         void    (*mgd_prepare_tx)(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif);
@@ -4062,6 +4098,10 @@ void ieee80211_aes_cmac_calculate_k1_k2(struct ieee80211_key_conf *keyconf,
  *      reverse order than in packet)
  * @aes_cmac: PN data, most significant byte first (big endian,
  *      reverse order than in packet)
+ * @aes_gmac: PN data, most significant byte first (big endian,
+ *      reverse order than in packet)
+ * @gcmp: PN data, most significant byte first (big endian,
+ *      reverse order than in packet)
  */
 struct ieee80211_key_seq {
         union {
@@ -4075,6 +4115,12 @@ struct ieee80211_key_seq {
                 struct {
                         u8 pn[6];
                 } aes_cmac;
+                struct {
+                        u8 pn[6];
+                } aes_gmac;
+                struct {
+                        u8 pn[6];
+                } gcmp;
         };
 };
 
@@ -4099,7 +4145,7 @@ void ieee80211_get_key_tx_seq(struct ieee80211_key_conf *keyconf,
  * ieee80211_get_key_rx_seq - get key RX sequence counter
  *
  * @keyconf: the parameter passed with the set key
- * @tid: The TID, or -1 for the management frame value (CCMP only);
+ * @tid: The TID, or -1 for the management frame value (CCMP/GCMP only);
  *      the value on TID 0 is also used for non-QoS frames. For
  *      CMAC, only TID 0 is valid.
  * @seq: buffer to receive the sequence data
@@ -4135,7 +4181,7 @@ void ieee80211_set_key_tx_seq(struct ieee80211_key_conf *keyconf,
  * ieee80211_set_key_rx_seq - set key RX sequence counter
  *
  * @keyconf: the parameter passed with the set key
- * @tid: The TID, or -1 for the management frame value (CCMP only);
+ * @tid: The TID, or -1 for the management frame value (CCMP/GCMP only);
  *      the value on TID 0 is also used for non-QoS frames. For
  *      CMAC, only TID 0 is valid.
  * @seq: new sequence data
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index c823d910b46c..850647811749 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -20,6 +20,8 @@
 #include <linux/ieee802154.h>
 #include <linux/skbuff.h>
 
+#include <net/cfg802154.h>
+
 /* General MAC frame format:
  *  2 bytes: Frame Control
  *  1 byte:  Sequence Number
@@ -212,7 +214,8 @@ struct ieee802154_ops {
                                             unsigned long changed);
         int             (*set_txpower)(struct ieee802154_hw *hw, int db);
         int             (*set_lbt)(struct ieee802154_hw *hw, bool on);
-        int             (*set_cca_mode)(struct ieee802154_hw *hw, u8 mode);
+        int             (*set_cca_mode)(struct ieee802154_hw *hw,
+                                        const struct wpan_phy_cca *cca);
         int             (*set_cca_ed_level)(struct ieee802154_hw *hw,
                                             s32 level);
         int             (*set_csma_params)(struct ieee802154_hw *hw,
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 2e8756b8c775..36faf4990c4b 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -60,6 +60,7 @@ struct net {
         struct list_head        exit_list;      /* Use only net_mutex */
 
         struct user_namespace   *user_ns;       /* Owning user namespace */
+        struct idr              netns_ids;
 
         struct ns_common        ns;
 
@@ -290,6 +291,9 @@ static inline struct net *read_pnet(struct net * const *pnet)
 #define __net_initconst __initconst
 #endif
 
+int peernet2id(struct net *net, struct net *peer);
+struct net *get_net_ns_by_id(struct net *net, int id);
+
 struct pernet_operations {
         struct list_head list;
         int (*init)(struct net *net);
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index f0daed2b54d1..74f271a172dd 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -191,8 +191,6 @@ __nf_conntrack_find(struct net *net, u16 zone,
 int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 bool nf_ct_delete(struct nf_conn *ct, u32 pid, int report);
 
-void nf_conntrack_flush_report(struct net *net, u32 portid, int report);
-
 bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
                        u_int16_t l3num, struct nf_conntrack_tuple *tuple);
 bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 64158353ecb2..e010ee8da41d 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -490,14 +490,10 @@ static inline struct sk_buff *nlmsg_new(size_t payload, gfp_t flags)
  * Corrects the netlink message header to include the appeneded
  * attributes. Only necessary if attributes have been added to
  * the message.
- *
- * Returns the total data length of the skb.
  */
-static inline int nlmsg_end(struct sk_buff *skb, struct nlmsghdr *nlh)
+static inline void nlmsg_end(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         nlh->nlmsg_len = skb_tail_pointer(skb) - (unsigned char *)nlh;
-
-        return skb->len;
 }
 
 /**
@@ -520,8 +516,10 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
  */
 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
 {
-        if (mark)
+        if (mark) {
+                WARN_ON((unsigned char *) mark < skb->data);
                 skb_trim(skb, (unsigned char *) mark - skb->data);
+        }
 }
 
 /**
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 0ffef1a38efc..dbe225478adb 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -48,7 +48,8 @@ struct netns_ipv4 {
         struct hlist_head       *fib_table_hash;
         struct sock             *fibnl;
 
-        struct sock             **icmp_sk;
+        struct sock  * __percpu *icmp_sk;
+
         struct inet_peer_base   *peers;
         struct tcpm_hash_bucket *tcp_metrics_hash;
         unsigned int            tcp_metrics_hash_log;
@@ -81,6 +82,8 @@ struct netns_ipv4 {
 
         int sysctl_fwmark_reflect;
         int sysctl_tcp_fwmark_accept;
+        int sysctl_tcp_mtu_probing;
+        int sysctl_tcp_base_mss;
 
         struct ping_group_range ping_group_range;
 
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 14bd0e1c47fa..ab672b537dd4 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -51,8 +51,10 @@ struct nfc_hci_ops {
         int (*tm_send)(struct nfc_hci_dev *hdev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_hci_dev *hdev,
                               struct nfc_target *target);
-        int (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
+        int (*event_received)(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
                               struct sk_buff *skb);
+        void (*cmd_received)(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+                            struct sk_buff *skb);
         int (*fw_download)(struct nfc_hci_dev *hdev, const char *firmware_name);
         int (*discover_se)(struct nfc_hci_dev *dev);
         int (*enable_se)(struct nfc_hci_dev *dev, u32 se_idx);
@@ -63,8 +65,10 @@ struct nfc_hci_ops {
 };
 
 /* Pipes */
-#define NFC_HCI_INVALID_PIPE    0x80
 #define NFC_HCI_DO_NOT_CREATE_PIPE      0x81
+#define NFC_HCI_INVALID_PIPE    0x80
+#define NFC_HCI_INVALID_GATE    0xFF
+#define NFC_HCI_INVALID_HOST    0x80
 #define NFC_HCI_LINK_MGMT_PIPE  0x00
 #define NFC_HCI_ADMIN_PIPE      0x01
 
@@ -73,7 +77,13 @@ struct nfc_hci_gate {
         u8 pipe;
 };
 
+struct nfc_hci_pipe {
+        u8 gate;
+        u8 dest_host;
+};
+
 #define NFC_HCI_MAX_CUSTOM_GATES        50
+#define NFC_HCI_MAX_PIPES               127
 struct nfc_hci_init_data {
         u8 gate_count;
         struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES];
@@ -125,6 +135,7 @@ struct nfc_hci_dev {
         void *clientdata;
 
         u8 gate2pipe[NFC_HCI_MAX_GATES];
+        struct nfc_hci_pipe pipes[NFC_HCI_MAX_PIPES];
 
         u8 sw_romlib;
         u8 sw_patch;
@@ -167,6 +178,8 @@ void *nfc_hci_get_clientdata(struct nfc_hci_dev *hdev);
 void nfc_hci_driver_failure(struct nfc_hci_dev *hdev, int err);
 
 int nfc_hci_result_to_errno(u8 result);
+void nfc_hci_reset_pipes(struct nfc_hci_dev *dev);
+void nfc_hci_reset_pipes_per_host(struct nfc_hci_dev *hdev, u8 host);
 
 /* Host IDs */
 #define NFC_HCI_HOST_CONTROLLER_ID      0x00
@@ -219,6 +232,12 @@ int nfc_hci_result_to_errno(u8 result);
 #define NFC_HCI_EVT_POST_DATA                   0x02
 #define NFC_HCI_EVT_HOT_PLUG                    0x03
 
+/* Generic commands */
+#define NFC_HCI_ANY_SET_PARAMETER       0x01
+#define NFC_HCI_ANY_GET_PARAMETER       0x02
+#define NFC_HCI_ANY_OPEN_PIPE           0x03
+#define NFC_HCI_ANY_CLOSE_PIPE          0x04
+
 /* Reader RF gates events */
 #define NFC_HCI_EVT_READER_REQUESTED    0x10
 #define NFC_HCI_EVT_END_OPERATION       0x11
@@ -249,8 +268,6 @@ int nfc_hci_send_cmd(struct nfc_hci_dev *hdev, u8 gate, u8 cmd,
 int nfc_hci_send_cmd_async(struct nfc_hci_dev *hdev, u8 gate, u8 cmd,
                            const u8 *param, size_t param_len,
                            data_exchange_cb_t cb, void *cb_context);
-int nfc_hci_send_response(struct nfc_hci_dev *hdev, u8 gate, u8 response,
-                          const u8 *param, size_t param_len);
 int nfc_hci_send_event(struct nfc_hci_dev *hdev, u8 gate, u8 event,
                        const u8 *param, size_t param_len);
 int nfc_hci_target_discovered(struct nfc_hci_dev *hdev, u8 gate);
diff --git a/include/net/nfc/nci.h b/include/net/nfc/nci.h
index e7257a4653b4..a2f2f3d3196d 100644
--- a/include/net/nfc/nci.h
+++ b/include/net/nfc/nci.h
@@ -62,6 +62,25 @@
 #define NCI_STATUS_NFCEE_PROTOCOL_ERROR                         0xc2
 #define NCI_STATUS_NFCEE_TIMEOUT_ERROR                          0xc3
 
+/* NFCEE Interface/Protocols */
+#define NCI_NFCEE_INTERFACE_APDU           0x00
+#define NCI_NFCEE_INTERFACE_HCI_ACCESS     0x01
+#define NCI_NFCEE_INTERFACE_TYPE3_CMD_SET  0x02
+#define NCI_NFCEE_INTERFACE_TRANSPARENT        0x03
+
+/* Destination type */
+#define NCI_DESTINATION_NFCC_LOOPBACK      0x01
+#define NCI_DESTINATION_REMOTE_NFC_ENDPOINT    0x02
+#define NCI_DESTINATION_NFCEE              0x03
+
+/* Destination-specific parameters type */
+#define NCI_DESTINATION_SPECIFIC_PARAM_RF_TYPE     0x00
+#define NCI_DESTINATION_SPECIFIC_PARAM_NFCEE_TYPE  0x01
+
+/* NFCEE Discovery Action */
+#define NCI_NFCEE_DISCOVERY_ACTION_DISABLE                      0x00
+#define NCI_NFCEE_DISCOVERY_ACTION_ENABLE                       0x01
+
 /* NCI RF Technology and Mode */
 #define NCI_NFC_A_PASSIVE_POLL_MODE                             0x00
 #define NCI_NFC_B_PASSIVE_POLL_MODE                             0x01
@@ -224,6 +243,28 @@ struct nci_core_set_config_cmd {
         struct  set_config_param param; /* support 1 param per cmd is enough */
 } __packed;
 
+#define NCI_OP_CORE_CONN_CREATE_CMD     nci_opcode_pack(NCI_GID_CORE, 0x04)
+#define DEST_SPEC_PARAMS_ID_INDEX       0
+#define DEST_SPEC_PARAMS_PROTOCOL_INDEX 1
+struct dest_spec_params {
+        __u8    id;
+        __u8    protocol;
+} __packed;
+
+struct core_conn_create_dest_spec_params {
+        __u8    type;
+        __u8    length;
+        __u8    value[0];
+} __packed;
+
+struct nci_core_conn_create_cmd {
+        __u8    destination_type;
+        __u8    number_destination_params;
+        struct core_conn_create_dest_spec_params params[0];
+} __packed;
+
+#define NCI_OP_CORE_CONN_CLOSE_CMD      nci_opcode_pack(NCI_GID_CORE, 0x05)
+
 #define NCI_OP_RF_DISCOVER_MAP_CMD      nci_opcode_pack(NCI_GID_RF_MGMT, 0x00)
 struct disc_map_config {
         __u8    rf_protocol;
@@ -260,6 +301,19 @@ struct nci_rf_deactivate_cmd {
         __u8    type;
 } __packed;
 
+#define NCI_OP_NFCEE_DISCOVER_CMD nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x00)
+struct nci_nfcee_discover_cmd {
+        __u8    discovery_action;
+} __packed;
+
+#define NCI_OP_NFCEE_MODE_SET_CMD nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x01)
+#define NCI_NFCEE_DISABLE       0x00
+#define NCI_NFCEE_ENABLE        0x01
+struct nci_nfcee_mode_set_cmd {
+        __u8    nfcee_id;
+        __u8    nfcee_mode;
+} __packed;
+
 /* ----------------------- */
 /* ---- NCI Responses ---- */
 /* ----------------------- */
@@ -295,6 +349,16 @@ struct nci_core_set_config_rsp {
         __u8    params_id[0];   /* variable size array */
 } __packed;
 
+#define NCI_OP_CORE_CONN_CREATE_RSP     nci_opcode_pack(NCI_GID_CORE, 0x04)
+struct nci_core_conn_create_rsp {
+        __u8    status;
+        __u8    max_ctrl_pkt_payload_len;
+        __u8    credits_cnt;
+        __u8    conn_id;
+} __packed;
+
+#define NCI_OP_CORE_CONN_CLOSE_RSP      nci_opcode_pack(NCI_GID_CORE, 0x05)
+
 #define NCI_OP_RF_DISCOVER_MAP_RSP      nci_opcode_pack(NCI_GID_RF_MGMT, 0x00)
 
 #define NCI_OP_RF_DISCOVER_RSP          nci_opcode_pack(NCI_GID_RF_MGMT, 0x03)
@@ -303,6 +367,13 @@ struct nci_core_set_config_rsp {
 
 #define NCI_OP_RF_DEACTIVATE_RSP        nci_opcode_pack(NCI_GID_RF_MGMT, 0x06)
 
+#define NCI_OP_NFCEE_DISCOVER_RSP nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x00)
+struct nci_nfcee_discover_rsp {
+        __u8    status;
+        __u8    num_nfcee;
+} __packed;
+
+#define NCI_OP_NFCEE_MODE_SET_RSP nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x01)
 /* --------------------------- */
 /* ---- NCI Notifications ---- */
 /* --------------------------- */
@@ -430,4 +501,30 @@ struct nci_rf_deactivate_ntf {
         __u8    reason;
 } __packed;
 
+#define NCI_OP_RF_NFCEE_ACTION_NTF      nci_opcode_pack(NCI_GID_RF_MGMT, 0x09)
+struct nci_rf_nfcee_action_ntf {
+        __u8 nfcee_id;
+        __u8 trigger;
+        __u8 supported_data_length;
+        __u8 supported_data[0];
+} __packed;
+
+#define NCI_OP_NFCEE_DISCOVER_NTF nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x00)
+struct nci_nfcee_supported_protocol {
+        __u8    num_protocol;
+        __u8    supported_protocol[0];
+} __packed;
+
+struct nci_nfcee_information_tlv {
+        __u8    num_tlv;
+        __u8    information_tlv[0];
+} __packed;
+
+struct nci_nfcee_discover_ntf {
+        __u8    nfcee_id;
+        __u8    nfcee_status;
+        struct nci_nfcee_supported_protocol supported_protocols;
+        struct nci_nfcee_information_tlv        information_tlv;
+} __packed;
+
 #endif /* __NCI_H */
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 9e51bb4d841e..ff87f8611fa3 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -78,15 +78,107 @@ struct nci_ops {
         int   (*se_io)(struct nci_dev *ndev, u32 se_idx,
                                 u8 *apdu, size_t apdu_length,
                                 se_io_cb_t cb, void *cb_context);
+        int   (*hci_load_session)(struct nci_dev *ndev);
+        void  (*hci_event_received)(struct nci_dev *ndev, u8 pipe, u8 event,
+                                    struct sk_buff *skb);
+        void  (*hci_cmd_received)(struct nci_dev *ndev, u8 pipe, u8 cmd,
+                                  struct sk_buff *skb);
 };
 
 #define NCI_MAX_SUPPORTED_RF_INTERFACES         4
 #define NCI_MAX_DISCOVERED_TARGETS              10
+#define NCI_MAX_NUM_NFCEE   255
+#define NCI_MAX_CONN_ID         7
+
+struct nci_conn_info {
+        struct list_head list;
+        __u8    id; /* can be an RF Discovery ID or an NFCEE ID */
+        __u8    conn_id;
+        __u8    max_pkt_payload_len;
+
+        atomic_t credits_cnt;
+        __u8     initial_num_credits;
+
+        data_exchange_cb_t      data_exchange_cb;
+        void *data_exchange_cb_context;
+
+        struct sk_buff *rx_skb;
+};
+
+#define NCI_INVALID_CONN_ID 0x80
+
+#define NCI_HCI_ANY_OPEN_PIPE      0x03
+
+/* Gates */
+#define NCI_HCI_ADMIN_GATE         0x00
+#define NCI_HCI_LINK_MGMT_GATE     0x06
+
+/* Pipes */
+#define NCI_HCI_LINK_MGMT_PIPE             0x00
+#define NCI_HCI_ADMIN_PIPE                 0x01
+
+/* Generic responses */
+#define NCI_HCI_ANY_OK                     0x00
+#define NCI_HCI_ANY_E_NOT_CONNECTED        0x01
+#define NCI_HCI_ANY_E_CMD_PAR_UNKNOWN      0x02
+#define NCI_HCI_ANY_E_NOK                  0x03
+#define NCI_HCI_ANY_E_PIPES_FULL           0x04
+#define NCI_HCI_ANY_E_REG_PAR_UNKNOWN      0x05
+#define NCI_HCI_ANY_E_PIPE_NOT_OPENED      0x06
+#define NCI_HCI_ANY_E_CMD_NOT_SUPPORTED    0x07
+#define NCI_HCI_ANY_E_INHIBITED            0x08
+#define NCI_HCI_ANY_E_TIMEOUT              0x09
+#define NCI_HCI_ANY_E_REG_ACCESS_DENIED    0x0a
+#define NCI_HCI_ANY_E_PIPE_ACCESS_DENIED   0x0b
+
+#define NCI_HCI_DO_NOT_OPEN_PIPE           0x81
+#define NCI_HCI_INVALID_PIPE               0x80
+#define NCI_HCI_INVALID_GATE               0xFF
+#define NCI_HCI_INVALID_HOST               0x80
+
+#define NCI_HCI_MAX_CUSTOM_GATES   50
+#define NCI_HCI_MAX_PIPES          127
+
+struct nci_hci_gate {
+        u8 gate;
+        u8 pipe;
+        u8 dest_host;
+} __packed;
+
+struct nci_hci_pipe {
+        u8 gate;
+        u8 host;
+} __packed;
+
+struct nci_hci_init_data {
+        u8 gate_count;
+        struct nci_hci_gate gates[NCI_HCI_MAX_CUSTOM_GATES];
+        char session_id[9];
+};
+
+#define NCI_HCI_MAX_GATES          256
+
+struct nci_hci_dev {
+        u8 nfcee_id;
+        struct nci_dev *ndev;
+        struct nci_conn_info *conn_info;
+
+        struct nci_hci_init_data init_data;
+        struct nci_hci_pipe pipes[NCI_HCI_MAX_PIPES];
+        u8 gate2pipe[NCI_HCI_MAX_GATES];
+        int expected_pipes;
+        int count_pipes;
+
+        struct sk_buff_head rx_hcp_frags;
+        struct work_struct msg_rx_work;
+        struct sk_buff_head msg_rx_queue;
+};
 
 /* NCI Core structures */
 struct nci_dev {
         struct nfc_dev          *nfc_dev;
         struct nci_ops          *ops;
+        struct nci_hci_dev      *hci_dev;
 
         int                     tx_headroom;
         int                     tx_tailroom;
@@ -95,7 +187,10 @@ struct nci_dev {
         unsigned long           flags;
 
         atomic_t                cmd_cnt;
-        atomic_t                credits_cnt;
+        __u8                    cur_conn_id;
+
+        struct list_head        conn_info_list;
+        struct nci_conn_info    *rf_conn_info;
 
         struct timer_list       cmd_timer;
         struct timer_list       data_timer;
@@ -141,13 +236,10 @@ struct nci_dev {
         __u8                    manufact_id;
         __u32                   manufact_specific_info;
 
-        /* received during NCI_OP_RF_INTF_ACTIVATED_NTF */
-        __u8                    max_data_pkt_payload_size;
-        __u8                    initial_num_credits;
+        /* Save RF Discovery ID or NFCEE ID under conn_create */
+        __u8                    cur_id;
 
         /* stored during nci_data_exchange */
-        data_exchange_cb_t      data_exchange_cb;
-        void                    *data_exchange_cb_context;
         struct sk_buff          *rx_data_reassembly;
 
         /* stored during intf_activated_ntf */
@@ -163,9 +255,36 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
 void nci_free_device(struct nci_dev *ndev);
 int nci_register_device(struct nci_dev *ndev);
 void nci_unregister_device(struct nci_dev *ndev);
+int nci_request(struct nci_dev *ndev,
+                void (*req)(struct nci_dev *ndev,
+                            unsigned long opt),
+                unsigned long opt, __u32 timeout);
 int nci_recv_frame(struct nci_dev *ndev, struct sk_buff *skb);
 int nci_set_config(struct nci_dev *ndev, __u8 id, size_t len, __u8 *val);
 
+int nci_nfcee_discover(struct nci_dev *ndev, u8 action);
+int nci_nfcee_mode_set(struct nci_dev *ndev, u8 nfcee_id, u8 nfcee_mode);
+int nci_core_conn_create(struct nci_dev *ndev, u8 destination_type,
+                         u8 number_destination_params,
+                         size_t params_len,
+                         struct core_conn_create_dest_spec_params *params);
+int nci_core_conn_close(struct nci_dev *ndev, u8 conn_id);
+
+struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev);
+int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event,
+                       const u8 *param, size_t param_len);
+int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate,
+                     u8 cmd, const u8 *param, size_t param_len,
+                     struct sk_buff **skb);
+int nci_hci_open_pipe(struct nci_dev *ndev, u8 pipe);
+int nci_hci_connect_gate(struct nci_dev *ndev, u8 dest_host,
+                         u8 dest_gate, u8 pipe);
+int nci_hci_set_param(struct nci_dev *ndev, u8 gate, u8 idx,
+                      const u8 *param, size_t param_len);
+int nci_hci_get_param(struct nci_dev *ndev, u8 gate, u8 idx,
+                      struct sk_buff **skb);
+int nci_hci_dev_session_init(struct nci_dev *ndev);
+
 static inline struct sk_buff *nci_skb_alloc(struct nci_dev *ndev,
                                             unsigned int len,
                                             gfp_t how)
@@ -200,7 +319,9 @@ void nci_rx_data_packet(struct nci_dev *ndev, struct sk_buff *skb);
 int nci_send_cmd(struct nci_dev *ndev, __u16 opcode, __u8 plen, void *payload);
 int nci_send_data(struct nci_dev *ndev, __u8 conn_id, struct sk_buff *skb);
 void nci_data_exchange_complete(struct nci_dev *ndev, struct sk_buff *skb,
-                                int err);
+                                __u8 conn_id, int err);
+void nci_hci_data_received_cb(void *context, struct sk_buff *skb, int err);
+
 void nci_clear_target_list(struct nci_dev *ndev);
 
 /* ----- NCI requests ----- */
@@ -209,6 +330,8 @@ void nci_clear_target_list(struct nci_dev *ndev);
 #define NCI_REQ_CANCELED        2
 
 void nci_req_complete(struct nci_dev *ndev, int result);
+struct nci_conn_info *nci_get_conn_info_by_conn_id(struct nci_dev *ndev,
+                                                   int conn_id);
 
 /* ----- NCI status code ----- */
 int nci_to_errno(__u8 code);
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 12adb817c27a..73190e65d5c1 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -135,6 +135,31 @@ struct nfc_se {
         u16 state;
 };
 
+/**
+ * nfc_evt_transaction - A struct for NFC secure element event transaction.
+ *
+ * @aid: The application identifier triggering the event
+ *
+ * @aid_len: The application identifier length [5:16]
+ *
+ * @params: The application parameters transmitted during the transaction
+ *
+ * @params_len: The applications parameters length [0:255]
+ *
+ */
+#define NFC_MIN_AID_LENGTH      5
+#define NFC_MAX_AID_LENGTH      16
+#define NFC_MAX_PARAMS_LENGTH   255
+
+#define NFC_EVT_TRANSACTION_AID_TAG     0x81
+#define NFC_EVT_TRANSACTION_PARAMS_TAG  0x82
+struct nfc_evt_transaction {
+        u32 aid_len;
+        u8 aid[NFC_MAX_AID_LENGTH];
+        u8 params_len;
+        u8 params[NFC_MAX_PARAMS_LENGTH];
+} __packed;
+
 struct nfc_genl_data {
         u32 poll_req_portid;
         struct mutex genl_data_mutex;
@@ -262,6 +287,8 @@ int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb);
 
 void nfc_driver_failure(struct nfc_dev *dev, int err);
 
+int nfc_se_transaction(struct nfc_dev *dev, u8 se_idx,
+                       struct nfc_evt_transaction *evt_transaction);
 int nfc_add_se(struct nfc_dev *dev, u32 se_idx, u16 type);
 int nfc_remove_se(struct nfc_dev *dev, u32 se_idx);
 struct nfc_se *nfc_find_se(struct nfc_dev *dev, u32 se_idx);
diff --git a/include/net/nl802154.h b/include/net/nl802154.h
index 6dbd406ca41b..f8b5bc997959 100644
--- a/include/net/nl802154.h
+++ b/include/net/nl802154.h
@@ -82,7 +82,7 @@ enum nl802154_attrs {
         NL802154_ATTR_TX_POWER,
 
         NL802154_ATTR_CCA_MODE,
-        NL802154_ATTR_CCA_MODE3_AND,
+        NL802154_ATTR_CCA_OPT,
         NL802154_ATTR_CCA_ED_LEVEL,
 
         NL802154_ATTR_MAX_FRAME_RETRIES,
@@ -119,4 +119,47 @@ enum nl802154_iftype {
         NL802154_IFTYPE_MAX = NUM_NL802154_IFTYPES - 1
 };
 
+/**
+ * enum nl802154_cca_modes - cca modes
+ *
+ * @__NL802154_CCA_INVALID: cca mode number 0 is reserved
+ * @NL802154_CCA_ENERGY: Energy above threshold
+ * @NL802154_CCA_CARRIER: Carrier sense only
+ * @NL802154_CCA_ENERGY_CARRIER: Carrier sense with energy above threshold
+ * @NL802154_CCA_ALOHA: CCA shall always report an idle medium
+ * @NL802154_CCA_UWB_SHR: UWB preamble sense based on the SHR of a frame
+ * @NL802154_CCA_UWB_MULTIPEXED: UWB preamble sense based on the packet with
+ *      the multiplexed preamble
+ * @__NL802154_CCA_ATTR_AFTER_LAST: Internal
+ * @NL802154_CCA_ATTR_MAX: Maximum CCA attribute number
+ */
+enum nl802154_cca_modes {
+        __NL802154_CCA_INVALID,
+        NL802154_CCA_ENERGY,
+        NL802154_CCA_CARRIER,
+        NL802154_CCA_ENERGY_CARRIER,
+        NL802154_CCA_ALOHA,
+        NL802154_CCA_UWB_SHR,
+        NL802154_CCA_UWB_MULTIPEXED,
+
+        /* keep last */
+        __NL802154_CCA_ATTR_AFTER_LAST,
+        NL802154_CCA_ATTR_MAX = __NL802154_CCA_ATTR_AFTER_LAST - 1
+};
+
+/**
+ * enum nl802154_cca_opts - additional options for cca modes
+ *
+ * @NL802154_CCA_OPT_ENERGY_CARRIER_OR: NL802154_CCA_ENERGY_CARRIER with OR
+ * @NL802154_CCA_OPT_ENERGY_CARRIER_AND: NL802154_CCA_ENERGY_CARRIER with AND
+ */
+enum nl802154_cca_opts {
+        NL802154_CCA_OPT_ENERGY_CARRIER_AND,
+        NL802154_CCA_OPT_ENERGY_CARRIER_OR,
+
+        /* keep last */
+        __NL802154_CCA_OPT_ATTR_AFTER_LAST,
+        NL802154_CCA_OPT_ATTR_MAX = __NL802154_CCA_OPT_ATTR_AFTER_LAST - 1
+};
+
 #endif /* __NL802154_H */
diff --git a/include/net/ping.h b/include/net/ping.h
index f074060bc5de..cc16d413f681 100644
--- a/include/net/ping.h
+++ b/include/net/ping.h
@@ -59,7 +59,7 @@ extern struct pingv6_ops pingv6_ops;
 
 struct pingfakehdr {
         struct icmphdr icmph;
-        struct iovec *iov;
+        struct msghdr *msg;
         sa_family_t family;
         __wsum wcheck;
 };
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 27a33833ff4a..2342bf12cb78 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -3,6 +3,7 @@
 
 #include <linux/jiffies.h>
 #include <linux/ktime.h>
+#include <linux/if_vlan.h>
 #include <net/sch_generic.h>
 
 struct qdisc_walker {
@@ -114,6 +115,17 @@ int tc_classify_compat(struct sk_buff *skb, const struct tcf_proto *tp,
 int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                 struct tcf_result *res);
 
+static inline __be16 tc_skb_protocol(const struct sk_buff *skb)
+{
+        /* We need to take extra care in case the skb came via
+         * vlan accelerated path. In that case, use skb->vlan_proto
+         * as the original vlan header was already stripped.
+         */
+        if (skb_vlan_tag_present(skb))
+                return skb->vlan_proto;
+        return skb->protocol;
+}
+
 /* Calculate maximal size of packet seen by hard_start_xmit
    routine of this device.
  */
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index b776d72d84be..ebc5a2ed8631 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -147,6 +147,24 @@ struct regulatory_request {
  *      NL80211_IFTYPE_P2P_CLIENT, NL80211_IFTYPE_P2P_GO,
  *      NL80211_IFTYPE_P2P_DEVICE. The flag will be set by default if a device
  *      includes any modes unsupported for enforcement checking.
+ * @REGULATORY_WIPHY_SELF_MANAGED: for devices that employ wiphy-specific
+ *      regdom management. These devices will ignore all regdom changes not
+ *      originating from their own wiphy.
+ *      A self-managed wiphys only employs regulatory information obtained from
+ *      the FW and driver and does not use other cfg80211 sources like
+ *      beacon-hints, country-code IEs and hints from other devices on the same
+ *      system. Conversely, a self-managed wiphy does not share its regulatory
+ *      hints with other devices in the system. If a system contains several
+ *      devices, one or more of which are self-managed, there might be
+ *      contradictory regulatory settings between them. Usage of flag is
+ *      generally discouraged. Only use it if the FW/driver is incompatible
+ *      with non-locally originated hints.
+ *      This flag is incompatible with the flags: %REGULATORY_CUSTOM_REG,
+ *      %REGULATORY_STRICT_REG, %REGULATORY_COUNTRY_IE_FOLLOW_POWER,
+ *      %REGULATORY_COUNTRY_IE_IGNORE and %REGULATORY_DISABLE_BEACON_HINTS.
+ *      Mixing any of the above flags with this flag will result in a failure
+ *      to register the wiphy. This flag implies
+ *      %REGULATORY_DISABLE_BEACON_HINTS and %REGULATORY_COUNTRY_IE_IGNORE.
  */
 enum ieee80211_regulatory_flags {
         REGULATORY_CUSTOM_REG                   = BIT(0),
@@ -156,6 +174,7 @@ enum ieee80211_regulatory_flags {
         REGULATORY_COUNTRY_IE_IGNORE            = BIT(4),
         REGULATORY_ENABLE_RELAX_NO_IR           = BIT(5),
         REGULATORY_IGNORE_STALE_KICKOFF         = BIT(6),
+        REGULATORY_WIPHY_SELF_MANAGED           = BIT(7),
 };
 
 struct ieee80211_freq_range {
diff --git a/include/net/route.h b/include/net/route.h
index b17cf28f996e..fe22d03afb6a 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -46,6 +46,7 @@
 
 struct fib_nh;
 struct fib_info;
+struct uncached_list;
 struct rtable {
         struct dst_entry        dst;
 
@@ -64,6 +65,7 @@ struct rtable {
         u32                     rt_pmtu;
 
         struct list_head        rt_uncached;
+        struct uncached_list    *rt_uncached_list;
 };
 
 static inline bool rt_is_input_route(const struct rtable *rt)
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index e21b9f9653c0..6c6d5393fc34 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -46,6 +46,7 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
  *                          to create when creating a new device.
  *      @get_num_rx_queues: Function to determine number of receive queues
  *                          to create when creating a new device.
+ *      @get_link_net: Function to get the i/o netns of the device
  */
 struct rtnl_link_ops {
         struct list_head        list;
@@ -93,6 +94,7 @@ struct rtnl_link_ops {
         int                     (*fill_slave_info)(struct sk_buff *skb,
                                                    const struct net_device *dev,
                                                    const struct net_device *slave_dev);
+        struct net              *(*get_link_net)(const struct net_device *dev);
 };
 
 int __rtnl_link_register(struct rtnl_link_ops *ops);
diff --git a/include/net/sock.h b/include/net/sock.h
index 2210fec65669..e13824570b0f 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -857,18 +857,6 @@ static inline void sock_rps_record_flow_hash(__u32 hash)
 #endif
 }
 
-static inline void sock_rps_reset_flow_hash(__u32 hash)
-{
-#ifdef CONFIG_RPS
-        struct rps_sock_flow_table *sock_flow_table;
-
-        rcu_read_lock();
-        sock_flow_table = rcu_dereference(rps_sock_flow_table);
-        rps_reset_sock_flow(sock_flow_table, hash);
-        rcu_read_unlock();
-#endif
-}
-
 static inline void sock_rps_record_flow(const struct sock *sk)
 {
 #ifdef CONFIG_RPS
@@ -876,28 +864,18 @@ static inline void sock_rps_record_flow(const struct sock *sk)
 #endif
 }
 
-static inline void sock_rps_reset_flow(const struct sock *sk)
-{
-#ifdef CONFIG_RPS
-        sock_rps_reset_flow_hash(sk->sk_rxhash);
-#endif
-}
-
 static inline void sock_rps_save_rxhash(struct sock *sk,
                                         const struct sk_buff *skb)
 {
 #ifdef CONFIG_RPS
-        if (unlikely(sk->sk_rxhash != skb->hash)) {
-                sock_rps_reset_flow(sk);
+        if (unlikely(sk->sk_rxhash != skb->hash))
                 sk->sk_rxhash = skb->hash;
-        }
 #endif
 }
 
 static inline void sock_rps_reset_rxhash(struct sock *sk)
 {
 #ifdef CONFIG_RPS
-        sock_rps_reset_flow(sk);
         sk->sk_rxhash = 0;
 #endif
 }
@@ -1374,29 +1352,6 @@ void sk_prot_clear_portaddr_nulls(struct sock *sk, int size);
 #define SOCK_BINDADDR_LOCK      4
 #define SOCK_BINDPORT_LOCK      8
 
-/* sock_iocb: used to kick off async processing of socket ios */
-struct sock_iocb {
-        struct list_head        list;
-
-        int                     flags;
-        int                     size;
-        struct socket           *sock;
-        struct sock             *sk;
-        struct scm_cookie       *scm;
-        struct msghdr           *msg, async_msg;
-        struct kiocb            *kiocb;
-};
-
-static inline struct sock_iocb *kiocb_to_siocb(struct kiocb *iocb)
-{
-        return (struct sock_iocb *)iocb->private;
-}
-
-static inline struct kiocb *siocb_to_kiocb(struct sock_iocb *si)
-{
-        return si->kiocb;
-}
-
 struct socket_alloc {
         struct socket socket;
         struct inode vfs_inode;
@@ -1826,27 +1781,25 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
 }
 
 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
-                                           char __user *from, char *to,
+                                           struct iov_iter *from, char *to,
                                            int copy, int offset)
 {
         if (skb->ip_summed == CHECKSUM_NONE) {
-                int err = 0;
-                __wsum csum = csum_and_copy_from_user(from, to, copy, 0, &err);
-                if (err)
-                        return err;
+                __wsum csum = 0;
+                if (csum_and_copy_from_iter(to, copy, &csum, from) != copy)
+                        return -EFAULT;
                 skb->csum = csum_block_add(skb->csum, csum, offset);
         } else if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY) {
-                if (!access_ok(VERIFY_READ, from, copy) ||
-                    __copy_from_user_nocache(to, from, copy))
+                if (copy_from_iter_nocache(to, copy, from) != copy)
                         return -EFAULT;
-        } else if (copy_from_user(to, from, copy))
+        } else if (copy_from_iter(to, copy, from) != copy)
                 return -EFAULT;
 
         return 0;
 }
 
 static inline int skb_add_data_nocache(struct sock *sk, struct sk_buff *skb,
-                                       char __user *from, int copy)
+                                       struct iov_iter *from, int copy)
 {
         int err, offset = skb->len;
 
@@ -1858,7 +1811,7 @@ static inline int skb_add_data_nocache(struct sock *sk, struct sk_buff *skb,
         return err;
 }
 
-static inline int skb_copy_to_page_nocache(struct sock *sk, char __user *from,
+static inline int skb_copy_to_page_nocache(struct sock *sk, struct iov_iter *from,
                                            struct sk_buff *skb,
                                            struct page *page,
                                            int off, int copy)
@@ -2262,6 +2215,7 @@ bool sk_net_capable(const struct sock *sk, int cap);
 extern __u32 sysctl_wmem_max;
 extern __u32 sysctl_rmem_max;
 
+extern int sysctl_tstamp_allow_data;
 extern int sysctl_optmem_max;
 
 extern __u32 sysctl_wmem_default;
diff --git a/include/net/switchdev.h b/include/net/switchdev.h
index 8a6d1641fd9b..cfcdac2e5d25 100644
--- a/include/net/switchdev.h
+++ b/include/net/switchdev.h
@@ -11,13 +11,46 @@
 #define _LINUX_SWITCHDEV_H_
 
 #include <linux/netdevice.h>
+#include <linux/notifier.h>
+
+enum netdev_switch_notifier_type {
+        NETDEV_SWITCH_FDB_ADD = 1,
+        NETDEV_SWITCH_FDB_DEL,
+};
+
+struct netdev_switch_notifier_info {
+        struct net_device *dev;
+};
+
+struct netdev_switch_notifier_fdb_info {
+        struct netdev_switch_notifier_info info; /* must be first */
+        const unsigned char *addr;
+        u16 vid;
+};
+
+static inline struct net_device *
+netdev_switch_notifier_info_to_dev(const struct netdev_switch_notifier_info *info)
+{
+        return info->dev;
+}
 
 #ifdef CONFIG_NET_SWITCHDEV
 
 int netdev_switch_parent_id_get(struct net_device *dev,
                                 struct netdev_phys_item_id *psid);
 int netdev_switch_port_stp_update(struct net_device *dev, u8 state);
-
+int register_netdev_switch_notifier(struct notifier_block *nb);
+int unregister_netdev_switch_notifier(struct notifier_block *nb);
+int call_netdev_switch_notifiers(unsigned long val, struct net_device *dev,
+                                 struct netdev_switch_notifier_info *info);
+int netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                struct nlmsghdr *nlh, u16 flags);
+int netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                struct nlmsghdr *nlh, u16 flags);
+int ndo_dflt_netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                               struct nlmsghdr *nlh, u16 flags);
+int ndo_dflt_netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                               struct nlmsghdr *nlh, u16 flags);
 #else
 
 static inline int netdev_switch_parent_id_get(struct net_device *dev,
@@ -32,6 +65,50 @@ static inline int netdev_switch_port_stp_update(struct net_device *dev,
         return -EOPNOTSUPP;
 }
 
+static inline int register_netdev_switch_notifier(struct notifier_block *nb)
+{
+        return 0;
+}
+
+static inline int unregister_netdev_switch_notifier(struct notifier_block *nb)
+{
+        return 0;
+}
+
+static inline int call_netdev_switch_notifiers(unsigned long val, struct net_device *dev,
+                                               struct netdev_switch_notifier_info *info)
+{
+        return NOTIFY_DONE;
+}
+
+static inline int netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                                    struct nlmsghdr *nlh,
+                                                    u16 flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                                    struct nlmsghdr *nlh,
+                                                    u16 flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int ndo_dflt_netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                                        struct nlmsghdr *nlh,
+                                                        u16 flags)
+{
+        return 0;
+}
+
+static inline int ndo_dflt_netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                                        struct nlmsghdr *nlh,
+                                                        u16 flags)
+{
+        return 0;
+}
+
 #endif
 
 #endif /* _LINUX_SWITCHDEV_H_ */
diff --git a/include/net/tc_act/tc_bpf.h b/include/net/tc_act/tc_bpf.h
new file mode 100644
index 000000000000..86a070ffc930
--- /dev/null
+++ b/include/net/tc_act/tc_bpf.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2015 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __NET_TC_BPF_H
+#define __NET_TC_BPF_H
+
+#include <linux/filter.h>
+#include <net/act_api.h>
+
+struct tcf_bpf {
+        struct tcf_common       common;
+        struct bpf_prog         *filter;
+        struct sock_filter      *bpf_ops;
+        u16                     bpf_num_ops;
+};
+#define to_bpf(a) \
+        container_of(a->priv, struct tcf_bpf, common)
+
+#endif /* __NET_TC_BPF_H */
diff --git a/include/net/tc_act/tc_connmark.h b/include/net/tc_act/tc_connmark.h
new file mode 100644
index 000000000000..5c1104c2e24f
--- /dev/null
+++ b/include/net/tc_act/tc_connmark.h
@@ -0,0 +1,14 @@
+#ifndef __NET_TC_CONNMARK_H
+#define __NET_TC_CONNMARK_H
+
+#include <net/act_api.h>
+
+struct tcf_connmark_info {
+        struct tcf_common common;
+        u16 zone;
+};
+
+#define to_connmark(a) \
+        container_of(a->priv, struct tcf_connmark_info, common)
+
+#endif /* __NET_TC_CONNMARK_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 9d9111ef43ae..8d6b983d5099 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -262,8 +262,6 @@ extern int sysctl_tcp_low_latency;
 extern int sysctl_tcp_nometrics_save;
 extern int sysctl_tcp_moderate_rcvbuf;
 extern int sysctl_tcp_tso_win_divisor;
-extern int sysctl_tcp_mtu_probing;
-extern int sysctl_tcp_base_mss;
 extern int sysctl_tcp_workaround_signed_windows;
 extern int sysctl_tcp_slow_start_after_idle;
 extern int sysctl_tcp_thin_linear_timeouts;
@@ -274,6 +272,7 @@ extern int sysctl_tcp_challenge_ack_limit;
 extern unsigned int sysctl_tcp_notsent_lowat;
 extern int sysctl_tcp_min_tso_segs;
 extern int sysctl_tcp_autocorking;
+extern int sysctl_tcp_invalid_ratelimit;
 
 extern atomic_long_t tcp_memory_allocated;
 extern struct percpu_counter tcp_sockets_allocated;
@@ -448,6 +447,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb);
 struct sock *tcp_create_openreq_child(struct sock *sk,
                                       struct request_sock *req,
                                       struct sk_buff *skb);
+void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst);
 struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                                   struct request_sock *req,
                                   struct dst_entry *dst);
@@ -636,6 +636,11 @@ static inline u32 tcp_rto_min_us(struct sock *sk)
         return jiffies_to_usecs(tcp_rto_min(sk));
 }
 
+static inline bool tcp_ca_dst_locked(const struct dst_entry *dst)
+{
+        return dst_metric_locked(dst, RTAX_CC_ALGO);
+}
+
 /* Compute the actual receive window we are currently advertising.
  * Rcv_nxt can be after the window if our peer push more data
  * than the offered window.
@@ -787,6 +792,8 @@ enum tcp_ca_ack_event_flags {
 #define TCP_CA_MAX      128
 #define TCP_CA_BUF_MAX  (TCP_CA_NAME_MAX*TCP_CA_MAX)
 
+#define TCP_CA_UNSPEC   0
+
 /* Algorithm can be set on socket without CAP_NET_ADMIN privileges */
 #define TCP_CONG_NON_RESTRICTED 0x1
 /* Requires ECN/ECT set on all packets */
@@ -794,7 +801,8 @@ enum tcp_ca_ack_event_flags {
 
 struct tcp_congestion_ops {
         struct list_head        list;
-        unsigned long flags;
+        u32 key;
+        u32 flags;
 
         /* initialize private data (optional) */
         void (*init)(struct sock *sk);
@@ -841,6 +849,17 @@ u32 tcp_reno_ssthresh(struct sock *sk);
 void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 acked);
 extern struct tcp_congestion_ops tcp_reno;
 
+struct tcp_congestion_ops *tcp_ca_find_key(u32 key);
+u32 tcp_ca_get_key_by_name(const char *name);
+#ifdef CONFIG_INET
+char *tcp_ca_get_name_by_key(u32 key, char *buffer);
+#else
+static inline char *tcp_ca_get_name_by_key(u32 key, char *buffer)
+{
+        return NULL;
+}
+#endif
+
 static inline bool tcp_ca_needs_ecn(const struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -1124,6 +1143,7 @@ static inline void tcp_openreq_init(struct request_sock *req,
         tcp_rsk(req)->rcv_isn = TCP_SKB_CB(skb)->seq;
         tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
         tcp_rsk(req)->snt_synack = tcp_time_stamp;
+        tcp_rsk(req)->last_oow_ack_time = 0;
         req->mss = rx_opt->mss_clamp;
         req->ts_recent = rx_opt->saw_tstamp ? rx_opt->rcv_tsval : 0;
         ireq->tstamp_ok = rx_opt->tstamp_ok;
@@ -1216,6 +1236,37 @@ static inline bool tcp_paws_reject(const struct tcp_options_received *rx_opt,
         return true;
 }
 
+/* Return true if we're currently rate-limiting out-of-window ACKs and
+ * thus shouldn't send a dupack right now. We rate-limit dupacks in
+ * response to out-of-window SYNs or ACKs to mitigate ACK loops or DoS
+ * attacks that send repeated SYNs or ACKs for the same connection. To
+ * do this, we do not send a duplicate SYNACK or ACK if the remote
+ * endpoint is sending out-of-window SYNs or pure ACKs at a high rate.
+ */
+static inline bool tcp_oow_rate_limited(struct net *net,
+                                        const struct sk_buff *skb,
+                                        int mib_idx, u32 *last_oow_ack_time)
+{
+        /* Data packets without SYNs are not likely part of an ACK loop. */
+        if ((TCP_SKB_CB(skb)->seq != TCP_SKB_CB(skb)->end_seq) &&
+            !tcp_hdr(skb)->syn)
+                goto not_rate_limited;
+
+        if (*last_oow_ack_time) {
+                s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time);
+
+                if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
+                        NET_INC_STATS_BH(net, mib_idx);
+                        return true;    /* rate-limited: don't send yet! */
+                }
+        }
+
+        *last_oow_ack_time = tcp_time_stamp;
+
+not_rate_limited:
+        return false;   /* not rate-limited: go ahead, send dupack now! */
+}
+
 static inline void tcp_mib_init(struct net *net)
 {
         /* See RFC 2012 */
@@ -1693,4 +1744,19 @@ static inline struct ip_options_rcu *tcp_v4_save_options(struct sk_buff *skb)
         return dopt;
 }
 
+/* locally generated TCP pure ACKs have skb->truesize == 2
+ * (check tcp_send_ack() in net/ipv4/tcp_output.c )
+ * This is much faster than dissecting the packet to find out.
+ * (Think of GRE encapsulations, IPv4, IPv6, ...)
+ */
+static inline bool skb_is_tcp_pure_ack(const struct sk_buff *skb)
+{
+        return skb->truesize == 2;
+}
+
+static inline void skb_set_tcp_pure_ack(struct sk_buff *skb)
+{
+        skb->truesize = 2;
+}
+
 #endif  /* _TCP_H */
diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h
index 2a50a70ef587..1a20d33d56bc 100644
--- a/include/net/udp_tunnel.h
+++ b/include/net/udp_tunnel.h
@@ -77,17 +77,17 @@ void setup_udp_tunnel_sock(struct net *net, struct socket *sock,
                            struct udp_tunnel_sock_cfg *sock_cfg);
 
 /* Transmit the skb using UDP encapsulation. */
-int udp_tunnel_xmit_skb(struct socket *sock, struct rtable *rt,
-                        struct sk_buff *skb, __be32 src, __be32 dst,
-                        __u8 tos, __u8 ttl, __be16 df, __be16 src_port,
-                        __be16 dst_port, bool xnet);
+int udp_tunnel_xmit_skb(struct rtable *rt, struct sk_buff *skb,
+                        __be32 src, __be32 dst, __u8 tos, __u8 ttl,
+                        __be16 df, __be16 src_port, __be16 dst_port,
+                        bool xnet, bool nocheck);
 
 #if IS_ENABLED(CONFIG_IPV6)
-int udp_tunnel6_xmit_skb(struct socket *sock, struct dst_entry *dst,
-                         struct sk_buff *skb, struct net_device *dev,
-                         struct in6_addr *saddr, struct in6_addr *daddr,
+int udp_tunnel6_xmit_skb(struct dst_entry *dst, struct sk_buff *skb,
+                         struct net_device *dev, struct in6_addr *saddr,
+                         struct in6_addr *daddr,
                          __u8 prio, __u8 ttl, __be16 src_port,
-                         __be16 dst_port);
+                         __be16 dst_port, bool nocheck);
 #endif
 
 void udp_tunnel_sock_release(struct socket *sock);
diff --git a/include/net/udplite.h b/include/net/udplite.h
index ae7c8d1fbcad..80761938b9a7 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -20,8 +20,7 @@ static __inline__ int udplite_getfrag(void *from, char *to, int  offset,
                                       int len, int odd, struct sk_buff *skb)
 {
         struct msghdr *msg = from;
-        /* XXX: stripping const */
-        return memcpy_fromiovecend(to, (struct iovec *)msg->msg_iter.iov, offset, len);
+        return copy_from_iter(to, len, &msg->msg_iter) != len ? -EFAULT : 0;
 }
 
 /* Designate sk as UDP-Lite socket */
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 903461aa5644..2927d6244481 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -11,14 +11,96 @@
 #define VNI_HASH_BITS   10
 #define VNI_HASH_SIZE   (1<<VNI_HASH_BITS)
 
-/* VXLAN protocol header */
+/*
+ * VXLAN Group Based Policy Extension:
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |1|-|-|-|1|-|-|-|R|D|R|R|A|R|R|R|        Group Policy ID        |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                VXLAN Network Identifier (VNI) |   Reserved    |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ * D = Don't Learn bit. When set, this bit indicates that the egress
+ *     VTEP MUST NOT learn the source address of the encapsulated frame.
+ *
+ * A = Indicates that the group policy has already been applied to
+ *     this packet. Policies MUST NOT be applied by devices when the
+ *     A bit is set.
+ *
+ * [0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy
+ */
+struct vxlanhdr_gbp {
+        __u8    vx_flags;
+#ifdef __LITTLE_ENDIAN_BITFIELD
+        __u8    reserved_flags1:3,
+                policy_applied:1,
+                reserved_flags2:2,
+                dont_learn:1,
+                reserved_flags3:1;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+        __u8    reserved_flags1:1,
+                dont_learn:1,
+                reserved_flags2:2,
+                policy_applied:1,
+                reserved_flags3:3;
+#else
+#error  "Please fix <asm/byteorder.h>"
+#endif
+        __be16  policy_id;
+        __be32  vx_vni;
+};
+
+#define VXLAN_GBP_USED_BITS (VXLAN_HF_GBP | 0xFFFFFF)
+
+/* skb->mark mapping
+ *
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |R|R|R|R|R|R|R|R|R|D|R|R|A|R|R|R|        Group Policy ID        |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+#define VXLAN_GBP_DONT_LEARN            (BIT(6) << 16)
+#define VXLAN_GBP_POLICY_APPLIED        (BIT(3) << 16)
+#define VXLAN_GBP_ID_MASK               (0xFFFF)
+
+/* VXLAN protocol header:
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |G|R|R|R|I|R|R|C|               Reserved                        |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                VXLAN Network Identifier (VNI) |   Reserved    |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ * G = 1        Group Policy (VXLAN-GBP)
+ * I = 1        VXLAN Network Identifier (VNI) present
+ * C = 1        Remote checksum offload (RCO)
+ */
 struct vxlanhdr {
         __be32 vx_flags;
         __be32 vx_vni;
 };
 
+/* VXLAN header flags. */
+#define VXLAN_HF_RCO BIT(24)
+#define VXLAN_HF_VNI BIT(27)
+#define VXLAN_HF_GBP BIT(31)
+
+/* Remote checksum offload header option */
+#define VXLAN_RCO_MASK  0x7f    /* Last byte of vni field */
+#define VXLAN_RCO_UDP   0x80    /* Indicate UDP RCO (TCP when not set *) */
+#define VXLAN_RCO_SHIFT 1       /* Left shift of start */
+#define VXLAN_RCO_SHIFT_MASK ((1 << VXLAN_RCO_SHIFT) - 1)
+#define VXLAN_MAX_REMCSUM_START (VXLAN_RCO_MASK << VXLAN_RCO_SHIFT)
+
+#define VXLAN_N_VID     (1u << 24)
+#define VXLAN_VID_MASK  (VXLAN_N_VID - 1)
+#define VXLAN_HLEN (sizeof(struct udphdr) + sizeof(struct vxlanhdr))
+
+struct vxlan_metadata {
+        __be32          vni;
+        u32             gbp;
+};
+
 struct vxlan_sock;
-typedef void (vxlan_rcv_t)(struct vxlan_sock *vh, struct sk_buff *skb, __be32 key);
+typedef void (vxlan_rcv_t)(struct vxlan_sock *vh, struct sk_buff *skb,
+                           struct vxlan_metadata *md);
 
 /* per UDP socket information */
 struct vxlan_sock {
@@ -31,6 +113,7 @@ struct vxlan_sock {
         struct hlist_head vni_list[VNI_HASH_SIZE];
         atomic_t          refcnt;
         struct udp_offload udp_offloads;
+        u32               flags;
 };
 
 #define VXLAN_F_LEARN                   0x01
@@ -42,6 +125,16 @@ struct vxlan_sock {
 #define VXLAN_F_UDP_CSUM                0x40
 #define VXLAN_F_UDP_ZERO_CSUM6_TX       0x80
 #define VXLAN_F_UDP_ZERO_CSUM6_RX       0x100
+#define VXLAN_F_REMCSUM_TX              0x200
+#define VXLAN_F_REMCSUM_RX              0x400
+#define VXLAN_F_GBP                     0x800
+
+/* Flags that are used in the receive patch. These flags must match in
+ * order for a socket to be shareable
+ */
+#define VXLAN_F_RCV_FLAGS               (VXLAN_F_GBP |                  \
+                                         VXLAN_F_UDP_ZERO_CSUM6_RX |    \
+                                         VXLAN_F_REMCSUM_RX)
 
 struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
                                   vxlan_rcv_t *rcv, void *data,
@@ -49,10 +142,10 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
 
 void vxlan_sock_release(struct vxlan_sock *vs);
 
-int vxlan_xmit_skb(struct vxlan_sock *vs,
-                   struct rtable *rt, struct sk_buff *skb,
+int vxlan_xmit_skb(struct rtable *rt, struct sk_buff *skb,
                    __be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
-                   __be16 src_port, __be16 dst_port, __be32 vni, bool xnet);
+                   __be16 src_port, __be16 dst_port, struct vxlan_metadata *md,
+                   bool xnet, u32 vxflags);
 
 static inline netdev_features_t vxlan_features_check(struct sk_buff *skb,
                                                      netdev_features_t features)
diff --git a/include/trace/events/net.h b/include/trace/events/net.h
index 1de256b35807..49cc7c3de252 100644
--- a/include/trace/events/net.h
+++ b/include/trace/events/net.h
@@ -40,9 +40,9 @@ TRACE_EVENT(net_dev_start_xmit,
                 __assign_str(name, dev->name);
                 __entry->queue_mapping = skb->queue_mapping;
                 __entry->skbaddr = skb;
-                __entry->vlan_tagged = vlan_tx_tag_present(skb);
+                __entry->vlan_tagged = skb_vlan_tag_present(skb);
                 __entry->vlan_proto = ntohs(skb->vlan_proto);
-                __entry->vlan_tci = vlan_tx_tag_get(skb);
+                __entry->vlan_tci = skb_vlan_tag_get(skb);
                 __entry->protocol = ntohs(skb->protocol);
                 __entry->ip_summed = skb->ip_summed;
                 __entry->len = skb->len;
@@ -174,9 +174,9 @@ DECLARE_EVENT_CLASS(net_dev_rx_verbose_template,
 #endif
                 __entry->queue_mapping = skb->queue_mapping;
                 __entry->skbaddr = skb;
-                __entry->vlan_tagged = vlan_tx_tag_present(skb);
+                __entry->vlan_tagged = skb_vlan_tag_present(skb);
                 __entry->vlan_proto = ntohs(skb->vlan_proto);
-                __entry->vlan_tci = vlan_tx_tag_get(skb);
+                __entry->vlan_tci = skb_vlan_tag_get(skb);
                 __entry->protocol = ntohs(skb->protocol);
                 __entry->ip_summed = skb->ip_summed;
                 __entry->hash = skb->hash;
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 00b100023c47..14b7b6e44c77 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -283,6 +283,7 @@ header-y += net.h
 header-y += netlink_diag.h
 header-y += netlink.h
 header-y += netrom.h
+header-y += net_namespace.h
 header-y += net_tstamp.h
 header-y += nfc.h
 header-y += nfs2.h
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 5f66d9c2889d..2e49fc880d29 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -139,6 +139,7 @@ static inline __u32 ethtool_cmd_speed(const struct ethtool_cmd *ep)
 
 #define ETHTOOL_FWVERS_LEN      32
 #define ETHTOOL_BUSINFO_LEN     32
+#define ETHTOOL_EROMVERS_LEN    32
 
 /**
  * struct ethtool_drvinfo - general driver and device information
@@ -148,6 +149,7 @@ static inline __u32 ethtool_cmd_speed(const struct ethtool_cmd *ep)
  *      not be an empty string.
  * @version: Driver version string; may be an empty string
  * @fw_version: Firmware version string; may be an empty string
+ * @erom_version: Expansion ROM version string; may be an empty string
  * @bus_info: Device bus address.  This should match the dev_name()
  *      string for the underlying bus device, if there is one.  May be
  *      an empty string.
@@ -176,7 +178,7 @@ struct ethtool_drvinfo {
         char    version[32];
         char    fw_version[ETHTOOL_FWVERS_LEN];
         char    bus_info[ETHTOOL_BUSINFO_LEN];
-        char    reserved1[32];
+        char    erom_version[ETHTOOL_EROMVERS_LEN];
         char    reserved2[12];
         __u32   n_priv_flags;
         __u32   n_stats;
diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
index b03ee8f62d3c..eaaea6208b42 100644
--- a/include/uapi/linux/if_bridge.h
+++ b/include/uapi/linux/if_bridge.h
@@ -125,6 +125,8 @@ enum {
 #define BRIDGE_VLAN_INFO_MASTER (1<<0)  /* Operate on Bridge device as well */
 #define BRIDGE_VLAN_INFO_PVID   (1<<1)  /* VLAN is PVID, ingress untagged */
 #define BRIDGE_VLAN_INFO_UNTAGGED       (1<<2)  /* VLAN egresses untagged */
+#define BRIDGE_VLAN_INFO_RANGE_BEGIN    (1<<3) /* VLAN is start of vlan range */
+#define BRIDGE_VLAN_INFO_RANGE_END      (1<<4) /* VLAN is end of vlan range */
 
 struct bridge_vlan_info {
         __u16 flags;
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index f7d0d2d7173a..0deee3eeddbf 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -146,6 +146,7 @@ enum {
         IFLA_PHYS_PORT_ID,
         IFLA_CARRIER_CHANGES,
         IFLA_PHYS_SWITCH_ID,
+        IFLA_LINK_NETNSID,
         __IFLA_MAX
 };
 
@@ -370,6 +371,9 @@ enum {
         IFLA_VXLAN_UDP_CSUM,
         IFLA_VXLAN_UDP_ZERO_CSUM6_TX,
         IFLA_VXLAN_UDP_ZERO_CSUM6_RX,
+        IFLA_VXLAN_REMCSUM_TX,
+        IFLA_VXLAN_REMCSUM_RX,
+        IFLA_VXLAN_GBP,
         __IFLA_VXLAN_MAX
 };
 #define IFLA_VXLAN_MAX  (__IFLA_VXLAN_MAX - 1)
diff --git a/include/uapi/linux/in.h b/include/uapi/linux/in.h
index c33a65e3d62c..589ced069e8a 100644
--- a/include/uapi/linux/in.h
+++ b/include/uapi/linux/in.h
@@ -109,6 +109,7 @@ struct in_addr {
 
 #define IP_MINTTL       21
 #define IP_NODEFRAG     22
+#define IP_CHECKSUM     23
 
 /* IP_MTU_DISCOVER values */
 #define IP_PMTUDISC_DONT                0       /* Never send DF frames */
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index e863d088b9a5..437a6a4b125a 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -1,6 +1,7 @@
 #ifndef _UAPI_IPV6_H
 #define _UAPI_IPV6_H
 
+#include <linux/libc-compat.h>
 #include <linux/types.h>
 #include <linux/in6.h>
 #include <asm/byteorder.h>
@@ -15,16 +16,19 @@
  *      *under construction*
  */
 
-
+#if __UAPI_DEF_IN6_PKTINFO
 struct in6_pktinfo {
         struct in6_addr ipi6_addr;
         int             ipi6_ifindex;
 };
+#endif
 
+#if __UAPI_DEF_IP6_MTUINFO
 struct ip6_mtuinfo {
         struct sockaddr_in6     ip6m_addr;
         __u32                   ip6m_mtu;
 };
+#endif
 
 struct in6_ifreq {
         struct in6_addr ifr6_addr;
@@ -165,6 +169,7 @@ enum {
         DEVCONF_SUPPRESS_FRAG_NDISC,
         DEVCONF_ACCEPT_RA_FROM_LOCAL,
         DEVCONF_USE_OPTIMISTIC,
+        DEVCONF_ACCEPT_RA_MTU,
         DEVCONF_MAX
 };
 
diff --git a/include/uapi/linux/l2tp.h b/include/uapi/linux/l2tp.h
index 21caa2631c20..347ef22a964e 100644
--- a/include/uapi/linux/l2tp.h
+++ b/include/uapi/linux/l2tp.h
@@ -178,5 +178,6 @@ enum l2tp_seqmode {
  */
 #define L2TP_GENL_NAME          "l2tp"
 #define L2TP_GENL_VERSION       0x1
+#define L2TP_GENL_MCGROUP       "l2tp"
 
 #endif /* _UAPI_LINUX_L2TP_H_ */
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index e28807ad17fa..fa673e9cc040 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -70,6 +70,8 @@
 #define __UAPI_DEF_IPV6_MREQ            0
 #define __UAPI_DEF_IPPROTO_V6           0
 #define __UAPI_DEF_IPV6_OPTIONS         0
+#define __UAPI_DEF_IN6_PKTINFO          0
+#define __UAPI_DEF_IP6_MTUINFO          0
 
 #else
 
@@ -84,6 +86,8 @@
 #define __UAPI_DEF_IPV6_MREQ            1
 #define __UAPI_DEF_IPPROTO_V6           1
 #define __UAPI_DEF_IPV6_OPTIONS         1
+#define __UAPI_DEF_IN6_PKTINFO          1
+#define __UAPI_DEF_IP6_MTUINFO          1
 
 #endif /* _NETINET_IN_H */
 
@@ -106,6 +110,8 @@
 #define __UAPI_DEF_IPV6_MREQ            1
 #define __UAPI_DEF_IPPROTO_V6           1
 #define __UAPI_DEF_IPV6_OPTIONS         1
+#define __UAPI_DEF_IN6_PKTINFO          1
+#define __UAPI_DEF_IP6_MTUINFO          1
 
 /* Definitions for xattr.h */
 #define __UAPI_DEF_XATTR                1
diff --git a/include/uapi/linux/neighbour.h b/include/uapi/linux/neighbour.h
index f3d77f9f1e0b..3873a35509aa 100644
--- a/include/uapi/linux/neighbour.h
+++ b/include/uapi/linux/neighbour.h
@@ -25,6 +25,7 @@ enum {
         NDA_VNI,
         NDA_IFINDEX,
         NDA_MASTER,
+        NDA_LINK_NETNSID,
         __NDA_MAX
 };
 
diff --git a/include/uapi/linux/net_namespace.h b/include/uapi/linux/net_namespace.h
new file mode 100644
index 000000000000..778cd2c3ebf4
--- /dev/null
+++ b/include/uapi/linux/net_namespace.h
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015 6WIND S.A.
+ * Author: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ */
+#ifndef _UAPI_LINUX_NET_NAMESPACE_H_
+#define _UAPI_LINUX_NET_NAMESPACE_H_
+
+/* Attributes of RTM_NEWNSID/RTM_GETNSID messages */
+enum {
+        NETNSA_NONE,
+#define NETNSA_NSID_NOT_ASSIGNED -1
+        NETNSA_NSID,
+        NETNSA_PID,
+        NETNSA_FD,
+        __NETNSA_MAX,
+};
+
+#define NETNSA_MAX              (__NETNSA_MAX - 1)
+
+#endif /* _UAPI_LINUX_NET_NAMESPACE_H_ */
diff --git a/include/uapi/linux/net_tstamp.h b/include/uapi/linux/net_tstamp.h
index edbc888ceb51..6d1abea9746e 100644
--- a/include/uapi/linux/net_tstamp.h
+++ b/include/uapi/linux/net_tstamp.h
@@ -24,8 +24,9 @@ enum {
         SOF_TIMESTAMPING_TX_SCHED = (1<<8),
         SOF_TIMESTAMPING_TX_ACK = (1<<9),
         SOF_TIMESTAMPING_OPT_CMSG = (1<<10),
+        SOF_TIMESTAMPING_OPT_TSONLY = (1<<11),
 
-        SOF_TIMESTAMPING_LAST = SOF_TIMESTAMPING_OPT_CMSG,
+        SOF_TIMESTAMPING_LAST = SOF_TIMESTAMPING_OPT_TSONLY,
         SOF_TIMESTAMPING_MASK = (SOF_TIMESTAMPING_LAST - 1) |
                                  SOF_TIMESTAMPING_LAST
 };
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 8119255feae4..c1e2e63cf9b5 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -183,6 +183,7 @@ enum nfc_attrs {
         NFC_ATTR_SE_APDU,
         NFC_ATTR_TARGET_ISO15693_DSFID,
         NFC_ATTR_TARGET_ISO15693_UID,
+        NFC_ATTR_SE_PARAMS,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index b37bd5a1cb82..68b294e83944 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -29,6 +29,13 @@
 
 #define NL80211_GENL_NAME "nl80211"
 
+#define NL80211_MULTICAST_GROUP_CONFIG          "config"
+#define NL80211_MULTICAST_GROUP_SCAN            "scan"
+#define NL80211_MULTICAST_GROUP_REG             "regulatory"
+#define NL80211_MULTICAST_GROUP_MLME            "mlme"
+#define NL80211_MULTICAST_GROUP_VENDOR          "vendor"
+#define NL80211_MULTICAST_GROUP_TESTMODE        "testmode"
+
 /**
  * DOC: Station handling
  *
@@ -173,8 +180,8 @@
  *      %NL80211_ATTR_WIPHY and %NL80211_ATTR_WIPHY_NAME.
  *
  * @NL80211_CMD_GET_INTERFACE: Request an interface's configuration;
- *      either a dump request on a %NL80211_ATTR_WIPHY or a specific get
- *      on an %NL80211_ATTR_IFINDEX is supported.
+ *      either a dump request for all interfaces or a specific get with a
+ *      single %NL80211_ATTR_IFINDEX is supported.
  * @NL80211_CMD_SET_INTERFACE: Set type of a virtual interface, requires
  *      %NL80211_ATTR_IFINDEX and %NL80211_ATTR_IFTYPE.
  * @NL80211_CMD_NEW_INTERFACE: Newly created virtual interface or response
@@ -252,7 +259,18 @@
  *      %NL80211_ATTR_IFINDEX.
  *
  * @NL80211_CMD_GET_REG: ask the wireless core to send us its currently set
- *      regulatory domain.
+ *      regulatory domain. If %NL80211_ATTR_WIPHY is specified and the device
+ *      has a private regulatory domain, it will be returned. Otherwise, the
+ *      global regdomain will be returned.
+ *      A device will have a private regulatory domain if it uses the
+ *      regulatory_hint() API. Even when a private regdomain is used the channel
+ *      information will still be mended according to further hints from
+ *      the regulatory core to help with compliance. A dump version of this API
+ *      is now available which will returns the global regdomain as well as
+ *      all private regdomains of present wiphys (for those that have it).
+ *      If a wiphy is self-managed (%NL80211_ATTR_WIPHY_SELF_MANAGED_REG), then
+ *      its private regdomain is the only valid one for it. The regulatory
+ *      core is not used to help with compliance in this case.
  * @NL80211_CMD_SET_REG: Set current regulatory domain. CRDA sends this command
  *      after being queried by the kernel. CRDA replies by sending a regulatory
  *      domain structure which consists of %NL80211_ATTR_REG_ALPHA set to our
@@ -306,7 +324,9 @@
  *      if passed, define which channels should be scanned; if not
  *      passed, all channels allowed for the current regulatory domain
  *      are used.  Extra IEs can also be passed from the userspace by
- *      using the %NL80211_ATTR_IE attribute.
+ *      using the %NL80211_ATTR_IE attribute.  The first cycle of the
+ *      scheduled scan can be delayed by %NL80211_ATTR_SCHED_SCAN_DELAY
+ *      is supplied.
  * @NL80211_CMD_STOP_SCHED_SCAN: stop a scheduled scan. Returns -ENOENT if
  *      scheduled scan is not running. The caller may assume that as soon
  *      as the call returns, it is safe to start a new scheduled scan again.
@@ -774,6 +794,10 @@
  *      peer given by %NL80211_ATTR_MAC. Both peers must be on the base channel
  *      when this command completes.
  *
+ * @NL80211_CMD_WIPHY_REG_CHANGE: Similar to %NL80211_CMD_REG_CHANGE, but used
+ *      as an event to indicate changes for devices with wiphy-specific regdom
+ *      management.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -958,6 +982,8 @@ enum nl80211_commands {
         NL80211_CMD_TDLS_CHANNEL_SWITCH,
         NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
 
+        NL80211_CMD_WIPHY_REG_CHANGE,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -1655,6 +1681,9 @@ enum nl80211_commands {
  * @NL80211_ATTR_SOCKET_OWNER: Flag attribute, if set during interface
  *      creation then the new interface will be owned by the netlink socket
  *      that created it and will be destroyed when the socket is closed.
+ *      If set during scheduled scan start then the new scan req will be
+ *      owned by the netlink socket that created it and the scheduled scan will
+ *      be stopped when the socket is closed.
  *
  * @NL80211_ATTR_TDLS_INITIATOR: flag attribute indicating the current end is
  *      the TDLS link initiator.
@@ -1688,6 +1717,29 @@ enum nl80211_commands {
  *
  * @NL80211_ATTR_MAC_MASK: MAC address mask
  *
+ * @NL80211_ATTR_WIPHY_SELF_MANAGED_REG: flag attribute indicating this device
+ *      is self-managing its regulatory information and any regulatory domain
+ *      obtained from it is coming from the device's wiphy and not the global
+ *      cfg80211 regdomain.
+ *
+ * @NL80211_ATTR_EXT_FEATURES: extended feature flags contained in a byte
+ *      array. The feature flags are identified by their bit index (see &enum
+ *      nl80211_ext_feature_index). The bit index is ordered starting at the
+ *      least-significant bit of the first byte in the array, ie. bit index 0
+ *      is located at bit 0 of byte 0. bit index 25 would be located at bit 1
+ *      of byte 3 (u8 array).
+ *
+ * @NL80211_ATTR_SURVEY_RADIO_STATS: Request overall radio statistics to be
+ *      returned along with other survey data. If set, @NL80211_CMD_GET_SURVEY
+ *      may return a survey entry without a channel indicating global radio
+ *      statistics (only some values are valid and make sense.)
+ *      For devices that don't return such an entry even then, the information
+ *      should be contained in the result as the sum of the respective counters
+ *      over all channels.
+ *
+ * @NL80211_ATTR_SCHED_SCAN_DELAY: delay before a scheduled scan (or a
+ *      WoWLAN net-detect scan) is started, u32 in seconds.
+ *
  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
@@ -2045,6 +2097,16 @@ enum nl80211_attrs {
 
         NL80211_ATTR_MAC_MASK,
 
+        NL80211_ATTR_WIPHY_SELF_MANAGED_REG,
+
+        NL80211_ATTR_EXT_FEATURES,
+
+        NL80211_ATTR_SURVEY_RADIO_STATS,
+
+        NL80211_ATTR_NETNS_FD,
+
+        NL80211_ATTR_SCHED_SCAN_DELAY,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -2085,7 +2147,7 @@ enum nl80211_attrs {
 
 #define NL80211_MAX_SUPP_RATES                  32
 #define NL80211_MAX_SUPP_HT_RATES               77
-#define NL80211_MAX_SUPP_REG_RULES              32
+#define NL80211_MAX_SUPP_REG_RULES              64
 #define NL80211_TKIP_DATA_OFFSET_ENCR_KEY       0
 #define NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY     16
 #define NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY     24
@@ -2225,8 +2287,15 @@ struct nl80211_sta_flag_update {
  * @NL80211_RATE_INFO_VHT_MCS: MCS index for VHT (u8)
  * @NL80211_RATE_INFO_VHT_NSS: number of streams in VHT (u8)
  * @NL80211_RATE_INFO_80_MHZ_WIDTH: 80 MHz VHT rate
- * @NL80211_RATE_INFO_80P80_MHZ_WIDTH: 80+80 MHz VHT rate
+ * @NL80211_RATE_INFO_80P80_MHZ_WIDTH: unused - 80+80 is treated the
+ *      same as 160 for purposes of the bitrates
  * @NL80211_RATE_INFO_160_MHZ_WIDTH: 160 MHz VHT rate
+ * @NL80211_RATE_INFO_10_MHZ_WIDTH: 10 MHz width - note that this is
+ *      a legacy rate and will be reported as the actual bitrate, i.e.
+ *      half the base (20 MHz) rate
+ * @NL80211_RATE_INFO_5_MHZ_WIDTH: 5 MHz width - note that this is
+ *      a legacy rate and will be reported as the actual bitrate, i.e.
+ *      a quarter of the base (20 MHz) rate
  * @__NL80211_RATE_INFO_AFTER_LAST: internal use
  */
 enum nl80211_rate_info {
@@ -2241,6 +2310,8 @@ enum nl80211_rate_info {
         NL80211_RATE_INFO_80_MHZ_WIDTH,
         NL80211_RATE_INFO_80P80_MHZ_WIDTH,
         NL80211_RATE_INFO_160_MHZ_WIDTH,
+        NL80211_RATE_INFO_10_MHZ_WIDTH,
+        NL80211_RATE_INFO_5_MHZ_WIDTH,
 
         /* keep last */
         __NL80211_RATE_INFO_AFTER_LAST,
@@ -2285,18 +2356,24 @@ enum nl80211_sta_bss_param {
  *
  * @__NL80211_STA_INFO_INVALID: attribute number 0 is reserved
  * @NL80211_STA_INFO_INACTIVE_TIME: time since last activity (u32, msecs)
- * @NL80211_STA_INFO_RX_BYTES: total received bytes (u32, from this station)
- * @NL80211_STA_INFO_TX_BYTES: total transmitted bytes (u32, to this station)
- * @NL80211_STA_INFO_RX_BYTES64: total received bytes (u64, from this station)
- * @NL80211_STA_INFO_TX_BYTES64: total transmitted bytes (u64, to this station)
+ * @NL80211_STA_INFO_RX_BYTES: total received bytes (MPDU length)
+ *      (u32, from this station)
+ * @NL80211_STA_INFO_TX_BYTES: total transmitted bytes (MPDU length)
+ *      (u32, to this station)
+ * @NL80211_STA_INFO_RX_BYTES64: total received bytes (MPDU length)
+ *      (u64, from this station)
+ * @NL80211_STA_INFO_TX_BYTES64: total transmitted bytes (MPDU length)
+ *      (u64, to this station)
  * @NL80211_STA_INFO_SIGNAL: signal strength of last received PPDU (u8, dBm)
  * @NL80211_STA_INFO_TX_BITRATE: current unicast tx rate, nested attribute
  *      containing info as possible, see &enum nl80211_rate_info
- * @NL80211_STA_INFO_RX_PACKETS: total received packet (u32, from this station)
- * @NL80211_STA_INFO_TX_PACKETS: total transmitted packets (u32, to this
- *      station)
- * @NL80211_STA_INFO_TX_RETRIES: total retries (u32, to this station)
- * @NL80211_STA_INFO_TX_FAILED: total failed packets (u32, to this station)
+ * @NL80211_STA_INFO_RX_PACKETS: total received packet (MSDUs and MMPDUs)
+ *      (u32, from this station)
+ * @NL80211_STA_INFO_TX_PACKETS: total transmitted packets (MSDUs and MMPDUs)
+ *      (u32, to this station)
+ * @NL80211_STA_INFO_TX_RETRIES: total retries (MPDUs) (u32, to this station)
+ * @NL80211_STA_INFO_TX_FAILED: total failed packets (MPDUs)
+ *      (u32, to this station)
  * @NL80211_STA_INFO_SIGNAL_AVG: signal strength average (u8, dBm)
  * @NL80211_STA_INFO_LLID: the station's mesh LLID
  * @NL80211_STA_INFO_PLID: the station's mesh PLID
@@ -2320,6 +2397,16 @@ enum nl80211_sta_bss_param {
  *      Same format as NL80211_STA_INFO_CHAIN_SIGNAL.
  * @NL80211_STA_EXPECTED_THROUGHPUT: expected throughput considering also the
  *      802.11 header (u32, kbps)
+ * @NL80211_STA_INFO_RX_DROP_MISC: RX packets dropped for unspecified reasons
+ *      (u64)
+ * @NL80211_STA_INFO_BEACON_RX: number of beacons received from this peer (u64)
+ * @NL80211_STA_INFO_BEACON_SIGNAL_AVG: signal strength average
+ *      for beacons only (u8, dBm)
+ * @NL80211_STA_INFO_TID_STATS: per-TID statistics (see &enum nl80211_tid_stats)
+ *      This is a nested attribute where each the inner attribute number is the
+ *      TID+1 and the special TID 16 (i.e. value 17) is used for non-QoS frames;
+ *      each one of those is again nested with &enum nl80211_tid_stats
+ *      attributes carrying the actual values.
  * @__NL80211_STA_INFO_AFTER_LAST: internal
  * @NL80211_STA_INFO_MAX: highest possible station info attribute
  */
@@ -2352,6 +2439,10 @@ enum nl80211_sta_info {
         NL80211_STA_INFO_CHAIN_SIGNAL,
         NL80211_STA_INFO_CHAIN_SIGNAL_AVG,
         NL80211_STA_INFO_EXPECTED_THROUGHPUT,
+        NL80211_STA_INFO_RX_DROP_MISC,
+        NL80211_STA_INFO_BEACON_RX,
+        NL80211_STA_INFO_BEACON_SIGNAL_AVG,
+        NL80211_STA_INFO_TID_STATS,
 
         /* keep last */
         __NL80211_STA_INFO_AFTER_LAST,
@@ -2359,6 +2450,31 @@ enum nl80211_sta_info {
 };
 
 /**
+ * enum nl80211_tid_stats - per TID statistics attributes
+ * @__NL80211_TID_STATS_INVALID: attribute number 0 is reserved
+ * @NL80211_TID_STATS_RX_MSDU: number of MSDUs received (u64)
+ * @NL80211_TID_STATS_TX_MSDU: number of MSDUs transmitted (or
+ *      attempted to transmit; u64)
+ * @NL80211_TID_STATS_TX_MSDU_RETRIES: number of retries for
+ *      transmitted MSDUs (not counting the first attempt; u64)
+ * @NL80211_TID_STATS_TX_MSDU_FAILED: number of failed transmitted
+ *      MSDUs (u64)
+ * @NUM_NL80211_TID_STATS: number of attributes here
+ * @NL80211_TID_STATS_MAX: highest numbered attribute here
+ */
+enum nl80211_tid_stats {
+        __NL80211_TID_STATS_INVALID,
+        NL80211_TID_STATS_RX_MSDU,
+        NL80211_TID_STATS_TX_MSDU,
+        NL80211_TID_STATS_TX_MSDU_RETRIES,
+        NL80211_TID_STATS_TX_MSDU_FAILED,
+
+        /* keep last */
+        NUM_NL80211_TID_STATS,
+        NL80211_TID_STATS_MAX = NUM_NL80211_TID_STATS - 1
+};
+
+/**
  * enum nl80211_mpath_flags - nl80211 mesh path flags
  *
  * @NL80211_MPATH_FLAG_ACTIVE: the mesh path is active
@@ -2772,16 +2888,18 @@ enum nl80211_user_reg_hint_type {
  * @NL80211_SURVEY_INFO_FREQUENCY: center frequency of channel
  * @NL80211_SURVEY_INFO_NOISE: noise level of channel (u8, dBm)
  * @NL80211_SURVEY_INFO_IN_USE: channel is currently being used
- * @NL80211_SURVEY_INFO_CHANNEL_TIME: amount of time (in ms) that the radio
- *      spent on this channel
- * @NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY: amount of the time the primary
+ * @NL80211_SURVEY_INFO_TIME: amount of time (in ms) that the radio
+ *      was turned on (on channel or globally)
+ * @NL80211_SURVEY_INFO_TIME_BUSY: amount of the time the primary
  *      channel was sensed busy (either due to activity or energy detect)
- * @NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY: amount of time the extension
+ * @NL80211_SURVEY_INFO_TIME_EXT_BUSY: amount of time the extension
  *      channel was sensed busy
- * @NL80211_SURVEY_INFO_CHANNEL_TIME_RX: amount of time the radio spent
- *      receiving data
- * @NL80211_SURVEY_INFO_CHANNEL_TIME_TX: amount of time the radio spent
- *      transmitting data
+ * @NL80211_SURVEY_INFO_TIME_RX: amount of time the radio spent
+ *      receiving data (on channel or globally)
+ * @NL80211_SURVEY_INFO_TIME_TX: amount of time the radio spent
+ *      transmitting data (on channel or globally)
+ * @NL80211_SURVEY_INFO_TIME_SCAN: time the radio spent for scan
+ *      (on this channel or globally)
  * @NL80211_SURVEY_INFO_MAX: highest survey info attribute number
  *      currently defined
  * @__NL80211_SURVEY_INFO_AFTER_LAST: internal use
@@ -2791,17 +2909,25 @@ enum nl80211_survey_info {
         NL80211_SURVEY_INFO_FREQUENCY,
         NL80211_SURVEY_INFO_NOISE,
         NL80211_SURVEY_INFO_IN_USE,
-        NL80211_SURVEY_INFO_CHANNEL_TIME,
-        NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
-        NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
-        NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
-        NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
+        NL80211_SURVEY_INFO_TIME,
+        NL80211_SURVEY_INFO_TIME_BUSY,
+        NL80211_SURVEY_INFO_TIME_EXT_BUSY,
+        NL80211_SURVEY_INFO_TIME_RX,
+        NL80211_SURVEY_INFO_TIME_TX,
+        NL80211_SURVEY_INFO_TIME_SCAN,
 
         /* keep last */
         __NL80211_SURVEY_INFO_AFTER_LAST,
         NL80211_SURVEY_INFO_MAX = __NL80211_SURVEY_INFO_AFTER_LAST - 1
 };
 
+/* keep old names for compatibility */
+#define NL80211_SURVEY_INFO_CHANNEL_TIME                NL80211_SURVEY_INFO_TIME
+#define NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY           NL80211_SURVEY_INFO_TIME_BUSY
+#define NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY       NL80211_SURVEY_INFO_TIME_EXT_BUSY
+#define NL80211_SURVEY_INFO_CHANNEL_TIME_RX             NL80211_SURVEY_INFO_TIME_RX
+#define NL80211_SURVEY_INFO_CHANNEL_TIME_TX             NL80211_SURVEY_INFO_TIME_TX
+
 /**
  * enum nl80211_mntr_flags - monitor configuration flags
  *
@@ -3238,6 +3364,9 @@ enum nl80211_bss {
 /**
  * enum nl80211_bss_status - BSS "status"
  * @NL80211_BSS_STATUS_AUTHENTICATED: Authenticated with this BSS.
+ *      Note that this is no longer used since cfg80211 no longer
+ *      keeps track of whether or not authentication was done with
+ *      a given BSS.
  * @NL80211_BSS_STATUS_ASSOCIATED: Associated with this BSS.
  * @NL80211_BSS_STATUS_IBSS_JOINED: Joined to this IBSS.
  *
@@ -3621,9 +3750,12 @@ struct nl80211_pattern_support {
  * @NL80211_WOWLAN_TRIG_NET_DETECT: wake up when a configured network
  *      is detected.  This is a nested attribute that contains the
  *      same attributes used with @NL80211_CMD_START_SCHED_SCAN.  It
- *      specifies how the scan is performed (e.g. the interval and the
- *      channels to scan) as well as the scan results that will
- *      trigger a wake (i.e. the matchsets).
+ *      specifies how the scan is performed (e.g. the interval, the
+ *      channels to scan and the initial delay) as well as the scan
+ *      results that will trigger a wake (i.e. the matchsets).  This
+ *      attribute is also sent in a response to
+ *      @NL80211_CMD_GET_WIPHY, indicating the number of match sets
+ *      supported by the driver (u32).
  * @NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS: nested attribute
  *      containing an array with information about what triggered the
  *      wake up.  If no elements are present in the array, it means
@@ -4194,6 +4326,19 @@ enum nl80211_feature_flags {
 };
 
 /**
+ * enum nl80211_ext_feature_index - bit index of extended features.
+ *
+ * @NUM_NL80211_EXT_FEATURES: number of extended features.
+ * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
+ */
+enum nl80211_ext_feature_index {
+
+        /* add new features before the definition below */
+        NUM_NL80211_EXT_FEATURES,
+        MAX_NL80211_EXT_FEATURES = NUM_NL80211_EXT_FEATURES - 1
+};
+
+/**
  * enum nl80211_probe_resp_offload_support_attr - optional supported
  *      protocols for probe-response offloading by the driver/FW.
  *      To be used with the %NL80211_ATTR_PROBE_RESP_OFFLOAD attribute.
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index f714e8633352..bbd49a0c46c7 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -252,11 +252,21 @@ enum ovs_vport_attr {
 
 #define OVS_VPORT_ATTR_MAX (__OVS_VPORT_ATTR_MAX - 1)
 
+enum {
+        OVS_VXLAN_EXT_UNSPEC,
+        OVS_VXLAN_EXT_GBP,      /* Flag or __u32 */
+        __OVS_VXLAN_EXT_MAX,
+};
+
+#define OVS_VXLAN_EXT_MAX (__OVS_VXLAN_EXT_MAX - 1)
+
+
 /* OVS_VPORT_ATTR_OPTIONS attributes for tunnels.
  */
 enum {
         OVS_TUNNEL_ATTR_UNSPEC,
         OVS_TUNNEL_ATTR_DST_PORT, /* 16-bit UDP port, used by L4 tunnels. */
+        OVS_TUNNEL_ATTR_EXTENSION,
         __OVS_TUNNEL_ATTR_MAX
 };
 
@@ -328,6 +338,7 @@ enum ovs_tunnel_key_attr {
         OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS,        /* Array of Geneve options. */
         OVS_TUNNEL_KEY_ATTR_TP_SRC,             /* be16 src Transport Port. */
         OVS_TUNNEL_KEY_ATTR_TP_DST,             /* be16 dst Transport Port. */
+        OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS,         /* Nested OVS_VXLAN_EXT_* */
         __OVS_TUNNEL_KEY_ATTR_MAX
 };
 
@@ -448,6 +459,14 @@ struct ovs_key_nd {
  * a wildcarded match. Omitting attribute is treated as wildcarding all
  * corresponding fields. Optional for all requests. If not present,
  * all flow key bits are exact match bits.
+ * @OVS_FLOW_ATTR_UFID: A value between 1-16 octets specifying a unique
+ * identifier for the flow. Causes the flow to be indexed by this value rather
+ * than the value of the %OVS_FLOW_ATTR_KEY attribute. Optional for all
+ * requests. Present in notifications if the flow was created with this
+ * attribute.
+ * @OVS_FLOW_ATTR_UFID_FLAGS: A 32-bit value of OR'd %OVS_UFID_F_*
+ * flags that provide alternative semantics for flow installation and
+ * retrieval. Optional for all requests.
  *
  * These attributes follow the &struct ovs_header within the Generic Netlink
  * payload for %OVS_FLOW_* commands.
@@ -463,12 +482,24 @@ enum ovs_flow_attr {
         OVS_FLOW_ATTR_MASK,      /* Sequence of OVS_KEY_ATTR_* attributes. */
         OVS_FLOW_ATTR_PROBE,     /* Flow operation is a feature probe, error
                                   * logging should be suppressed. */
+        OVS_FLOW_ATTR_UFID,      /* Variable length unique flow identifier. */
+        OVS_FLOW_ATTR_UFID_FLAGS,/* u32 of OVS_UFID_F_*. */
         __OVS_FLOW_ATTR_MAX
 };
 
 #define OVS_FLOW_ATTR_MAX (__OVS_FLOW_ATTR_MAX - 1)
 
 /**
+ * Omit attributes for notifications.
+ *
+ * If a datapath request contains an %OVS_UFID_F_OMIT_* flag, then the datapath
+ * may omit the corresponding %OVS_FLOW_ATTR_* from the response.
+ */
+#define OVS_UFID_F_OMIT_KEY      (1 << 0)
+#define OVS_UFID_F_OMIT_MASK     (1 << 1)
+#define OVS_UFID_F_OMIT_ACTIONS  (1 << 2)
+
+/**
  * enum ovs_sample_attr - Attributes for %OVS_ACTION_ATTR_SAMPLE action.
  * @OVS_SAMPLE_ATTR_PROBABILITY: 32-bit fraction of packets to sample with
  * @OVS_ACTION_ATTR_SAMPLE.  A value of 0 samples no packets, a value of
@@ -568,6 +599,12 @@ struct ovs_action_hash {
  * @OVS_ACTION_ATTR_SET: Replaces the contents of an existing header.  The
  * single nested %OVS_KEY_ATTR_* attribute specifies a header to modify and its
  * value.
+ * @OVS_ACTION_ATTR_SET_MASKED: Replaces the contents of an existing header.  A
+ * nested %OVS_KEY_ATTR_* attribute specifies a header to modify, its value,
+ * and a mask.  For every bit set in the mask, the corresponding bit value
+ * is copied from the value to the packet header field, rest of the bits are
+ * left unchanged.  The non-masked value bits must be passed in as zeroes.
+ * Masking is not supported for the %OVS_KEY_ATTR_TUNNEL attribute.
  * @OVS_ACTION_ATTR_PUSH_VLAN: Push a new outermost 802.1Q header onto the
  * packet.
  * @OVS_ACTION_ATTR_POP_VLAN: Pop the outermost 802.1Q header off the packet.
@@ -586,6 +623,9 @@ struct ovs_action_hash {
  * Only a single header can be set with a single %OVS_ACTION_ATTR_SET.  Not all
  * fields within a header are modifiable, e.g. the IPv4 protocol and fragment
  * type may not be changed.
+ *
+ * @OVS_ACTION_ATTR_SET_TO_MASKED: Kernel internal masked set action translated
+ * from the @OVS_ACTION_ATTR_SET.
  */
 
 enum ovs_action_attr {
@@ -600,8 +640,19 @@ enum ovs_action_attr {
         OVS_ACTION_ATTR_HASH,         /* struct ovs_action_hash. */
         OVS_ACTION_ATTR_PUSH_MPLS,    /* struct ovs_action_push_mpls. */
         OVS_ACTION_ATTR_POP_MPLS,     /* __be16 ethertype. */
+        OVS_ACTION_ATTR_SET_MASKED,   /* One nested OVS_KEY_ATTR_* including
+                                       * data immediately followed by a mask.
+                                       * The data must be zero for the unmasked
+                                       * bits. */
 
-        __OVS_ACTION_ATTR_MAX
+        __OVS_ACTION_ATTR_MAX,        /* Nothing past this will be accepted
+                                       * from userspace. */
+
+#ifdef __KERNEL__
+        OVS_ACTION_ATTR_SET_TO_MASKED, /* Kernel module internal masked
+                                        * set action converted from
+                                        * OVS_ACTION_ATTR_SET. */
+#endif
 };
 
 #define OVS_ACTION_ATTR_MAX (__OVS_ACTION_ATTR_MAX - 1)
diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h
index d62316baae94..534b84710745 100644
--- a/include/uapi/linux/pkt_sched.h
+++ b/include/uapi/linux/pkt_sched.h
@@ -774,6 +774,8 @@ enum {
 
         TCA_FQ_FLOW_REFILL_DELAY,       /* flow credit refill delay in usec */
 
+        TCA_FQ_ORPHAN_MASK,     /* mask applied to orphaned skb hashes */
+
         __TCA_FQ_MAX
 };
 
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index 9c9b8b4480cd..5cc5d66bf519 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -132,6 +132,11 @@ enum {
         RTM_GETMDB = 86,
 #define RTM_GETMDB RTM_GETMDB
 
+        RTM_NEWNSID = 88,
+#define RTM_NEWNSID RTM_NEWNSID
+        RTM_GETNSID = 90,
+#define RTM_GETNSID RTM_GETNSID
+
         __RTM_MAX,
 #define RTM_MAX         (((__RTM_MAX + 3) & ~3) - 1)
 };
@@ -389,6 +394,8 @@ enum {
 #define RTAX_INITRWND RTAX_INITRWND
         RTAX_QUICKACK,
 #define RTAX_QUICKACK RTAX_QUICKACK
+        RTAX_CC_ALGO,
+#define RTAX_CC_ALGO RTAX_CC_ALGO
         __RTAX_MAX
 };
 
@@ -634,6 +641,7 @@ struct tcamsg {
 /* New extended info filters for IFLA_EXT_MASK */
 #define RTEXT_FILTER_VF         (1 << 0)
 #define RTEXT_FILTER_BRVLAN     (1 << 1)
+#define RTEXT_FILTER_BRVLAN_COMPRESSED  (1 << 2)
 
 /* End of information exported to user level */
 
diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index b22224100011..6a6fb747c78d 100644
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -270,6 +270,12 @@ enum
         LINUX_MIB_TCPHYSTARTTRAINCWND,          /* TCPHystartTrainCwnd */
         LINUX_MIB_TCPHYSTARTDELAYDETECT,        /* TCPHystartDelayDetect */
         LINUX_MIB_TCPHYSTARTDELAYCWND,          /* TCPHystartDelayCwnd */
+        LINUX_MIB_TCPACKSKIPPEDSYNRECV,         /* TCPACKSkippedSynRecv */
+        LINUX_MIB_TCPACKSKIPPEDPAWS,            /* TCPACKSkippedPAWS */
+        LINUX_MIB_TCPACKSKIPPEDSEQ,             /* TCPACKSkippedSeq */
+        LINUX_MIB_TCPACKSKIPPEDFINWAIT2,        /* TCPACKSkippedFinWait2 */
+        LINUX_MIB_TCPACKSKIPPEDTIMEWAIT,        /* TCPACKSkippedTimeWait */
+        LINUX_MIB_TCPACKSKIPPEDCHALLENGE,       /* TCPACKSkippedChallenge */
         __LINUX_MIB_MAX
 };
 
diff --git a/include/uapi/linux/tc_act/Kbuild b/include/uapi/linux/tc_act/Kbuild
index b057da2b87a4..19d5219b0b99 100644
--- a/include/uapi/linux/tc_act/Kbuild
+++ b/include/uapi/linux/tc_act/Kbuild
@@ -8,3 +8,4 @@ header-y += tc_nat.h
 header-y += tc_pedit.h
 header-y += tc_skbedit.h
 header-y += tc_vlan.h
+header-y += tc_bpf.h
diff --git a/include/uapi/linux/tc_act/tc_bpf.h b/include/uapi/linux/tc_act/tc_bpf.h
new file mode 100644
index 000000000000..5288bd77e63b
--- /dev/null
+++ b/include/uapi/linux/tc_act/tc_bpf.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2015 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __LINUX_TC_BPF_H
+#define __LINUX_TC_BPF_H
+
+#include <linux/pkt_cls.h>
+
+#define TCA_ACT_BPF 13
+
+struct tc_act_bpf {
+        tc_gen;
+};
+
+enum {
+        TCA_ACT_BPF_UNSPEC,
+        TCA_ACT_BPF_TM,
+        TCA_ACT_BPF_PARMS,
+        TCA_ACT_BPF_OPS_LEN,
+        TCA_ACT_BPF_OPS,
+        __TCA_ACT_BPF_MAX,
+};
+#define TCA_ACT_BPF_MAX (__TCA_ACT_BPF_MAX - 1)
+
+#endif
diff --git a/include/uapi/linux/tc_act/tc_connmark.h b/include/uapi/linux/tc_act/tc_connmark.h
new file mode 100644
index 000000000000..994b0971bce2
--- /dev/null
+++ b/include/uapi/linux/tc_act/tc_connmark.h
@@ -0,0 +1,22 @@
+#ifndef __UAPI_TC_CONNMARK_H
+#define __UAPI_TC_CONNMARK_H
+
+#include <linux/types.h>
+#include <linux/pkt_cls.h>
+
+#define TCA_ACT_CONNMARK 14
+
+struct tc_connmark {
+        tc_gen;
+        __u16 zone;
+};
+
+enum {
+        TCA_CONNMARK_UNSPEC,
+        TCA_CONNMARK_PARMS,
+        TCA_CONNMARK_TM,
+        __TCA_CONNMARK_MAX
+};
+#define TCA_CONNMARK_MAX (__TCA_CONNMARK_MAX - 1)
+
+#endif
diff --git a/include/uapi/linux/tipc_config.h b/include/uapi/linux/tipc_config.h
index 876d0a14863c..087b0ef82c07 100644
--- a/include/uapi/linux/tipc_config.h
+++ b/include/uapi/linux/tipc_config.h
@@ -272,6 +272,26 @@ static inline int TLV_CHECK(const void *tlv, __u16 space, __u16 exp_type)
                 (ntohs(((struct tlv_desc *)tlv)->tlv_type) == exp_type);
 }
 
+static inline int TLV_GET_LEN(struct tlv_desc *tlv)
+{
+        return ntohs(tlv->tlv_len);
+}
+
+static inline void TLV_SET_LEN(struct tlv_desc *tlv, __u16 len)
+{
+        tlv->tlv_len = htons(len);
+}
+
+static inline int TLV_CHECK_TYPE(struct tlv_desc *tlv,  __u16 type)
+{
+        return (ntohs(tlv->tlv_type) == type);
+}
+
+static inline void TLV_SET_TYPE(struct tlv_desc *tlv, __u16 type)
+{
+        tlv->tlv_type = htons(type);
+}
+
 static inline int TLV_SET(void *tlv, __u16 type, void *data, __u16 len)
 {
         struct tlv_desc *tlv_ptr;
diff --git a/include/xen/page.h b/include/xen/page.h
index 12765b6f9517..c5ed20bb3fe9 100644
--- a/include/xen/page.h
+++ b/include/xen/page.h
@@ -3,6 +3,11 @@
 
 #include <asm/xen/page.h>
 
+static inline unsigned long page_to_mfn(struct page *page)
+{
+        return pfn_to_mfn(page_to_pfn(page));
+}
+
 struct xen_memory_region {
         phys_addr_t start;
         phys_addr_t size;