Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking changes from David S Miller:

 1) Remove the ipv4 routing cache.  Now lookups go directly into the FIB
    trie and use prebuilt routes cached there.

    No more garbage collection, no more rDOS attacks on the routing
    cache.  Instead we now get predictable and consistent performance,
    no matter what the pattern of traffic we service.

    This has been almost 2 years in the making.  Special thanks to
    Julian Anastasov, Eric Dumazet, Steffen Klassert, and others who
    have helped along the way.

    I'm sure that with a change of this magnitude there will be some
    kind of fallout, but such things ought the be simple to fix at this
    point.  Luckily I'm not European so I'll be around all of August to
    fix things :-)

    The major stages of this work here are each fronted by a forced
    merge commit whose commit message contains a top-level description
    of the motivations and implementation issues.

 2) Pre-demux of established ipv4 TCP sockets, saves a route demux on
    input.

 3) TCP SYN/ACK performance tweaks from Eric Dumazet.

 4) Add namespace support for netfilter L4 conntrack helpers, from Gao
    Feng.

 5) Add config mechanism for Energy Efficient Ethernet to ethtool, from
    Yuval Mintz.

 6) Remove quadratic behavior from /proc/net/unix, from Eric Dumazet.

 7) Support for connection tracker helpers in userspace, from Pablo
    Neira Ayuso.

 8) Allow userspace driven TX load balancing functions in TEAM driver,
    from Jiri Pirko.

 9) Kill off NLMSG_PUT and RTA_PUT macros, more gross stuff with
    embedded gotos.

10) TCP Small Queues, essentially minimize the amount of TCP data queued
    up in the packet scheduler layer.  Whereas the existing BQL (Byte
    Queue Limits) limits the pkt_sched --> netdevice queuing levels,
    this controls the TCP --> pkt_sched queueing levels.

    From Eric Dumazet.

11) Reduce the number of get_page/put_page ops done on SKB fragments,
    from Alexander Duyck.

12) Implement protection against blind resets in TCP (RFC 5961), from
    Eric Dumazet.

13) Support the client side of TCP Fast Open, basically the ability to
    send data in the SYN exchange, from Yuchung Cheng.

    Basically, the sender queues up data with a sendmsg() call using
    MSG_FASTOPEN, then they do the connect() which emits the queued up
    fastopen data.

14) Avoid all the problems we get into in TCP when timers or PMTU events
    hit a locked socket.  The TCP Small Queues changes added a
    tcp_release_cb() that allows us to queue work up to the
    release_sock() caller, and that's what we use here too.  From Eric
    Dumazet.

15) Zero copy on TX support for TUN driver, from Michael S. Tsirkin.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1870 commits)
  genetlink: define lockdep_genl_is_held() when CONFIG_LOCKDEP
  r8169: revert "add byte queue limit support".
  ipv4: Change rt->rt_iif encoding.
  net: Make skb->skb_iif always track skb->dev
  ipv4: Prepare for change of rt->rt_iif encoding.
  ipv4: Remove all RTCF_DIRECTSRC handliing.
  ipv4: Really ignore ICMP address requests/replies.
  decnet: Don't set RTCF_DIRECTSRC.
  net/ipv4/ip_vti.c: Fix __rcu warnings detected by sparse.
  ipv4: Remove redundant assignment
  rds: set correct msg_namelen
  openvswitch: potential NULL deref in sample()
  tcp: dont drop MTU reduction indications
  bnx2x: Add new 57840 device IDs
  tcp: avoid oops in tcp_metrics and reset tcpm_stamp
  niu: Change niu_rbr_fill() to use unlikely() to check niu_rbr_add_page() return value
  niu: Fix to check for dma mapping errors.
  net: Fix references to out-of-scope variables in put_cmsg_compat()
  net: ethernet: davinci_emac: add pm_runtime support
  net: ethernet: davinci_emac: Remove unnecessary #include
  ...

122 files changed, 2802 insertions, 988 deletions

diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 8deaf6d050c3..1954a4e305a3 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -7,6 +7,7 @@
 #include <linux/bcma/bcma_driver_chipcommon.h>
 #include <linux/bcma/bcma_driver_pci.h>
 #include <linux/bcma/bcma_driver_mips.h>
+#include <linux/bcma/bcma_driver_gmac_cmn.h>
 #include <linux/ssb/ssb.h> /* SPROM sharing */
 
 #include "bcma_regs.h"
@@ -70,6 +71,13 @@ struct bcma_host_ops {
 
 /* Core-ID values. */
 #define BCMA_CORE_OOB_ROUTER            0x367   /* Out of band */
+#define BCMA_CORE_4706_CHIPCOMMON       0x500
+#define BCMA_CORE_4706_SOC_RAM          0x50E
+#define BCMA_CORE_4706_MAC_GBIT         0x52D
+#define BCMA_CORE_AMEMC                 0x52E   /* DDR1/2 memory controller core */
+#define BCMA_CORE_ALTA                  0x534   /* I2S core */
+#define BCMA_CORE_4706_MAC_GBIT_COMMON  0x5DC
+#define BCMA_CORE_DDR23_PHY             0x5DD
 #define BCMA_CORE_INVALID               0x700
 #define BCMA_CORE_CHIPCOMMON            0x800
 #define BCMA_CORE_ILINE20               0x801
@@ -130,6 +138,36 @@ struct bcma_host_ops {
 
 #define BCMA_MAX_NR_CORES               16
 
+/* Chip IDs of PCIe devices */
+#define BCMA_CHIP_ID_BCM4313    0x4313
+#define BCMA_CHIP_ID_BCM43224   43224
+#define  BCMA_PKG_ID_BCM43224_FAB_CSM   0x8
+#define  BCMA_PKG_ID_BCM43224_FAB_SMIC  0xa
+#define BCMA_CHIP_ID_BCM43225   43225
+#define BCMA_CHIP_ID_BCM43227   43227
+#define BCMA_CHIP_ID_BCM43228   43228
+#define BCMA_CHIP_ID_BCM43421   43421
+#define BCMA_CHIP_ID_BCM43428   43428
+#define BCMA_CHIP_ID_BCM43431   43431
+#define BCMA_CHIP_ID_BCM43460   43460
+#define BCMA_CHIP_ID_BCM4331    0x4331
+#define BCMA_CHIP_ID_BCM6362    0x6362
+#define BCMA_CHIP_ID_BCM4360    0x4360
+#define BCMA_CHIP_ID_BCM4352    0x4352
+
+/* Chip IDs of SoCs */
+#define BCMA_CHIP_ID_BCM4706    0x5300
+#define BCMA_CHIP_ID_BCM4716    0x4716
+#define  BCMA_PKG_ID_BCM4716    8
+#define  BCMA_PKG_ID_BCM4717    9
+#define  BCMA_PKG_ID_BCM4718    10
+#define BCMA_CHIP_ID_BCM47162   47162
+#define BCMA_CHIP_ID_BCM4748    0x4748
+#define BCMA_CHIP_ID_BCM4749    0x4749
+#define BCMA_CHIP_ID_BCM5356    0x5356
+#define BCMA_CHIP_ID_BCM5357    0x5357
+#define BCMA_CHIP_ID_BCM53572   53572
+
 struct bcma_device {
         struct bcma_bus *bus;
         struct bcma_device_id id;
@@ -215,6 +253,7 @@ struct bcma_bus {
         struct bcma_drv_cc drv_cc;
         struct bcma_drv_pci drv_pci;
         struct bcma_drv_mips drv_mips;
+        struct bcma_drv_gmac_cmn drv_gmac_cmn;
 
         /* We decided to share SPROM struct with SSB as long as we do not need
          * any hacks for BCMA. This simplifies drivers code. */
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 8bbfe31fbac8..3c80885fa829 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -24,7 +24,7 @@
 #define   BCMA_CC_FLASHT_NONE           0x00000000      /* No flash */
 #define   BCMA_CC_FLASHT_STSER          0x00000100      /* ST serial flash */
 #define   BCMA_CC_FLASHT_ATSER          0x00000200      /* Atmel serial flash */
-#define   BCMA_CC_FLASHT_NFLASH         0x00000200
+#define   BCMA_CC_FLASHT_NFLASH         0x00000200      /* NAND flash */
 #define   BCMA_CC_FLASHT_PARA           0x00000700      /* Parallel flash */
 #define  BCMA_CC_CAP_PLLT               0x00038000      /* PLL Type */
 #define   BCMA_PLLTYPE_NONE             0x00000000
@@ -45,6 +45,7 @@
 #define  BCMA_CC_CAP_PMU                0x10000000      /* PMU available (rev >= 20) */
 #define  BCMA_CC_CAP_ECI                0x20000000      /* ECI available (rev >= 20) */
 #define  BCMA_CC_CAP_SPROM              0x40000000      /* SPROM present */
+#define  BCMA_CC_CAP_NFLASH             0x80000000      /* NAND flash present (rev >= 35 or BCM4706?) */
 #define BCMA_CC_CORECTL                 0x0008
 #define  BCMA_CC_CORECTL_UARTCLK0       0x00000001      /* Drive UART with internal clock */
 #define  BCMA_CC_CORECTL_SE             0x00000002      /* sync clk out enable (corerev >= 3) */
@@ -88,6 +89,11 @@
 #define  BCMA_CC_CHIPST_4313_OTP_PRESENT        2
 #define  BCMA_CC_CHIPST_4331_SPROM_PRESENT      2
 #define  BCMA_CC_CHIPST_4331_OTP_PRESENT        4
+#define  BCMA_CC_CHIPST_4706_PKG_OPTION         BIT(0) /* 0: full-featured package 1: low-cost package */
+#define  BCMA_CC_CHIPST_4706_SFLASH_PRESENT     BIT(1) /* 0: parallel, 1: serial flash is present */
+#define  BCMA_CC_CHIPST_4706_SFLASH_TYPE        BIT(2) /* 0: 8b-p/ST-s flash, 1: 16b-p/Atmal-s flash */
+#define  BCMA_CC_CHIPST_4706_MIPS_BENDIAN       BIT(3) /* 0: little, 1: big endian */
+#define  BCMA_CC_CHIPST_4706_PCIE1_DISABLE      BIT(5) /* PCIE1 enable strap pin */
 #define BCMA_CC_JCMD                    0x0030          /* Rev >= 10 only */
 #define  BCMA_CC_JCMD_START             0x80000000
 #define  BCMA_CC_JCMD_BUSY              0x80000000
@@ -117,10 +123,58 @@
 #define  BCMA_CC_JCTL_EXT_EN            2               /* Enable external targets */
 #define  BCMA_CC_JCTL_EN                1               /* Enable Jtag master */
 #define BCMA_CC_FLASHCTL                0x0040
+/* Start/busy bit in flashcontrol */
+#define  BCMA_CC_FLASHCTL_OPCODE        0x000000ff
+#define  BCMA_CC_FLASHCTL_ACTION        0x00000700
+#define  BCMA_CC_FLASHCTL_CS_ACTIVE     0x00001000      /* Chip Select Active, rev >= 20 */
 #define  BCMA_CC_FLASHCTL_START         0x80000000
 #define  BCMA_CC_FLASHCTL_BUSY          BCMA_CC_FLASHCTL_START
+/* Flashcontrol action + opcodes for ST flashes */
+#define  BCMA_CC_FLASHCTL_ST_WREN       0x0006          /* Write Enable */
+#define  BCMA_CC_FLASHCTL_ST_WRDIS      0x0004          /* Write Disable */
+#define  BCMA_CC_FLASHCTL_ST_RDSR       0x0105          /* Read Status Register */
+#define  BCMA_CC_FLASHCTL_ST_WRSR       0x0101          /* Write Status Register */
+#define  BCMA_CC_FLASHCTL_ST_READ       0x0303          /* Read Data Bytes */
+#define  BCMA_CC_FLASHCTL_ST_PP         0x0302          /* Page Program */
+#define  BCMA_CC_FLASHCTL_ST_SE         0x02d8          /* Sector Erase */
+#define  BCMA_CC_FLASHCTL_ST_BE         0x00c7          /* Bulk Erase */
+#define  BCMA_CC_FLASHCTL_ST_DP         0x00b9          /* Deep Power-down */
+#define  BCMA_CC_FLASHCTL_ST_RES        0x03ab          /* Read Electronic Signature */
+#define  BCMA_CC_FLASHCTL_ST_CSA        0x1000          /* Keep chip select asserted */
+#define  BCMA_CC_FLASHCTL_ST_SSE        0x0220          /* Sub-sector Erase */
+/* Flashcontrol action + opcodes for Atmel flashes */
+#define  BCMA_CC_FLASHCTL_AT_READ                       0x07e8
+#define  BCMA_CC_FLASHCTL_AT_PAGE_READ                  0x07d2
+#define  BCMA_CC_FLASHCTL_AT_STATUS                     0x01d7
+#define  BCMA_CC_FLASHCTL_AT_BUF1_WRITE                 0x0384
+#define  BCMA_CC_FLASHCTL_AT_BUF2_WRITE                 0x0387
+#define  BCMA_CC_FLASHCTL_AT_BUF1_ERASE_PROGRAM         0x0283
+#define  BCMA_CC_FLASHCTL_AT_BUF2_ERASE_PROGRAM         0x0286
+#define  BCMA_CC_FLASHCTL_AT_BUF1_PROGRAM               0x0288
+#define  BCMA_CC_FLASHCTL_AT_BUF2_PROGRAM               0x0289
+#define  BCMA_CC_FLASHCTL_AT_PAGE_ERASE                 0x0281
+#define  BCMA_CC_FLASHCTL_AT_BLOCK_ERASE                0x0250
+#define  BCMA_CC_FLASHCTL_AT_BUF1_WRITE_ERASE_PROGRAM   0x0382
+#define  BCMA_CC_FLASHCTL_AT_BUF2_WRITE_ERASE_PROGRAM   0x0385
+#define  BCMA_CC_FLASHCTL_AT_BUF1_LOAD                  0x0253
+#define  BCMA_CC_FLASHCTL_AT_BUF2_LOAD                  0x0255
+#define  BCMA_CC_FLASHCTL_AT_BUF1_COMPARE               0x0260
+#define  BCMA_CC_FLASHCTL_AT_BUF2_COMPARE               0x0261
+#define  BCMA_CC_FLASHCTL_AT_BUF1_REPROGRAM             0x0258
+#define  BCMA_CC_FLASHCTL_AT_BUF2_REPROGRAM             0x0259
 #define BCMA_CC_FLASHADDR               0x0044
 #define BCMA_CC_FLASHDATA               0x0048
+/* Status register bits for ST flashes */
+#define  BCMA_CC_FLASHDATA_ST_WIP       0x01            /* Write In Progress */
+#define  BCMA_CC_FLASHDATA_ST_WEL       0x02            /* Write Enable Latch */
+#define  BCMA_CC_FLASHDATA_ST_BP_MASK   0x1c            /* Block Protect */
+#define  BCMA_CC_FLASHDATA_ST_BP_SHIFT  2
+#define  BCMA_CC_FLASHDATA_ST_SRWD      0x80            /* Status Register Write Disable */
+/* Status register bits for Atmel flashes */
+#define  BCMA_CC_FLASHDATA_AT_READY     0x80
+#define  BCMA_CC_FLASHDATA_AT_MISMATCH  0x40
+#define  BCMA_CC_FLASHDATA_AT_ID_MASK   0x38
+#define  BCMA_CC_FLASHDATA_AT_ID_SHIFT  3
 #define BCMA_CC_BCAST_ADDR              0x0050
 #define BCMA_CC_BCAST_DATA              0x0054
 #define BCMA_CC_GPIOPULLUP              0x0058          /* Rev >= 20 only */
@@ -280,6 +334,15 @@
 
 /* 4706 PMU */
 #define BCMA_CC_PMU4706_MAINPLL_PLL0    0
+#define BCMA_CC_PMU6_4706_PROCPLL_OFF   4       /* The CPU PLL */
+#define  BCMA_CC_PMU6_4706_PROC_P2DIV_MASK      0x000f0000
+#define  BCMA_CC_PMU6_4706_PROC_P2DIV_SHIFT     16
+#define  BCMA_CC_PMU6_4706_PROC_P1DIV_MASK      0x0000f000
+#define  BCMA_CC_PMU6_4706_PROC_P1DIV_SHIFT     12
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_INT_MASK   0x00000ff8
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_INT_SHIFT  3
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_MASK  0x00000007
+#define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_SHIFT 0
 
 /* ALP clock on pre-PMU chips */
 #define BCMA_CC_PMU_ALP_CLOCK           20000000
@@ -308,6 +371,19 @@
 #define BCMA_CC_PPL_PCHI_OFF            5
 #define BCMA_CC_PPL_PCHI_MASK           0x0000003f
 
+#define BCMA_CC_PMU_PLL_CTL0            0
+#define BCMA_CC_PMU_PLL_CTL1            1
+#define BCMA_CC_PMU_PLL_CTL2            2
+#define BCMA_CC_PMU_PLL_CTL3            3
+#define BCMA_CC_PMU_PLL_CTL4            4
+#define BCMA_CC_PMU_PLL_CTL5            5
+
+#define BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK        0x00f00000
+#define BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT       20
+
+#define BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_MASK     0x1ff00000
+#define BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT    20
+
 /* BCM4331 ChipControl numbers. */
 #define BCMA_CHIPCTL_4331_BT_COEXIST            BIT(0)  /* 0 disable */
 #define BCMA_CHIPCTL_4331_SECI                  BIT(1)  /* 0 SECI is disabled (JATG functional) */
@@ -321,9 +397,18 @@
 #define BCMA_CHIPCTL_4331_OVR_PIPEAUXPWRDOWN    BIT(9)  /* override core control on pipe_AuxPowerDown */
 #define BCMA_CHIPCTL_4331_PCIE_AUXCLKEN         BIT(10) /* pcie_auxclkenable */
 #define BCMA_CHIPCTL_4331_PCIE_PIPE_PLLDOWN     BIT(11) /* pcie_pipe_pllpowerdown */
+#define BCMA_CHIPCTL_4331_EXTPA_EN2             BIT(12) /* 0 ext pa disable, 1 ext pa enabled */
 #define BCMA_CHIPCTL_4331_BT_SHD0_ON_GPIO4      BIT(16) /* enable bt_shd0 at gpio4 */
 #define BCMA_CHIPCTL_4331_BT_SHD1_ON_GPIO5      BIT(17) /* enable bt_shd1 at gpio5 */
 
+/* 43224 chip-specific ChipControl register bits */
+#define BCMA_CCTRL_43224_GPIO_TOGGLE            0x8000          /* gpio[3:0] pins as btcoex or s/w gpio */
+#define BCMA_CCTRL_43224A0_12MA_LED_DRIVE       0x00F000F0      /* 12 mA drive strength */
+#define BCMA_CCTRL_43224B0_12MA_LED_DRIVE       0xF0            /* 12 mA drive strength for later 43224s */
+
+/* 4313 Chip specific ChipControl register bits */
+#define BCMA_CCTRL_4313_12MA_LED_DRIVE          0x00000007      /* 12 mA drive strengh for later 4313 */
+
 /* Data for the PMU, if available.
  * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
  */
@@ -411,5 +496,6 @@ extern void bcma_chipco_chipctl_maskset(struct bcma_drv_cc *cc,
                                         u32 offset, u32 mask, u32 set);
 extern void bcma_chipco_regctl_maskset(struct bcma_drv_cc *cc,
                                        u32 offset, u32 mask, u32 set);
+extern void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid);
 
 #endif /* LINUX_BCMA_DRIVER_CC_H_ */
diff --git a/include/linux/bcma/bcma_driver_gmac_cmn.h b/include/linux/bcma/bcma_driver_gmac_cmn.h
new file mode 100644
index 000000000000..def894b83b0d
--- /dev/null
+++ b/include/linux/bcma/bcma_driver_gmac_cmn.h
@@ -0,0 +1,100 @@
+#ifndef LINUX_BCMA_DRIVER_GMAC_CMN_H_
+#define LINUX_BCMA_DRIVER_GMAC_CMN_H_
+
+#include <linux/types.h>
+
+#define BCMA_GMAC_CMN_STAG0             0x000
+#define BCMA_GMAC_CMN_STAG1             0x004
+#define BCMA_GMAC_CMN_STAG2             0x008
+#define BCMA_GMAC_CMN_STAG3             0x00C
+#define BCMA_GMAC_CMN_PARSER_CTL        0x020
+#define BCMA_GMAC_CMN_MIB_MAX_LEN       0x024
+#define BCMA_GMAC_CMN_PHY_ACCESS        0x100
+#define  BCMA_GMAC_CMN_PA_DATA_MASK     0x0000ffff
+#define  BCMA_GMAC_CMN_PA_ADDR_MASK     0x001f0000
+#define  BCMA_GMAC_CMN_PA_ADDR_SHIFT    16
+#define  BCMA_GMAC_CMN_PA_REG_MASK      0x1f000000
+#define  BCMA_GMAC_CMN_PA_REG_SHIFT     24
+#define  BCMA_GMAC_CMN_PA_WRITE         0x20000000
+#define  BCMA_GMAC_CMN_PA_START         0x40000000
+#define BCMA_GMAC_CMN_PHY_CTL           0x104
+#define  BCMA_GMAC_CMN_PC_EPA_MASK      0x0000001f
+#define  BCMA_GMAC_CMN_PC_MCT_MASK      0x007f0000
+#define  BCMA_GMAC_CMN_PC_MCT_SHIFT     16
+#define  BCMA_GMAC_CMN_PC_MTE           0x00800000
+#define BCMA_GMAC_CMN_GMAC0_RGMII_CTL   0x110
+#define BCMA_GMAC_CMN_CFP_ACCESS        0x200
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA0    0x210
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA1    0x214
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA2    0x218
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA3    0x21C
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA4    0x220
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA5    0x224
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA6    0x228
+#define BCMA_GMAC_CMN_CFP_TCAM_DATA7    0x22C
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK0    0x230
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK1    0x234
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK2    0x238
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK3    0x23C
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK4    0x240
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK5    0x244
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK6    0x248
+#define BCMA_GMAC_CMN_CFP_TCAM_MASK7    0x24C
+#define BCMA_GMAC_CMN_CFP_ACTION_DATA   0x250
+#define BCMA_GMAC_CMN_TCAM_BIST_CTL     0x2A0
+#define BCMA_GMAC_CMN_TCAM_BIST_STATUS  0x2A4
+#define BCMA_GMAC_CMN_TCAM_CMP_STATUS   0x2A8
+#define BCMA_GMAC_CMN_TCAM_DISABLE      0x2AC
+#define BCMA_GMAC_CMN_TCAM_TEST_CTL     0x2F0
+#define BCMA_GMAC_CMN_UDF_0_A3_A0       0x300
+#define BCMA_GMAC_CMN_UDF_0_A7_A4       0x304
+#define BCMA_GMAC_CMN_UDF_0_A8          0x308
+#define BCMA_GMAC_CMN_UDF_1_A3_A0       0x310
+#define BCMA_GMAC_CMN_UDF_1_A7_A4       0x314
+#define BCMA_GMAC_CMN_UDF_1_A8          0x318
+#define BCMA_GMAC_CMN_UDF_2_A3_A0       0x320
+#define BCMA_GMAC_CMN_UDF_2_A7_A4       0x324
+#define BCMA_GMAC_CMN_UDF_2_A8          0x328
+#define BCMA_GMAC_CMN_UDF_0_B3_B0       0x330
+#define BCMA_GMAC_CMN_UDF_0_B7_B4       0x334
+#define BCMA_GMAC_CMN_UDF_0_B8          0x338
+#define BCMA_GMAC_CMN_UDF_1_B3_B0       0x340
+#define BCMA_GMAC_CMN_UDF_1_B7_B4       0x344
+#define BCMA_GMAC_CMN_UDF_1_B8          0x348
+#define BCMA_GMAC_CMN_UDF_2_B3_B0       0x350
+#define BCMA_GMAC_CMN_UDF_2_B7_B4       0x354
+#define BCMA_GMAC_CMN_UDF_2_B8          0x358
+#define BCMA_GMAC_CMN_UDF_0_C3_C0       0x360
+#define BCMA_GMAC_CMN_UDF_0_C7_C4       0x364
+#define BCMA_GMAC_CMN_UDF_0_C8          0x368
+#define BCMA_GMAC_CMN_UDF_1_C3_C0       0x370
+#define BCMA_GMAC_CMN_UDF_1_C7_C4       0x374
+#define BCMA_GMAC_CMN_UDF_1_C8          0x378
+#define BCMA_GMAC_CMN_UDF_2_C3_C0       0x380
+#define BCMA_GMAC_CMN_UDF_2_C7_C4       0x384
+#define BCMA_GMAC_CMN_UDF_2_C8          0x388
+#define BCMA_GMAC_CMN_UDF_0_D3_D0       0x390
+#define BCMA_GMAC_CMN_UDF_0_D7_D4       0x394
+#define BCMA_GMAC_CMN_UDF_0_D11_D8      0x394
+
+struct bcma_drv_gmac_cmn {
+        struct bcma_device *core;
+
+        /* Drivers accessing BCMA_GMAC_CMN_PHY_ACCESS and
+         * BCMA_GMAC_CMN_PHY_CTL need to take that mutex first. */
+        struct mutex phy_mutex;
+};
+
+/* Register access */
+#define gmac_cmn_read16(gc, offset)             bcma_read16((gc)->core, offset)
+#define gmac_cmn_read32(gc, offset)             bcma_read32((gc)->core, offset)
+#define gmac_cmn_write16(gc, offset, val)       bcma_write16((gc)->core, offset, val)
+#define gmac_cmn_write32(gc, offset, val)       bcma_write32((gc)->core, offset, val)
+
+#ifdef CONFIG_BCMA_DRIVER_GMAC_CMN
+extern void __devinit bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc);
+#else
+static inline void bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc) { }
+#endif
+
+#endif /* LINUX_BCMA_DRIVER_GMAC_CMN_H_ */
diff --git a/include/linux/can.h b/include/linux/can.h
index 9a19bcb3eeaf..018055efc034 100644
--- a/include/linux/can.h
+++ b/include/linux/can.h
@@ -21,7 +21,7 @@
 /* special address description flags for the CAN_ID */
 #define CAN_EFF_FLAG 0x80000000U /* EFF/SFF is set in the MSB */
 #define CAN_RTR_FLAG 0x40000000U /* remote transmission request */
-#define CAN_ERR_FLAG 0x20000000U /* error frame */
+#define CAN_ERR_FLAG 0x20000000U /* error message frame */
 
 /* valid bits in CAN ID for frame formats */
 #define CAN_SFF_MASK 0x000007FFU /* standard frame format (SFF) */
@@ -32,32 +32,84 @@
  * Controller Area Network Identifier structure
  *
  * bit 0-28     : CAN identifier (11/29 bit)
- * bit 29       : error frame flag (0 = data frame, 1 = error frame)
+ * bit 29       : error message frame flag (0 = data frame, 1 = error message)
  * bit 30       : remote transmission request flag (1 = rtr frame)
  * bit 31       : frame format flag (0 = standard 11 bit, 1 = extended 29 bit)
  */
 typedef __u32 canid_t;
 
+#define CAN_SFF_ID_BITS         11
+#define CAN_EFF_ID_BITS         29
+
 /*
- * Controller Area Network Error Frame Mask structure
+ * Controller Area Network Error Message Frame Mask structure
  *
  * bit 0-28     : error class mask (see include/linux/can/error.h)
  * bit 29-31    : set to zero
  */
 typedef __u32 can_err_mask_t;
 
+/* CAN payload length and DLC definitions according to ISO 11898-1 */
+#define CAN_MAX_DLC 8
+#define CAN_MAX_DLEN 8
+
+/* CAN FD payload length and DLC definitions according to ISO 11898-7 */
+#define CANFD_MAX_DLC 15
+#define CANFD_MAX_DLEN 64
+
 /**
  * struct can_frame - basic CAN frame structure
- * @can_id:  the CAN ID of the frame and CAN_*_FLAG flags, see above.
- * @can_dlc: the data length field of the CAN frame
- * @data:    the CAN frame payload.
+ * @can_id:  CAN ID of the frame and CAN_*_FLAG flags, see canid_t definition
+ * @can_dlc: frame payload length in byte (0 .. 8) aka data length code
+ *           N.B. the DLC field from ISO 11898-1 Chapter 8.4.2.3 has a 1:1
+ *           mapping of the 'data length code' to the real payload length
+ * @data:    CAN frame payload (up to 8 byte)
  */
 struct can_frame {
         canid_t can_id;  /* 32 bit CAN_ID + EFF/RTR/ERR flags */
-        __u8    can_dlc; /* data length code: 0 .. 8 */
-        __u8    data[8] __attribute__((aligned(8)));
+        __u8    can_dlc; /* frame payload length in byte (0 .. CAN_MAX_DLEN) */
+        __u8    data[CAN_MAX_DLEN] __attribute__((aligned(8)));
+};
+
+/*
+ * defined bits for canfd_frame.flags
+ *
+ * As the default for CAN FD should be to support the high data rate in the
+ * payload section of the frame (HDR) and to support up to 64 byte in the
+ * data section (EDL) the bits are only set in the non-default case.
+ * Btw. as long as there's no real implementation for CAN FD network driver
+ * these bits are only preliminary.
+ *
+ * RX: NOHDR/NOEDL - info about received CAN FD frame
+ *     ESI         - bit from originating CAN controller
+ * TX: NOHDR/NOEDL - control per-frame settings if supported by CAN controller
+ *     ESI         - bit is set by local CAN controller
+ */
+#define CANFD_NOHDR 0x01 /* frame without high data rate */
+#define CANFD_NOEDL 0x02 /* frame without extended data length */
+#define CANFD_ESI   0x04 /* error state indicator */
+
+/**
+ * struct canfd_frame - CAN flexible data rate frame structure
+ * @can_id: CAN ID of the frame and CAN_*_FLAG flags, see canid_t definition
+ * @len:    frame payload length in byte (0 .. CANFD_MAX_DLEN)
+ * @flags:  additional flags for CAN FD
+ * @__res0: reserved / padding
+ * @__res1: reserved / padding
+ * @data:   CAN FD frame payload (up to CANFD_MAX_DLEN byte)
+ */
+struct canfd_frame {
+        canid_t can_id;  /* 32 bit CAN_ID + EFF/RTR/ERR flags */
+        __u8    len;     /* frame payload length in byte */
+        __u8    flags;   /* additional flags for CAN FD */
+        __u8    __res0;  /* reserved / padding */
+        __u8    __res1;  /* reserved / padding */
+        __u8    data[CANFD_MAX_DLEN] __attribute__((aligned(8)));
 };
 
+#define CAN_MTU         (sizeof(struct can_frame))
+#define CANFD_MTU       (sizeof(struct canfd_frame))
+
 /* particular protocols of the protocol family PF_CAN */
 #define CAN_RAW         1 /* RAW sockets */
 #define CAN_BCM         2 /* Broadcast Manager */
@@ -97,7 +149,7 @@ struct sockaddr_can {
  *          <received_can_id> & mask == can_id & mask
  *
  * The filter can be inverted (CAN_INV_FILTER bit set in can_id) or it can
- * filter for error frames (CAN_ERR_FLAG bit set in mask).
+ * filter for error message frames (CAN_ERR_FLAG bit set in mask).
  */
 struct can_filter {
         canid_t can_id;
diff --git a/include/linux/can/core.h b/include/linux/can/core.h
index 0ccc1cd28b95..78c6c52073ad 100644
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -17,10 +17,10 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 
-#define CAN_VERSION "20090105"
+#define CAN_VERSION "20120528"
 
 /* increment this number each time you change some user-space interface */
-#define CAN_ABI_VERSION "8"
+#define CAN_ABI_VERSION "9"
 
 #define CAN_VERSION_STRING "rev " CAN_VERSION " abi " CAN_ABI_VERSION
 
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index 5d2efe7e3f1b..2b2fc345afca 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -33,7 +33,7 @@ struct can_priv {
         struct can_device_stats can_stats;
 
         struct can_bittiming bittiming;
-        struct can_bittiming_const *bittiming_const;
+        const struct can_bittiming_const *bittiming_const;
         struct can_clock clock;
 
         enum can_state state;
@@ -61,23 +61,40 @@ struct can_priv {
  * To be used in the CAN netdriver receive path to ensure conformance with
  * ISO 11898-1 Chapter 8.4.2.3 (DLC field)
  */
-#define get_can_dlc(i)  (min_t(__u8, (i), 8))
+#define get_can_dlc(i)          (min_t(__u8, (i), CAN_MAX_DLC))
+#define get_canfd_dlc(i)        (min_t(__u8, (i), CANFD_MAX_DLC))
 
 /* Drop a given socketbuffer if it does not contain a valid CAN frame. */
 static inline int can_dropped_invalid_skb(struct net_device *dev,
                                           struct sk_buff *skb)
 {
-        const struct can_frame *cf = (struct can_frame *)skb->data;
-
-        if (unlikely(skb->len != sizeof(*cf) || cf->can_dlc > 8)) {
-                kfree_skb(skb);
-                dev->stats.tx_dropped++;
-                return 1;
-        }
+        const struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
+
+        if (skb->protocol == htons(ETH_P_CAN)) {
+                if (unlikely(skb->len != CAN_MTU ||
+                             cfd->len > CAN_MAX_DLEN))
+                        goto inval_skb;
+        } else if (skb->protocol == htons(ETH_P_CANFD)) {
+                if (unlikely(skb->len != CANFD_MTU ||
+                             cfd->len > CANFD_MAX_DLEN))
+                        goto inval_skb;
+        } else
+                goto inval_skb;
 
         return 0;
+
+inval_skb:
+        kfree_skb(skb);
+        dev->stats.tx_dropped++;
+        return 1;
 }
 
+/* get data length from can_dlc with sanitized can_dlc */
+u8 can_dlc2len(u8 can_dlc);
+
+/* map the sanitized data length to an appropriate data length code */
+u8 can_len2dlc(u8 len);
+
 struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max);
 void free_candev(struct net_device *dev);
 
diff --git a/include/linux/can/error.h b/include/linux/can/error.h
index 63e855ea6b84..7b7148bded71 100644
--- a/include/linux/can/error.h
+++ b/include/linux/can/error.h
@@ -1,7 +1,7 @@
 /*
  * linux/can/error.h
  *
- * Definitions of the CAN error frame to be filtered and passed to the user.
+ * Definitions of the CAN error messages to be filtered and passed to the user.
  *
  * Author: Oliver Hartkopp <oliver.hartkopp@volkswagen.de>
  * Copyright (c) 2002-2007 Volkswagen Group Electronic Research
@@ -12,7 +12,7 @@
 #ifndef CAN_ERROR_H
 #define CAN_ERROR_H
 
-#define CAN_ERR_DLC 8 /* dlc for error frames */
+#define CAN_ERR_DLC 8 /* dlc for error message frames */
 
 /* error class (mask) in can_id */
 #define CAN_ERR_TX_TIMEOUT   0x00000001U /* TX timeout (by netdevice driver) */
diff --git a/include/linux/can/raw.h b/include/linux/can/raw.h
index 781f3a3701be..a814062b0719 100644
--- a/include/linux/can/raw.h
+++ b/include/linux/can/raw.h
@@ -23,7 +23,8 @@ enum {
         CAN_RAW_FILTER = 1,     /* set 0 .. n can_filter(s)          */
         CAN_RAW_ERR_FILTER,     /* set filter for error frames       */
         CAN_RAW_LOOPBACK,       /* local loopback (default:on)       */
-        CAN_RAW_RECV_OWN_MSGS   /* receive my own msgs (default:off) */
+        CAN_RAW_RECV_OWN_MSGS,  /* receive my own msgs (default:off) */
+        CAN_RAW_FD_FRAMES,      /* allow CAN FD frames (default:off) */
 };
 
 #endif
diff --git a/include/linux/cpu_rmap.h b/include/linux/cpu_rmap.h
index 473771a528c0..ac3bbb5b9502 100644
--- a/include/linux/cpu_rmap.h
+++ b/include/linux/cpu_rmap.h
@@ -1,3 +1,6 @@
+#ifndef __LINUX_CPU_RMAP_H
+#define __LINUX_CPU_RMAP_H
+
 /*
  * cpu_rmap.c: CPU affinity reverse-map support
  * Copyright 2011 Solarflare Communications Inc.
@@ -71,3 +74,4 @@ extern void free_irq_cpu_rmap(struct cpu_rmap *rmap);
 extern int irq_cpu_rmap_add(struct cpu_rmap *rmap, int irq);
 
 #endif
+#endif /* __LINUX_CPU_RMAP_H */
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 3d406e0ede6d..d426336d92d9 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -124,17 +124,30 @@ static inline bool is_valid_ether_addr(const u8 *addr)
 }
 
 /**
- * random_ether_addr - Generate software assigned random Ethernet address
+ * eth_random_addr - Generate software assigned random Ethernet address
  * @addr: Pointer to a six-byte array containing the Ethernet address
  *
  * Generate a random Ethernet address (MAC) that is not multicast
  * and has the local assigned bit set.
  */
-static inline void random_ether_addr(u8 *addr)
+static inline void eth_random_addr(u8 *addr)
 {
-        get_random_bytes (addr, ETH_ALEN);
-        addr [0] &= 0xfe;       /* clear multicast bit */
-        addr [0] |= 0x02;       /* set local assignment bit (IEEE802) */
+        get_random_bytes(addr, ETH_ALEN);
+        addr[0] &= 0xfe;        /* clear multicast bit */
+        addr[0] |= 0x02;        /* set local assignment bit (IEEE802) */
+}
+
+#define random_ether_addr(addr) eth_random_addr(addr)
+
+/**
+ * eth_broadcast_addr - Assign broadcast address
+ * @addr: Pointer to a six-byte array containing the Ethernet address
+ *
+ * Assign the broadcast address to the given address array.
+ */
+static inline void eth_broadcast_addr(u8 *addr)
+{
+        memset(addr, 0xff, ETH_ALEN);
 }
 
 /**
@@ -149,7 +162,7 @@ static inline void random_ether_addr(u8 *addr)
 static inline void eth_hw_addr_random(struct net_device *dev)
 {
         dev->addr_assign_type |= NET_ADDR_RANDOM;
-        random_ether_addr(dev->dev_addr);
+        eth_random_addr(dev->dev_addr);
 }
 
 /**
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index e17fa7140588..21eff418091b 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -137,6 +137,35 @@ struct ethtool_eeprom {
 };
 
 /**
+ * struct ethtool_eee - Energy Efficient Ethernet information
+ * @cmd: ETHTOOL_{G,S}EEE
+ * @supported: Mask of %SUPPORTED_* flags for the speed/duplex combinations
+ *      for which there is EEE support.
+ * @advertised: Mask of %ADVERTISED_* flags for the speed/duplex combinations
+ *      advertised as eee capable.
+ * @lp_advertised: Mask of %ADVERTISED_* flags for the speed/duplex
+ *      combinations advertised by the link partner as eee capable.
+ * @eee_active: Result of the eee auto negotiation.
+ * @eee_enabled: EEE configured mode (enabled/disabled).
+ * @tx_lpi_enabled: Whether the interface should assert its tx lpi, given
+ *      that eee was negotiated.
+ * @tx_lpi_timer: Time in microseconds the interface delays prior to asserting
+ *      its tx lpi (after reaching 'idle' state). Effective only when eee
+ *      was negotiated and tx_lpi_enabled was set.
+ */
+struct ethtool_eee {
+        __u32   cmd;
+        __u32   supported;
+        __u32   advertised;
+        __u32   lp_advertised;
+        __u32   eee_active;
+        __u32   eee_enabled;
+        __u32   tx_lpi_enabled;
+        __u32   tx_lpi_timer;
+        __u32   reserved[2];
+};
+
+/**
  * struct ethtool_modinfo - plugin module eeprom information
  * @cmd: %ETHTOOL_GMODULEINFO
  * @type: Standard the module information conforms to %ETH_MODULE_SFF_xxxx
@@ -945,6 +974,8 @@ static inline u32 ethtool_rxfh_indir_default(u32 index, u32 n_rx_rings)
  * @get_module_info: Get the size and type of the eeprom contained within
  *      a plug-in module.
  * @get_module_eeprom: Get the eeprom information from the plug-in module
+ * @get_eee: Get Energy-Efficient (EEE) supported and status.
+ * @set_eee: Set EEE status (enable/disable) as well as LPI timers.
  *
  * All operations are optional (i.e. the function pointer may be set
  * to %NULL) and callers must take this into account.  Callers must
@@ -1011,6 +1042,8 @@ struct ethtool_ops {
                                    struct ethtool_modinfo *);
         int     (*get_module_eeprom)(struct net_device *,
                                      struct ethtool_eeprom *, u8 *);
+        int     (*get_eee)(struct net_device *, struct ethtool_eee *);
+        int     (*set_eee)(struct net_device *, struct ethtool_eee *);
 
 
 };
@@ -1089,6 +1122,8 @@ struct ethtool_ops {
 #define ETHTOOL_GET_TS_INFO     0x00000041 /* Get time stamping and PHC info */
 #define ETHTOOL_GMODULEINFO     0x00000042 /* Get plug-in module information */
 #define ETHTOOL_GMODULEEEPROM   0x00000043 /* Get plug-in module eeprom */
+#define ETHTOOL_GEEE            0x00000044 /* Get EEE settings */
+#define ETHTOOL_SEEE            0x00000045 /* Set EEE settings */
 
 /* compatibility with older code */
 #define SPARC_ETH_GSET          ETHTOOL_GSET
@@ -1118,6 +1153,10 @@ struct ethtool_ops {
 #define SUPPORTED_10000baseR_FEC        (1 << 20)
 #define SUPPORTED_20000baseMLD2_Full    (1 << 21)
 #define SUPPORTED_20000baseKR2_Full     (1 << 22)
+#define SUPPORTED_40000baseKR4_Full     (1 << 23)
+#define SUPPORTED_40000baseCR4_Full     (1 << 24)
+#define SUPPORTED_40000baseSR4_Full     (1 << 25)
+#define SUPPORTED_40000baseLR4_Full     (1 << 26)
 
 /* Indicates what features are advertised by the interface. */
 #define ADVERTISED_10baseT_Half         (1 << 0)
@@ -1143,6 +1182,10 @@ struct ethtool_ops {
 #define ADVERTISED_10000baseR_FEC       (1 << 20)
 #define ADVERTISED_20000baseMLD2_Full   (1 << 21)
 #define ADVERTISED_20000baseKR2_Full    (1 << 22)
+#define ADVERTISED_40000baseKR4_Full    (1 << 23)
+#define ADVERTISED_40000baseCR4_Full    (1 << 24)
+#define ADVERTISED_40000baseSR4_Full    (1 << 25)
+#define ADVERTISED_40000baseLR4_Full    (1 << 26)
 
 /* The following are all involved in forcing a particular link
  * mode for the device for setting things.  When getting the
diff --git a/include/linux/genetlink.h b/include/linux/genetlink.h
index 7a114016ac7d..5ab61c1eb6bf 100644
--- a/include/linux/genetlink.h
+++ b/include/linux/genetlink.h
@@ -85,7 +85,7 @@ enum {
 /* All generic netlink requests are serialized by a global lock.  */
 extern void genl_lock(void);
 extern void genl_unlock(void);
-#ifdef CONFIG_PROVE_LOCKING
+#ifdef CONFIG_LOCKDEP
 extern int lockdep_genl_is_held(void);
 #endif
 
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index ce9af8918514..e02fc682bb68 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -47,6 +47,7 @@
 #define IEEE80211_FCTL_MOREDATA         0x2000
 #define IEEE80211_FCTL_PROTECTED        0x4000
 #define IEEE80211_FCTL_ORDER            0x8000
+#define IEEE80211_FCTL_CTL_EXT          0x0f00
 
 #define IEEE80211_SCTL_FRAG             0x000F
 #define IEEE80211_SCTL_SEQ              0xFFF0
@@ -54,6 +55,7 @@
 #define IEEE80211_FTYPE_MGMT            0x0000
 #define IEEE80211_FTYPE_CTL             0x0004
 #define IEEE80211_FTYPE_DATA            0x0008
+#define IEEE80211_FTYPE_EXT             0x000c
 
 /* management */
 #define IEEE80211_STYPE_ASSOC_REQ       0x0000
@@ -70,6 +72,7 @@
 #define IEEE80211_STYPE_ACTION          0x00D0
 
 /* control */
+#define IEEE80211_STYPE_CTL_EXT         0x0060
 #define IEEE80211_STYPE_BACK_REQ        0x0080
 #define IEEE80211_STYPE_BACK            0x0090
 #define IEEE80211_STYPE_PSPOLL          0x00A0
@@ -97,6 +100,18 @@
 #define IEEE80211_STYPE_QOS_CFPOLL              0x00E0
 #define IEEE80211_STYPE_QOS_CFACKPOLL           0x00F0
 
+/* extension, added by 802.11ad */
+#define IEEE80211_STYPE_DMG_BEACON              0x0000
+
+/* control extension - for IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTL_EXT */
+#define IEEE80211_CTL_EXT_POLL          0x2000
+#define IEEE80211_CTL_EXT_SPR           0x3000
+#define IEEE80211_CTL_EXT_GRANT 0x4000
+#define IEEE80211_CTL_EXT_DMG_CTS       0x5000
+#define IEEE80211_CTL_EXT_DMG_DTS       0x6000
+#define IEEE80211_CTL_EXT_SSW           0x8000
+#define IEEE80211_CTL_EXT_SSW_FBACK     0x9000
+#define IEEE80211_CTL_EXT_SSW_ACK       0xa000
 
 /* miscellaneous IEEE 802.11 constants */
 #define IEEE80211_MAX_FRAG_THRESHOLD    2352
@@ -568,6 +583,26 @@ struct ieee80211s_hdr {
 #define MESH_FLAGS_PS_DEEP      0x4
 
 /**
+ * enum ieee80211_preq_flags - mesh PREQ element flags
+ *
+ * @IEEE80211_PREQ_PROACTIVE_PREP_FLAG: proactive PREP subfield
+ */
+enum ieee80211_preq_flags {
+        IEEE80211_PREQ_PROACTIVE_PREP_FLAG      = 1<<2,
+};
+
+/**
+ * enum ieee80211_preq_target_flags - mesh PREQ element per target flags
+ *
+ * @IEEE80211_PREQ_TO_FLAG: target only subfield
+ * @IEEE80211_PREQ_USN_FLAG: unknown target HWMP sequence number subfield
+ */
+enum ieee80211_preq_target_flags {
+        IEEE80211_PREQ_TO_FLAG  = 1<<0,
+        IEEE80211_PREQ_USN_FLAG = 1<<2,
+};
+
+/**
  * struct ieee80211_quiet_ie
  *
  * This structure refers to "Quiet information element"
@@ -1072,6 +1107,73 @@ struct ieee80211_ht_operation {
 #define WLAN_HT_SMPS_CONTROL_STATIC     1
 #define WLAN_HT_SMPS_CONTROL_DYNAMIC    3
 
+#define VHT_MCS_SUPPORTED_SET_SIZE      8
+
+struct ieee80211_vht_capabilities {
+        __le32 vht_capabilities_info;
+        u8 vht_supported_mcs_set[VHT_MCS_SUPPORTED_SET_SIZE];
+} __packed;
+
+struct ieee80211_vht_operation {
+        u8 vht_op_info_chwidth;
+        u8 vht_op_info_chan_center_freq_seg1_idx;
+        u8 vht_op_info_chan_center_freq_seg2_idx;
+        __le16 vht_basic_mcs_set;
+} __packed;
+
+/**
+ * struct ieee80211_vht_mcs_info - VHT MCS information
+ * @rx_mcs_map: RX MCS map 2 bits for each stream, total 8 streams
+ * @rx_highest: Indicates highest long GI VHT PPDU data rate
+ *      STA can receive. Rate expressed in units of 1 Mbps.
+ *      If this field is 0 this value should not be used to
+ *      consider the highest RX data rate supported.
+ * @tx_mcs_map: TX MCS map 2 bits for each stream, total 8 streams
+ * @tx_highest: Indicates highest long GI VHT PPDU data rate
+ *      STA can transmit. Rate expressed in units of 1 Mbps.
+ *      If this field is 0 this value should not be used to
+ *      consider the highest TX data rate supported.
+ */
+struct ieee80211_vht_mcs_info {
+        __le16 rx_mcs_map;
+        __le16 rx_highest;
+        __le16 tx_mcs_map;
+        __le16 tx_highest;
+} __packed;
+
+#define IEEE80211_VHT_MCS_ZERO_TO_SEVEN_SUPPORT 0
+#define IEEE80211_VHT_MCS_ZERO_TO_EIGHT_SUPPORT 1
+#define IEEE80211_VHT_MCS_ZERO_TO_NINE_SUPPORT  2
+#define IEEE80211_VHT_MCS_NOT_SUPPORTED 3
+
+/* 802.11ac VHT Capabilities */
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895                0x00000000
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991                0x00000001
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454               0x00000002
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ              0x00000004
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ     0x00000008
+#define IEEE80211_VHT_CAP_RXLDPC                              0x00000010
+#define IEEE80211_VHT_CAP_SHORT_GI_80                         0x00000020
+#define IEEE80211_VHT_CAP_SHORT_GI_160                        0x00000040
+#define IEEE80211_VHT_CAP_TXSTBC                              0x00000080
+#define IEEE80211_VHT_CAP_RXSTBC_1                            0x00000100
+#define IEEE80211_VHT_CAP_RXSTBC_2                            0x00000200
+#define IEEE80211_VHT_CAP_RXSTBC_3                            0x00000300
+#define IEEE80211_VHT_CAP_RXSTBC_4                            0x00000400
+#define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE               0x00000800
+#define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE               0x00001000
+#define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX             0x00006000
+#define IEEE80211_VHT_CAP_SOUNDING_DIMENTION_MAX              0x00030000
+#define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE               0x00080000
+#define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE               0x00100000
+#define IEEE80211_VHT_CAP_VHT_TXOP_PS                         0x00200000
+#define IEEE80211_VHT_CAP_HTC_VHT                             0x00400000
+#define IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT          0x00800000
+#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB   0x08000000
+#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB     0x0c000000
+#define IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN                  0x10000000
+#define IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN                  0x20000000
+
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
 #define WLAN_AUTH_SHARED_KEY 1
@@ -1104,6 +1206,21 @@ struct ieee80211_ht_operation {
 #define WLAN_CAPABILITY_QOS             (1<<9)
 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
+
+/* DMG (60gHz) 802.11ad */
+/* type - bits 0..1 */
+#define WLAN_CAPABILITY_DMG_TYPE_IBSS           (1<<0) /* Tx by: STA */
+#define WLAN_CAPABILITY_DMG_TYPE_PBSS           (2<<0) /* Tx by: PCP */
+#define WLAN_CAPABILITY_DMG_TYPE_AP             (3<<0) /* Tx by: AP */
+
+#define WLAN_CAPABILITY_DMG_CBAP_ONLY           (1<<2)
+#define WLAN_CAPABILITY_DMG_CBAP_SOURCE (1<<3)
+#define WLAN_CAPABILITY_DMG_PRIVACY             (1<<4)
+#define WLAN_CAPABILITY_DMG_ECPAC               (1<<5)
+
+#define WLAN_CAPABILITY_DMG_SPECTRUM_MGMT       (1<<8)
+#define WLAN_CAPABILITY_DMG_RADIO_MEASURE       (1<<12)
+
 /* measurement */
 #define IEEE80211_SPCT_MSR_RPRT_MODE_LATE       (1<<0)
 #define IEEE80211_SPCT_MSR_RPRT_MODE_INCAPABLE  (1<<1)
@@ -1113,7 +1230,6 @@ struct ieee80211_ht_operation {
 #define IEEE80211_SPCT_MSR_RPRT_TYPE_CCA        1
 #define IEEE80211_SPCT_MSR_RPRT_TYPE_RPI        2
 
-
 /* 802.11g ERP information element */
 #define WLAN_ERP_NON_ERP_PRESENT (1<<0)
 #define WLAN_ERP_USE_PROTECTION (1<<1)
@@ -1125,6 +1241,16 @@ enum {
         WLAN_ERP_PREAMBLE_LONG = 1,
 };
 
+/* Band ID, 802.11ad #8.4.1.45 */
+enum {
+        IEEE80211_BANDID_TV_WS = 0, /* TV white spaces */
+        IEEE80211_BANDID_SUB1  = 1, /* Sub-1 GHz (excluding TV white spaces) */
+        IEEE80211_BANDID_2G    = 2, /* 2.4 GHz */
+        IEEE80211_BANDID_3G    = 3, /* 3.6 GHz */
+        IEEE80211_BANDID_5G    = 4, /* 4.9 and 5 GHz */
+        IEEE80211_BANDID_60G   = 5, /* 60 GHz */
+};
+
 /* Status codes */
 enum ieee80211_statuscode {
         WLAN_STATUS_SUCCESS = 0,
@@ -1176,6 +1302,17 @@ enum ieee80211_statuscode {
         WLAN_STATUS_ANTI_CLOG_REQUIRED = 76,
         WLAN_STATUS_FCG_NOT_SUPP = 78,
         WLAN_STATUS_STA_NO_TBTT = 78,
+        /* 802.11ad */
+        WLAN_STATUS_REJECTED_WITH_SUGGESTED_CHANGES = 39,
+        WLAN_STATUS_REJECTED_FOR_DELAY_PERIOD = 47,
+        WLAN_STATUS_REJECT_WITH_SCHEDULE = 83,
+        WLAN_STATUS_PENDING_ADMITTING_FST_SESSION = 86,
+        WLAN_STATUS_PERFORMING_FST_NOW = 87,
+        WLAN_STATUS_PENDING_GAP_IN_BA_WINDOW = 88,
+        WLAN_STATUS_REJECT_U_PID_SETTING = 89,
+        WLAN_STATUS_REJECT_DSE_BAND = 96,
+        WLAN_STATUS_DENIED_WITH_SUGGESTED_BAND_AND_CHANNEL = 99,
+        WLAN_STATUS_DENIED_DUE_TO_SPECTRUM_MANAGEMENT = 103,
 };
 
 
@@ -1332,6 +1469,43 @@ enum ieee80211_eid {
         WLAN_EID_DSE_REGISTERED_LOCATION = 58,
         WLAN_EID_SUPPORTED_REGULATORY_CLASSES = 59,
         WLAN_EID_EXT_CHANSWITCH_ANN = 60,
+
+        WLAN_EID_VHT_CAPABILITY = 191,
+        WLAN_EID_VHT_OPERATION = 192,
+
+        /* 802.11ad */
+        WLAN_EID_NON_TX_BSSID_CAP =  83,
+        WLAN_EID_WAKEUP_SCHEDULE = 143,
+        WLAN_EID_EXT_SCHEDULE = 144,
+        WLAN_EID_STA_AVAILABILITY = 145,
+        WLAN_EID_DMG_TSPEC = 146,
+        WLAN_EID_DMG_AT = 147,
+        WLAN_EID_DMG_CAP = 148,
+        WLAN_EID_DMG_OPERATION = 151,
+        WLAN_EID_DMG_BSS_PARAM_CHANGE = 152,
+        WLAN_EID_DMG_BEAM_REFINEMENT = 153,
+        WLAN_EID_CHANNEL_MEASURE_FEEDBACK = 154,
+        WLAN_EID_AWAKE_WINDOW = 157,
+        WLAN_EID_MULTI_BAND = 158,
+        WLAN_EID_ADDBA_EXT = 159,
+        WLAN_EID_NEXT_PCP_LIST = 160,
+        WLAN_EID_PCP_HANDOVER = 161,
+        WLAN_EID_DMG_LINK_MARGIN = 162,
+        WLAN_EID_SWITCHING_STREAM = 163,
+        WLAN_EID_SESSION_TRANSITION = 164,
+        WLAN_EID_DYN_TONE_PAIRING_REPORT = 165,
+        WLAN_EID_CLUSTER_REPORT = 166,
+        WLAN_EID_RELAY_CAP = 167,
+        WLAN_EID_RELAY_XFER_PARAM_SET = 168,
+        WLAN_EID_BEAM_LINK_MAINT = 169,
+        WLAN_EID_MULTIPLE_MAC_ADDR = 170,
+        WLAN_EID_U_PID = 171,
+        WLAN_EID_DMG_LINK_ADAPT_ACK = 172,
+        WLAN_EID_QUIET_PERIOD_REQ = 175,
+        WLAN_EID_QUIET_PERIOD_RESP = 177,
+        WLAN_EID_EPAC_POLICY = 182,
+        WLAN_EID_CLISTER_TIME_OFF = 183,
+        WLAN_EID_ANTENNA_SECTOR_ID_PATTERN = 190,
 };
 
 /* Action category code */
@@ -1348,7 +1522,10 @@ enum ieee80211_category {
         WLAN_CATEGORY_MESH_ACTION = 13,
         WLAN_CATEGORY_MULTIHOP_ACTION = 14,
         WLAN_CATEGORY_SELF_PROTECTED = 15,
+        WLAN_CATEGORY_DMG = 16,
         WLAN_CATEGORY_WMM = 17,
+        WLAN_CATEGORY_FST = 18,
+        WLAN_CATEGORY_UNPROT_DMG = 20,
         WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
         WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
 };
@@ -1443,7 +1620,7 @@ enum ieee80211_tdls_actioncode {
  *
  * @IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET: the default synchronization method
  * @IEEE80211_SYNC_METHOD_VENDOR: a vendor specific synchronization method
- * that will be specified in a vendor specific information element
+ *      that will be specified in a vendor specific information element
  */
 enum {
         IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET = 1,
@@ -1455,7 +1632,7 @@ enum {
  *
  * @IEEE80211_PATH_PROTOCOL_HWMP: the default path selection protocol
  * @IEEE80211_PATH_PROTOCOL_VENDOR: a vendor specific protocol that will
- * be specified in a vendor specific information element
+ *      be specified in a vendor specific information element
  */
 enum {
         IEEE80211_PATH_PROTOCOL_HWMP = 1,
@@ -1467,13 +1644,35 @@ enum {
  *
  * @IEEE80211_PATH_METRIC_AIRTIME: the default path selection metric
  * @IEEE80211_PATH_METRIC_VENDOR: a vendor specific metric that will be
- * specified in a vendor specific information element
+ *      specified in a vendor specific information element
  */
 enum {
         IEEE80211_PATH_METRIC_AIRTIME = 1,
         IEEE80211_PATH_METRIC_VENDOR = 255,
 };
 
+/**
+ * enum ieee80211_root_mode_identifier - root mesh STA mode identifier
+ *
+ * These attribute are used by dot11MeshHWMPRootMode to set root mesh STA mode
+ *
+ * @IEEE80211_ROOTMODE_NO_ROOT: the mesh STA is not a root mesh STA (default)
+ * @IEEE80211_ROOTMODE_ROOT: the mesh STA is a root mesh STA if greater than
+ *      this value
+ * @IEEE80211_PROACTIVE_PREQ_NO_PREP: the mesh STA is a root mesh STA supports
+ *      the proactive PREQ with proactive PREP subfield set to 0
+ * @IEEE80211_PROACTIVE_PREQ_WITH_PREP: the mesh STA is a root mesh STA
+ *      supports the proactive PREQ with proactive PREP subfield set to 1
+ * @IEEE80211_PROACTIVE_RANN: the mesh STA is a root mesh STA supports
+ *      the proactive RANN
+ */
+enum ieee80211_root_mode_identifier {
+        IEEE80211_ROOTMODE_NO_ROOT = 0,
+        IEEE80211_ROOTMODE_ROOT = 1,
+        IEEE80211_PROACTIVE_PREQ_NO_PREP = 2,
+        IEEE80211_PROACTIVE_PREQ_WITH_PREP = 3,
+        IEEE80211_PROACTIVE_RANN = 4,
+};
 
 /*
  * IEEE 802.11-2007 7.3.2.9 Country information element
@@ -1574,6 +1773,7 @@ enum ieee80211_sa_query_action {
 #define WLAN_CIPHER_SUITE_CCMP          0x000FAC04
 #define WLAN_CIPHER_SUITE_WEP104        0x000FAC05
 #define WLAN_CIPHER_SUITE_AES_CMAC      0x000FAC06
+#define WLAN_CIPHER_SUITE_GCMP          0x000FAC08
 
 #define WLAN_CIPHER_SUITE_SMS4          0x00147201
 
@@ -1589,6 +1789,10 @@ enum ieee80211_sa_query_action {
 
 #define WLAN_OUI_WFA                    0x506f9a
 #define WLAN_OUI_TYPE_WFA_P2P           9
+#define WLAN_OUI_MICROSOFT              0x0050f2
+#define WLAN_OUI_TYPE_MICROSOFT_WPA     1
+#define WLAN_OUI_TYPE_MICROSOFT_WMM     2
+#define WLAN_OUI_TYPE_MICROSOFT_WPS     4
 
 /*
  * WMM/802.11e Tspec Element
diff --git a/include/linux/if.h b/include/linux/if.h
index f995c663c493..1ec407b01e46 100644
--- a/include/linux/if.h
+++ b/include/linux/if.h
@@ -81,6 +81,8 @@
 #define IFF_UNICAST_FLT 0x20000         /* Supports unicast filtering   */
 #define IFF_TEAM_PORT   0x40000         /* device used as team port */
 #define IFF_SUPP_NOFCS  0x80000         /* device supports sending custom FCS */
+#define IFF_LIVE_ADDR_CHANGE 0x100000   /* device supports hardware address
+                                         * change when it's running */
 
 
 #define IF_GET_IFACE    0x0001          /* for querying only */
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index 56d907a2c804..167ce5b363d2 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -105,7 +105,8 @@
 #define ETH_P_WAN_PPP   0x0007          /* Dummy type for WAN PPP frames*/
 #define ETH_P_PPP_MP    0x0008          /* Dummy type for PPP MP frames */
 #define ETH_P_LOCALTALK 0x0009          /* Localtalk pseudo type        */
-#define ETH_P_CAN       0x000C          /* Controller Area Network      */
+#define ETH_P_CAN       0x000C          /* CAN: Controller Area Network */
+#define ETH_P_CANFD     0x000D          /* CANFD: CAN flexible data rate*/
 #define ETH_P_PPPTALK   0x0010          /* Dummy type for Atalk over PPP*/
 #define ETH_P_TR_802_2  0x0011          /* 802.2 frames                 */
 #define ETH_P_MOBITEX   0x0015          /* Mobitex (kaz@cafe.net)       */
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index f715750d0b87..ac173bd2ab65 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -140,6 +140,8 @@ enum {
         IFLA_EXT_MASK,          /* Extended info mask, VFs, etc */
         IFLA_PROMISCUITY,       /* Promiscuity count: > 0 means acts PROMISC */
 #define IFLA_PROMISCUITY IFLA_PROMISCUITY
+        IFLA_NUM_TX_QUEUES,
+        IFLA_NUM_RX_QUEUES,
         __IFLA_MAX
 };
 
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 8185f57a9c7f..6960fc1841a7 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -13,6 +13,9 @@
 
 #ifdef __KERNEL__
 
+#include <linux/netpoll.h>
+#include <net/sch_generic.h>
+
 struct team_pcpu_stats {
         u64                     rx_packets;
         u64                     rx_bytes;
@@ -60,9 +63,54 @@ struct team_port {
                 unsigned int mtu;
         } orig;
 
-        struct rcu_head rcu;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        struct netpoll *np;
+#endif
+
+        long mode_priv[0];
 };
 
+static inline bool team_port_enabled(struct team_port *port)
+{
+        return port->index != -1;
+}
+
+static inline bool team_port_txable(struct team_port *port)
+{
+        return port->linkup && team_port_enabled(port);
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static inline void team_netpoll_send_skb(struct team_port *port,
+                                         struct sk_buff *skb)
+{
+        struct netpoll *np = port->np;
+
+        if (np)
+                netpoll_send_skb(np, skb);
+}
+#else
+static inline void team_netpoll_send_skb(struct team_port *port,
+                                         struct sk_buff *skb)
+{
+}
+#endif
+
+static inline int team_dev_queue_xmit(struct team *team, struct team_port *port,
+                                      struct sk_buff *skb)
+{
+        BUILD_BUG_ON(sizeof(skb->queue_mapping) !=
+                     sizeof(qdisc_skb_cb(skb)->slave_dev_queue_mapping));
+        skb_set_queue_mapping(skb, qdisc_skb_cb(skb)->slave_dev_queue_mapping);
+
+        skb->dev = port->dev;
+        if (unlikely(netpoll_tx_running(port->dev))) {
+                team_netpoll_send_skb(port, skb);
+                return 0;
+        }
+        return dev_queue_xmit(skb);
+}
+
 struct team_mode_ops {
         int (*init)(struct team *team);
         void (*exit)(struct team *team);
@@ -73,6 +121,8 @@ struct team_mode_ops {
         int (*port_enter)(struct team *team, struct team_port *port);
         void (*port_leave)(struct team *team, struct team_port *port);
         void (*port_change_mac)(struct team *team, struct team_port *port);
+        void (*port_enabled)(struct team *team, struct team_port *port);
+        void (*port_disabled)(struct team *team, struct team_port *port);
 };
 
 enum team_option_type {
@@ -82,6 +132,11 @@ enum team_option_type {
         TEAM_OPTION_TYPE_BOOL,
 };
 
+struct team_option_inst_info {
+        u32 array_index;
+        struct team_port *port; /* != NULL if per-port */
+};
+
 struct team_gsetter_ctx {
         union {
                 u32 u32_val;
@@ -92,23 +147,28 @@ struct team_gsetter_ctx {
                 } bin_val;
                 bool bool_val;
         } data;
-        struct team_port *port;
+        struct team_option_inst_info *info;
 };
 
 struct team_option {
         struct list_head list;
         const char *name;
         bool per_port;
+        unsigned int array_size; /* != 0 means the option is array */
         enum team_option_type type;
+        int (*init)(struct team *team, struct team_option_inst_info *info);
         int (*getter)(struct team *team, struct team_gsetter_ctx *ctx);
         int (*setter)(struct team *team, struct team_gsetter_ctx *ctx);
 };
 
+extern void team_option_inst_set_change(struct team_option_inst_info *opt_inst_info);
+extern void team_options_change_check(struct team *team);
+
 struct team_mode {
-        struct list_head list;
         const char *kind;
         struct module *owner;
         size_t priv_size;
+        size_t port_priv_size;
         const struct team_mode_ops *ops;
 };
 
@@ -178,8 +238,11 @@ extern int team_options_register(struct team *team,
 extern void team_options_unregister(struct team *team,
                                     const struct team_option *option,
                                     size_t option_count);
-extern int team_mode_register(struct team_mode *mode);
-extern int team_mode_unregister(struct team_mode *mode);
+extern int team_mode_register(const struct team_mode *mode);
+extern void team_mode_unregister(const struct team_mode *mode);
+
+#define TEAM_DEFAULT_NUM_TX_QUEUES 16
+#define TEAM_DEFAULT_NUM_RX_QUEUES 16
 
 #endif /* __KERNEL__ */
 
@@ -241,6 +304,7 @@ enum {
         TEAM_ATTR_OPTION_DATA,          /* dynamic */
         TEAM_ATTR_OPTION_REMOVED,       /* flag */
         TEAM_ATTR_OPTION_PORT_IFINDEX,  /* u32 */ /* for per-port options */
+        TEAM_ATTR_OPTION_ARRAY_INDEX,   /* u32 */ /* for array options */
 
         __TEAM_ATTR_OPTION_MAX,
         TEAM_ATTR_OPTION_MAX = __TEAM_ATTR_OPTION_MAX - 1,
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index 16b92d008bed..5efff60b6f56 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -80,4 +80,18 @@ enum {
 
 #define IFLA_GRE_MAX    (__IFLA_GRE_MAX - 1)
 
+/* VTI-mode i_flags */
+#define VTI_ISVTI 0x0001
+
+enum {
+        IFLA_VTI_UNSPEC,
+        IFLA_VTI_LINK,
+        IFLA_VTI_IKEY,
+        IFLA_VTI_OKEY,
+        IFLA_VTI_LOCAL,
+        IFLA_VTI_REMOTE,
+        __IFLA_VTI_MAX,
+};
+
+#define IFLA_VTI_MAX    (__IFLA_VTI_MAX - 1)
 #endif /* _IF_TUNNEL_H_ */
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 597f4a9f3240..67f9ddacb70c 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -38,6 +38,7 @@ enum
         IPV4_DEVCONF_ACCEPT_LOCAL,
         IPV4_DEVCONF_SRC_VMARK,
         IPV4_DEVCONF_PROXY_ARP_PVLAN,
+        IPV4_DEVCONF_ROUTE_LOCALNET,
         __IPV4_DEVCONF_MAX
 };
 
@@ -131,6 +132,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 #define IN_DEV_PROMOTE_SECONDARIES(in_dev) \
                                         IN_DEV_ORCONF((in_dev), \
                                                       PROMOTE_SECONDARIES)
+#define IN_DEV_ROUTE_LOCALNET(in_dev)   IN_DEV_ORCONF(in_dev, ROUTE_LOCALNET)
 
 #define IN_DEV_RX_REDIRECTS(in_dev) \
         ((IN_DEV_FORWARD(in_dev) && \
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 8260ef779762..379e433e15e0 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -299,9 +299,9 @@ struct ipv6_pinfo {
         struct in6_addr         rcv_saddr;
         struct in6_addr         daddr;
         struct in6_pktinfo      sticky_pktinfo;
-        struct in6_addr         *daddr_cache;
+        const struct in6_addr           *daddr_cache;
 #ifdef CONFIG_IPV6_SUBTREES
-        struct in6_addr         *saddr_cache;
+        const struct in6_addr           *saddr_cache;
 #endif
 
         __be32                  flow_label;
@@ -410,6 +410,22 @@ struct tcp6_sock {
 
 extern int inet6_sk_rebuild_header(struct sock *sk);
 
+struct inet6_timewait_sock {
+        struct in6_addr tw_v6_daddr;
+        struct in6_addr tw_v6_rcv_saddr;
+};
+
+struct tcp6_timewait_sock {
+        struct tcp_timewait_sock   tcp6tw_tcp;
+        struct inet6_timewait_sock tcp6tw_inet6;
+};
+
+static inline struct inet6_timewait_sock *inet6_twsk(const struct sock *sk)
+{
+        return (struct inet6_timewait_sock *)(((u8 *)sk) +
+                                              inet_twsk(sk)->tw_ipv6_offset);
+}
+
 #if IS_ENABLED(CONFIG_IPV6)
 static inline struct ipv6_pinfo * inet6_sk(const struct sock *__sk)
 {
@@ -459,28 +475,12 @@ static inline void inet_sk_copy_descendant(struct sock *sk_to,
 #define __ipv6_only_sock(sk)    (inet6_sk(sk)->ipv6only)
 #define ipv6_only_sock(sk)      ((sk)->sk_family == PF_INET6 && __ipv6_only_sock(sk))
 
-struct inet6_timewait_sock {
-        struct in6_addr tw_v6_daddr;
-        struct in6_addr tw_v6_rcv_saddr;
-};
-
-struct tcp6_timewait_sock {
-        struct tcp_timewait_sock   tcp6tw_tcp;
-        struct inet6_timewait_sock tcp6tw_inet6;
-};
-
 static inline u16 inet6_tw_offset(const struct proto *prot)
 {
         return prot->twsk_prot->twsk_obj_size -
                         sizeof(struct inet6_timewait_sock);
 }
 
-static inline struct inet6_timewait_sock *inet6_twsk(const struct sock *sk)
-{
-        return (struct inet6_timewait_sock *)(((u8 *)sk) +
-                                              inet_twsk(sk)->tw_ipv6_offset);
-}
-
 static inline struct in6_addr *__inet6_rcv_saddr(const struct sock *sk)
 {
         return likely(sk->sk_state != TCP_TIME_WAIT) ?
diff --git a/include/linux/ks8851_mll.h b/include/linux/ks8851_mll.h
new file mode 100644
index 000000000000..e9ccfb59ed30
--- /dev/null
+++ b/include/linux/ks8851_mll.h
@@ -0,0 +1,33 @@
+/*
+ * ks8861_mll platform data struct definition
+ * Copyright (c) 2012 BTicino S.p.A.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _LINUX_KS8851_MLL_H
+#define _LINUX_KS8851_MLL_H
+
+#include <linux/if_ether.h>
+
+/**
+ * struct ks8851_mll_platform_data - Platform data of the KS8851_MLL network driver
+ * @macaddr:    The MAC address of the device, set to all 0:s to use the on in
+ *              the chip.
+ */
+struct ks8851_mll_platform_data {
+        u8 mac_addr[ETH_ALEN];
+};
+
+#endif
diff --git a/include/linux/mdio.h b/include/linux/mdio.h
index dfb947959ec9..7cccafe50e7b 100644
--- a/include/linux/mdio.h
+++ b/include/linux/mdio.h
@@ -43,7 +43,11 @@
 #define MDIO_PKGID2             15
 #define MDIO_AN_ADVERTISE       16      /* AN advertising (base page) */
 #define MDIO_AN_LPA             19      /* AN LP abilities (base page) */
+#define MDIO_PCS_EEE_ABLE       20      /* EEE Capability register */
+#define MDIO_PCS_EEE_WK_ERR     22      /* EEE wake error counter */
 #define MDIO_PHYXS_LNSTAT       24      /* PHY XGXS lane state */
+#define MDIO_AN_EEE_ADV         60      /* EEE advertisement */
+#define MDIO_AN_EEE_LPABLE      61      /* EEE link partner ability */
 
 /* Media-dependent registers. */
 #define MDIO_PMA_10GBT_SWAPPOL  130     /* 10GBASE-T pair swap & polarity */
@@ -56,7 +60,6 @@
 #define MDIO_PCS_10GBRT_STAT2   33      /* 10GBASE-R/-T PCS status 2 */
 #define MDIO_AN_10GBT_CTRL      32      /* 10GBASE-T auto-negotiation control */
 #define MDIO_AN_10GBT_STAT      33      /* 10GBASE-T auto-negotiation status */
-#define MDIO_AN_EEE_ADV         60      /* EEE advertisement */
 
 /* LASI (Link Alarm Status Interrupt) registers, defined by XENPAK MSA. */
 #define MDIO_PMA_LASI_RXCTRL    0x9000  /* RX_ALARM control */
@@ -82,6 +85,7 @@
 #define MDIO_AN_CTRL1_RESTART           BMCR_ANRESTART
 #define MDIO_AN_CTRL1_ENABLE            BMCR_ANENABLE
 #define MDIO_AN_CTRL1_XNP               0x2000  /* Enable extended next page */
+#define MDIO_PCS_CTRL1_CLKSTOP_EN       0x400   /* Stop the clock during LPI */
 
 /* 10 Gb/s */
 #define MDIO_CTRL1_SPEED10G             (MDIO_CTRL1_SPEEDSELEXT | 0x00)
@@ -237,9 +241,25 @@
 #define MDIO_AN_10GBT_STAT_MS           0x4000  /* Master/slave config */
 #define MDIO_AN_10GBT_STAT_MSFLT        0x8000  /* Master/slave config fault */
 
-/* AN EEE Advertisement register. */
-#define MDIO_AN_EEE_ADV_100TX           0x0002  /* Advertise 100TX EEE cap */
-#define MDIO_AN_EEE_ADV_1000T           0x0004  /* Advertise 1000T EEE cap */
+/* EEE Supported/Advertisement/LP Advertisement registers.
+ *
+ * EEE capability Register (3.20), Advertisement (7.60) and
+ * Link partner ability (7.61) registers have and can use the same identical
+ * bit masks.
+ */
+#define MDIO_AN_EEE_ADV_100TX   0x0002  /* Advertise 100TX EEE cap */
+#define MDIO_AN_EEE_ADV_1000T   0x0004  /* Advertise 1000T EEE cap */
+/* Note: the two defines above can be potentially used by the user-land
+ * and cannot remove them now.
+ * So, we define the new generic MDIO_EEE_100TX and MDIO_EEE_1000T macros
+ * using the previous ones (that can be considered obsolete).
+ */
+#define MDIO_EEE_100TX          MDIO_AN_EEE_ADV_100TX   /* 100TX EEE cap */
+#define MDIO_EEE_1000T          MDIO_AN_EEE_ADV_1000T   /* 1000T EEE cap */
+#define MDIO_EEE_10GT           0x0008  /* 10GT EEE cap */
+#define MDIO_EEE_1000KX         0x0010  /* 1000KX EEE cap */
+#define MDIO_EEE_10GKX4         0x0020  /* 10G KX4 EEE cap */
+#define MDIO_EEE_10GKR          0x0040  /* 10G KR EEE cap */
 
 /* LASI RX_ALARM control/status registers. */
 #define MDIO_PMA_LASI_RX_PHYXSLFLT      0x0001  /* PHY XS RX local fault */
diff --git a/include/linux/mii.h b/include/linux/mii.h
index 2783eca629a0..8ef3a7a11592 100644
--- a/include/linux/mii.h
+++ b/include/linux/mii.h
@@ -21,6 +21,8 @@
 #define MII_EXPANSION           0x06    /* Expansion register          */
 #define MII_CTRL1000            0x09    /* 1000BASE-T control          */
 #define MII_STAT1000            0x0a    /* 1000BASE-T status           */
+#define MII_MMD_CTRL            0x0d    /* MMD Access Control Register */
+#define MII_MMD_DATA            0x0e    /* MMD Access Data Register */
 #define MII_ESTATUS             0x0f    /* Extended Status             */
 #define MII_DCOUNTER            0x12    /* Disconnect counter          */
 #define MII_FCSCOUNTER          0x13    /* False carrier counter       */
@@ -141,6 +143,13 @@
 #define FLOW_CTRL_TX            0x01
 #define FLOW_CTRL_RX            0x02
 
+/* MMD Access Control register fields */
+#define MII_MMD_CTRL_DEVAD_MASK 0x1f    /* Mask MMD DEVAD*/
+#define MII_MMD_CTRL_ADDR       0x0000  /* Address */
+#define MII_MMD_CTRL_NOINCR     0x4000  /* no post increment */
+#define MII_MMD_CTRL_INCR_RDWT  0x8000  /* post increment on reads & writes */
+#define MII_MMD_CTRL_INCR_ON_WT 0xC000  /* post increment on writes only */
+
 /* This structure is used in all SIOCxMIIxxx ioctl calls */
 struct mii_ioctl_data {
         __u16           phy_id;
diff --git a/include/linux/mlx4/cmd.h b/include/linux/mlx4/cmd.h
index 1f3860a8a109..260695186256 100644
--- a/include/linux/mlx4/cmd.h
+++ b/include/linux/mlx4/cmd.h
@@ -154,6 +154,10 @@ enum {
         /* set port opcode modifiers */
         MLX4_SET_PORT_PRIO2TC = 0x8,
         MLX4_SET_PORT_SCHEDULER  = 0x9,
+
+        /* register/delete flow steering network rules */
+        MLX4_QP_FLOW_STEERING_ATTACH = 0x65,
+        MLX4_QP_FLOW_STEERING_DETACH = 0x66,
 };
 
 enum {
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 6a8f002b8ed3..4d7761f8c3f6 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -36,6 +36,7 @@
 #include <linux/pci.h>
 #include <linux/completion.h>
 #include <linux/radix-tree.h>
+#include <linux/cpu_rmap.h>
 
 #include <linux/atomic.h>
 
@@ -70,6 +71,36 @@ enum {
         MLX4_MFUNC_EQE_MASK     = (MLX4_MFUNC_MAX_EQES - 1)
 };
 
+/* Driver supports 3 diffrent device methods to manage traffic steering:
+ *      -device managed - High level API for ib and eth flow steering. FW is
+ *                        managing flow steering tables.
+ *      - B0 steering mode - Common low level API for ib and (if supported) eth.
+ *      - A0 steering mode - Limited low level API for eth. In case of IB,
+ *                           B0 mode is in use.
+ */
+enum {
+        MLX4_STEERING_MODE_A0,
+        MLX4_STEERING_MODE_B0,
+        MLX4_STEERING_MODE_DEVICE_MANAGED
+};
+
+static inline const char *mlx4_steering_mode_str(int steering_mode)
+{
+        switch (steering_mode) {
+        case MLX4_STEERING_MODE_A0:
+                return "A0 steering";
+
+        case MLX4_STEERING_MODE_B0:
+                return "B0 steering";
+
+        case MLX4_STEERING_MODE_DEVICE_MANAGED:
+                return "Device managed flow steering";
+
+        default:
+                return "Unrecognize steering mode";
+        }
+}
+
 enum {
         MLX4_DEV_CAP_FLAG_RC            = 1LL <<  0,
         MLX4_DEV_CAP_FLAG_UC            = 1LL <<  1,
@@ -102,7 +133,8 @@ enum {
 enum {
         MLX4_DEV_CAP_FLAG2_RSS                  = 1LL <<  0,
         MLX4_DEV_CAP_FLAG2_RSS_TOP              = 1LL <<  1,
-        MLX4_DEV_CAP_FLAG2_RSS_XOR              = 1LL <<  2
+        MLX4_DEV_CAP_FLAG2_RSS_XOR              = 1LL <<  2,
+        MLX4_DEV_CAP_FLAG2_FS_EN                = 1LL <<  3
 };
 
 #define MLX4_ATTR_EXTENDED_PORT_INFO    cpu_to_be16(0xff90)
@@ -295,6 +327,8 @@ struct mlx4_caps {
         int                     num_amgms;
         int                     reserved_mcgs;
         int                     num_qp_per_mgm;
+        int                     steering_mode;
+        int                     fs_log_max_ucast_qp_range_size;
         int                     num_pds;
         int                     reserved_pds;
         int                     max_xrcds;
@@ -509,6 +543,8 @@ struct mlx4_dev {
         u8                      rev_id;
         char                    board_id[MLX4_BOARD_ID_LEN];
         int                     num_vfs;
+        u64                     regid_promisc_array[MLX4_MAX_PORTS + 1];
+        u64                     regid_allmulti_array[MLX4_MAX_PORTS + 1];
 };
 
 struct mlx4_init_port_param {
@@ -623,9 +659,99 @@ int mlx4_unicast_attach(struct mlx4_dev *dev, struct mlx4_qp *qp, u8 gid[16],
 int mlx4_unicast_detach(struct mlx4_dev *dev, struct mlx4_qp *qp, u8 gid[16],
                         enum mlx4_protocol prot);
 int mlx4_multicast_attach(struct mlx4_dev *dev, struct mlx4_qp *qp, u8 gid[16],
-                          int block_mcast_loopback, enum mlx4_protocol protocol);
+                          u8 port, int block_mcast_loopback,
+                          enum mlx4_protocol protocol, u64 *reg_id);
 int mlx4_multicast_detach(struct mlx4_dev *dev, struct mlx4_qp *qp, u8 gid[16],
-                          enum mlx4_protocol protocol);
+                          enum mlx4_protocol protocol, u64 reg_id);
+
+enum {
+        MLX4_DOMAIN_UVERBS      = 0x1000,
+        MLX4_DOMAIN_ETHTOOL     = 0x2000,
+        MLX4_DOMAIN_RFS         = 0x3000,
+        MLX4_DOMAIN_NIC    = 0x5000,
+};
+
+enum mlx4_net_trans_rule_id {
+        MLX4_NET_TRANS_RULE_ID_ETH = 0,
+        MLX4_NET_TRANS_RULE_ID_IB,
+        MLX4_NET_TRANS_RULE_ID_IPV6,
+        MLX4_NET_TRANS_RULE_ID_IPV4,
+        MLX4_NET_TRANS_RULE_ID_TCP,
+        MLX4_NET_TRANS_RULE_ID_UDP,
+        MLX4_NET_TRANS_RULE_NUM, /* should be last */
+};
+
+enum mlx4_net_trans_promisc_mode {
+        MLX4_FS_PROMISC_NONE = 0,
+        MLX4_FS_PROMISC_UPLINK,
+        /* For future use. Not implemented yet */
+        MLX4_FS_PROMISC_FUNCTION_PORT,
+        MLX4_FS_PROMISC_ALL_MULTI,
+};
+
+struct mlx4_spec_eth {
+        u8      dst_mac[6];
+        u8      dst_mac_msk[6];
+        u8      src_mac[6];
+        u8      src_mac_msk[6];
+        u8      ether_type_enable;
+        __be16  ether_type;
+        __be16  vlan_id_msk;
+        __be16  vlan_id;
+};
+
+struct mlx4_spec_tcp_udp {
+        __be16 dst_port;
+        __be16 dst_port_msk;
+        __be16 src_port;
+        __be16 src_port_msk;
+};
+
+struct mlx4_spec_ipv4 {
+        __be32 dst_ip;
+        __be32 dst_ip_msk;
+        __be32 src_ip;
+        __be32 src_ip_msk;
+};
+
+struct mlx4_spec_ib {
+        __be32  r_qpn;
+        __be32  qpn_msk;
+        u8      dst_gid[16];
+        u8      dst_gid_msk[16];
+};
+
+struct mlx4_spec_list {
+        struct  list_head list;
+        enum    mlx4_net_trans_rule_id id;
+        union {
+                struct mlx4_spec_eth eth;
+                struct mlx4_spec_ib ib;
+                struct mlx4_spec_ipv4 ipv4;
+                struct mlx4_spec_tcp_udp tcp_udp;
+        };
+};
+
+enum mlx4_net_trans_hw_rule_queue {
+        MLX4_NET_TRANS_Q_FIFO,
+        MLX4_NET_TRANS_Q_LIFO,
+};
+
+struct mlx4_net_trans_rule {
+        struct  list_head list;
+        enum    mlx4_net_trans_hw_rule_queue queue_mode;
+        bool    exclusive;
+        bool    allow_loopback;
+        enum    mlx4_net_trans_promisc_mode promisc_mode;
+        u8      port;
+        u16     priority;
+        u32     qpn;
+};
+
+int mlx4_flow_steer_promisc_add(struct mlx4_dev *dev, u8 port, u32 qpn,
+                                enum mlx4_net_trans_promisc_mode mode);
+int mlx4_flow_steer_promisc_remove(struct mlx4_dev *dev, u8 port,
+                                   enum mlx4_net_trans_promisc_mode mode);
 int mlx4_multicast_promisc_add(struct mlx4_dev *dev, u32 qpn, u8 port);
 int mlx4_multicast_promisc_remove(struct mlx4_dev *dev, u32 qpn, u8 port);
 int mlx4_unicast_promisc_add(struct mlx4_dev *dev, u32 qpn, u8 port);
@@ -659,7 +785,8 @@ void mlx4_fmr_unmap(struct mlx4_dev *dev, struct mlx4_fmr *fmr,
 int mlx4_fmr_free(struct mlx4_dev *dev, struct mlx4_fmr *fmr);
 int mlx4_SYNC_TPT(struct mlx4_dev *dev);
 int mlx4_test_interrupts(struct mlx4_dev *dev);
-int mlx4_assign_eq(struct mlx4_dev *dev, char* name , int* vector);
+int mlx4_assign_eq(struct mlx4_dev *dev, char *name, struct cpu_rmap *rmap,
+                   int *vector);
 void mlx4_release_eq(struct mlx4_dev *dev, int vec);
 
 int mlx4_wol_read(struct mlx4_dev *dev, u64 *config, int port);
@@ -668,4 +795,8 @@ int mlx4_wol_write(struct mlx4_dev *dev, u64 config, int port);
 int mlx4_counter_alloc(struct mlx4_dev *dev, u32 *idx);
 void mlx4_counter_free(struct mlx4_dev *dev, u32 idx);
 
+int mlx4_flow_attach(struct mlx4_dev *dev,
+                     struct mlx4_net_trans_rule *rule, u64 *reg_id);
+int mlx4_flow_detach(struct mlx4_dev *dev, u64 reg_id);
+
 #endif /* MLX4_DEVICE_H */
diff --git a/include/linux/mlx4/driver.h b/include/linux/mlx4/driver.h
index 5f1298b1b5ef..8dc485febc6b 100644
--- a/include/linux/mlx4/driver.h
+++ b/include/linux/mlx4/driver.h
@@ -37,6 +37,8 @@
 
 struct mlx4_dev;
 
+#define MLX4_MAC_MASK      0xffffffffffffULL
+
 enum mlx4_dev_event {
         MLX4_DEV_EVENT_CATASTROPHIC_ERROR,
         MLX4_DEV_EVENT_PORT_UP,
diff --git a/include/linux/net.h b/include/linux/net.h
index e9ac2df079ba..99276c3dc89a 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -72,6 +72,7 @@ struct net;
 #define SOCK_NOSPACE            2
 #define SOCK_PASSCRED           3
 #define SOCK_PASSSEC            4
+#define SOCK_EXTERNALLY_ALLOCATED 5
 
 #ifndef ARCH_HAS_SOCKET_TYPES
 /**
@@ -247,6 +248,7 @@ extern int	     sock_recvmsg(struct socket *sock, struct msghdr *msg,
                                   size_t size, int flags);
 extern int           sock_map_fd(struct socket *sock, int flags);
 extern struct socket *sockfd_lookup(int fd, int *err);
+extern struct socket *sock_from_file(struct file *file, int *err);
 #define              sockfd_put(sock) fput(sock->file)
 extern int           net_ratelimit(void);
 
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d94cb1431519..eb06e58bed0b 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1046,10 +1046,9 @@ struct net_device {
          */
         char                    name[IFNAMSIZ];
 
-        struct pm_qos_request   pm_qos_req;
-
-        /* device name hash chain */
+        /* device name hash chain, please keep it close to name[] */
         struct hlist_node       name_hlist;
+
         /* snmp alias */
         char                    *ifalias;
 
@@ -1322,6 +1321,8 @@ struct net_device {
 
         /* group the device belongs to */
         int group;
+
+        struct pm_qos_request   pm_qos_req;
 };
 #define to_net_dev(d) container_of(d, struct net_device, dev)
 
@@ -1626,6 +1627,7 @@ extern int		dev_alloc_name(struct net_device *dev, const char *name);
 extern int              dev_open(struct net_device *dev);
 extern int              dev_close(struct net_device *dev);
 extern void             dev_disable_lro(struct net_device *dev);
+extern int              dev_loopback_xmit(struct sk_buff *newskb);
 extern int              dev_queue_xmit(struct sk_buff *skb);
 extern int              register_netdevice(struct net_device *dev);
 extern void             unregister_netdevice_queue(struct net_device *dev,
@@ -2108,7 +2110,12 @@ static inline int netif_set_real_num_rx_queues(struct net_device *dev,
 static inline int netif_copy_real_num_queues(struct net_device *to_dev,
                                              const struct net_device *from_dev)
 {
-        netif_set_real_num_tx_queues(to_dev, from_dev->real_num_tx_queues);
+        int err;
+
+        err = netif_set_real_num_tx_queues(to_dev,
+                                           from_dev->real_num_tx_queues);
+        if (err)
+                return err;
 #ifdef CONFIG_RPS
         return netif_set_real_num_rx_queues(to_dev,
                                             from_dev->real_num_rx_queues);
@@ -2117,6 +2124,9 @@ static inline int netif_copy_real_num_queues(struct net_device *to_dev,
 #endif
 }
 
+#define DEFAULT_MAX_NUM_RSS_QUEUES      (8)
+extern int netif_get_num_default_rss_queues(void);
+
 /* Use this variant when it is known for sure that it
  * is executing from hardware interrupt context or with hardware interrupts
  * disabled.
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index ff9c84c29b28..c613cf0d7884 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -94,6 +94,16 @@ static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
                a1->all[3] == a2->all[3];
 }
 
+static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
+                                     union nf_inet_addr *result,
+                                     const union nf_inet_addr *mask)
+{
+        result->all[0] = a1->all[0] & mask->all[0];
+        result->all[1] = a1->all[1] & mask->all[1];
+        result->all[2] = a1->all[2] & mask->all[2];
+        result->all[3] = a1->all[3] & mask->all[3];
+}
+
 extern void netfilter_init(void);
 
 /* Largest hook number + 1 */
@@ -383,6 +393,22 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
 extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *) __rcu;
 extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
 extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;
+
+struct nf_conn;
+struct nlattr;
+
+struct nfq_ct_hook {
+        size_t (*build_size)(const struct nf_conn *ct);
+        int (*build)(struct sk_buff *skb, struct nf_conn *ct);
+        int (*parse)(const struct nlattr *attr, struct nf_conn *ct);
+};
+extern struct nfq_ct_hook __rcu *nfq_ct_hook;
+
+struct nfq_ct_nat_hook {
+        void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
+                           u32 ctinfo, int off);
+};
+extern struct nfq_ct_nat_hook __rcu *nfq_ct_nat_hook;
 #else
 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
 #endif
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index 1697036336b6..874ae8f2706b 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -10,6 +10,7 @@ header-y += nfnetlink.h
 header-y += nfnetlink_acct.h
 header-y += nfnetlink_compat.h
 header-y += nfnetlink_conntrack.h
+header-y += nfnetlink_cthelper.h
 header-y += nfnetlink_cttimeout.h
 header-y += nfnetlink_log.h
 header-y += nfnetlink_queue.h
diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h
index 0ce91d56a5f2..0dfc8b7210a3 100644
--- a/include/linux/netfilter/nf_conntrack_sip.h
+++ b/include/linux/netfilter/nf_conntrack_sip.h
@@ -2,6 +2,8 @@
 #define __NF_CONNTRACK_SIP_H__
 #ifdef __KERNEL__
 
+#include <net/netfilter/nf_conntrack_expect.h>
+
 #define SIP_PORT        5060
 #define SIP_TIMEOUT     3600
 
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index a1048c1587d1..18341cdb2443 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -50,7 +50,8 @@ struct nfgenmsg {
 #define NFNL_SUBSYS_IPSET               6
 #define NFNL_SUBSYS_ACCT                7
 #define NFNL_SUBSYS_CTNETLINK_TIMEOUT   8
-#define NFNL_SUBSYS_COUNT               9
+#define NFNL_SUBSYS_CTHELPER            9
+#define NFNL_SUBSYS_COUNT               10
 
 #ifdef __KERNEL__
 
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h
index e58e4b93c108..f649f7423ca2 100644
--- a/include/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/linux/netfilter/nfnetlink_conntrack.h
@@ -7,6 +7,8 @@ enum cntl_msg_types {
         IPCTNL_MSG_CT_GET,
         IPCTNL_MSG_CT_DELETE,
         IPCTNL_MSG_CT_GET_CTRZERO,
+        IPCTNL_MSG_CT_GET_STATS_CPU,
+        IPCTNL_MSG_CT_GET_STATS,
 
         IPCTNL_MSG_MAX
 };
@@ -15,6 +17,7 @@ enum ctnl_exp_msg_types {
         IPCTNL_MSG_EXP_NEW,
         IPCTNL_MSG_EXP_GET,
         IPCTNL_MSG_EXP_DELETE,
+        IPCTNL_MSG_EXP_GET_STATS_CPU,
 
         IPCTNL_MSG_EXP_MAX
 };
@@ -191,6 +194,7 @@ enum ctattr_expect_nat {
 enum ctattr_help {
         CTA_HELP_UNSPEC,
         CTA_HELP_NAME,
+        CTA_HELP_INFO,
         __CTA_HELP_MAX
 };
 #define CTA_HELP_MAX (__CTA_HELP_MAX - 1)
@@ -202,4 +206,39 @@ enum ctattr_secctx {
 };
 #define CTA_SECCTX_MAX (__CTA_SECCTX_MAX - 1)
 
+enum ctattr_stats_cpu {
+        CTA_STATS_UNSPEC,
+        CTA_STATS_SEARCHED,
+        CTA_STATS_FOUND,
+        CTA_STATS_NEW,
+        CTA_STATS_INVALID,
+        CTA_STATS_IGNORE,
+        CTA_STATS_DELETE,
+        CTA_STATS_DELETE_LIST,
+        CTA_STATS_INSERT,
+        CTA_STATS_INSERT_FAILED,
+        CTA_STATS_DROP,
+        CTA_STATS_EARLY_DROP,
+        CTA_STATS_ERROR,
+        CTA_STATS_SEARCH_RESTART,
+        __CTA_STATS_MAX,
+};
+#define CTA_STATS_MAX (__CTA_STATS_MAX - 1)
+
+enum ctattr_stats_global {
+        CTA_STATS_GLOBAL_UNSPEC,
+        CTA_STATS_GLOBAL_ENTRIES,
+        __CTA_STATS_GLOBAL_MAX,
+};
+#define CTA_STATS_GLOBAL_MAX (__CTA_STATS_GLOBAL_MAX - 1)
+
+enum ctattr_expect_stats {
+        CTA_STATS_EXP_UNSPEC,
+        CTA_STATS_EXP_NEW,
+        CTA_STATS_EXP_CREATE,
+        CTA_STATS_EXP_DELETE,
+        __CTA_STATS_EXP_MAX,
+};
+#define CTA_STATS_EXP_MAX (__CTA_STATS_EXP_MAX - 1)
+
 #endif /* _IPCONNTRACK_NETLINK_H */
diff --git a/include/linux/netfilter/nfnetlink_cthelper.h b/include/linux/netfilter/nfnetlink_cthelper.h
new file mode 100644
index 000000000000..33659f6fad3e
--- /dev/null
+++ b/include/linux/netfilter/nfnetlink_cthelper.h
@@ -0,0 +1,55 @@
+#ifndef _NFNL_CTHELPER_H_
+#define _NFNL_CTHELPER_H_
+
+#define NFCT_HELPER_STATUS_DISABLED     0
+#define NFCT_HELPER_STATUS_ENABLED      1
+
+enum nfnl_acct_msg_types {
+        NFNL_MSG_CTHELPER_NEW,
+        NFNL_MSG_CTHELPER_GET,
+        NFNL_MSG_CTHELPER_DEL,
+        NFNL_MSG_CTHELPER_MAX
+};
+
+enum nfnl_cthelper_type {
+        NFCTH_UNSPEC,
+        NFCTH_NAME,
+        NFCTH_TUPLE,
+        NFCTH_QUEUE_NUM,
+        NFCTH_POLICY,
+        NFCTH_PRIV_DATA_LEN,
+        NFCTH_STATUS,
+        __NFCTH_MAX
+};
+#define NFCTH_MAX (__NFCTH_MAX - 1)
+
+enum nfnl_cthelper_policy_type {
+        NFCTH_POLICY_SET_UNSPEC,
+        NFCTH_POLICY_SET_NUM,
+        NFCTH_POLICY_SET,
+        NFCTH_POLICY_SET1       = NFCTH_POLICY_SET,
+        NFCTH_POLICY_SET2,
+        NFCTH_POLICY_SET3,
+        NFCTH_POLICY_SET4,
+        __NFCTH_POLICY_SET_MAX
+};
+#define NFCTH_POLICY_SET_MAX (__NFCTH_POLICY_SET_MAX - 1)
+
+enum nfnl_cthelper_pol_type {
+        NFCTH_POLICY_UNSPEC,
+        NFCTH_POLICY_NAME,
+        NFCTH_POLICY_EXPECT_MAX,
+        NFCTH_POLICY_EXPECT_TIMEOUT,
+        __NFCTH_POLICY_MAX
+};
+#define NFCTH_POLICY_MAX (__NFCTH_POLICY_MAX - 1)
+
+enum nfnl_cthelper_tuple_type {
+        NFCTH_TUPLE_UNSPEC,
+        NFCTH_TUPLE_L3PROTONUM,
+        NFCTH_TUPLE_L4PROTONUM,
+        __NFCTH_TUPLE_MAX,
+};
+#define NFCTH_TUPLE_MAX (__NFCTH_TUPLE_MAX - 1)
+
+#endif /* _NFNL_CTHELPER_H */
diff --git a/include/linux/netfilter/nfnetlink_queue.h b/include/linux/netfilter/nfnetlink_queue.h
index 24b32e6c009e..3b1c1360aedf 100644
--- a/include/linux/netfilter/nfnetlink_queue.h
+++ b/include/linux/netfilter/nfnetlink_queue.h
@@ -42,6 +42,8 @@ enum nfqnl_attr_type {
         NFQA_IFINDEX_PHYSOUTDEV,        /* __u32 ifindex */
         NFQA_HWADDR,                    /* nfqnl_msg_packet_hw */
         NFQA_PAYLOAD,                   /* opaque data payload */
+        NFQA_CT,                        /* nf_conntrack_netlink.h */
+        NFQA_CT_INFO,                   /* enum ip_conntrack_info */
 
         __NFQA_MAX
 };
@@ -84,8 +86,15 @@ enum nfqnl_attr_config {
         NFQA_CFG_CMD,                   /* nfqnl_msg_config_cmd */
         NFQA_CFG_PARAMS,                /* nfqnl_msg_config_params */
         NFQA_CFG_QUEUE_MAXLEN,          /* __u32 */
+        NFQA_CFG_MASK,                  /* identify which flags to change */
+        NFQA_CFG_FLAGS,                 /* value of these flags (__u32) */
         __NFQA_CFG_MAX
 };
 #define NFQA_CFG_MAX (__NFQA_CFG_MAX-1)
 
+/* Flags for NFQA_CFG_FLAGS */
+#define NFQA_CFG_F_FAIL_OPEN                    (1 << 0)
+#define NFQA_CFG_F_CONNTRACK                    (1 << 1)
+#define NFQA_CFG_F_MAX                          (1 << 2)
+
 #endif /* _NFNETLINK_QUEUE_H */
diff --git a/include/linux/netfilter/xt_connlimit.h b/include/linux/netfilter/xt_connlimit.h
index d1366f05d1b2..f1656096121e 100644
--- a/include/linux/netfilter/xt_connlimit.h
+++ b/include/linux/netfilter/xt_connlimit.h
@@ -22,13 +22,8 @@ struct xt_connlimit_info {
 #endif
         };
         unsigned int limit;
-        union {
-                /* revision 0 */
-                unsigned int inverse;
-
-                /* revision 1 */
-                __u32 flags;
-        };
+        /* revision 1 */
+        __u32 flags;
 
         /* Used internally by the kernel */
         struct xt_connlimit_data *data __attribute__((aligned(8)));
diff --git a/include/linux/netfilter/xt_recent.h b/include/linux/netfilter/xt_recent.h
index 83318e01425e..6ef36c113e89 100644
--- a/include/linux/netfilter/xt_recent.h
+++ b/include/linux/netfilter/xt_recent.h
@@ -32,4 +32,14 @@ struct xt_recent_mtinfo {
         __u8 side;
 };
 
+struct xt_recent_mtinfo_v1 {
+        __u32 seconds;
+        __u32 hit_count;
+        __u8 check_set;
+        __u8 invert;
+        char name[XT_RECENT_NAME_LEN];
+        __u8 side;
+        union nf_inet_addr mask;
+};
+
 #endif /* _LINUX_NETFILTER_XT_RECENT_H */
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index fa0946c549d3..e2b12801378d 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -66,6 +66,7 @@ enum nf_ip_hook_priorities {
         NF_IP_PRI_SECURITY = 50,
         NF_IP_PRI_NAT_SRC = 100,
         NF_IP_PRI_SELINUX_LAST = 225,
+        NF_IP_PRI_CONNTRACK_HELPER = 300,
         NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,
         NF_IP_PRI_LAST = INT_MAX,
 };
diff --git a/include/linux/netfilter_ipv4/Kbuild b/include/linux/netfilter_ipv4/Kbuild
index c61b8fb1a9ef..8ba0c5b72ea9 100644
--- a/include/linux/netfilter_ipv4/Kbuild
+++ b/include/linux/netfilter_ipv4/Kbuild
@@ -5,7 +5,6 @@ header-y += ipt_LOG.h
 header-y += ipt_REJECT.h
 header-y += ipt_TTL.h
 header-y += ipt_ULOG.h
-header-y += ipt_addrtype.h
 header-y += ipt_ah.h
 header-y += ipt_ecn.h
 header-y += ipt_ttl.h
diff --git a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h
deleted file mode 100644
index 0da42237c8da..000000000000
--- a/include/linux/netfilter_ipv4/ipt_addrtype.h
+++ /dev/null
@@ -1,27 +0,0 @@
-#ifndef _IPT_ADDRTYPE_H
-#define _IPT_ADDRTYPE_H
-
-#include <linux/types.h>
-
-enum {
-        IPT_ADDRTYPE_INVERT_SOURCE      = 0x0001,
-        IPT_ADDRTYPE_INVERT_DEST        = 0x0002,
-        IPT_ADDRTYPE_LIMIT_IFACE_IN     = 0x0004,
-        IPT_ADDRTYPE_LIMIT_IFACE_OUT    = 0x0008,
-};
-
-struct ipt_addrtype_info_v1 {
-        __u16   source;         /* source-type mask */
-        __u16   dest;           /* dest-type mask */
-        __u32   flags;
-};
-
-/* revision 0 */
-struct ipt_addrtype_info {
-        __u16   source;         /* source-type mask */
-        __u16   dest;           /* dest-type mask */
-        __u32   invert_source;
-        __u32   invert_dest;
-};
-
-#endif
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index 57c025127f1d..7c8a513ce7a3 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -71,6 +71,7 @@ enum nf_ip6_hook_priorities {
         NF_IP6_PRI_SECURITY = 50,
         NF_IP6_PRI_NAT_SRC = 100,
         NF_IP6_PRI_SELINUX_LAST = 225,
+        NF_IP6_PRI_CONNTRACK_HELPER = 300,
         NF_IP6_PRI_LAST = INT_MAX,
 };
 
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 0f628ffa420c..f74dd133788f 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -174,11 +174,17 @@ struct netlink_skb_parms {
 extern void netlink_table_grab(void);
 extern void netlink_table_ungrab(void);
 
-extern struct sock *netlink_kernel_create(struct net *net,
-                                          int unit,unsigned int groups,
-                                          void (*input)(struct sk_buff *skb),
-                                          struct mutex *cb_mutex,
-                                          struct module *module);
+/* optional Netlink kernel configuration parameters */
+struct netlink_kernel_cfg {
+        unsigned int    groups;
+        void            (*input)(struct sk_buff *skb);
+        struct mutex    *cb_mutex;
+        void            (*bind)(int group);
+};
+
+extern struct sock *netlink_kernel_create(struct net *net, int unit,
+                                          struct module *module,
+                                          struct netlink_kernel_cfg *cfg);
 extern void netlink_kernel_release(struct sock *sk);
 extern int __netlink_change_ngroups(struct sock *sk, unsigned int groups);
 extern int netlink_change_ngroups(struct sock *sk, unsigned int groups);
@@ -241,14 +247,6 @@ struct netlink_notify {
 struct nlmsghdr *
 __nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len, int flags);
 
-#define NLMSG_NEW(skb, pid, seq, type, len, flags) \
-({      if (unlikely(skb_tailroom(skb) < (int)NLMSG_SPACE(len))) \
-                goto nlmsg_failure; \
-        __nlmsg_put(skb, pid, seq, type, len, flags); })
-
-#define NLMSG_PUT(skb, pid, seq, type, len) \
-        NLMSG_NEW(skb, pid, seq, type, len, 0)
-
 struct netlink_dump_control {
         int (*dump)(struct sk_buff *skb, struct netlink_callback *);
         int (*done)(struct netlink_callback*);
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index 5dfa091c3347..28f5389c924b 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -43,7 +43,7 @@ struct netpoll_info {
 void netpoll_send_udp(struct netpoll *np, const char *msg, int len);
 void netpoll_print_options(struct netpoll *np);
 int netpoll_parse_options(struct netpoll *np, char *opt);
-int __netpoll_setup(struct netpoll *np);
+int __netpoll_setup(struct netpoll *np, struct net_device *ndev);
 int netpoll_setup(struct netpoll *np);
 int netpoll_trap(void);
 void netpoll_set_trap(int trap);
diff --git a/include/linux/nfc.h b/include/linux/nfc.h
index 0ae9b5857c83..6189f27e305b 100644
--- a/include/linux/nfc.h
+++ b/include/linux/nfc.h
@@ -56,6 +56,10 @@
  *      %NFC_ATTR_PROTOCOLS)
  * @NFC_EVENT_DEVICE_REMOVED: event emitted when a device is removed
  *      (it sends %NFC_ATTR_DEVICE_INDEX)
+ * @NFC_EVENT_TM_ACTIVATED: event emitted when the adapter is activated in
+ *      target mode.
+ * @NFC_EVENT_DEVICE_DEACTIVATED: event emitted when the adapter is deactivated
+ *      from target mode.
  */
 enum nfc_commands {
         NFC_CMD_UNSPEC,
@@ -71,6 +75,8 @@ enum nfc_commands {
         NFC_EVENT_DEVICE_ADDED,
         NFC_EVENT_DEVICE_REMOVED,
         NFC_EVENT_TARGET_LOST,
+        NFC_EVENT_TM_ACTIVATED,
+        NFC_EVENT_TM_DEACTIVATED,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -94,6 +100,8 @@ enum nfc_commands {
  * @NFC_ATTR_TARGET_SENSF_RES: NFC-F targets extra information, max 18 bytes
  * @NFC_ATTR_COMM_MODE: Passive or active mode
  * @NFC_ATTR_RF_MODE: Initiator or target
+ * @NFC_ATTR_IM_PROTOCOLS: Initiator mode protocols to poll for
+ * @NFC_ATTR_TM_PROTOCOLS: Target mode protocols to listen for
  */
 enum nfc_attrs {
         NFC_ATTR_UNSPEC,
@@ -109,6 +117,8 @@ enum nfc_attrs {
         NFC_ATTR_COMM_MODE,
         NFC_ATTR_RF_MODE,
         NFC_ATTR_DEVICE_POWERED,
+        NFC_ATTR_IM_PROTOCOLS,
+        NFC_ATTR_TM_PROTOCOLS,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
@@ -118,6 +128,7 @@ enum nfc_attrs {
 #define NFC_NFCID1_MAXSIZE 10
 #define NFC_SENSB_RES_MAXSIZE 12
 #define NFC_SENSF_RES_MAXSIZE 18
+#define NFC_GB_MAXSIZE        48
 
 /* NFC protocols */
 #define NFC_PROTO_JEWEL         1
@@ -125,8 +136,9 @@ enum nfc_attrs {
 #define NFC_PROTO_FELICA        3
 #define NFC_PROTO_ISO14443      4
 #define NFC_PROTO_NFC_DEP       5
+#define NFC_PROTO_ISO14443_B    6
 
-#define NFC_PROTO_MAX           6
+#define NFC_PROTO_MAX           7
 
 /* NFC communication modes */
 #define NFC_COMM_ACTIVE  0
@@ -135,13 +147,15 @@ enum nfc_attrs {
 /* NFC RF modes */
 #define NFC_RF_INITIATOR 0
 #define NFC_RF_TARGET    1
+#define NFC_RF_NONE      2
 
 /* NFC protocols masks used in bitsets */
-#define NFC_PROTO_JEWEL_MASK    (1 << NFC_PROTO_JEWEL)
-#define NFC_PROTO_MIFARE_MASK   (1 << NFC_PROTO_MIFARE)
-#define NFC_PROTO_FELICA_MASK   (1 << NFC_PROTO_FELICA)
-#define NFC_PROTO_ISO14443_MASK (1 << NFC_PROTO_ISO14443)
-#define NFC_PROTO_NFC_DEP_MASK  (1 << NFC_PROTO_NFC_DEP)
+#define NFC_PROTO_JEWEL_MASK      (1 << NFC_PROTO_JEWEL)
+#define NFC_PROTO_MIFARE_MASK     (1 << NFC_PROTO_MIFARE)
+#define NFC_PROTO_FELICA_MASK     (1 << NFC_PROTO_FELICA)
+#define NFC_PROTO_ISO14443_MASK   (1 << NFC_PROTO_ISO14443)
+#define NFC_PROTO_NFC_DEP_MASK    (1 << NFC_PROTO_NFC_DEP)
+#define NFC_PROTO_ISO14443_B_MASK (1 << NFC_PROTO_ISO14443_B)
 
 struct sockaddr_nfc {
         sa_family_t sa_family;
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index a6959f72745e..2f3878806403 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -170,6 +170,8 @@
  *      %NL80211_ATTR_CIPHER_GROUP, %NL80211_ATTR_WPA_VERSIONS,
  *      %NL80211_ATTR_AKM_SUITES, %NL80211_ATTR_PRIVACY,
  *      %NL80211_ATTR_AUTH_TYPE and %NL80211_ATTR_INACTIVITY_TIMEOUT.
+ *      The channel to use can be set on the interface or be given using the
+ *      %NL80211_ATTR_WIPHY_FREQ and %NL80211_ATTR_WIPHY_CHANNEL_TYPE attrs.
  * @NL80211_CMD_NEW_BEACON: old alias for %NL80211_CMD_START_AP
  * @NL80211_CMD_STOP_AP: Stop AP operation on the given interface
  * @NL80211_CMD_DEL_BEACON: old alias for %NL80211_CMD_STOP_AP
@@ -275,6 +277,12 @@
  * @NL80211_CMD_NEW_SURVEY_RESULTS: survey data notification (as a reply to
  *      NL80211_CMD_GET_SURVEY and on the "scan" multicast group)
  *
+ * @NL80211_CMD_SET_PMKSA: Add a PMKSA cache entry, using %NL80211_ATTR_MAC
+ *      (for the BSSID) and %NL80211_ATTR_PMKID.
+ * @NL80211_CMD_DEL_PMKSA: Delete a PMKSA cache entry, using %NL80211_ATTR_MAC
+ *      (for the BSSID) and %NL80211_ATTR_PMKID.
+ * @NL80211_CMD_FLUSH_PMKSA: Flush all PMKSA cache entries.
+ *
  * @NL80211_CMD_REG_CHANGE: indicates to userspace the regulatory domain
  *      has been changed and provides details of the request information
  *      that caused the change such as who initiated the regulatory request
@@ -454,6 +462,10 @@
  *      the frame.
  * @NL80211_CMD_ACTION_TX_STATUS: Alias for @NL80211_CMD_FRAME_TX_STATUS for
  *      backward compatibility.
+ *
+ * @NL80211_CMD_SET_POWER_SAVE: Set powersave, using %NL80211_ATTR_PS_STATE
+ * @NL80211_CMD_GET_POWER_SAVE: Get powersave status in %NL80211_ATTR_PS_STATE
+ *
  * @NL80211_CMD_SET_CQM: Connection quality monitor configuration. This command
  *      is used to configure connection quality monitoring notification trigger
  *      levels.
@@ -759,6 +771,9 @@ enum nl80211_commands {
  * @NL80211_ATTR_IFNAME: network interface name
  * @NL80211_ATTR_IFTYPE: type of virtual interface, see &enum nl80211_iftype
  *
+ * @NL80211_ATTR_WDEV: wireless device identifier, used for pseudo-devices
+ *      that don't have a netdev (u64)
+ *
  * @NL80211_ATTR_MAC: MAC address (various uses)
  *
  * @NL80211_ATTR_KEY_DATA: (temporal) key data; for TKIP this consists of
@@ -769,6 +784,13 @@ enum nl80211_commands {
  *      section 7.3.2.25.1, e.g. 0x000FAC04)
  * @NL80211_ATTR_KEY_SEQ: transmit key sequence number (IV/PN) for TKIP and
  *      CCMP keys, each six bytes in little endian
+ * @NL80211_ATTR_KEY_DEFAULT: Flag attribute indicating the key is default key
+ * @NL80211_ATTR_KEY_DEFAULT_MGMT: Flag attribute indicating the key is the
+ *      default management key
+ * @NL80211_ATTR_CIPHER_SUITES_PAIRWISE: For crypto settings for connect or
+ *      other commands, indicates which pairwise cipher suites are used
+ * @NL80211_ATTR_CIPHER_SUITE_GROUP: For crypto settings for connect or
+ *      other commands, indicates which group cipher suite is used
  *
  * @NL80211_ATTR_BEACON_INTERVAL: beacon interval in TU
  * @NL80211_ATTR_DTIM_PERIOD: DTIM period for beaconing
@@ -1004,6 +1026,8 @@ enum nl80211_commands {
  * @NL80211_ATTR_ACK: Flag attribute indicating that the frame was
  *      acknowledged by the recipient.
  *
+ * @NL80211_ATTR_PS_STATE: powersave state, using &enum nl80211_ps_state values.
+ *
  * @NL80211_ATTR_CQM: connection quality monitor configuration in a
  *      nested attribute with %NL80211_ATTR_CQM_* sub-attributes.
  *
@@ -1061,7 +1085,7 @@ enum nl80211_commands {
  *      flag isn't set, the frame will be rejected. This is also used as an
  *      nl80211 capability flag.
  *
- * @NL80211_ATTR_BSS_HTOPMODE: HT operation mode (u16)
+ * @NL80211_ATTR_BSS_HT_OPMODE: HT operation mode (u16)
  *
  * @NL80211_ATTR_KEY_DEFAULT_TYPES: A nested attribute containing flags
  *      attributes, specifying what a key should be set as default as.
@@ -1085,10 +1109,10 @@ enum nl80211_commands {
  *      indicate which WoW triggers should be enabled. This is also
  *      used by %NL80211_CMD_GET_WOWLAN to get the currently enabled WoWLAN
  *      triggers.
-
+ *
  * @NL80211_ATTR_SCHED_SCAN_INTERVAL: Interval between scheduled scan
  *      cycles, in msecs.
-
+ *
  * @NL80211_ATTR_SCHED_SCAN_MATCH: Nested attribute with one or more
  *      sets of attributes to match during scheduled scans.  Only BSSs
  *      that match any of the sets will be reported.  These are
@@ -1115,7 +1139,7 @@ enum nl80211_commands {
  *      are managed in software: interfaces of these types aren't subject to
  *      any restrictions in their number or combinations.
  *
- * @%NL80211_ATTR_REKEY_DATA: nested attribute containing the information
+ * @NL80211_ATTR_REKEY_DATA: nested attribute containing the information
  *      necessary for GTK rekeying in the device, see &enum nl80211_rekey_data.
  *
  * @NL80211_ATTR_SCAN_SUPP_RATES: rates per to be advertised as supported in scan,
@@ -1182,7 +1206,6 @@ enum nl80211_commands {
  * @NL80211_ATTR_FEATURE_FLAGS: This u32 attribute contains flags from
  *      &enum nl80211_feature_flags and is advertised in wiphy information.
  * @NL80211_ATTR_PROBE_RESP_OFFLOAD: Indicates that the HW responds to probe
- *
  *      requests while operating in AP-mode.
  *      This attribute holds a bitmap of the supported protocols for
  *      offloading (see &enum nl80211_probe_resp_offload_support_attr).
@@ -1222,6 +1245,12 @@ enum nl80211_commands {
  * @NL80211_ATTR_BG_SCAN_PERIOD: Background scan period in seconds
  *      or 0 to disable background scan.
  *
+ * @NL80211_ATTR_USER_REG_HINT_TYPE: type of regulatory hint passed from
+ *      userspace. If unset it is assumed the hint comes directly from
+ *      a user. If set code could specify exactly what type of source
+ *      was used to provide the hint. For the different types of
+ *      allowed user regulatory hints see nl80211_user_reg_hint_type.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1473,6 +1502,10 @@ enum nl80211_attrs {
 
         NL80211_ATTR_BG_SCAN_PERIOD,
 
+        NL80211_ATTR_WDEV,
+
+        NL80211_ATTR_USER_REG_HINT_TYPE,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1520,6 +1553,13 @@ enum nl80211_attrs {
 #define NL80211_MAX_NR_CIPHER_SUITES            5
 #define NL80211_MAX_NR_AKM_SUITES               2
 
+#define NL80211_MIN_REMAIN_ON_CHANNEL_TIME      10
+
+/* default RSSI threshold for scan results if none specified. */
+#define NL80211_SCAN_RSSI_THOLD_OFF             -300
+
+#define NL80211_CQM_TXE_MAX_INTVL               1800
+
 /**
  * enum nl80211_iftype - (virtual) interface types
  *
@@ -1613,12 +1653,20 @@ struct nl80211_sta_flag_update {
  *
  * These attribute types are used with %NL80211_STA_INFO_TXRATE
  * when getting information about the bitrate of a station.
+ * There are 2 attributes for bitrate, a legacy one that represents
+ * a 16-bit value, and new one that represents a 32-bit value.
+ * If the rate value fits into 16 bit, both attributes are reported
+ * with the same value. If the rate is too high to fit into 16 bits
+ * (>6.5535Gbps) only 32-bit attribute is included.
+ * User space tools encouraged to use the 32-bit attribute and fall
+ * back to the 16-bit one for compatibility with older kernels.
  *
  * @__NL80211_RATE_INFO_INVALID: attribute number 0 is reserved
  * @NL80211_RATE_INFO_BITRATE: total bitrate (u16, 100kbit/s)
  * @NL80211_RATE_INFO_MCS: mcs index for 802.11n (u8)
  * @NL80211_RATE_INFO_40_MHZ_WIDTH: 40 Mhz dualchannel bitrate
  * @NL80211_RATE_INFO_SHORT_GI: 400ns guard interval
+ * @NL80211_RATE_INFO_BITRATE32: total bitrate (u32, 100kbit/s)
  * @NL80211_RATE_INFO_MAX: highest rate_info number currently defined
  * @__NL80211_RATE_INFO_AFTER_LAST: internal use
  */
@@ -1628,6 +1676,7 @@ enum nl80211_rate_info {
         NL80211_RATE_INFO_MCS,
         NL80211_RATE_INFO_40_MHZ_WIDTH,
         NL80211_RATE_INFO_SHORT_GI,
+        NL80211_RATE_INFO_BITRATE32,
 
         /* keep last */
         __NL80211_RATE_INFO_AFTER_LAST,
@@ -1788,6 +1837,9 @@ enum nl80211_mpath_info {
  * @NL80211_BAND_ATTR_HT_CAPA: HT capabilities, as in the HT information IE
  * @NL80211_BAND_ATTR_HT_AMPDU_FACTOR: A-MPDU factor, as in 11n
  * @NL80211_BAND_ATTR_HT_AMPDU_DENSITY: A-MPDU density, as in 11n
+ * @NL80211_BAND_ATTR_VHT_MCS_SET: 32-byte attribute containing the MCS set as
+ *      defined in 802.11ac
+ * @NL80211_BAND_ATTR_VHT_CAPA: VHT capabilities, as in the HT information IE
  * @NL80211_BAND_ATTR_MAX: highest band attribute currently defined
  * @__NL80211_BAND_ATTR_AFTER_LAST: internal use
  */
@@ -1801,6 +1853,9 @@ enum nl80211_band_attr {
         NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
         NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 
+        NL80211_BAND_ATTR_VHT_MCS_SET,
+        NL80211_BAND_ATTR_VHT_CAPA,
+
         /* keep last */
         __NL80211_BAND_ATTR_AFTER_LAST,
         NL80211_BAND_ATTR_MAX = __NL80211_BAND_ATTR_AFTER_LAST - 1
@@ -1952,6 +2007,8 @@ enum nl80211_reg_rule_attr {
  * @__NL80211_SCHED_SCAN_MATCH_ATTR_INVALID: attribute number 0 is reserved
  * @NL80211_SCHED_SCAN_MATCH_ATTR_SSID: SSID to be used for matching,
  * only report BSS with matching SSID.
+ * @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI: RSSI threshold (in dBm) for reporting a
+ *      BSS in scan results. Filtering is turned off if not specified.
  * @NL80211_SCHED_SCAN_MATCH_ATTR_MAX: highest scheduled scan filter
  *      attribute number currently defined
  * @__NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST: internal use
@@ -1959,7 +2016,8 @@ enum nl80211_reg_rule_attr {
 enum nl80211_sched_scan_match_attr {
         __NL80211_SCHED_SCAN_MATCH_ATTR_INVALID,
 
-        NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
+        NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
+        NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 
         /* keep last */
         __NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST,
@@ -1967,6 +2025,9 @@ enum nl80211_sched_scan_match_attr {
                 __NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST - 1
 };
 
+/* only for backward compatibility */
+#define NL80211_ATTR_SCHED_SCAN_MATCH_SSID NL80211_SCHED_SCAN_MATCH_ATTR_SSID
+
 /**
  * enum nl80211_reg_rule_flags - regulatory rule flags
  *
@@ -2008,6 +2069,26 @@ enum nl80211_dfs_regions {
 };
 
 /**
+ * enum nl80211_user_reg_hint_type - type of user regulatory hint
+ *
+ * @NL80211_USER_REG_HINT_USER: a user sent the hint. This is always
+ *      assumed if the attribute is not set.
+ * @NL80211_USER_REG_HINT_CELL_BASE: the hint comes from a cellular
+ *      base station. Device drivers that have been tested to work
+ *      properly to support this type of hint can enable these hints
+ *      by setting the NL80211_FEATURE_CELL_BASE_REG_HINTS feature
+ *      capability on the struct wiphy. The wireless core will
+ *      ignore all cell base station hints until at least one device
+ *      present has been registered with the wireless core that
+ *      has listed NL80211_FEATURE_CELL_BASE_REG_HINTS as a
+ *      supported feature.
+ */
+enum nl80211_user_reg_hint_type {
+        NL80211_USER_REG_HINT_USER      = 0,
+        NL80211_USER_REG_HINT_CELL_BASE = 1,
+};
+
+/**
  * enum nl80211_survey_info - survey information
  *
  * These attribute types are used with %NL80211_ATTR_SURVEY_INFO
@@ -2086,78 +2167,91 @@ enum nl80211_mntr_flags {
  * @__NL80211_MESHCONF_INVALID: internal use
  *
  * @NL80211_MESHCONF_RETRY_TIMEOUT: specifies the initial retry timeout in
- * millisecond units, used by the Peer Link Open message
+ *      millisecond units, used by the Peer Link Open message
  *
  * @NL80211_MESHCONF_CONFIRM_TIMEOUT: specifies the initial confirm timeout, in
- * millisecond units, used by the peer link management to close a peer link
+ *      millisecond units, used by the peer link management to close a peer link
  *
  * @NL80211_MESHCONF_HOLDING_TIMEOUT: specifies the holding timeout, in
- * millisecond units
+ *      millisecond units
  *
  * @NL80211_MESHCONF_MAX_PEER_LINKS: maximum number of peer links allowed
- * on this mesh interface
+ *      on this mesh interface
  *
  * @NL80211_MESHCONF_MAX_RETRIES: specifies the maximum number of peer link
- * open retries that can be sent to establish a new peer link instance in a
- * mesh
+ *      open retries that can be sent to establish a new peer link instance in a
+ *      mesh
  *
  * @NL80211_MESHCONF_TTL: specifies the value of TTL field set at a source mesh
- * point.
+ *      point.
  *
  * @NL80211_MESHCONF_AUTO_OPEN_PLINKS: whether we should automatically
- * open peer links when we detect compatible mesh peers.
+ *      open peer links when we detect compatible mesh peers.
  *
  * @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES: the number of action frames
- * containing a PREQ that an MP can send to a particular destination (path
- * target)
+ *      containing a PREQ that an MP can send to a particular destination (path
+ *      target)
  *
  * @NL80211_MESHCONF_PATH_REFRESH_TIME: how frequently to refresh mesh paths
- * (in milliseconds)
+ *      (in milliseconds)
  *
  * @NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT: minimum length of time to wait
- * until giving up on a path discovery (in milliseconds)
+ *      until giving up on a path discovery (in milliseconds)
  *
  * @NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT: The time (in TUs) for which mesh
- * points receiving a PREQ shall consider the forwarding information from the
- * root to be valid. (TU = time unit)
+ *      points receiving a PREQ shall consider the forwarding information from
+ *      the root to be valid. (TU = time unit)
  *
  * @NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL: The minimum interval of time (in
- * TUs) during which an MP can send only one action frame containing a PREQ
- * reference element
+ *      TUs) during which an MP can send only one action frame containing a PREQ
+ *      reference element
  *
  * @NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME: The interval of time (in TUs)
- * that it takes for an HWMP information element to propagate across the mesh
+ *      that it takes for an HWMP information element to propagate across the
+ *      mesh
  *
  * @NL80211_MESHCONF_HWMP_ROOTMODE: whether root mode is enabled or not
  *
  * @NL80211_MESHCONF_ELEMENT_TTL: specifies the value of TTL field set at a
- * source mesh point for path selection elements.
+ *      source mesh point for path selection elements.
  *
  * @NL80211_MESHCONF_HWMP_RANN_INTERVAL:  The interval of time (in TUs) between
- * root announcements are transmitted.
+ *      root announcements are transmitted.
  *
  * @NL80211_MESHCONF_GATE_ANNOUNCEMENTS: Advertise that this mesh station has
- * access to a broader network beyond the MBSS.  This is done via Root
- * Announcement frames.
+ *      access to a broader network beyond the MBSS.  This is done via Root
+ *      Announcement frames.
  *
  * @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL: The minimum interval of time (in
- * TUs) during which a mesh STA can send only one Action frame containing a
- * PERR element.
+ *      TUs) during which a mesh STA can send only one Action frame containing a
+ *      PERR element.
  *
  * @NL80211_MESHCONF_FORWARDING: set Mesh STA as forwarding or non-forwarding
- * or forwarding entity (default is TRUE - forwarding entity)
+ *      or forwarding entity (default is TRUE - forwarding entity)
  *
  * @NL80211_MESHCONF_RSSI_THRESHOLD: RSSI threshold in dBm. This specifies the
- * threshold for average signal strength of candidate station to establish
- * a peer link.
- *
- * @NL80211_MESHCONF_ATTR_MAX: highest possible mesh configuration attribute
+ *      threshold for average signal strength of candidate station to establish
+ *      a peer link.
  *
  * @NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR: maximum number of neighbors
- * to synchronize to for 11s default synchronization method (see 11C.12.2.2)
+ *      to synchronize to for 11s default synchronization method
+ *      (see 11C.12.2.2)
  *
  * @NL80211_MESHCONF_HT_OPMODE: set mesh HT protection mode.
  *
+ * @NL80211_MESHCONF_ATTR_MAX: highest possible mesh configuration attribute
+ *
+ * @NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT: The time (in TUs) for
+ *      which mesh STAs receiving a proactive PREQ shall consider the forwarding
+ *      information to the root mesh STA to be valid.
+ *
+ * @NL80211_MESHCONF_HWMP_ROOT_INTERVAL: The interval of time (in TUs) between
+ *      proactive PREQs are transmitted.
+ *
+ * @NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL: The minimum interval of time
+ *      (in TUs) during which a mesh STA can send only one Action frame
+ *      containing a PREQ element for root path confirmation.
+ *
  * @__NL80211_MESHCONF_ATTR_AFTER_LAST: internal use
  */
 enum nl80211_meshconf_params {
@@ -2184,6 +2278,9 @@ enum nl80211_meshconf_params {
         NL80211_MESHCONF_RSSI_THRESHOLD,
         NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
         NL80211_MESHCONF_HT_OPMODE,
+        NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
+        NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
+        NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
 
         /* keep last */
         __NL80211_MESHCONF_ATTR_AFTER_LAST,
@@ -2199,34 +2296,36 @@ enum nl80211_meshconf_params {
  * @__NL80211_MESH_SETUP_INVALID: Internal use
  *
  * @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL: Enable this option to use a
- * vendor specific path selection algorithm or disable it to use the default
- * HWMP.
+ *      vendor specific path selection algorithm or disable it to use the
+ *      default HWMP.
  *
  * @NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC: Enable this option to use a
- * vendor specific path metric or disable it to use the default Airtime
- * metric.
+ *      vendor specific path metric or disable it to use the default Airtime
+ *      metric.
  *
  * @NL80211_MESH_SETUP_IE: Information elements for this mesh, for instance, a
- * robust security network ie, or a vendor specific information element that
- * vendors will use to identify the path selection methods and metrics in use.
+ *      robust security network ie, or a vendor specific information element
+ *      that vendors will use to identify the path selection methods and
+ *      metrics in use.
  *
  * @NL80211_MESH_SETUP_USERSPACE_AUTH: Enable this option if an authentication
- * daemon will be authenticating mesh candidates.
+ *      daemon will be authenticating mesh candidates.
  *
  * @NL80211_MESH_SETUP_USERSPACE_AMPE: Enable this option if an authentication
- * daemon will be securing peer link frames.  AMPE is a secured version of Mesh
- * Peering Management (MPM) and is implemented with the assistance of a
- * userspace daemon.  When this flag is set, the kernel will send peer
- * management frames to a userspace daemon that will implement AMPE
- * functionality (security capabilities selection, key confirmation, and key
- * management).  When the flag is unset (default), the kernel can autonomously
- * complete (unsecured) mesh peering without the need of a userspace daemon.
- *
- * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
+ *      daemon will be securing peer link frames.  AMPE is a secured version of
+ *      Mesh Peering Management (MPM) and is implemented with the assistance of
+ *      a userspace daemon.  When this flag is set, the kernel will send peer
+ *      management frames to a userspace daemon that will implement AMPE
+ *      functionality (security capabilities selection, key confirmation, and
+ *      key management).  When the flag is unset (default), the kernel can
+ *      autonomously complete (unsecured) mesh peering without the need of a
+ *      userspace daemon.
  *
  * @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC: Enable this option to use a
- * vendor specific synchronization method or disable it to use the default
- * neighbor offset synchronization
+ *      vendor specific synchronization method or disable it to use the default
+ *      neighbor offset synchronization
+ *
+ * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
  *
  * @__NL80211_MESH_SETUP_ATTR_AFTER_LAST: Internal use
  */
@@ -2490,12 +2589,19 @@ enum nl80211_tx_rate_attributes {
  * enum nl80211_band - Frequency band
  * @NL80211_BAND_2GHZ: 2.4 GHz ISM band
  * @NL80211_BAND_5GHZ: around 5 GHz band (4.9 - 5.7 GHz)
+ * @NL80211_BAND_60GHZ: around 60 GHz band (58.32 - 64.80 GHz)
  */
 enum nl80211_band {
         NL80211_BAND_2GHZ,
         NL80211_BAND_5GHZ,
+        NL80211_BAND_60GHZ,
 };
 
+/**
+ * enum nl80211_ps_state - powersave state
+ * @NL80211_PS_DISABLED: powersave is disabled
+ * @NL80211_PS_ENABLED: powersave is enabled
+ */
 enum nl80211_ps_state {
         NL80211_PS_DISABLED,
         NL80211_PS_ENABLED,
@@ -2513,6 +2619,17 @@ enum nl80211_ps_state {
  * @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT: RSSI threshold event
  * @NL80211_ATTR_CQM_PKT_LOSS_EVENT: a u32 value indicating that this many
  *      consecutive packets were not acknowledged by the peer
+ * @NL80211_ATTR_CQM_TXE_RATE: TX error rate in %. Minimum % of TX failures
+ *      during the given %NL80211_ATTR_CQM_TXE_INTVL before an
+ *      %NL80211_CMD_NOTIFY_CQM with reported %NL80211_ATTR_CQM_TXE_RATE and
+ *      %NL80211_ATTR_CQM_TXE_PKTS is generated.
+ * @NL80211_ATTR_CQM_TXE_PKTS: number of attempted packets in a given
+ *      %NL80211_ATTR_CQM_TXE_INTVL before %NL80211_ATTR_CQM_TXE_RATE is
+ *      checked.
+ * @NL80211_ATTR_CQM_TXE_INTVL: interval in seconds. Specifies the periodic
+ *      interval in which %NL80211_ATTR_CQM_TXE_PKTS and
+ *      %NL80211_ATTR_CQM_TXE_RATE must be satisfied before generating an
+ *      %NL80211_CMD_NOTIFY_CQM. Set to 0 to turn off TX error reporting.
  * @__NL80211_ATTR_CQM_AFTER_LAST: internal
  * @NL80211_ATTR_CQM_MAX: highest key attribute
  */
@@ -2522,6 +2639,9 @@ enum nl80211_attr_cqm {
         NL80211_ATTR_CQM_RSSI_HYST,
         NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
         NL80211_ATTR_CQM_PKT_LOSS_EVENT,
+        NL80211_ATTR_CQM_TXE_RATE,
+        NL80211_ATTR_CQM_TXE_PKTS,
+        NL80211_ATTR_CQM_TXE_INTVL,
 
         /* keep last */
         __NL80211_ATTR_CQM_AFTER_LAST,
@@ -2534,10 +2654,14 @@ enum nl80211_attr_cqm {
  *      configured threshold
  * @NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH: The RSSI is higher than the
  *      configured threshold
+ * @NL80211_CQM_RSSI_BEACON_LOSS_EVENT: The device experienced beacon loss.
+ *      (Note that deauth/disassoc will still follow if the AP is not
+ *      available. This event might get used as roaming event, etc.)
  */
 enum nl80211_cqm_rssi_threshold_event {
         NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
         NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
+        NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
 };
 
 
@@ -2867,11 +2991,15 @@ enum nl80211_ap_sme_features {
  * @NL80211_FEATURE_HT_IBSS: This driver supports IBSS with HT datarates.
  * @NL80211_FEATURE_INACTIVITY_TIMER: This driver takes care of freeing up
  *      the connected inactive stations in AP mode.
+ * @NL80211_FEATURE_CELL_BASE_REG_HINTS: This driver has been tested
+ *      to work properly to suppport receiving regulatory hints from
+ *      cellular base stations.
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS    = 1 << 0,
         NL80211_FEATURE_HT_IBSS         = 1 << 1,
         NL80211_FEATURE_INACTIVITY_TIMER = 1 << 2,
+        NL80211_FEATURE_CELL_BASE_REG_HINTS = 1 << 3,
 };
 
 /**
diff --git a/include/linux/nl802154.h b/include/linux/nl802154.h
index 5a3db3aa5f17..fd4f2d1cdf6c 100644
--- a/include/linux/nl802154.h
+++ b/include/linux/nl802154.h
@@ -130,18 +130,8 @@ enum {
 enum {
         __IEEE802154_DEV_INVALID = -1,
 
-         /* TODO:
-         * Nowadays three device types supported by this stack at linux-zigbee
-         * project: WPAN = 0, MONITOR = 1 and SMAC = 2.
-         *
-         * Since this stack implementation exists many years, it's definitely
-         * bad idea to change the assigned values due to they are already used
-         * by third-party userspace software like: iz-tools, wireshark...
-         *
-         * Currently only monitor device is added and initialized by '1' for
-         * compatibility.
-         */
-        IEEE802154_DEV_MONITOR = 1,
+        IEEE802154_DEV_WPAN,
+        IEEE802154_DEV_MONITOR,
 
         __IEEE802154_DEV_MAX,
 };
diff --git a/include/linux/phy.h b/include/linux/phy.h
index c291cae8ce32..93b3cf77f564 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -243,6 +243,15 @@ enum phy_state {
         PHY_RESUMING
 };
 
+/**
+ * struct phy_c45_device_ids - 802.3-c45 Device Identifiers
+ * @devices_in_package: Bit vector of devices present.
+ * @device_ids: The device identifer for each present device.
+ */
+struct phy_c45_device_ids {
+        u32 devices_in_package;
+        u32 device_ids[8];
+};
 
 /* phy_device: An instance of a PHY
  *
@@ -250,6 +259,8 @@ enum phy_state {
  * bus: Pointer to the bus this PHY is on
  * dev: driver model device structure for this PHY
  * phy_id: UID for this device found during discovery
+ * c45_ids: 802.3-c45 Device Identifers if is_c45.
+ * is_c45:  Set to true if this phy uses clause 45 addressing.
  * state: state of the PHY for management purposes
  * dev_flags: Device-specific flags used by the PHY driver.
  * addr: Bus address of PHY
@@ -285,6 +296,9 @@ struct phy_device {
 
         u32 phy_id;
 
+        struct phy_c45_device_ids c45_ids;
+        bool is_c45;
+
         enum phy_state state;
 
         u32 dev_flags;
@@ -412,6 +426,12 @@ struct phy_driver {
         /* Clears up any memory if needed */
         void (*remove)(struct phy_device *phydev);
 
+        /* Returns true if this is a suitable driver for the given
+         * phydev.  If NULL, matching is based on phy_id and
+         * phy_id_mask.
+         */
+        int (*match_phy_device)(struct phy_device *phydev);
+
         /* Handles ethtool queries for hardware time stamping. */
         int (*ts_info)(struct phy_device *phydev, struct ethtool_ts_info *ti);
 
@@ -480,7 +500,9 @@ static inline int phy_write(struct phy_device *phydev, u32 regnum, u16 val)
         return mdiobus_write(phydev->bus, phydev->addr, regnum, val);
 }
 
-struct phy_device* get_phy_device(struct mii_bus *bus, int addr);
+struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
+                bool is_c45, struct phy_c45_device_ids *c45_ids);
+struct phy_device *get_phy_device(struct mii_bus *bus, int addr, bool is_c45);
 int phy_device_register(struct phy_device *phy);
 int phy_init_hw(struct phy_device *phydev);
 struct phy_device * phy_attach(struct net_device *dev,
@@ -511,7 +533,9 @@ int genphy_read_status(struct phy_device *phydev);
 int genphy_suspend(struct phy_device *phydev);
 int genphy_resume(struct phy_device *phydev);
 void phy_driver_unregister(struct phy_driver *drv);
+void phy_drivers_unregister(struct phy_driver *drv, int n);
 int phy_driver_register(struct phy_driver *new_driver);
+int phy_drivers_register(struct phy_driver *new_driver, int n);
 void phy_state_machine(struct work_struct *work);
 void phy_start_machine(struct phy_device *phydev,
                 void (*handler)(struct net_device *));
@@ -532,6 +556,11 @@ int phy_register_fixup_for_uid(u32 phy_uid, u32 phy_uid_mask,
                 int (*run)(struct phy_device *));
 int phy_scan_fixups(struct phy_device *phydev);
 
+int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable);
+int phy_get_eee_err(struct phy_device *phydev);
+int phy_ethtool_set_eee(struct phy_device *phydev, struct ethtool_eee *data);
+int phy_ethtool_get_eee(struct phy_device *phydev, struct ethtool_eee *data);
+
 int __init mdio_bus_init(void);
 void mdio_bus_exit(void);
 
diff --git a/include/linux/pkt_cls.h b/include/linux/pkt_cls.h
index defbde203d07..082eafaf026b 100644
--- a/include/linux/pkt_cls.h
+++ b/include/linux/pkt_cls.h
@@ -451,8 +451,10 @@ enum {
 #define TCF_EM_U32              3
 #define TCF_EM_META             4
 #define TCF_EM_TEXT             5
-#define        TCF_EM_VLAN              6
-#define TCF_EM_MAX              6
+#define TCF_EM_VLAN             6
+#define TCF_EM_CANID            7
+#define TCF_EM_IPSET            8
+#define TCF_EM_MAX              8
 
 enum {
         TCF_EM_PROG_TC
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 2c1de8982c85..db71c4ad8624 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -612,12 +612,6 @@ struct tcamsg {
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
 
-static __inline__ int rtattr_strcmp(const struct rtattr *rta, const char *str)
-{
-        int len = strlen(str) + 1;
-        return len > rta->rta_len || memcmp(RTA_DATA(rta), str, len);
-}
-
 extern int rtnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, u32 group, int echo);
 extern int rtnl_unicast(struct sk_buff *skb, struct net *net, u32 pid);
 extern void rtnl_notify(struct sk_buff *skb, struct net *net, u32 pid,
@@ -625,124 +619,7 @@ extern void rtnl_notify(struct sk_buff *skb, struct net *net, u32 pid,
 extern void rtnl_set_sk_err(struct net *net, u32 group, int error);
 extern int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics);
 extern int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst,
-                              u32 id, u32 ts, u32 tsage, long expires,
-                              u32 error);
-
-extern void __rta_fill(struct sk_buff *skb, int attrtype, int attrlen, const void *data);
-
-#define RTA_PUT(skb, attrtype, attrlen, data) \
-({      if (unlikely(skb_tailroom(skb) < (int)RTA_SPACE(attrlen))) \
-                 goto rtattr_failure; \
-        __rta_fill(skb, attrtype, attrlen, data); }) 
-
-#define RTA_APPEND(skb, attrlen, data) \
-({      if (unlikely(skb_tailroom(skb) < (int)(attrlen))) \
-                goto rtattr_failure; \
-        memcpy(skb_put(skb, attrlen), data, attrlen); })
-
-#define RTA_PUT_NOHDR(skb, attrlen, data) \
-({      RTA_APPEND(skb, RTA_ALIGN(attrlen), data); \
-        memset(skb_tail_pointer(skb) - (RTA_ALIGN(attrlen) - attrlen), 0, \
-               RTA_ALIGN(attrlen) - attrlen); })
-
-#define RTA_PUT_U8(skb, attrtype, value) \
-({      u8 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u8), &_tmp); })
-
-#define RTA_PUT_U16(skb, attrtype, value) \
-({      u16 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u16), &_tmp); })
-
-#define RTA_PUT_U32(skb, attrtype, value) \
-({      u32 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u32), &_tmp); })
-
-#define RTA_PUT_U64(skb, attrtype, value) \
-({      u64 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u64), &_tmp); })
-
-#define RTA_PUT_SECS(skb, attrtype, value) \
-        RTA_PUT_U64(skb, attrtype, (value) / HZ)
-
-#define RTA_PUT_MSECS(skb, attrtype, value) \
-        RTA_PUT_U64(skb, attrtype, jiffies_to_msecs(value))
-
-#define RTA_PUT_STRING(skb, attrtype, value) \
-        RTA_PUT(skb, attrtype, strlen(value) + 1, value)
-
-#define RTA_PUT_FLAG(skb, attrtype) \
-        RTA_PUT(skb, attrtype, 0, NULL);
-
-#define RTA_NEST(skb, type) \
-({      struct rtattr *__start = (struct rtattr *)skb_tail_pointer(skb); \
-        RTA_PUT(skb, type, 0, NULL); \
-        __start;  })
-
-#define RTA_NEST_END(skb, start) \
-({      (start)->rta_len = skb_tail_pointer(skb) - (unsigned char *)(start); \
-        (skb)->len; })
-
-#define RTA_NEST_COMPAT(skb, type, attrlen, data) \
-({      struct rtattr *__start = (struct rtattr *)skb_tail_pointer(skb); \
-        RTA_PUT(skb, type, attrlen, data); \
-        RTA_NEST(skb, type); \
-        __start; })
-
-#define RTA_NEST_COMPAT_END(skb, start) \
-({      struct rtattr *__nest = (void *)(start) + NLMSG_ALIGN((start)->rta_len); \
-        (start)->rta_len = skb_tail_pointer(skb) - (unsigned char *)(start); \
-        RTA_NEST_END(skb, __nest); \
-        (skb)->len; })
-
-#define RTA_NEST_CANCEL(skb, start) \
-({      if (start) \
-                skb_trim(skb, (unsigned char *) (start) - (skb)->data); \
-        -1; })
-
-#define RTA_GET_U8(rta) \
-({      if (!rta || RTA_PAYLOAD(rta) < sizeof(u8)) \
-                goto rtattr_failure; \
-        *(u8 *) RTA_DATA(rta); })
-
-#define RTA_GET_U16(rta) \
-({      if (!rta || RTA_PAYLOAD(rta) < sizeof(u16)) \
-                goto rtattr_failure; \
-        *(u16 *) RTA_DATA(rta); })
-
-#define RTA_GET_U32(rta) \
-({      if (!rta || RTA_PAYLOAD(rta) < sizeof(u32)) \
-                goto rtattr_failure; \
-        *(u32 *) RTA_DATA(rta); })
-
-#define RTA_GET_U64(rta) \
-({      u64 _tmp; \
-        if (!rta || RTA_PAYLOAD(rta) < sizeof(u64)) \
-                goto rtattr_failure; \
-        memcpy(&_tmp, RTA_DATA(rta), sizeof(_tmp)); \
-        _tmp; })
-
-#define RTA_GET_FLAG(rta) (!!(rta))
-
-#define RTA_GET_SECS(rta) ((unsigned long) RTA_GET_U64(rta) * HZ)
-#define RTA_GET_MSECS(rta) (msecs_to_jiffies((unsigned long) RTA_GET_U64(rta)))
-                
-static inline struct rtattr *
-__rta_reserve(struct sk_buff *skb, int attrtype, int attrlen)
-{
-        struct rtattr *rta;
-        int size = RTA_LENGTH(attrlen);
-
-        rta = (struct rtattr*)skb_put(skb, RTA_ALIGN(size));
-        rta->rta_type = attrtype;
-        rta->rta_len = size;
-        memset(RTA_DATA(rta) + attrlen, 0, RTA_ALIGN(size) - size);
-        return rta;
-}
-
-#define __RTA_PUT(skb, attrtype, attrlen) \
-({      if (unlikely(skb_tailroom(skb) < (int)RTA_SPACE(attrlen))) \
-                goto rtattr_failure; \
-        __rta_reserve(skb, attrtype, attrlen); })
+                              u32 id, long expires, u32 error);
 
 extern void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change);
 
@@ -794,13 +671,6 @@ extern void __rtnl_unlock(void);
         } \
 } while(0)
 
-static inline u32 rtm_get_table(struct rtattr **rta, u8 table)
-{
-        return RTA_GET_U32(rta[RTA_TABLE-1]);
-rtattr_failure:
-        return table;
-}
-
 extern int ndo_dflt_fdb_dump(struct sk_buff *skb,
                              struct netlink_callback *cb,
                              struct net_device *dev,
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 642cb7355df3..d205c4be7f5b 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1667,6 +1667,22 @@ static inline void skb_orphan(struct sk_buff *skb)
 }
 
 /**
+ *      skb_orphan_frags - orphan the frags contained in a buffer
+ *      @skb: buffer to orphan frags from
+ *      @gfp_mask: allocation mask for replacement pages
+ *
+ *      For each frag in the SKB which needs a destructor (i.e. has an
+ *      owner) create a copy of that frag and release the original
+ *      page by calling the destructor.
+ */
+static inline int skb_orphan_frags(struct sk_buff *skb, gfp_t gfp_mask)
+{
+        if (likely(!(skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY)))
+                return 0;
+        return skb_copy_ubufs(skb, gfp_mask);
+}
+
+/**
  *      __skb_queue_purge - empty a list
  *      @list: list to empty
  *
diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index 2e68f5ba0389..00bc189cb395 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -208,7 +208,6 @@ enum
         LINUX_MIB_TCPDSACKOFOSENT,              /* TCPDSACKOfoSent */
         LINUX_MIB_TCPDSACKRECV,                 /* TCPDSACKRecv */
         LINUX_MIB_TCPDSACKOFORECV,              /* TCPDSACKOfoRecv */
-        LINUX_MIB_TCPABORTONSYN,                /* TCPAbortOnSyn */
         LINUX_MIB_TCPABORTONDATA,               /* TCPAbortOnData */
         LINUX_MIB_TCPABORTONCLOSE,              /* TCPAbortOnClose */
         LINUX_MIB_TCPABORTONMEMORY,             /* TCPAbortOnMemory */
@@ -233,7 +232,13 @@ enum
         LINUX_MIB_TCPREQQFULLDOCOOKIES,         /* TCPReqQFullDoCookies */
         LINUX_MIB_TCPREQQFULLDROP,              /* TCPReqQFullDrop */
         LINUX_MIB_TCPRETRANSFAIL,               /* TCPRetransFail */
-        LINUX_MIB_TCPRCVCOALESCE,                       /* TCPRcvCoalesce */
+        LINUX_MIB_TCPRCVCOALESCE,               /* TCPRcvCoalesce */
+        LINUX_MIB_TCPOFOQUEUE,                  /* TCPOFOQueue */
+        LINUX_MIB_TCPOFODROP,                   /* TCPOFODrop */
+        LINUX_MIB_TCPOFOMERGE,                  /* TCPOFOMerge */
+        LINUX_MIB_TCPCHALLENGEACK,              /* TCPChallengeACK */
+        LINUX_MIB_TCPSYNCHALLENGE,              /* TCPSYNChallenge */
+        LINUX_MIB_TCPFASTOPENACTIVE,            /* TCPFastOpenActive */
         __LINUX_MIB_MAX
 };
 
diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
index db4bae78bda9..e3e395acc2fd 100644
--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -18,6 +18,7 @@ enum {
         SK_MEMINFO_FWD_ALLOC,
         SK_MEMINFO_WMEM_QUEUED,
         SK_MEMINFO_OPTMEM,
+        SK_MEMINFO_BACKLOG,
 
         SK_MEMINFO_VARS,
 };
@@ -43,6 +44,5 @@ void sock_diag_save_cookie(void *sk, __u32 *cookie);
 
 int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
 
-extern struct sock *sock_diag_nlsk;
 #endif /* KERNEL */
 #endif
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 25d6322fb635..ba7b2e817cfa 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -268,6 +268,7 @@ struct ucred {
 #define MSG_SENDPAGE_NOTLAST 0x20000 /* sendpage() internal : not the last page */
 #define MSG_EOF         MSG_FIN
 
+#define MSG_FASTOPEN    0x20000000      /* Send data in TCP SYN */
 #define MSG_CMSG_CLOEXEC 0x40000000     /* Set close_on_exit for file
                                            descriptor received through
                                            SCM_RIGHTS */
diff --git a/include/linux/spi/at86rf230.h b/include/linux/spi/at86rf230.h
new file mode 100644
index 000000000000..b2b1afbb3202
--- /dev/null
+++ b/include/linux/spi/at86rf230.h
@@ -0,0 +1,31 @@
+/*
+ * AT86RF230/RF231 driver
+ *
+ * Copyright (C) 2009-2012 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dmitry.baryshkov@siemens.com>
+ */
+#ifndef AT86RF230_H
+#define AT86RF230_H
+
+struct at86rf230_platform_data {
+        int rstn;
+        int slp_tr;
+        int dig2;
+};
+
+#endif
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index bc14bd738ade..bb674c02f306 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -243,6 +243,7 @@ struct ssb_bus_ops {
 #define SSB_DEV_MINI_MACPHY     0x823
 #define SSB_DEV_ARM_1176        0x824
 #define SSB_DEV_ARM_7TDMI       0x825
+#define SSB_DEV_ARM_CM3         0x82A
 
 /* Vendor-ID values */
 #define SSB_VENDOR_BROADCOM     0x4243
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 5f359dbfcdce..eb125a4c30b3 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -243,6 +243,16 @@ static inline unsigned int tcp_optlen(const struct sk_buff *skb)
         return (tcp_hdr(skb)->doff - 5) * 4;
 }
 
+/* TCP Fast Open */
+#define TCP_FASTOPEN_COOKIE_MIN 4       /* Min Fast Open Cookie size in bytes */
+#define TCP_FASTOPEN_COOKIE_MAX 16      /* Max Fast Open Cookie size in bytes */
+
+/* TCP Fast Open Cookie as stored in memory */
+struct tcp_fastopen_cookie {
+        s8      len;
+        u8      val[TCP_FASTOPEN_COOKIE_MAX];
+};
+
 /* This defines a selective acknowledgement block. */
 struct tcp_sack_block_wire {
         __be32  start_seq;
@@ -339,6 +349,9 @@ struct tcp_sock {
         u32     rcv_tstamp;     /* timestamp of last received ACK (for keepalives) */
         u32     lsndtime;       /* timestamp of last sent data packet (for restart window) */
 
+        struct list_head tsq_node; /* anchor in tsq_tasklet.head list */
+        unsigned long   tsq_flags;
+
         /* Data for direct copy to user */
         struct {
                 struct sk_buff_head     prequeue;
@@ -373,7 +386,9 @@ struct tcp_sock {
                 unused      : 1;
         u8      repair_queue;
         u8      do_early_retrans:1,/* Enable RFC5827 early-retransmit  */
-                early_retrans_delayed:1; /* Delayed ER timer installed */
+                early_retrans_delayed:1, /* Delayed ER timer installed */
+                syn_data:1,     /* SYN includes data */
+                syn_fastopen:1; /* SYN includes Fast Open option */
 
 /* RTT measurement */
         u32     srtt;           /* smoothed round trip time << 3        */
@@ -478,6 +493,9 @@ struct tcp_sock {
                 u32               probe_seq_start;
                 u32               probe_seq_end;
         } mtu_probe;
+        u32     mtu_info; /* We received an ICMP_FRAG_NEEDED / ICMPV6_PKT_TOOBIG
+                           * while socket was owned by user.
+                           */
 
 #ifdef CONFIG_TCP_MD5SIG
 /* TCP AF-Specific parts; only used by MD5 Signature support so far */
@@ -487,6 +505,9 @@ struct tcp_sock {
         struct tcp_md5sig_info  __rcu *md5sig_info;
 #endif
 
+/* TCP fastopen related information */
+        struct tcp_fastopen_request *fastopen_req;
+
         /* When the cookie options are generated and exchanged, then this
          * object holds a reference to them (cookie_values->kref).  Also
          * contains related tcp_cookie_transactions fields.
@@ -494,6 +515,17 @@ struct tcp_sock {
         struct tcp_cookie_values  *cookie_values;
 };
 
+enum tsq_flags {
+        TSQ_THROTTLED,
+        TSQ_QUEUED,
+        TCP_TSQ_DEFERRED,          /* tcp_tasklet_func() found socket was owned */
+        TCP_WRITE_TIMER_DEFERRED,  /* tcp_write_timer() found socket was owned */
+        TCP_DELACK_TIMER_DEFERRED, /* tcp_delack_timer() found socket was owned */
+        TCP_MTU_REDUCED_DEFERRED,  /* tcp_v{4|6}_err() could not call
+                                    * tcp_v{4|6}_mtu_reduced()
+                                    */
+};
+
 static inline struct tcp_sock *tcp_sk(const struct sock *sk)
 {
         return (struct tcp_sock *)sk;
@@ -507,7 +539,7 @@ struct tcp_timewait_sock {
         u32                       tw_ts_recent;
         long                      tw_ts_recent_stamp;
 #ifdef CONFIG_TCP_MD5SIG
-        struct tcp_md5sig_key   *tw_md5_key;
+        struct tcp_md5sig_key     *tw_md5_key;
 #endif
         /* Few sockets in timewait have cookies; in that case, then this
          * object holds a reference to them (tw_cookie_values->kref).
diff --git a/include/linux/tipc_config.h b/include/linux/tipc_config.h
index 9730b0e51e46..c98928420100 100644
--- a/include/linux/tipc_config.h
+++ b/include/linux/tipc_config.h
@@ -102,8 +102,8 @@
 #define  TIPC_CMD_SET_LINK_TOL      0x4107    /* tx link_config, rx none */
 #define  TIPC_CMD_SET_LINK_PRI      0x4108    /* tx link_config, rx none */
 #define  TIPC_CMD_SET_LINK_WINDOW   0x4109    /* tx link_config, rx none */
-#define  TIPC_CMD_SET_LOG_SIZE      0x410A    /* tx unsigned, rx none */
-#define  TIPC_CMD_DUMP_LOG          0x410B    /* tx none, rx ultra_string */
+#define  TIPC_CMD_SET_LOG_SIZE      0x410A    /* obsoleted */
+#define  TIPC_CMD_DUMP_LOG          0x410B    /* obsoleted */
 #define  TIPC_CMD_RESET_LINK_STATS  0x410C    /* tx link_name, rx none */
 
 /*
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 76f439647c4b..f87cf622317f 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -66,9 +66,8 @@ struct usbnet {
 #               define EVENT_STS_SPLIT  3
 #               define EVENT_LINK_RESET 4
 #               define EVENT_RX_PAUSED  5
-#               define EVENT_DEV_WAKING 6
-#               define EVENT_DEV_ASLEEP 7
-#               define EVENT_DEV_OPEN   8
+#               define EVENT_DEV_ASLEEP 6
+#               define EVENT_DEV_OPEN   7
 };
 
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index f2b801c4b555..089a09d001d1 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -46,7 +46,8 @@ struct prefix_info {
 #include <net/if_inet6.h>
 #include <net/ipv6.h>
 
-#define IN6_ADDR_HSIZE          16
+#define IN6_ADDR_HSIZE_SHIFT    4
+#define IN6_ADDR_HSIZE          (1 << IN6_ADDR_HSIZE_SHIFT)
 
 extern int                      addrconf_init(void);
 extern void                     addrconf_cleanup(void);
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 2ee33da36a7a..b5f8988e4283 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -14,10 +14,11 @@ extern struct sock *unix_get_socket(struct file *filp);
 extern struct sock *unix_peer_get(struct sock *);
 
 #define UNIX_HASH_SIZE  256
+#define UNIX_HASH_BITS  8
 
 extern unsigned int unix_tot_inflight;
 extern spinlock_t unix_table_lock;
-extern struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1];
+extern struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
 
 struct unix_address {
         atomic_t        refcnt;
diff --git a/include/net/arp.h b/include/net/arp.h
index 4a1f3fb562eb..7f7df93f37cd 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -15,24 +15,31 @@ static inline u32 arp_hashfn(u32 key, const struct net_device *dev, u32 hash_rnd
         return val * hash_rnd;
 }
 
-static inline struct neighbour *__ipv4_neigh_lookup(struct net_device *dev, u32 key)
+static inline struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev, u32 key)
 {
-        struct neigh_hash_table *nht;
+        struct neigh_hash_table *nht = rcu_dereference_bh(arp_tbl.nht);
         struct neighbour *n;
         u32 hash_val;
 
-        rcu_read_lock_bh();
-        nht = rcu_dereference_bh(arp_tbl.nht);
         hash_val = arp_hashfn(key, dev, nht->hash_rnd[0]) >> (32 - nht->hash_shift);
         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
              n != NULL;
              n = rcu_dereference_bh(n->next)) {
-                if (n->dev == dev && *(u32 *)n->primary_key == key) {
-                        if (!atomic_inc_not_zero(&n->refcnt))
-                                n = NULL;
-                        break;
-                }
+                if (n->dev == dev && *(u32 *)n->primary_key == key)
+                        return n;
         }
+
+        return NULL;
+}
+
+static inline struct neighbour *__ipv4_neigh_lookup(struct net_device *dev, u32 key)
+{
+        struct neighbour *n;
+
+        rcu_read_lock_bh();
+        n = __ipv4_neigh_lookup_noref(dev, key);
+        if (n && !atomic_inc_not_zero(&n->refcnt))
+                n = NULL;
         rcu_read_unlock_bh();
 
         return n;
diff --git a/include/net/bluetooth/a2mp.h b/include/net/bluetooth/a2mp.h
new file mode 100644
index 000000000000..6a76e0a0705e
--- /dev/null
+++ b/include/net/bluetooth/a2mp.h
@@ -0,0 +1,126 @@
+/*
+   Copyright (c) 2010,2011 Code Aurora Forum.  All rights reserved.
+   Copyright (c) 2011,2012 Intel Corp.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 and
+   only version 2 as published by the Free Software Foundation.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+*/
+
+#ifndef __A2MP_H
+#define __A2MP_H
+
+#include <net/bluetooth/l2cap.h>
+
+#define A2MP_FEAT_EXT   0x8000
+
+struct amp_mgr {
+        struct l2cap_conn       *l2cap_conn;
+        struct l2cap_chan       *a2mp_chan;
+        struct kref             kref;
+        __u8                    ident;
+        __u8                    handle;
+        unsigned long           flags;
+};
+
+struct a2mp_cmd {
+        __u8    code;
+        __u8    ident;
+        __le16  len;
+        __u8    data[0];
+} __packed;
+
+/* A2MP command codes */
+#define A2MP_COMMAND_REJ         0x01
+struct a2mp_cmd_rej {
+        __le16  reason;
+        __u8    data[0];
+} __packed;
+
+#define A2MP_DISCOVER_REQ        0x02
+struct a2mp_discov_req {
+        __le16  mtu;
+        __le16  ext_feat;
+} __packed;
+
+struct a2mp_cl {
+        __u8    id;
+        __u8    type;
+        __u8    status;
+} __packed;
+
+#define A2MP_DISCOVER_RSP        0x03
+struct a2mp_discov_rsp {
+        __le16     mtu;
+        __le16     ext_feat;
+        struct a2mp_cl cl[0];
+} __packed;
+
+#define A2MP_CHANGE_NOTIFY       0x04
+#define A2MP_CHANGE_RSP          0x05
+
+#define A2MP_GETINFO_REQ         0x06
+struct a2mp_info_req {
+        __u8       id;
+} __packed;
+
+#define A2MP_GETINFO_RSP         0x07
+struct a2mp_info_rsp {
+        __u8    id;
+        __u8    status;
+        __le32  total_bw;
+        __le32  max_bw;
+        __le32  min_latency;
+        __le16  pal_cap;
+        __le16  assoc_size;
+} __packed;
+
+#define A2MP_GETAMPASSOC_REQ     0x08
+struct a2mp_amp_assoc_req {
+        __u8    id;
+} __packed;
+
+#define A2MP_GETAMPASSOC_RSP     0x09
+struct a2mp_amp_assoc_rsp {
+        __u8    id;
+        __u8    status;
+        __u8    amp_assoc[0];
+} __packed;
+
+#define A2MP_CREATEPHYSLINK_REQ  0x0A
+#define A2MP_DISCONNPHYSLINK_REQ 0x0C
+struct a2mp_physlink_req {
+        __u8    local_id;
+        __u8    remote_id;
+        __u8    amp_assoc[0];
+} __packed;
+
+#define A2MP_CREATEPHYSLINK_RSP  0x0B
+#define A2MP_DISCONNPHYSLINK_RSP 0x0D
+struct a2mp_physlink_rsp {
+        __u8    local_id;
+        __u8    remote_id;
+        __u8    status;
+} __packed;
+
+/* A2MP response status */
+#define A2MP_STATUS_SUCCESS                     0x00
+#define A2MP_STATUS_INVALID_CTRL_ID             0x01
+#define A2MP_STATUS_UNABLE_START_LINK_CREATION  0x02
+#define A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS     0x02
+#define A2MP_STATUS_COLLISION_OCCURED           0x03
+#define A2MP_STATUS_DISCONN_REQ_RECVD           0x04
+#define A2MP_STATUS_PHYS_LINK_EXISTS            0x05
+#define A2MP_STATUS_SECURITY_VIOLATION          0x06
+
+void amp_mgr_get(struct amp_mgr *mgr);
+int amp_mgr_put(struct amp_mgr *mgr);
+struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
+                                       struct sk_buff *skb);
+
+#endif /* __A2MP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 961669b648fd..565d4bee1e49 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -1,4 +1,4 @@
-/* 
+/*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (C) 2000-2001 Qualcomm Incorporated
 
@@ -12,22 +12,19 @@
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
    SOFTWARE IS DISCLAIMED.
 */
 
 #ifndef __BLUETOOTH_H
 #define __BLUETOOTH_H
 
-#include <asm/types.h>
-#include <asm/byteorder.h>
-#include <linux/list.h>
 #include <linux/poll.h>
 #include <net/sock.h>
 
@@ -168,8 +165,8 @@ typedef struct {
 #define BDADDR_LE_PUBLIC        0x01
 #define BDADDR_LE_RANDOM        0x02
 
-#define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0}})
-#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff}})
+#define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0} })
+#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff} })
 
 /* Copy, swap, convert BD Address */
 static inline int bacmp(bdaddr_t *ba1, bdaddr_t *ba2)
@@ -215,7 +212,7 @@ int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                                 struct msghdr *msg, size_t len, int flags);
 int  bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         struct msghdr *msg, size_t len, int flags);
-uint bt_sock_poll(struct file * file, struct socket *sock, poll_table *wait);
+uint bt_sock_poll(struct file *file, struct socket *sock, poll_table *wait);
 int  bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int  bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo);
 
@@ -225,12 +222,12 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
 
 /* Skb helpers */
 struct l2cap_ctrl {
-        unsigned int    sframe  : 1,
-                        poll    : 1,
-                        final   : 1,
-                        fcs     : 1,
-                        sar     : 2,
-                        super   : 2;
+        unsigned int    sframe:1,
+                        poll:1,
+                        final:1,
+                        fcs:1,
+                        sar:2,
+                        super:2;
         __u16           reqseq;
         __u16           txseq;
         __u8            retries;
@@ -249,7 +246,8 @@ static inline struct sk_buff *bt_skb_alloc(unsigned int len, gfp_t how)
 {
         struct sk_buff *skb;
 
-        if ((skb = alloc_skb(len + BT_SKB_RESERVE, how))) {
+        skb = alloc_skb(len + BT_SKB_RESERVE, how);
+        if (skb) {
                 skb_reserve(skb, BT_SKB_RESERVE);
                 bt_cb(skb)->incoming  = 0;
         }
@@ -261,7 +259,8 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk,
 {
         struct sk_buff *skb;
 
-        if ((skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err))) {
+        skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err);
+        if (skb) {
                 skb_reserve(skb, BT_SKB_RESERVE);
                 bt_cb(skb)->incoming  = 0;
         }
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 3def64ba77fa..ccd723e0f783 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -30,6 +30,9 @@
 #define HCI_MAX_EVENT_SIZE      260
 #define HCI_MAX_FRAME_SIZE      (HCI_MAX_ACL_SIZE + 4)
 
+#define HCI_LINK_KEY_SIZE       16
+#define HCI_AMP_LINK_KEY_SIZE   (2 * HCI_LINK_KEY_SIZE)
+
 /* HCI dev events */
 #define HCI_DEV_REG                     1
 #define HCI_DEV_UNREG                   2
@@ -56,9 +59,12 @@
 #define HCI_BREDR       0x00
 #define HCI_AMP         0x01
 
+/* First BR/EDR Controller shall have ID = 0 */
+#define HCI_BREDR_ID    0
+
 /* HCI device quirks */
 enum {
-        HCI_QUIRK_NO_RESET,
+        HCI_QUIRK_RESET_ON_CLOSE,
         HCI_QUIRK_RAW_DEVICE,
         HCI_QUIRK_FIXUP_BUFFER_SIZE
 };
@@ -133,13 +139,12 @@ enum {
 #define HCIINQUIRY      _IOR('H', 240, int)
 
 /* HCI timeouts */
-#define HCI_CONNECT_TIMEOUT     (40000) /* 40 seconds */
-#define HCI_DISCONN_TIMEOUT     (2000)  /* 2 seconds */
-#define HCI_PAIRING_TIMEOUT     (60000) /* 60 seconds */
-#define HCI_IDLE_TIMEOUT        (6000)  /* 6 seconds */
-#define HCI_INIT_TIMEOUT        (10000) /* 10 seconds */
-#define HCI_CMD_TIMEOUT         (1000)  /* 1 seconds */
-#define HCI_ACL_TX_TIMEOUT      (45000) /* 45 seconds */
+#define HCI_DISCONN_TIMEOUT     msecs_to_jiffies(2000)  /* 2 seconds */
+#define HCI_PAIRING_TIMEOUT     msecs_to_jiffies(60000) /* 60 seconds */
+#define HCI_INIT_TIMEOUT        msecs_to_jiffies(10000) /* 10 seconds */
+#define HCI_CMD_TIMEOUT         msecs_to_jiffies(1000)  /* 1 second */
+#define HCI_ACL_TX_TIMEOUT      msecs_to_jiffies(45000) /* 45 seconds */
+#define HCI_AUTO_OFF_TIMEOUT    msecs_to_jiffies(2000)  /* 2 seconds */
 
 /* HCI data types */
 #define HCI_COMMAND_PKT         0x01
@@ -371,7 +376,7 @@ struct hci_cp_reject_conn_req {
 #define HCI_OP_LINK_KEY_REPLY           0x040b
 struct hci_cp_link_key_reply {
         bdaddr_t bdaddr;
-        __u8     link_key[16];
+        __u8     link_key[HCI_LINK_KEY_SIZE];
 } __packed;
 
 #define HCI_OP_LINK_KEY_NEG_REPLY       0x040c
@@ -523,6 +528,28 @@ struct hci_cp_io_capability_neg_reply {
         __u8     reason;
 } __packed;
 
+#define HCI_OP_CREATE_PHY_LINK          0x0435
+struct hci_cp_create_phy_link {
+        __u8     phy_handle;
+        __u8     key_len;
+        __u8     key_type;
+        __u8     key[HCI_AMP_LINK_KEY_SIZE];
+} __packed;
+
+#define HCI_OP_ACCEPT_PHY_LINK          0x0436
+struct hci_cp_accept_phy_link {
+        __u8     phy_handle;
+        __u8     key_len;
+        __u8     key_type;
+        __u8     key[HCI_AMP_LINK_KEY_SIZE];
+} __packed;
+
+#define HCI_OP_DISCONN_PHY_LINK 0x0437
+struct hci_cp_disconn_phy_link {
+        __u8     phy_handle;
+        __u8     reason;
+} __packed;
+
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
         __le16   handle;
@@ -818,6 +845,31 @@ struct hci_rp_read_local_amp_info {
         __le32   be_flush_to;
 } __packed;
 
+#define HCI_OP_READ_LOCAL_AMP_ASSOC     0x140a
+struct hci_cp_read_local_amp_assoc {
+        __u8     phy_handle;
+        __le16   len_so_far;
+        __le16   max_len;
+} __packed;
+struct hci_rp_read_local_amp_assoc {
+        __u8     status;
+        __u8     phy_handle;
+        __le16   rem_len;
+        __u8     frag[0];
+} __packed;
+
+#define HCI_OP_WRITE_REMOTE_AMP_ASSOC   0x140b
+struct hci_cp_write_remote_amp_assoc {
+        __u8     phy_handle;
+        __le16   len_so_far;
+        __le16   rem_len;
+        __u8     frag[0];
+} __packed;
+struct hci_rp_write_remote_amp_assoc {
+        __u8     status;
+        __u8     phy_handle;
+} __packed;
+
 #define HCI_OP_LE_SET_EVENT_MASK        0x2001
 struct hci_cp_le_set_event_mask {
         __u8     mask[8];
@@ -1048,7 +1100,7 @@ struct hci_ev_link_key_req {
 #define HCI_EV_LINK_KEY_NOTIFY          0x18
 struct hci_ev_link_key_notify {
         bdaddr_t bdaddr;
-        __u8     link_key[16];
+        __u8     link_key[HCI_LINK_KEY_SIZE];
         __u8     key_type;
 } __packed;
 
@@ -1196,6 +1248,39 @@ struct hci_ev_le_meta {
         __u8     subevent;
 } __packed;
 
+#define HCI_EV_PHY_LINK_COMPLETE        0x40
+struct hci_ev_phy_link_complete {
+        __u8     status;
+        __u8     phy_handle;
+} __packed;
+
+#define HCI_EV_CHANNEL_SELECTED         0x41
+struct hci_ev_channel_selected {
+        __u8     phy_handle;
+} __packed;
+
+#define HCI_EV_DISCONN_PHY_LINK_COMPLETE        0x42
+struct hci_ev_disconn_phy_link_complete {
+        __u8     status;
+        __u8     phy_handle;
+        __u8     reason;
+} __packed;
+
+#define HCI_EV_LOGICAL_LINK_COMPLETE            0x45
+struct hci_ev_logical_link_complete {
+        __u8     status;
+        __le16   handle;
+        __u8     phy_handle;
+        __u8     flow_spec_id;
+} __packed;
+
+#define HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE    0x46
+struct hci_ev_disconn_logical_link_complete {
+        __u8     status;
+        __le16   handle;
+        __u8     reason;
+} __packed;
+
 #define HCI_EV_NUM_COMP_BLOCKS          0x48
 struct hci_comp_blocks_info {
         __le16   handle;
@@ -1296,7 +1381,6 @@ struct hci_sco_hdr {
         __u8    dlen;
 } __packed;
 
-#include <linux/skbuff.h>
 static inline struct hci_event_hdr *hci_event_hdr(const struct sk_buff *skb)
 {
         return (struct hci_event_hdr *) skb->data;
@@ -1313,12 +1397,12 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
 }
 
 /* Command opcode pack/unpack */
-#define hci_opcode_pack(ogf, ocf)       (__u16) ((ocf & 0x03ff)|(ogf << 10))
+#define hci_opcode_pack(ogf, ocf)       ((__u16) ((ocf & 0x03ff)|(ogf << 10)))
 #define hci_opcode_ogf(op)              (op >> 10)
 #define hci_opcode_ocf(op)              (op & 0x03ff)
 
 /* ACL handle and flags pack/unpack */
-#define hci_handle_pack(h, f)   (__u16) ((h & 0x0fff)|(f << 12))
+#define hci_handle_pack(h, f)   ((__u16) ((h & 0x0fff)|(f << 12)))
 #define hci_handle(h)           (h & 0x0fff)
 #define hci_flags(h)            (h >> 12)
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9fc7728f94e4..475b8c04ba52 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -25,7 +25,6 @@
 #ifndef __HCI_CORE_H
 #define __HCI_CORE_H
 
-#include <linux/interrupt.h>
 #include <net/bluetooth/hci.h>
 
 /* HCI priority */
@@ -65,7 +64,7 @@ struct discovery_state {
                 DISCOVERY_RESOLVING,
                 DISCOVERY_STOPPING,
         } state;
-        struct list_head        all;            /* All devices found during inquiry */
+        struct list_head        all;    /* All devices found during inquiry */
         struct list_head        unknown;        /* Name state not known */
         struct list_head        resolve;        /* Name needs to be resolved */
         __u32                   timestamp;
@@ -105,7 +104,7 @@ struct link_key {
         struct list_head list;
         bdaddr_t bdaddr;
         u8 type;
-        u8 val[16];
+        u8 val[HCI_LINK_KEY_SIZE];
         u8 pin_len;
 };
 
@@ -333,6 +332,7 @@ struct hci_conn {
         void            *l2cap_data;
         void            *sco_data;
         void            *smp_conn;
+        struct amp_mgr  *amp_mgr;
 
         struct hci_conn *link;
 
@@ -360,7 +360,8 @@ extern int l2cap_connect_cfm(struct hci_conn *hcon, u8 status);
 extern int l2cap_disconn_ind(struct hci_conn *hcon);
 extern int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason);
 extern int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt);
-extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags);
+extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb,
+                              u16 flags);
 
 extern int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
 extern int sco_connect_cfm(struct hci_conn *hcon, __u8 status);
@@ -429,8 +430,8 @@ enum {
 static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
 {
         struct hci_dev *hdev = conn->hdev;
-        return (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
-                                test_bit(HCI_CONN_SSP_ENABLED, &conn->flags));
+        return test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
+               test_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 }
 
 static inline void hci_conn_hash_init(struct hci_dev *hdev)
@@ -586,18 +587,24 @@ void hci_conn_put_device(struct hci_conn *conn);
 
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
+        BT_DBG("hcon %p refcnt %d -> %d", conn, atomic_read(&conn->refcnt),
+               atomic_read(&conn->refcnt) + 1);
+
         atomic_inc(&conn->refcnt);
         cancel_delayed_work(&conn->disc_work);
 }
 
 static inline void hci_conn_put(struct hci_conn *conn)
 {
+        BT_DBG("hcon %p refcnt %d -> %d", conn, atomic_read(&conn->refcnt),
+               atomic_read(&conn->refcnt) - 1);
+
         if (atomic_dec_and_test(&conn->refcnt)) {
                 unsigned long timeo;
                 if (conn->type == ACL_LINK || conn->type == LE_LINK) {
                         del_timer(&conn->idle_timer);
                         if (conn->state == BT_CONNECTED) {
-                                timeo = msecs_to_jiffies(conn->disc_timeout);
+                                timeo = conn->disc_timeout;
                                 if (!conn->out)
                                         timeo *= 2;
                         } else {
@@ -640,6 +647,19 @@ static inline void hci_set_drvdata(struct hci_dev *hdev, void *data)
         dev_set_drvdata(&hdev->dev, data);
 }
 
+/* hci_dev_list shall be locked */
+static inline uint8_t __hci_num_ctrl(void)
+{
+        uint8_t count = 0;
+        struct list_head *p;
+
+        list_for_each(p, &hci_dev_list) {
+                count++;
+        }
+
+        return count;
+}
+
 struct hci_dev *hci_dev_get(int index);
 struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
 
@@ -661,7 +681,8 @@ int hci_get_conn_info(struct hci_dev *hdev, void __user *arg);
 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg);
 int hci_inquiry(void __user *arg);
 
-struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
+struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
+                                         bdaddr_t *bdaddr);
 int hci_blacklist_clear(struct hci_dev *hdev);
 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 1c7d1cd5e679..a7679f8913d2 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -40,11 +40,11 @@
 #define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
 #define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
 #define L2CAP_DEFAULT_ACK_TO            200
-#define L2CAP_LE_DEFAULT_MTU            23
 #define L2CAP_DEFAULT_MAX_SDU_SIZE      0xFFFF
 #define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
 #define L2CAP_DEFAULT_ACC_LAT           0xFFFFFFFF
 #define L2CAP_BREDR_MAX_PAYLOAD         1019    /* 3-DH5 packet */
+#define L2CAP_LE_MIN_MTU                23
 
 #define L2CAP_DISC_TIMEOUT              msecs_to_jiffies(100)
 #define L2CAP_DISC_REJ_TIMEOUT          msecs_to_jiffies(5000)
@@ -52,6 +52,8 @@
 #define L2CAP_CONN_TIMEOUT              msecs_to_jiffies(40000)
 #define L2CAP_INFO_TIMEOUT              msecs_to_jiffies(4000)
 
+#define L2CAP_A2MP_DEFAULT_MTU          670
+
 /* L2CAP socket address */
 struct sockaddr_l2 {
         sa_family_t     l2_family;
@@ -229,9 +231,14 @@ struct l2cap_conn_rsp {
         __le16     status;
 } __packed;
 
+/* protocol/service multiplexer (PSM) */
+#define L2CAP_PSM_SDP           0x0001
+#define L2CAP_PSM_RFCOMM        0x0003
+
 /* channel indentifier */
 #define L2CAP_CID_SIGNALING     0x0001
 #define L2CAP_CID_CONN_LESS     0x0002
+#define L2CAP_CID_A2MP          0x0003
 #define L2CAP_CID_LE_DATA       0x0004
 #define L2CAP_CID_LE_SIGNALING  0x0005
 #define L2CAP_CID_SMP           0x0006
@@ -271,6 +278,9 @@ struct l2cap_conf_rsp {
 #define L2CAP_CONF_PENDING      0x0004
 #define L2CAP_CONF_EFS_REJECT   0x0005
 
+/* configuration req/rsp continuation flag */
+#define L2CAP_CONF_FLAG_CONTINUATION    0x0001
+
 struct l2cap_conf_opt {
         __u8       type;
         __u8       len;
@@ -419,11 +429,6 @@ struct l2cap_seq_list {
 #define L2CAP_SEQ_LIST_CLEAR    0xFFFF
 #define L2CAP_SEQ_LIST_TAIL     0x8000
 
-struct srej_list {
-        __u16   tx_seq;
-        struct list_head list;
-};
-
 struct l2cap_chan {
         struct sock *sk;
 
@@ -459,6 +464,7 @@ struct l2cap_chan {
 
         __u16           tx_win;
         __u16           tx_win_max;
+        __u16           ack_win;
         __u8            max_tx;
         __u16           retrans_timeout;
         __u16           monitor_timeout;
@@ -475,14 +481,12 @@ struct l2cap_chan {
         __u16           expected_ack_seq;
         __u16           expected_tx_seq;
         __u16           buffer_seq;
-        __u16           buffer_seq_srej;
         __u16           srej_save_reqseq;
         __u16           last_acked_seq;
         __u16           frames_sent;
         __u16           unacked_frames;
         __u8            retry_count;
         __u16           srej_queue_next;
-        __u8            num_acked;
         __u16           sdu_len;
         struct sk_buff  *sdu;
         struct sk_buff  *sdu_last_frag;
@@ -515,7 +519,6 @@ struct l2cap_chan {
         struct sk_buff_head     srej_q;
         struct l2cap_seq_list   srej_list;
         struct l2cap_seq_list   retrans_list;
-        struct list_head        srej_l;
 
         struct list_head        list;
         struct list_head        global_l;
@@ -528,10 +531,14 @@ struct l2cap_chan {
 struct l2cap_ops {
         char                    *name;
 
-        struct l2cap_chan       *(*new_connection) (void *data);
-        int                     (*recv) (void *data, struct sk_buff *skb);
-        void                    (*close) (void *data);
-        void                    (*state_change) (void *data, int state);
+        struct l2cap_chan       *(*new_connection) (struct l2cap_chan *chan);
+        int                     (*recv) (struct l2cap_chan * chan,
+                                         struct sk_buff *skb);
+        void                    (*teardown) (struct l2cap_chan *chan, int err);
+        void                    (*close) (struct l2cap_chan *chan);
+        void                    (*state_change) (struct l2cap_chan *chan,
+                                                 int state);
+        void                    (*ready) (struct l2cap_chan *chan);
         struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
                                                unsigned long len, int nb);
 };
@@ -575,6 +582,7 @@ struct l2cap_conn {
 #define L2CAP_CHAN_RAW                  1
 #define L2CAP_CHAN_CONN_LESS            2
 #define L2CAP_CHAN_CONN_ORIENTED        3
+#define L2CAP_CHAN_CONN_FIX_A2MP        4
 
 /* ----- L2CAP socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
@@ -597,6 +605,7 @@ enum {
         CONF_EWS_RECV,
         CONF_LOC_CONF_PEND,
         CONF_REM_CONF_PEND,
+        CONF_NOT_COMPLETE,
 };
 
 #define L2CAP_CONF_MAX_CONF_REQ 2
@@ -664,11 +673,15 @@ enum {
 
 static inline void l2cap_chan_hold(struct l2cap_chan *c)
 {
+        BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
+
         atomic_inc(&c->refcnt);
 }
 
 static inline void l2cap_chan_put(struct l2cap_chan *c)
 {
+        BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
+
         if (atomic_dec_and_test(&c->refcnt))
                 kfree(c);
 }
@@ -713,11 +726,7 @@ static inline bool l2cap_clear_timer(struct l2cap_chan *chan,
 
 #define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
 #define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
-#define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
-                msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
 #define __clear_retrans_timer(c) l2cap_clear_timer(c, &c->retrans_timer)
-#define __set_monitor_timer(c) l2cap_set_timer(c, &c->monitor_timer, \
-                msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
 #define __clear_monitor_timer(c) l2cap_clear_timer(c, &c->monitor_timer)
 #define __set_ack_timer(c) l2cap_set_timer(c, &chan->ack_timer, \
                 msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
@@ -736,173 +745,17 @@ static inline __u16 __next_seq(struct l2cap_chan *chan, __u16 seq)
         return (seq + 1) % (chan->tx_win_max + 1);
 }
 
-static inline int l2cap_tx_window_full(struct l2cap_chan *ch)
-{
-        int sub;
-
-        sub = (ch->next_tx_seq - ch->expected_ack_seq) % 64;
-
-        if (sub < 0)
-                sub += 64;
-
-        return sub == ch->remote_tx_win;
-}
-
-static inline __u16 __get_reqseq(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_REQSEQ) >>
-                                                L2CAP_EXT_CTRL_REQSEQ_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
-}
-
-static inline __u32 __set_reqseq(struct l2cap_chan *chan, __u32 reqseq)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT) &
-                                                        L2CAP_EXT_CTRL_REQSEQ;
-        else
-                return (reqseq << L2CAP_CTRL_REQSEQ_SHIFT) & L2CAP_CTRL_REQSEQ;
-}
-
-static inline __u16 __get_txseq(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_TXSEQ) >>
-                                                L2CAP_EXT_CTRL_TXSEQ_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
-}
-
-static inline __u32 __set_txseq(struct l2cap_chan *chan, __u32 txseq)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT) &
-                                                        L2CAP_EXT_CTRL_TXSEQ;
-        else
-                return (txseq << L2CAP_CTRL_TXSEQ_SHIFT) & L2CAP_CTRL_TXSEQ;
-}
-
-static inline bool __is_sframe(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_FRAME_TYPE;
-        else
-                return ctrl & L2CAP_CTRL_FRAME_TYPE;
-}
-
-static inline __u32 __set_sframe(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_FRAME_TYPE;
-        else
-                return L2CAP_CTRL_FRAME_TYPE;
-}
-
-static inline __u8 __get_ctrl_sar(struct l2cap_chan *chan, __u32 ctrl)
+static inline struct l2cap_chan *l2cap_chan_no_new_connection(struct l2cap_chan *chan)
 {
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
+        return NULL;
 }
 
-static inline __u32 __set_ctrl_sar(struct l2cap_chan *chan, __u32 sar)
+static inline void l2cap_chan_no_teardown(struct l2cap_chan *chan, int err)
 {
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (sar << L2CAP_EXT_CTRL_SAR_SHIFT) & L2CAP_EXT_CTRL_SAR;
-        else
-                return (sar << L2CAP_CTRL_SAR_SHIFT) & L2CAP_CTRL_SAR;
 }
 
-static inline bool __is_sar_start(struct l2cap_chan *chan, __u32 ctrl)
+static inline void l2cap_chan_no_ready(struct l2cap_chan *chan)
 {
-        return __get_ctrl_sar(chan, ctrl) == L2CAP_SAR_START;
-}
-
-static inline __u32 __get_sar_mask(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_SAR;
-        else
-                return L2CAP_CTRL_SAR;
-}
-
-static inline __u8 __get_ctrl_super(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_SUPERVISE) >>
-                                                L2CAP_EXT_CTRL_SUPER_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
-}
-
-static inline __u32 __set_ctrl_super(struct l2cap_chan *chan, __u32 super)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (super << L2CAP_EXT_CTRL_SUPER_SHIFT) &
-                                                L2CAP_EXT_CTRL_SUPERVISE;
-        else
-                return (super << L2CAP_CTRL_SUPER_SHIFT) &
-                                                        L2CAP_CTRL_SUPERVISE;
-}
-
-static inline __u32 __set_ctrl_final(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_FINAL;
-        else
-                return L2CAP_CTRL_FINAL;
-}
-
-static inline bool __is_ctrl_final(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_FINAL;
-        else
-                return ctrl & L2CAP_CTRL_FINAL;
-}
-
-static inline __u32 __set_ctrl_poll(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_POLL;
-        else
-                return L2CAP_CTRL_POLL;
-}
-
-static inline bool __is_ctrl_poll(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_POLL;
-        else
-                return ctrl & L2CAP_CTRL_POLL;
-}
-
-static inline __u32 __get_control(struct l2cap_chan *chan, void *p)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return get_unaligned_le32(p);
-        else
-                return get_unaligned_le16(p);
-}
-
-static inline void __put_control(struct l2cap_chan *chan, __u32 control,
-                                                                void *p)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return put_unaligned_le32(control, p);
-        else
-                return put_unaligned_le16(control, p);
-}
-
-static inline __u8 __ctrl_size(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_HDR_SIZE - L2CAP_HDR_SIZE;
-        else
-                return L2CAP_ENH_HDR_SIZE - L2CAP_HDR_SIZE;
 }
 
 extern bool disable_ertm;
@@ -926,5 +779,8 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
 void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
 int l2cap_chan_check_security(struct l2cap_chan *chan);
 void l2cap_chan_set_defaults(struct l2cap_chan *chan);
+int l2cap_ertm_init(struct l2cap_chan *chan);
+void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
+void l2cap_chan_del(struct l2cap_chan *chan, int err);
 
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 23fd0546fccb..4348ee8bda69 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -444,7 +444,7 @@ struct mgmt_ev_auth_failed {
 struct mgmt_ev_device_found {
         struct mgmt_addr_info addr;
         __s8    rssi;
-        __u8    flags[4];
+        __le32  flags;
         __le16  eir_len;
         __u8    eir[0];
 } __packed;
diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
index 439dadc8102f..bcb9cc3ce98b 100644
--- a/include/net/caif/caif_hsi.h
+++ b/include/net/caif/caif_hsi.h
@@ -93,25 +93,25 @@ struct cfhsi_desc {
 #endif
 
 /* Structure implemented by the CAIF HSI driver. */
-struct cfhsi_drv {
-        void (*tx_done_cb) (struct cfhsi_drv *drv);
-        void (*rx_done_cb) (struct cfhsi_drv *drv);
-        void (*wake_up_cb) (struct cfhsi_drv *drv);
-        void (*wake_down_cb) (struct cfhsi_drv *drv);
+struct cfhsi_cb_ops {
+        void (*tx_done_cb) (struct cfhsi_cb_ops *drv);
+        void (*rx_done_cb) (struct cfhsi_cb_ops *drv);
+        void (*wake_up_cb) (struct cfhsi_cb_ops *drv);
+        void (*wake_down_cb) (struct cfhsi_cb_ops *drv);
 };
 
 /* Structure implemented by HSI device. */
-struct cfhsi_dev {
-        int (*cfhsi_up) (struct cfhsi_dev *dev);
-        int (*cfhsi_down) (struct cfhsi_dev *dev);
-        int (*cfhsi_tx) (u8 *ptr, int len, struct cfhsi_dev *dev);
-        int (*cfhsi_rx) (u8 *ptr, int len, struct cfhsi_dev *dev);
-        int (*cfhsi_wake_up) (struct cfhsi_dev *dev);
-        int (*cfhsi_wake_down) (struct cfhsi_dev *dev);
-        int (*cfhsi_get_peer_wake) (struct cfhsi_dev *dev, bool *status);
-        int (*cfhsi_fifo_occupancy)(struct cfhsi_dev *dev, size_t *occupancy);
-        int (*cfhsi_rx_cancel)(struct cfhsi_dev *dev);
-        struct cfhsi_drv *drv;
+struct cfhsi_ops {
+        int (*cfhsi_up) (struct cfhsi_ops *dev);
+        int (*cfhsi_down) (struct cfhsi_ops *dev);
+        int (*cfhsi_tx) (u8 *ptr, int len, struct cfhsi_ops *dev);
+        int (*cfhsi_rx) (u8 *ptr, int len, struct cfhsi_ops *dev);
+        int (*cfhsi_wake_up) (struct cfhsi_ops *dev);
+        int (*cfhsi_wake_down) (struct cfhsi_ops *dev);
+        int (*cfhsi_get_peer_wake) (struct cfhsi_ops *dev, bool *status);
+        int (*cfhsi_fifo_occupancy) (struct cfhsi_ops *dev, size_t *occupancy);
+        int (*cfhsi_rx_cancel)(struct cfhsi_ops *dev);
+        struct cfhsi_cb_ops *cb_ops;
 };
 
 /* Structure holds status of received CAIF frames processing */
@@ -132,17 +132,26 @@ enum {
         CFHSI_PRIO_LAST,
 };
 
+struct cfhsi_config {
+        u32 inactivity_timeout;
+        u32 aggregation_timeout;
+        u32 head_align;
+        u32 tail_align;
+        u32 q_high_mark;
+        u32 q_low_mark;
+};
+
 /* Structure implemented by CAIF HSI drivers. */
 struct cfhsi {
         struct caif_dev_common cfdev;
         struct net_device *ndev;
         struct platform_device *pdev;
         struct sk_buff_head qhead[CFHSI_PRIO_LAST];
-        struct cfhsi_drv drv;
-        struct cfhsi_dev *dev;
+        struct cfhsi_cb_ops cb_ops;
+        struct cfhsi_ops *ops;
         int tx_state;
         struct cfhsi_rx_state rx_state;
-        unsigned long inactivity_timeout;
+        struct cfhsi_config cfg;
         int rx_len;
         u8 *rx_ptr;
         u8 *tx_buf;
@@ -150,8 +159,6 @@ struct cfhsi {
         u8 *rx_flip_buf;
         spinlock_t lock;
         int flow_off_sent;
-        u32 q_low_mark;
-        u32 q_high_mark;
         struct list_head list;
         struct work_struct wake_up_work;
         struct work_struct wake_down_work;
@@ -164,13 +171,31 @@ struct cfhsi {
         struct timer_list rx_slowpath_timer;
 
         /* TX aggregation */
-        unsigned long aggregation_timeout;
         int aggregation_len;
         struct timer_list aggregation_timer;
 
         unsigned long bits;
 };
-
 extern struct platform_driver cfhsi_driver;
 
+/**
+ * enum ifla_caif_hsi - CAIF HSI NetlinkRT parameters.
+ * @IFLA_CAIF_HSI_INACTIVITY_TOUT: Inactivity timeout before
+ *                      taking the HSI wakeline down, in milliseconds.
+ * When using RT Netlink to create, destroy or configure a CAIF HSI interface,
+ * enum ifla_caif_hsi is used to specify the configuration attributes.
+ */
+enum ifla_caif_hsi {
+        __IFLA_CAIF_HSI_UNSPEC,
+        __IFLA_CAIF_HSI_INACTIVITY_TOUT,
+        __IFLA_CAIF_HSI_AGGREGATION_TOUT,
+        __IFLA_CAIF_HSI_HEAD_ALIGN,
+        __IFLA_CAIF_HSI_TAIL_ALIGN,
+        __IFLA_CAIF_HSI_QHIGH_WATERMARK,
+        __IFLA_CAIF_HSI_QLOW_WATERMARK,
+        __IFLA_CAIF_HSI_MAX
+};
+
+extern struct cfhsi_ops *cfhsi_get_ops(void);
+
 #endif          /* CAIF_HSI_H_ */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 0289d4ce7070..493fa0c79005 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -70,11 +70,13 @@
  *
  * @IEEE80211_BAND_2GHZ: 2.4GHz ISM band
  * @IEEE80211_BAND_5GHZ: around 5GHz band (4.9-5.7)
+ * @IEEE80211_BAND_60GHZ: around 60 GHz band (58.32 - 64.80 GHz)
  * @IEEE80211_NUM_BANDS: number of defined bands
  */
 enum ieee80211_band {
         IEEE80211_BAND_2GHZ = NL80211_BAND_2GHZ,
         IEEE80211_BAND_5GHZ = NL80211_BAND_5GHZ,
+        IEEE80211_BAND_60GHZ = NL80211_BAND_60GHZ,
 
         /* keep last */
         IEEE80211_NUM_BANDS
@@ -211,6 +213,22 @@ struct ieee80211_sta_ht_cap {
 };
 
 /**
+ * struct ieee80211_sta_vht_cap - STA's VHT capabilities
+ *
+ * This structure describes most essential parameters needed
+ * to describe 802.11ac VHT capabilities for an STA.
+ *
+ * @vht_supported: is VHT supported by the STA
+ * @cap: VHT capabilities map as described in 802.11ac spec
+ * @vht_mcs: Supported VHT MCS rates
+ */
+struct ieee80211_sta_vht_cap {
+        bool vht_supported;
+        u32 cap; /* use IEEE80211_VHT_CAP_ */
+        struct ieee80211_vht_mcs_info vht_mcs;
+};
+
+/**
  * struct ieee80211_supported_band - frequency band definition
  *
  * This structure describes a frequency band a wiphy
@@ -233,6 +251,7 @@ struct ieee80211_supported_band {
         int n_channels;
         int n_bitrates;
         struct ieee80211_sta_ht_cap ht_cap;
+        struct ieee80211_sta_vht_cap vht_cap;
 };
 
 /*
@@ -404,6 +423,8 @@ struct cfg80211_beacon_data {
  *
  * Used to configure an AP interface.
  *
+ * @channel: the channel to start the AP on
+ * @channel_type: the channel type to use
  * @beacon: beacon data
  * @beacon_interval: beacon interval
  * @dtim_period: DTIM period
@@ -417,6 +438,9 @@ struct cfg80211_beacon_data {
  * @inactivity_timeout: time in seconds to determine station's inactivity.
  */
 struct cfg80211_ap_settings {
+        struct ieee80211_channel *channel;
+        enum nl80211_channel_type channel_type;
+
         struct cfg80211_beacon_data beacon;
 
         int beacon_interval, dtim_period;
@@ -556,11 +580,13 @@ enum station_info_flags {
  * @RATE_INFO_FLAGS_MCS: @tx_bitrate_mcs filled
  * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 Mhz width transmission
  * @RATE_INFO_FLAGS_SHORT_GI: 400ns guard interval
+ * @RATE_INFO_FLAGS_60G: 60gHz MCS
  */
 enum rate_info_flags {
         RATE_INFO_FLAGS_MCS             = 1<<0,
         RATE_INFO_FLAGS_40_MHZ_WIDTH    = 1<<1,
         RATE_INFO_FLAGS_SHORT_GI        = 1<<2,
+        RATE_INFO_FLAGS_60G             = 1<<3,
 };
 
 /**
@@ -622,10 +648,10 @@ struct sta_bss_parameters {
  * @llid: mesh local link id
  * @plid: mesh peer link id
  * @plink_state: mesh peer link state
- * @signal: the signal strength, type depends on the wiphy's signal_type
-        NOTE: For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
- * @signal_avg: avg signal strength, type depends on the wiphy's signal_type
-        NOTE: For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
+ * @signal: The signal strength, type depends on the wiphy's signal_type.
+ *      For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
+ * @signal_avg: Average signal strength, type depends on the wiphy's signal_type.
+ *      For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
  * @txrate: current unicast bitrate from this station
  * @rxrate: current unicast bitrate to this station
  * @rx_packets: packets received from this station
@@ -785,47 +811,101 @@ struct bss_parameters {
         int ht_opmode;
 };
 
-/*
+/**
  * struct mesh_config - 802.11s mesh configuration
  *
  * These parameters can be changed while the mesh is active.
+ *
+ * @dot11MeshRetryTimeout: the initial retry timeout in millisecond units used
+ *      by the Mesh Peering Open message
+ * @dot11MeshConfirmTimeout: the initial retry timeout in millisecond units
+ *      used by the Mesh Peering Open message
+ * @dot11MeshHoldingTimeout: the confirm timeout in millisecond units used by
+ *      the mesh peering management to close a mesh peering
+ * @dot11MeshMaxPeerLinks: the maximum number of peer links allowed on this
+ *      mesh interface
+ * @dot11MeshMaxRetries: the maximum number of peer link open retries that can
+ *      be sent to establish a new peer link instance in a mesh
+ * @dot11MeshTTL: the value of TTL field set at a source mesh STA
+ * @element_ttl: the value of TTL field set at a mesh STA for path selection
+ *      elements
+ * @auto_open_plinks: whether we should automatically open peer links when we
+ *      detect compatible mesh peers
+ * @dot11MeshNbrOffsetMaxNeighbor: the maximum number of neighbors to
+ *      synchronize to for 11s default synchronization method
+ * @dot11MeshHWMPmaxPREQretries: the number of action frames containing a PREQ
+ *      that an originator mesh STA can send to a particular path target
+ * @path_refresh_time: how frequently to refresh mesh paths in milliseconds
+ * @min_discovery_timeout: the minimum length of time to wait until giving up on
+ *      a path discovery in milliseconds
+ * @dot11MeshHWMPactivePathTimeout: the time (in TUs) for which mesh STAs
+ *      receiving a PREQ shall consider the forwarding information from the
+ *      root to be valid. (TU = time unit)
+ * @dot11MeshHWMPpreqMinInterval: the minimum interval of time (in TUs) during
+ *      which a mesh STA can send only one action frame containing a PREQ
+ *      element
+ * @dot11MeshHWMPperrMinInterval: the minimum interval of time (in TUs) during
+ *      which a mesh STA can send only one Action frame containing a PERR
+ *      element
+ * @dot11MeshHWMPnetDiameterTraversalTime: the interval of time (in TUs) that
+ *      it takes for an HWMP information element to propagate across the mesh
+ * @dot11MeshHWMPRootMode: the configuration of a mesh STA as root mesh STA
+ * @dot11MeshHWMPRannInterval: the interval of time (in TUs) between root
+ *      announcements are transmitted
+ * @dot11MeshGateAnnouncementProtocol: whether to advertise that this mesh
+ *      station has access to a broader network beyond the MBSS. (This is
+ *      missnamed in draft 12.0: dot11MeshGateAnnouncementProtocol set to true
+ *      only means that the station will announce others it's a mesh gate, but
+ *      not necessarily using the gate announcement protocol. Still keeping the
+ *      same nomenclature to be in sync with the spec)
+ * @dot11MeshForwarding: whether the Mesh STA is forwarding or non-forwarding
+ *      entity (default is TRUE - forwarding entity)
+ * @rssi_threshold: the threshold for average signal strength of candidate
+ *      station to establish a peer link
+ * @ht_opmode: mesh HT protection mode
+ *
+ * @dot11MeshHWMPactivePathToRootTimeout: The time (in TUs) for which mesh STAs
+ *      receiving a proactive PREQ shall consider the forwarding information to
+ *      the root mesh STA to be valid.
+ *
+ * @dot11MeshHWMProotInterval: The interval of time (in TUs) between proactive
+ *      PREQs are transmitted.
+ * @dot11MeshHWMPconfirmationInterval: The minimum interval of time (in TUs)
+ *      during which a mesh STA can send only one Action frame containing
+ *      a PREQ element for root path confirmation.
  */
 struct mesh_config {
-        /* Timeouts in ms */
-        /* Mesh plink management parameters */
         u16 dot11MeshRetryTimeout;
         u16 dot11MeshConfirmTimeout;
         u16 dot11MeshHoldingTimeout;
         u16 dot11MeshMaxPeerLinks;
-        u8  dot11MeshMaxRetries;
-        u8  dot11MeshTTL;
-        /* ttl used in path selection information elements */
-        u8  element_ttl;
+        u8 dot11MeshMaxRetries;
+        u8 dot11MeshTTL;
+        u8 element_ttl;
         bool auto_open_plinks;
-        /* neighbor offset synchronization */
         u32 dot11MeshNbrOffsetMaxNeighbor;
-        /* HWMP parameters */
-        u8  dot11MeshHWMPmaxPREQretries;
+        u8 dot11MeshHWMPmaxPREQretries;
         u32 path_refresh_time;
         u16 min_discovery_timeout;
         u32 dot11MeshHWMPactivePathTimeout;
         u16 dot11MeshHWMPpreqMinInterval;
         u16 dot11MeshHWMPperrMinInterval;
         u16 dot11MeshHWMPnetDiameterTraversalTime;
-        u8  dot11MeshHWMPRootMode;
+        u8 dot11MeshHWMPRootMode;
         u16 dot11MeshHWMPRannInterval;
-        /* This is missnamed in draft 12.0: dot11MeshGateAnnouncementProtocol
-         * set to true only means that the station will announce others it's a
-         * mesh gate, but not necessarily using the gate announcement protocol.
-         * Still keeping the same nomenclature to be in sync with the spec. */
-        bool  dot11MeshGateAnnouncementProtocol;
+        bool dot11MeshGateAnnouncementProtocol;
         bool dot11MeshForwarding;
         s32 rssi_threshold;
         u16 ht_opmode;
+        u32 dot11MeshHWMPactivePathToRootTimeout;
+        u16 dot11MeshHWMProotInterval;
+        u16 dot11MeshHWMPconfirmationInterval;
 };
 
 /**
  * struct mesh_setup - 802.11s mesh setup configuration
+ * @channel: the channel to start the mesh network on
+ * @channel_type: the channel type to use
  * @mesh_id: the mesh ID
  * @mesh_id_len: length of the mesh ID, at least 1 and at most 32 bytes
  * @sync_method: which synchronization method to use
@@ -840,6 +920,8 @@ struct mesh_config {
  * These parameters are fixed when the mesh is created.
  */
 struct mesh_setup {
+        struct ieee80211_channel *channel;
+        enum nl80211_channel_type channel_type;
         const u8 *mesh_id;
         u8 mesh_id_len;
         u8 sync_method;
@@ -917,7 +999,7 @@ struct cfg80211_ssid {
  * @ie_len: length of ie in octets
  * @rates: bitmap of rates to advertise for each band
  * @wiphy: the wiphy this was for
- * @dev: the interface
+ * @wdev: the wireless device to scan for
  * @aborted: (internal) scan request was notified as aborted
  * @no_cck: used to send probe requests at non CCK rate in 2GHz band
  */
@@ -930,9 +1012,10 @@ struct cfg80211_scan_request {
 
         u32 rates[IEEE80211_NUM_BANDS];
 
+        struct wireless_dev *wdev;
+
         /* internal */
         struct wiphy *wiphy;
-        struct net_device *dev;
         bool aborted;
         bool no_cck;
 
@@ -966,6 +1049,7 @@ struct cfg80211_match_set {
  * @wiphy: the wiphy this was for
  * @dev: the interface
  * @channels: channels to scan
+ * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
  */
 struct cfg80211_sched_scan_request {
         struct cfg80211_ssid *ssids;
@@ -976,6 +1060,7 @@ struct cfg80211_sched_scan_request {
         size_t ie_len;
         struct cfg80211_match_set *match_sets;
         int n_match_sets;
+        s32 rssi_thold;
 
         /* internal */
         struct wiphy *wiphy;
@@ -1351,10 +1436,10 @@ struct cfg80211_gtk_rekey_data {
  *
  * @add_virtual_intf: create a new virtual interface with the given name,
  *      must set the struct wireless_dev's iftype. Beware: You must create
- *      the new netdev in the wiphy's network namespace! Returns the netdev,
- *      or an ERR_PTR.
+ *      the new netdev in the wiphy's network namespace! Returns the struct
+ *      wireless_dev, or an ERR_PTR.
  *
- * @del_virtual_intf: remove the virtual interface determined by ifindex.
+ * @del_virtual_intf: remove the virtual interface
  *
  * @change_virtual_intf: change type/configuration of virtual interface,
  *      keep the struct wireless_dev's iftype updated.
@@ -1411,14 +1496,14 @@ struct cfg80211_gtk_rekey_data {
  *
  * @set_txq_params: Set TX queue parameters
  *
- * @set_channel: Set channel for a given wireless interface. Some devices
- *      may support multi-channel operation (by channel hopping) so cfg80211
- *      doesn't verify much. Note, however, that the passed netdev may be
- *      %NULL as well if the user requested changing the channel for the
- *      device itself, or for a monitor interface.
- * @get_channel: Get the current operating channel, should return %NULL if
- *      there's no single defined operating channel if for example the
- *      device implements channel hopping for multi-channel virtual interfaces.
+ * @libertas_set_mesh_channel: Only for backward compatibility for libertas,
+ *      as it doesn't implement join_mesh and needs to set the channel to
+ *      join the mesh instead.
+ *
+ * @set_monitor_channel: Set the monitor mode channel for the device. If other
+ *      interfaces are active this callback should reject the configuration.
+ *      If no interfaces are active or the device is down, the channel should
+ *      be stored for when a monitor interface becomes active.
  *
  * @scan: Request to do a scan. If returning zero, the scan request is given
  *      the driver, and will be valid until passed to cfg80211_scan_done().
@@ -1488,6 +1573,8 @@ struct cfg80211_gtk_rekey_data {
  * @set_power_mgmt: Configure WLAN power management. A timeout value of -1
  *      allows the driver to adjust the dynamic ps timeout value.
  * @set_cqm_rssi_config: Configure connection quality monitor RSSI threshold.
+ * @set_cqm_txe_config: Configure connection quality monitor TX error
+ *      thresholds.
  * @sched_scan_start: Tell the driver to start a scheduled scan.
  * @sched_scan_stop: Tell the driver to stop an ongoing scheduled
  *      scan.  The driver_initiated flag specifies whether the driver
@@ -1525,18 +1612,23 @@ struct cfg80211_gtk_rekey_data {
  * @get_et_strings:  Ethtool API to get a set of strings to describe stats
  *      and perhaps other supported types of ethtool data-sets.
  *      See @ethtool_ops.get_strings
+ *
+ * @get_channel: Get the current operating channel for the virtual interface.
+ *      For monitor interfaces, it should return %NULL unless there's a single
+ *      current monitoring channel.
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
         int     (*resume)(struct wiphy *wiphy);
         void    (*set_wakeup)(struct wiphy *wiphy, bool enabled);
 
-        struct net_device * (*add_virtual_intf)(struct wiphy *wiphy,
-                                                char *name,
-                                                enum nl80211_iftype type,
-                                                u32 *flags,
-                                                struct vif_params *params);
-        int     (*del_virtual_intf)(struct wiphy *wiphy, struct net_device *dev);
+        struct wireless_dev * (*add_virtual_intf)(struct wiphy *wiphy,
+                                                  char *name,
+                                                  enum nl80211_iftype type,
+                                                  u32 *flags,
+                                                  struct vif_params *params);
+        int     (*del_virtual_intf)(struct wiphy *wiphy,
+                                    struct wireless_dev *wdev);
         int     (*change_virtual_intf)(struct wiphy *wiphy,
                                        struct net_device *dev,
                                        enum nl80211_iftype type, u32 *flags,
@@ -1605,11 +1697,15 @@ struct cfg80211_ops {
         int     (*set_txq_params)(struct wiphy *wiphy, struct net_device *dev,
                                   struct ieee80211_txq_params *params);
 
-        int     (*set_channel)(struct wiphy *wiphy, struct net_device *dev,
-                               struct ieee80211_channel *chan,
-                               enum nl80211_channel_type channel_type);
+        int     (*libertas_set_mesh_channel)(struct wiphy *wiphy,
+                                             struct net_device *dev,
+                                             struct ieee80211_channel *chan);
+
+        int     (*set_monitor_channel)(struct wiphy *wiphy,
+                                       struct ieee80211_channel *chan,
+                                       enum nl80211_channel_type channel_type);
 
-        int     (*scan)(struct wiphy *wiphy, struct net_device *dev,
+        int     (*scan)(struct wiphy *wiphy,
                         struct cfg80211_scan_request *request);
 
         int     (*auth)(struct wiphy *wiphy, struct net_device *dev,
@@ -1663,23 +1759,23 @@ struct cfg80211_ops {
         int     (*flush_pmksa)(struct wiphy *wiphy, struct net_device *netdev);
 
         int     (*remain_on_channel)(struct wiphy *wiphy,
-                                     struct net_device *dev,
+                                     struct wireless_dev *wdev,
                                      struct ieee80211_channel *chan,
                                      enum nl80211_channel_type channel_type,
                                      unsigned int duration,
                                      u64 *cookie);
         int     (*cancel_remain_on_channel)(struct wiphy *wiphy,
-                                            struct net_device *dev,
+                                            struct wireless_dev *wdev,
                                             u64 cookie);
 
-        int     (*mgmt_tx)(struct wiphy *wiphy, struct net_device *dev,
+        int     (*mgmt_tx)(struct wiphy *wiphy, struct wireless_dev *wdev,
                           struct ieee80211_channel *chan, bool offchan,
                           enum nl80211_channel_type channel_type,
                           bool channel_type_valid, unsigned int wait,
                           const u8 *buf, size_t len, bool no_cck,
                           bool dont_wait_for_ack, u64 *cookie);
         int     (*mgmt_tx_cancel_wait)(struct wiphy *wiphy,
-                                       struct net_device *dev,
+                                       struct wireless_dev *wdev,
                                        u64 cookie);
 
         int     (*set_power_mgmt)(struct wiphy *wiphy, struct net_device *dev,
@@ -1689,8 +1785,12 @@ struct cfg80211_ops {
                                        struct net_device *dev,
                                        s32 rssi_thold, u32 rssi_hyst);
 
+        int     (*set_cqm_txe_config)(struct wiphy *wiphy,
+                                      struct net_device *dev,
+                                      u32 rate, u32 pkts, u32 intvl);
+
         void    (*mgmt_frame_register)(struct wiphy *wiphy,
-                                       struct net_device *dev,
+                                       struct wireless_dev *wdev,
                                        u16 frame_type, bool reg);
 
         int     (*set_antenna)(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant);
@@ -1721,15 +1821,17 @@ struct cfg80211_ops {
                                   struct net_device *dev,
                                   u16 noack_map);
 
-        struct ieee80211_channel *(*get_channel)(struct wiphy *wiphy,
-                                               enum nl80211_channel_type *type);
-
         int     (*get_et_sset_count)(struct wiphy *wiphy,
                                      struct net_device *dev, int sset);
         void    (*get_et_stats)(struct wiphy *wiphy, struct net_device *dev,
                                 struct ethtool_stats *stats, u64 *data);
         void    (*get_et_strings)(struct wiphy *wiphy, struct net_device *dev,
                                   u32 sset, u8 *data);
+
+        struct ieee80211_channel *
+                (*get_channel)(struct wiphy *wiphy,
+                               struct wireless_dev *wdev,
+                               enum nl80211_channel_type *type);
 };
 
 /*
@@ -2083,7 +2185,9 @@ struct wiphy {
         char fw_version[ETHTOOL_BUSINFO_LEN];
         u32 hw_version;
 
+#ifdef CONFIG_PM
         struct wiphy_wowlan_support wowlan;
+#endif
 
         u16 max_remain_on_channel_duration;
 
@@ -2250,20 +2354,31 @@ struct cfg80211_internal_bss;
 struct cfg80211_cached_keys;
 
 /**
- * struct wireless_dev - wireless per-netdev state
+ * struct wireless_dev - wireless device state
+ *
+ * For netdevs, this structure must be allocated by the driver
+ * that uses the ieee80211_ptr field in struct net_device (this
+ * is intentional so it can be allocated along with the netdev.)
+ * It need not be registered then as netdev registration will
+ * be intercepted by cfg80211 to see the new wireless device.
  *
- * This structure must be allocated by the driver/stack
- * that uses the ieee80211_ptr field in struct net_device
- * (this is intentional so it can be allocated along with
- * the netdev.)
+ * For non-netdev uses, it must also be allocated by the driver
+ * in response to the cfg80211 callbacks that require it, as
+ * there's no netdev registration in that case it may not be
+ * allocated outside of callback operations that return it.
  *
  * @wiphy: pointer to hardware description
  * @iftype: interface type
  * @list: (private) Used to collect the interfaces
- * @netdev: (private) Used to reference back to the netdev
+ * @netdev: (private) Used to reference back to the netdev, may be %NULL
+ * @identifier: (private) Identifier used in nl80211 to identify this
+ *      wireless device if it has no netdev
  * @current_bss: (private) Used by the internal configuration code
  * @channel: (private) Used by the internal configuration code to track
- *      user-set AP, monitor and WDS channels for wireless extensions
+ *      the user-set AP, monitor and WDS channel
+ * @preset_chan: (private) Used by the internal configuration code to
+ *      track the channel to be used for AP later
+ * @preset_chantype: (private) the corresponding channel type
  * @bssid: (private) Used by the internal configuration code
  * @ssid: (private) Used by the internal configuration code
  * @ssid_len: (private) Used by the internal configuration code
@@ -2289,6 +2404,8 @@ struct wireless_dev {
         struct list_head list;
         struct net_device *netdev;
 
+        u32 identifier;
+
         struct list_head mgmt_registrations;
         spinlock_t mgmt_registrations_lock;
 
@@ -2313,8 +2430,14 @@ struct wireless_dev {
         spinlock_t event_lock;
 
         struct cfg80211_internal_bss *current_bss; /* associated / joined */
+        struct ieee80211_channel *preset_chan;
+        enum nl80211_channel_type preset_chantype;
+
+        /* for AP and mesh channel tracking */
         struct ieee80211_channel *channel;
 
+        bool ibss_fixed;
+
         bool ps;
         int ps_timeout;
 
@@ -3169,7 +3292,7 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
 
 /**
  * cfg80211_ready_on_channel - notification of remain_on_channel start
- * @dev: network device
+ * @wdev: wireless device
  * @cookie: the request cookie
  * @chan: The current channel (from remain_on_channel request)
  * @channel_type: Channel type
@@ -3177,21 +3300,20 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
  *      channel
  * @gfp: allocation flags
  */
-void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
+void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
                                struct ieee80211_channel *chan,
                                enum nl80211_channel_type channel_type,
                                unsigned int duration, gfp_t gfp);
 
 /**
  * cfg80211_remain_on_channel_expired - remain_on_channel duration expired
- * @dev: network device
+ * @wdev: wireless device
  * @cookie: the request cookie
  * @chan: The current channel (from remain_on_channel request)
  * @channel_type: Channel type
  * @gfp: allocation flags
  */
-void cfg80211_remain_on_channel_expired(struct net_device *dev,
-                                        u64 cookie,
+void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
                                         struct ieee80211_channel *chan,
                                         enum nl80211_channel_type channel_type,
                                         gfp_t gfp);
@@ -3219,7 +3341,7 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
 
 /**
  * cfg80211_rx_mgmt - notification of received, unprocessed management frame
- * @dev: network device
+ * @wdev: wireless device receiving the frame
  * @freq: Frequency on which the frame was received in MHz
  * @sig_dbm: signal strength in mBm, or 0 if unknown
  * @buf: Management frame (header + body)
@@ -3234,12 +3356,12 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
  * This function is called whenever an Action frame is received for a station
  * mode interface, but is not processed in kernel.
  */
-bool cfg80211_rx_mgmt(struct net_device *dev, int freq, int sig_dbm,
+bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_dbm,
                       const u8 *buf, size_t len, gfp_t gfp);
 
 /**
  * cfg80211_mgmt_tx_status - notification of TX status for management frame
- * @dev: network device
+ * @wdev: wireless device receiving the frame
  * @cookie: Cookie returned by cfg80211_ops::mgmt_tx()
  * @buf: Management frame (header + body)
  * @len: length of the frame data
@@ -3250,7 +3372,7 @@ bool cfg80211_rx_mgmt(struct net_device *dev, int freq, int sig_dbm,
  * transmitted with cfg80211_ops::mgmt_tx() to report the TX status of the
  * transmission attempt.
  */
-void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
+void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
                              const u8 *buf, size_t len, bool ack, gfp_t gfp);
 
 
@@ -3280,6 +3402,21 @@ void cfg80211_cqm_pktloss_notify(struct net_device *dev,
                                  const u8 *peer, u32 num_packets, gfp_t gfp);
 
 /**
+ * cfg80211_cqm_txe_notify - TX error rate event
+ * @dev: network device
+ * @peer: peer's MAC address
+ * @num_packets: how many packets were lost
+ * @rate: % of packets which failed transmission
+ * @intvl: interval (in s) over which the TX failure threshold was breached.
+ * @gfp: context flags
+ *
+ * Notify userspace when configured % TX failures over number of packets in a
+ * given interval is exceeded.
+ */
+void cfg80211_cqm_txe_notify(struct net_device *dev, const u8 *peer,
+                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp);
+
+/**
  * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
  * @dev: network device
  * @bssid: BSSID of AP (to avoid races)
@@ -3359,11 +3496,14 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
                                  const u8 *frame, size_t len,
                                  int freq, int sig_dbm, gfp_t gfp);
 
-/*
+/**
  * cfg80211_can_beacon_sec_chan - test if ht40 on extension channel can be used
  * @wiphy: the wiphy
  * @chan: main channel
  * @channel_type: HT mode
+ *
+ * This function returns true if there is no secondary channel or the secondary
+ * channel can be used for beaconing (i.e. is not a radar channel etc.)
  */
 bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
                                   struct ieee80211_channel *chan,
@@ -3386,7 +3526,7 @@ void cfg80211_ch_switch_notify(struct net_device *dev, int freq,
  *
  * return 0 if MCS index >= 32
  */
-u16 cfg80211_calculate_bitrate(struct rate_info *rate);
+u32 cfg80211_calculate_bitrate(struct rate_info *rate);
 
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
diff --git a/include/net/dn_route.h b/include/net/dn_route.h
index c507e05d172f..4f7d6a182381 100644
--- a/include/net/dn_route.h
+++ b/include/net/dn_route.h
@@ -67,6 +67,8 @@ extern void dn_rt_cache_flush(int delay);
 struct dn_route {
         struct dst_entry dst;
 
+        struct neighbour *n;
+
         struct flowidn fld;
 
         __le16 rt_saddr;
diff --git a/include/net/dst.h b/include/net/dst.h
index 8197eadca819..baf597890064 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -42,16 +42,16 @@ struct dst_entry {
                 struct dst_entry        *from;
         };
         struct dst_entry        *path;
-        struct neighbour __rcu  *_neighbour;
+        void                    *__pad0;
 #ifdef CONFIG_XFRM
         struct xfrm_state       *xfrm;
 #else
         void                    *__pad1;
 #endif
-        int                     (*input)(struct sk_buff*);
-        int                     (*output)(struct sk_buff*);
+        int                     (*input)(struct sk_buff *);
+        int                     (*output)(struct sk_buff *);
 
-        int                     flags;
+        unsigned short          flags;
 #define DST_HOST                0x0001
 #define DST_NOXFRM              0x0002
 #define DST_NOPOLICY            0x0004
@@ -62,8 +62,23 @@ struct dst_entry {
 #define DST_FAKE_RTABLE         0x0080
 #define DST_XFRM_TUNNEL         0x0100
 
+        unsigned short          pending_confirm;
+
         short                   error;
+
+        /* A non-zero value of dst->obsolete forces by-hand validation
+         * of the route entry.  Positive values are set by the generic
+         * dst layer to indicate that the entry has been forcefully
+         * destroyed.
+         *
+         * Negative values are used by the implementation layer code to
+         * force invocation of the dst_ops->check() method.
+         */
         short                   obsolete;
+#define DST_OBSOLETE_NONE       0
+#define DST_OBSOLETE_DEAD       2
+#define DST_OBSOLETE_FORCE_CHK  -1
+#define DST_OBSOLETE_KILL       -2
         unsigned short          header_len;     /* more space at head required */
         unsigned short          trailer_len;    /* space to reserve at tail */
 #ifdef CONFIG_IP_ROUTE_CLASSID
@@ -94,21 +109,6 @@ struct dst_entry {
         };
 };
 
-static inline struct neighbour *dst_get_neighbour_noref(struct dst_entry *dst)
-{
-        return rcu_dereference(dst->_neighbour);
-}
-
-static inline struct neighbour *dst_get_neighbour_noref_raw(struct dst_entry *dst)
-{
-        return rcu_dereference_raw(dst->_neighbour);
-}
-
-static inline void dst_set_neighbour(struct dst_entry *dst, struct neighbour *neigh)
-{
-        rcu_assign_pointer(dst->_neighbour, neigh);
-}
-
 extern u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
 extern const u32 dst_default_metrics[RTAX_MAX];
 
@@ -222,12 +222,6 @@ static inline unsigned long dst_metric_rtt(const struct dst_entry *dst, int metr
         return msecs_to_jiffies(dst_metric(dst, metric));
 }
 
-static inline void set_dst_metric_rtt(struct dst_entry *dst, int metric,
-                                      unsigned long rtt)
-{
-        dst_metric_set(dst, metric, jiffies_to_msecs(rtt));
-}
-
 static inline u32
 dst_allfrag(const struct dst_entry *dst)
 {
@@ -241,7 +235,7 @@ dst_metric_locked(const struct dst_entry *dst, int metric)
         return dst_metric(dst, RTAX_LOCK) & (1<<metric);
 }
 
-static inline void dst_hold(struct dst_entry * dst)
+static inline void dst_hold(struct dst_entry *dst)
 {
         /*
          * If your kernel compilation stops here, please check
@@ -264,8 +258,7 @@ static inline void dst_use_noref(struct dst_entry *dst, unsigned long time)
         dst->lastuse = time;
 }
 
-static inline
-struct dst_entry * dst_clone(struct dst_entry * dst)
+static inline struct dst_entry *dst_clone(struct dst_entry *dst)
 {
         if (dst)
                 atomic_inc(&dst->__refcnt);
@@ -371,14 +364,15 @@ static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
 }
 
 extern int dst_discard(struct sk_buff *skb);
-extern void *dst_alloc(struct dst_ops * ops, struct net_device *dev,
-                       int initial_ref, int initial_obsolete, int flags);
-extern void __dst_free(struct dst_entry * dst);
-extern struct dst_entry *dst_destroy(struct dst_entry * dst);
+extern void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
+                       int initial_ref, int initial_obsolete,
+                       unsigned short flags);
+extern void __dst_free(struct dst_entry *dst);
+extern struct dst_entry *dst_destroy(struct dst_entry *dst);
 
-static inline void dst_free(struct dst_entry * dst)
+static inline void dst_free(struct dst_entry *dst)
 {
-        if (dst->obsolete > 1)
+        if (dst->obsolete > 0)
                 return;
         if (!atomic_read(&dst->__refcnt)) {
                 dst = dst_destroy(dst);
@@ -396,19 +390,35 @@ static inline void dst_rcu_free(struct rcu_head *head)
 
 static inline void dst_confirm(struct dst_entry *dst)
 {
-        if (dst) {
-                struct neighbour *n;
+        dst->pending_confirm = 1;
+}
 
-                rcu_read_lock();
-                n = dst_get_neighbour_noref(dst);
-                neigh_confirm(n);
-                rcu_read_unlock();
+static inline int dst_neigh_output(struct dst_entry *dst, struct neighbour *n,
+                                   struct sk_buff *skb)
+{
+        struct hh_cache *hh;
+
+        if (unlikely(dst->pending_confirm)) {
+                n->confirmed = jiffies;
+                dst->pending_confirm = 0;
         }
+
+        hh = &n->hh;
+        if ((n->nud_state & NUD_CONNECTED) && hh->hh_len)
+                return neigh_hh_output(hh, skb);
+        else
+                return n->output(n, skb);
 }
 
 static inline struct neighbour *dst_neigh_lookup(const struct dst_entry *dst, const void *daddr)
 {
-        return dst->ops->neigh_lookup(dst, daddr);
+        return dst->ops->neigh_lookup(dst, NULL, daddr);
+}
+
+static inline struct neighbour *dst_neigh_lookup_skb(const struct dst_entry *dst,
+                                                     struct sk_buff *skb)
+{
+        return dst->ops->neigh_lookup(dst, skb, NULL);
 }
 
 static inline void dst_link_failure(struct sk_buff *skb)
diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
index 3682a0a076c1..2f26dfb8450e 100644
--- a/include/net/dst_ops.h
+++ b/include/net/dst_ops.h
@@ -8,6 +8,7 @@ struct dst_entry;
 struct kmem_cachep;
 struct net_device;
 struct sk_buff;
+struct sock;
 
 struct dst_ops {
         unsigned short          family;
@@ -24,9 +25,14 @@ struct dst_ops {
                                           struct net_device *dev, int how);
         struct dst_entry *      (*negative_advice)(struct dst_entry *);
         void                    (*link_failure)(struct sk_buff *);
-        void                    (*update_pmtu)(struct dst_entry *dst, u32 mtu);
+        void                    (*update_pmtu)(struct dst_entry *dst, struct sock *sk,
+                                               struct sk_buff *skb, u32 mtu);
+        void                    (*redirect)(struct dst_entry *dst, struct sock *sk,
+                                            struct sk_buff *skb);
         int                     (*local_out)(struct sk_buff *skb);
-        struct neighbour *      (*neigh_lookup)(const struct dst_entry *dst, const void *daddr);
+        struct neighbour *      (*neigh_lookup)(const struct dst_entry *dst,
+                                                struct sk_buff *skb,
+                                                const void *daddr);
 
         struct kmem_cache       *kmem_cachep;
 
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index 075f1e3a0fed..e361f4882426 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -52,6 +52,7 @@ struct fib_rules_ops {
                                              struct sk_buff *,
                                              struct fib_rule_hdr *,
                                              struct nlattr **);
+        void                    (*delete)(struct fib_rule *);
         int                     (*compare)(struct fib_rule *,
                                            struct fib_rule_hdr *,
                                            struct nlattr **);
diff --git a/include/net/flow.h b/include/net/flow.h
index 6c469dbdb917..e1dd5082ec7e 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -20,8 +20,7 @@ struct flowi_common {
         __u8    flowic_proto;
         __u8    flowic_flags;
 #define FLOWI_FLAG_ANYSRC               0x01
-#define FLOWI_FLAG_PRECOW_METRICS       0x02
-#define FLOWI_FLAG_CAN_SLEEP            0x04
+#define FLOWI_FLAG_CAN_SLEEP            0x02
         __u32   flowic_secid;
 };
 
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index ccb68880abf5..48905cd3884c 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -5,6 +5,8 @@
 #include <net/netlink.h>
 #include <net/net_namespace.h>
 
+#define GENLMSG_DEFAULT_SIZE (NLMSG_DEFAULT_SIZE - GENL_HDRLEN)
+
 /**
  * struct genl_multicast_group - generic netlink multicast group
  * @name: name of the multicast group, names are per-family
diff --git a/include/net/inet6_connection_sock.h b/include/net/inet6_connection_sock.h
index 1866a676c810..04642c920431 100644
--- a/include/net/inet6_connection_sock.h
+++ b/include/net/inet6_connection_sock.h
@@ -26,6 +26,7 @@ extern int inet6_csk_bind_conflict(const struct sock *sk,
                                    const struct inet_bind_bucket *tb, bool relax);
 
 extern struct dst_entry* inet6_csk_route_req(struct sock *sk,
+                                             struct flowi6 *fl6,
                                              const struct request_sock *req);
 
 extern struct request_sock *inet6_csk_search_req(const struct sock *sk,
@@ -42,4 +43,6 @@ extern void inet6_csk_reqsk_queue_hash_add(struct sock *sk,
 extern void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr);
 
 extern int inet6_csk_xmit(struct sk_buff *skb, struct flowi *fl);
+
+extern struct dst_entry *inet6_csk_update_pmtu(struct sock *sk, u32 mtu);
 #endif /* _INET6_CONNECTION_SOCK_H */
diff --git a/include/net/inet_common.h b/include/net/inet_common.h
index 22fac9892b16..234008782c8c 100644
--- a/include/net/inet_common.h
+++ b/include/net/inet_common.h
@@ -14,9 +14,11 @@ struct sockaddr;
 struct socket;
 
 extern int inet_release(struct socket *sock);
-extern int inet_stream_connect(struct socket *sock, struct sockaddr * uaddr,
+extern int inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
                                int addr_len, int flags);
-extern int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
+extern int __inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
+                                 int addr_len, int flags);
+extern int inet_dgram_connect(struct socket *sock, struct sockaddr *uaddr,
                               int addr_len, int flags);
 extern int inet_accept(struct socket *sock, struct socket *newsock, int flags);
 extern int inet_sendmsg(struct kiocb *iocb, struct socket *sock,
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 7d83f90f203f..5ee66f517b4f 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -43,7 +43,6 @@ struct inet_connection_sock_af_ops {
         struct sock *(*syn_recv_sock)(struct sock *sk, struct sk_buff *skb,
                                       struct request_sock *req,
                                       struct dst_entry *dst);
-        struct inet_peer *(*get_peer)(struct sock *sk, bool *release_it);
         u16         net_header_len;
         u16         net_frag_header_len;
         u16         sockaddr_len;
@@ -337,4 +336,6 @@ extern int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname,
                                       char __user *optval, int __user *optlen);
 extern int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname,
                                       char __user *optval, unsigned int optlen);
+
+extern struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu);
 #endif /* _INET_CONNECTION_SOCK_H */
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 808fc5f76b03..54be0287eb98 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -379,10 +379,10 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo,
                                              const __be16 sport,
                                              const __be16 dport)
 {
-        struct sock *sk;
+        struct sock *sk = skb_steal_sock(skb);
         const struct iphdr *iph = ip_hdr(skb);
 
-        if (unlikely(sk = skb_steal_sock(skb)))
+        if (sk)
                 return sk;
         else
                 return __inet_lookup(dev_net(skb_dst(skb)->dev), hashinfo,
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index ae17e1352d7e..613cfa401672 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -172,6 +172,7 @@ struct inet_sock {
         int                     uc_index;
         int                     mc_index;
         __be32                  mc_addr;
+        int                     rx_dst_ifindex;
         struct ip_mc_socklist __rcu     *mc_list;
         struct inet_cork_full   cork;
 };
@@ -245,8 +246,6 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
 
         if (inet_sk(sk)->transparent || inet_sk(sk)->hdrincl)
                 flags |= FLOWI_FLAG_ANYSRC;
-        if (sk->sk_protocol == IPPROTO_TCP)
-                flags |= FLOWI_FLAG_PRECOW_METRICS;
         return flags;
 }
 
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 2040bff945d4..53f464d7cddc 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -36,25 +36,19 @@ struct inet_peer {
         u32                     metrics[RTAX_MAX];
         u32                     rate_tokens;    /* rate limiting for ICMP */
         unsigned long           rate_last;
-        unsigned long           pmtu_expires;
-        u32                     pmtu_orig;
-        u32                     pmtu_learned;
-        struct inetpeer_addr_base redirect_learned;
         union {
                 struct list_head        gc_list;
                 struct rcu_head     gc_rcu;
         };
         /*
          * Once inet_peer is queued for deletion (refcnt == -1), following fields
-         * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
+         * are not available: rid, ip_id_count
          * We can share memory with rcu_head to help keep inet_peer small.
          */
         union {
                 struct {
                         atomic_t                        rid;            /* Frag reception counter */
                         atomic_t                        ip_id_count;    /* IP ID for the next packet */
-                        __u32                           tcp_ts;
-                        __u32                           tcp_ts_stamp;
                 };
                 struct rcu_head         rcu;
                 struct inet_peer        *gc_next;
@@ -65,6 +59,69 @@ struct inet_peer {
         atomic_t                refcnt;
 };
 
+struct inet_peer_base {
+        struct inet_peer __rcu  *root;
+        seqlock_t               lock;
+        u32                     flush_seq;
+        int                     total;
+};
+
+#define INETPEER_BASE_BIT       0x1UL
+
+static inline struct inet_peer *inetpeer_ptr(unsigned long val)
+{
+        BUG_ON(val & INETPEER_BASE_BIT);
+        return (struct inet_peer *) val;
+}
+
+static inline struct inet_peer_base *inetpeer_base_ptr(unsigned long val)
+{
+        if (!(val & INETPEER_BASE_BIT))
+                return NULL;
+        val &= ~INETPEER_BASE_BIT;
+        return (struct inet_peer_base *) val;
+}
+
+static inline bool inetpeer_ptr_is_peer(unsigned long val)
+{
+        return !(val & INETPEER_BASE_BIT);
+}
+
+static inline void __inetpeer_ptr_set_peer(unsigned long *val, struct inet_peer *peer)
+{
+        /* This implicitly clears INETPEER_BASE_BIT */
+        *val = (unsigned long) peer;
+}
+
+static inline bool inetpeer_ptr_set_peer(unsigned long *ptr, struct inet_peer *peer)
+{
+        unsigned long val = (unsigned long) peer;
+        unsigned long orig = *ptr;
+
+        if (!(orig & INETPEER_BASE_BIT) ||
+            cmpxchg(ptr, orig, val) != orig)
+                return false;
+        return true;
+}
+
+static inline void inetpeer_init_ptr(unsigned long *ptr, struct inet_peer_base *base)
+{
+        *ptr = (unsigned long) base | INETPEER_BASE_BIT;
+}
+
+static inline void inetpeer_transfer_peer(unsigned long *to, unsigned long *from)
+{
+        unsigned long val = *from;
+
+        *to = val;
+        if (inetpeer_ptr_is_peer(val)) {
+                struct inet_peer *peer = inetpeer_ptr(val);
+                atomic_inc(&peer->refcnt);
+        }
+}
+
+extern void inet_peer_base_init(struct inet_peer_base *);
+
 void                    inet_initpeers(void) __init;
 
 #define INETPEER_METRICS_NEW    (~(u32) 0)
@@ -75,31 +132,38 @@ static inline bool inet_metrics_new(const struct inet_peer *p)
 }
 
 /* can be called with or without local BH being disabled */
-struct inet_peer        *inet_getpeer(const struct inetpeer_addr *daddr, int create);
+struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+                               const struct inetpeer_addr *daddr,
+                               int create);
 
-static inline struct inet_peer *inet_getpeer_v4(__be32 v4daddr, int create)
+static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base,
+                                                __be32 v4daddr,
+                                                int create)
 {
         struct inetpeer_addr daddr;
 
         daddr.addr.a4 = v4daddr;
         daddr.family = AF_INET;
-        return inet_getpeer(&daddr, create);
+        return inet_getpeer(base, &daddr, create);
 }
 
-static inline struct inet_peer *inet_getpeer_v6(const struct in6_addr *v6daddr, int create)
+static inline struct inet_peer *inet_getpeer_v6(struct inet_peer_base *base,
+                                                const struct in6_addr *v6daddr,
+                                                int create)
 {
         struct inetpeer_addr daddr;
 
         *(struct in6_addr *)daddr.addr.a6 = *v6daddr;
         daddr.family = AF_INET6;
-        return inet_getpeer(&daddr, create);
+        return inet_getpeer(base, &daddr, create);
 }
 
 /* can be called from BH context or outside */
 extern void inet_putpeer(struct inet_peer *p);
 extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
 
-extern void inetpeer_invalidate_tree(int family);
+extern void inetpeer_invalidate_tree(struct inet_peer_base *);
+extern void inetpeer_invalidate_family(int family);
 
 /*
  * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
diff --git a/include/net/ip.h b/include/net/ip.h
index 83e0619f59d0..bd5e444a19ce 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -158,8 +158,9 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
         return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
 }
 
-void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
-                   const struct ip_reply_arg *arg, unsigned int len);
+void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
+                           __be32 saddr, const struct ip_reply_arg *arg,
+                           unsigned int len);
 
 struct ipv4_config {
         int     log_martians;
@@ -210,6 +211,9 @@ extern int inet_peer_threshold;
 extern int inet_peer_minttl;
 extern int inet_peer_maxttl;
 
+/* From ip_input.c */
+extern int sysctl_ip_early_demux;
+
 /* From ip_output.c */
 extern int sysctl_ip_dynaddr;
 
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 0ae759a6c76e..0fedbd8d747a 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -86,6 +86,8 @@ struct fib6_table;
 struct rt6_info {
         struct dst_entry                dst;
 
+        struct neighbour                *n;
+
         /*
          * Tail elements of dst_entry (__refcnt etc.)
          * and these elements (rarely used in hot path) are in
@@ -107,7 +109,7 @@ struct rt6_info {
         u32                             rt6i_peer_genid;
 
         struct inet6_dev                *rt6i_idev;
-        struct inet_peer                *rt6i_peer;
+        unsigned long                   _rt6i_peer;
 
 #ifdef CONFIG_XFRM
         u32                             rt6i_flow_cache_genid;
@@ -118,6 +120,36 @@ struct rt6_info {
         u8                              rt6i_protocol;
 };
 
+static inline struct inet_peer *rt6_peer_ptr(struct rt6_info *rt)
+{
+        return inetpeer_ptr(rt->_rt6i_peer);
+}
+
+static inline bool rt6_has_peer(struct rt6_info *rt)
+{
+        return inetpeer_ptr_is_peer(rt->_rt6i_peer);
+}
+
+static inline void __rt6_set_peer(struct rt6_info *rt, struct inet_peer *peer)
+{
+        __inetpeer_ptr_set_peer(&rt->_rt6i_peer, peer);
+}
+
+static inline bool rt6_set_peer(struct rt6_info *rt, struct inet_peer *peer)
+{
+        return inetpeer_ptr_set_peer(&rt->_rt6i_peer, peer);
+}
+
+static inline void rt6_init_peer(struct rt6_info *rt, struct inet_peer_base *base)
+{
+        inetpeer_init_ptr(&rt->_rt6i_peer, base);
+}
+
+static inline void rt6_transfer_peer(struct rt6_info *rt, struct rt6_info *ort)
+{
+        inetpeer_transfer_peer(&rt->_rt6i_peer, &ort->_rt6i_peer);
+}
+
 static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
 {
         return ((struct rt6_info *)dst)->rt6i_idev;
@@ -207,6 +239,7 @@ struct fib6_table {
         u32                     tb6_id;
         rwlock_t                tb6_lock;
         struct fib6_node        tb6_root;
+        struct inet_peer_base   tb6_peers;
 };
 
 #define RT6_TABLE_UNSPEC        RT_TABLE_UNSPEC
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 37c1a1ed82c1..5fa2af00634a 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -53,16 +53,25 @@ static inline unsigned int rt6_flags2srcprefs(int flags)
         return (flags >> 3) & 7;
 }
 
-extern void                     rt6_bind_peer(struct rt6_info *rt,
-                                              int create);
+extern void rt6_bind_peer(struct rt6_info *rt, int create);
+
+static inline struct inet_peer *__rt6_get_peer(struct rt6_info *rt, int create)
+{
+        if (rt6_has_peer(rt))
+                return rt6_peer_ptr(rt);
+
+        rt6_bind_peer(rt, create);
+        return (rt6_has_peer(rt) ? rt6_peer_ptr(rt) : NULL);
+}
 
 static inline struct inet_peer *rt6_get_peer(struct rt6_info *rt)
 {
-        if (rt->rt6i_peer)
-                return rt->rt6i_peer;
+        return __rt6_get_peer(rt, 0);
+}
 
-        rt6_bind_peer(rt, 0);
-        return rt->rt6i_peer;
+static inline struct inet_peer *rt6_get_peer_create(struct rt6_info *rt)
+{
+        return __rt6_get_peer(rt, 1);
 }
 
 extern void                     ip6_route_input(struct sk_buff *skb);
@@ -124,17 +133,12 @@ extern int			rt6_route_rcv(struct net_device *dev,
                                               u8 *opt, int len,
                                               const struct in6_addr *gwaddr);
 
-extern void                     rt6_redirect(const struct in6_addr *dest,
-                                             const struct in6_addr *src,
-                                             const struct in6_addr *saddr,
-                                             struct neighbour *neigh,
-                                             u8 *lladdr,
-                                             int on_link);
-
-extern void                     rt6_pmtu_discovery(const struct in6_addr *daddr,
-                                                   const struct in6_addr *saddr,
-                                                   struct net_device *dev,
-                                                   u32 pmtu);
+extern void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
+                            int oif, u32 mark);
+extern void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk,
+                               __be32 mtu);
+extern void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark);
+extern void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk);
 
 struct netlink_callback;
 
@@ -154,7 +158,8 @@ extern void rt6_remove_prefsrc(struct inet6_ifaddr *ifp);
  *      Store a destination cache entry in a socket
  */
 static inline void __ip6_dst_store(struct sock *sk, struct dst_entry *dst,
-                                   struct in6_addr *daddr, struct in6_addr *saddr)
+                                   const struct in6_addr *daddr,
+                                   const struct in6_addr *saddr)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct rt6_info *rt = (struct rt6_info *) dst;
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index fc73e667b50e..358fb86f57eb 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -9,6 +9,8 @@
 #define IP6_TNL_F_CAP_XMIT 0x10000
 /* capable of receiving packets */
 #define IP6_TNL_F_CAP_RCV 0x20000
+/* determine capability on a per-packet basis */
+#define IP6_TNL_F_CAP_PER_PACKET 0x40000
 
 /* IPv6 tunnel */
 
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 78df0866cc38..e69c3a47153d 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -18,7 +18,9 @@
 
 #include <net/flow.h>
 #include <linux/seq_file.h>
+#include <linux/rcupdate.h>
 #include <net/fib_rules.h>
+#include <net/inetpeer.h>
 
 struct fib_config {
         u8                      fc_dst_len;
@@ -44,6 +46,23 @@ struct fib_config {
  };
 
 struct fib_info;
+struct rtable;
+
+struct fib_nh_exception {
+        struct fib_nh_exception __rcu   *fnhe_next;
+        __be32                          fnhe_daddr;
+        u32                             fnhe_pmtu;
+        __be32                          fnhe_gw;
+        unsigned long                   fnhe_expires;
+        unsigned long                   fnhe_stamp;
+};
+
+struct fnhe_hash_bucket {
+        struct fib_nh_exception __rcu   *chain;
+};
+
+#define FNHE_HASH_SIZE          2048
+#define FNHE_RECLAIM_DEPTH      5
 
 struct fib_nh {
         struct net_device       *nh_dev;
@@ -62,6 +81,9 @@ struct fib_nh {
         __be32                  nh_gw;
         __be32                  nh_saddr;
         int                     nh_saddr_genid;
+        struct rtable           *nh_rth_output;
+        struct rtable           *nh_rth_input;
+        struct fnhe_hash_bucket *nh_exceptions;
 };
 
 /*
@@ -105,12 +127,10 @@ struct fib_result {
         unsigned char   nh_sel;
         unsigned char   type;
         unsigned char   scope;
+        u32             tclassid;
         struct fib_info *fi;
         struct fib_table *table;
         struct list_head *fa_head;
-#ifdef CONFIG_IP_MULTIPLE_TABLES
-        struct fib_rule *r;
-#endif
 };
 
 struct fib_result_nl {
@@ -157,11 +177,11 @@ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
                                          FIB_RES_SADDR(net, res))
 
 struct fib_table {
-        struct hlist_node tb_hlist;
-        u32             tb_id;
-        int             tb_default;
-        int             tb_num_default;
-        unsigned long   tb_data[0];
+        struct hlist_node       tb_hlist;
+        u32                     tb_id;
+        int                     tb_default;
+        int                     tb_num_default;
+        unsigned long           tb_data[0];
 };
 
 extern int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp,
@@ -214,24 +234,55 @@ static inline int fib_lookup(struct net *net, const struct flowi4 *flp,
 extern int __net_init fib4_rules_init(struct net *net);
 extern void __net_exit fib4_rules_exit(struct net *net);
 
-#ifdef CONFIG_IP_ROUTE_CLASSID
-extern u32 fib_rules_tclass(const struct fib_result *res);
-#endif
-
-extern int fib_lookup(struct net *n, struct flowi4 *flp, struct fib_result *res);
-
 extern struct fib_table *fib_new_table(struct net *net, u32 id);
 extern struct fib_table *fib_get_table(struct net *net, u32 id);
 
+extern int __fib_lookup(struct net *net, struct flowi4 *flp,
+                        struct fib_result *res);
+
+static inline int fib_lookup(struct net *net, struct flowi4 *flp,
+                             struct fib_result *res)
+{
+        if (!net->ipv4.fib_has_custom_rules) {
+                res->tclassid = 0;
+                if (net->ipv4.fib_local &&
+                    !fib_table_lookup(net->ipv4.fib_local, flp, res,
+                                      FIB_LOOKUP_NOREF))
+                        return 0;
+                if (net->ipv4.fib_main &&
+                    !fib_table_lookup(net->ipv4.fib_main, flp, res,
+                                      FIB_LOOKUP_NOREF))
+                        return 0;
+                if (net->ipv4.fib_default &&
+                    !fib_table_lookup(net->ipv4.fib_default, flp, res,
+                                      FIB_LOOKUP_NOREF))
+                        return 0;
+                return -ENETUNREACH;
+        }
+        return __fib_lookup(net, flp, res);
+}
+
 #endif /* CONFIG_IP_MULTIPLE_TABLES */
 
 /* Exported by fib_frontend.c */
 extern const struct nla_policy rtm_ipv4_policy[];
 extern void             ip_fib_init(void);
+extern __be32 fib_compute_spec_dst(struct sk_buff *skb);
 extern int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
                                u8 tos, int oif, struct net_device *dev,
-                               __be32 *spec_dst, u32 *itag);
+                               struct in_device *idev, u32 *itag);
 extern void fib_select_default(struct fib_result *res);
+#ifdef CONFIG_IP_ROUTE_CLASSID
+static inline int fib_num_tclassid_users(struct net *net)
+{
+        return net->ipv4.fib_num_tclassid_users;
+}
+#else
+static inline int fib_num_tclassid_users(struct net *net)
+{
+        return 0;
+}
+#endif
 
 /* Exported by fib_semantics.c */
 extern int ip_fib_check_default(__be32 gw, struct net_device *dev);
@@ -253,7 +304,7 @@ static inline void fib_combine_itag(u32 *itag, const struct fib_result *res)
 #endif
         *itag = FIB_RES_NH(*res).nh_tclassid<<16;
 #ifdef CONFIG_IP_MULTIPLE_TABLES
-        rtag = fib_rules_tclass(res);
+        rtag = res->tclassid;
         if (*itag == 0)
                 *itag = (rtag<<16);
         *itag |= (rtag>>16);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index aecf88436abf..01c34b363a34 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -251,6 +251,8 @@ static inline void fl6_sock_release(struct ip6_flowlabel *fl)
                 atomic_dec(&fl->users);
 }
 
+extern void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info);
+
 extern int                      ip6_ra_control(struct sock *sk, int sel);
 
 extern int                      ipv6_parse_hopopts(struct sk_buff *skb);
@@ -298,14 +300,23 @@ static inline int ipv6_addr_cmp(const struct in6_addr *a1, const struct in6_addr
         return memcmp(a1, a2, sizeof(struct in6_addr));
 }
 
-static inline int
+static inline bool
 ipv6_masked_addr_cmp(const struct in6_addr *a1, const struct in6_addr *m,
                      const struct in6_addr *a2)
 {
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+        const unsigned long *ul1 = (const unsigned long *)a1;
+        const unsigned long *ulm = (const unsigned long *)m;
+        const unsigned long *ul2 = (const unsigned long *)a2;
+
+        return !!(((ul1[0] ^ ul2[0]) & ulm[0]) |
+                  ((ul1[1] ^ ul2[1]) & ulm[1]));
+#else
         return !!(((a1->s6_addr32[0] ^ a2->s6_addr32[0]) & m->s6_addr32[0]) |
                   ((a1->s6_addr32[1] ^ a2->s6_addr32[1]) & m->s6_addr32[1]) |
                   ((a1->s6_addr32[2] ^ a2->s6_addr32[2]) & m->s6_addr32[2]) |
                   ((a1->s6_addr32[3] ^ a2->s6_addr32[3]) & m->s6_addr32[3]));
+#endif
 }
 
 static inline void ipv6_addr_prefix(struct in6_addr *pfx, 
@@ -335,10 +346,17 @@ static inline void ipv6_addr_set(struct in6_addr *addr,
 static inline bool ipv6_addr_equal(const struct in6_addr *a1,
                                    const struct in6_addr *a2)
 {
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+        const unsigned long *ul1 = (const unsigned long *)a1;
+        const unsigned long *ul2 = (const unsigned long *)a2;
+
+        return ((ul1[0] ^ ul2[0]) | (ul1[1] ^ ul2[1])) == 0UL;
+#else
         return ((a1->s6_addr32[0] ^ a2->s6_addr32[0]) |
                 (a1->s6_addr32[1] ^ a2->s6_addr32[1]) |
                 (a1->s6_addr32[2] ^ a2->s6_addr32[2]) |
                 (a1->s6_addr32[3] ^ a2->s6_addr32[3])) == 0;
+#endif
 }
 
 static inline bool __ipv6_prefix_equal(const __be32 *a1, const __be32 *a2,
@@ -391,8 +409,27 @@ bool ip6_frag_match(struct inet_frag_queue *q, void *a);
 
 static inline bool ipv6_addr_any(const struct in6_addr *a)
 {
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+        const unsigned long *ul = (const unsigned long *)a;
+
+        return (ul[0] | ul[1]) == 0UL;
+#else
         return (a->s6_addr32[0] | a->s6_addr32[1] |
                 a->s6_addr32[2] | a->s6_addr32[3]) == 0;
+#endif
+}
+
+static inline u32 ipv6_addr_hash(const struct in6_addr *a)
+{
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+        const unsigned long *ul = (const unsigned long *)a;
+        unsigned long x = ul[0] ^ ul[1];
+
+        return (u32)(x ^ (x >> 32));
+#else
+        return (__force u32)(a->s6_addr32[0] ^ a->s6_addr32[1] ^
+                             a->s6_addr32[2] ^ a->s6_addr32[3]);
+#endif
 }
 
 static inline bool ipv6_addr_loopback(const struct in6_addr *a)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 95e39b6a02ec..bb86aa6f98dd 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -233,8 +233,10 @@ enum ieee80211_rssi_event {
  *      valid in station mode only while @assoc is true and if also
  *      requested by %IEEE80211_HW_NEED_DTIM_PERIOD (cf. also hw conf
  *      @ps_dtim_period)
- * @last_tsf: last beacon's/probe response's TSF timestamp (could be old
+ * @sync_tsf: last beacon's/probe response's TSF timestamp (could be old
  *      as it may have been received during scanning long ago)
+ * @sync_device_ts: the device timestamp corresponding to the sync_tsf,
+ *      the driver/device can use this to calculate synchronisation
  * @beacon_int: beacon interval
  * @assoc_capability: capabilities taken from assoc resp
  * @basic_rates: bitmap of basic rates, each bit stands for an
@@ -281,7 +283,8 @@ struct ieee80211_bss_conf {
         u8 dtim_period;
         u16 beacon_int;
         u16 assoc_capability;
-        u64 last_tsf;
+        u64 sync_tsf;
+        u32 sync_device_ts;
         u32 basic_rates;
         int mcast_rate[IEEE80211_NUM_BANDS];
         u16 ht_operation_mode;
@@ -475,7 +478,7 @@ enum mac80211_rate_control_flags {
 #define IEEE80211_TX_INFO_RATE_DRIVER_DATA_SIZE 24
 
 /* maximum number of rate stages */
-#define IEEE80211_TX_MAX_RATES  5
+#define IEEE80211_TX_MAX_RATES  4
 
 /**
  * struct ieee80211_tx_rate - rate selection/status
@@ -563,11 +566,11 @@ struct ieee80211_tx_info {
                 } control;
                 struct {
                         struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
-                        u8 ampdu_ack_len;
                         int ack_signal;
+                        u8 ampdu_ack_len;
                         u8 ampdu_len;
                         u8 antenna;
-                        /* 14 bytes free */
+                        /* 21 bytes free */
                 } status;
                 struct {
                         struct ieee80211_tx_rate driver_rates[
@@ -634,7 +637,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
                 info->status.rates[i].count = 0;
 
         BUILD_BUG_ON(
-            offsetof(struct ieee80211_tx_info, status.ampdu_ack_len) != 23);
+            offsetof(struct ieee80211_tx_info, status.ack_signal) != 20);
         memset(&info->status.ampdu_ack_len, 0,
                sizeof(struct ieee80211_tx_info) -
                offsetof(struct ieee80211_tx_info, status.ampdu_ack_len));
@@ -696,6 +699,8 @@ enum mac80211_rx_flags {
  *
  * @mactime: value in microseconds of the 64-bit Time Synchronization Function
  *      (TSF) timer when the first data symbol (MPDU) arrived at the hardware.
+ * @device_timestamp: arbitrary timestamp for the device, mac80211 doesn't use
+ *      it but can store it and pass it back to the driver for synchronisation
  * @band: the active band when this frame was received
  * @freq: frequency the radio was tuned to when receiving this frame, in MHz
  * @signal: signal strength when receiving this frame, either in dBm, in dB or
@@ -709,13 +714,14 @@ enum mac80211_rx_flags {
  */
 struct ieee80211_rx_status {
         u64 mactime;
-        enum ieee80211_band band;
-        int freq;
-        int signal;
-        int antenna;
-        int rate_idx;
-        int flag;
-        unsigned int rx_flags;
+        u32 device_timestamp;
+        u16 flag;
+        u16 freq;
+        u8 rate_idx;
+        u8 rx_flags;
+        u8 band;
+        u8 antenna;
+        s8 signal;
 };
 
 /**
@@ -1297,6 +1303,10 @@ enum ieee80211_hw_flags {
  *      reports, by default it is set to _MCS, _GI and _BW but doesn't
  *      include _FMT. Use %IEEE80211_RADIOTAP_MCS_HAVE_* values, only
  *      adding _BW is supported today.
+ *
+ * @netdev_features: netdev features to be set in each netdev created
+ *      from this HW. Note only HW checksum features are currently
+ *      compatible with mac80211. Other feature bits will be rejected.
  */
 struct ieee80211_hw {
         struct ieee80211_conf conf;
@@ -1319,6 +1329,7 @@ struct ieee80211_hw {
         u8 max_tx_aggregation_subframes;
         u8 offchannel_tx_hw_queue;
         u8 radiotap_mcs_details;
+        netdev_features_t netdev_features;
 };
 
 /**
@@ -1891,19 +1902,6 @@ enum ieee80211_rate_control_changed {
  *      The low-level driver should send the frame out based on
  *      configuration in the TX control data. This handler should,
  *      preferably, never fail and stop queues appropriately.
- *      This must be implemented if @tx_frags is not.
- *      Must be atomic.
- *
- * @tx_frags: Called to transmit multiple fragments of a single MSDU.
- *      This handler must consume all fragments, sending out some of
- *      them only is useless and it can't ask for some of them to be
- *      queued again. If the frame is not fragmented the queue has a
- *      single SKB only. To avoid issues with the networking stack
- *      when TX status is reported the frames should be removed from
- *      the skb queue.
- *      If this is used, the tx_info @vif and @sta pointers will be
- *      invalid -- you must not use them in that case.
- *      This must be implemented if @tx isn't.
  *      Must be atomic.
  *
  * @start: Called before the first netdevice attached to the hardware
@@ -2183,7 +2181,10 @@ enum ieee80211_rate_control_changed {
  *      offload. Frames to transmit on the off-channel channel are transmitted
  *      normally except for the %IEEE80211_TX_CTL_TX_OFFCHAN flag. When the
  *      duration (which will always be non-zero) expires, the driver must call
- *      ieee80211_remain_on_channel_expired(). This callback may sleep.
+ *      ieee80211_remain_on_channel_expired().
+ *      Note that this callback may be called while the device is in IDLE and
+ *      must be accepted in this case.
+ *      This callback may sleep.
  * @cancel_remain_on_channel: Requests that an ongoing off-channel period is
  *      aborted before it expires. This callback may sleep.
  *
@@ -2246,11 +2247,24 @@ enum ieee80211_rate_control_changed {
  * @get_et_strings:  Ethtool API to get a set of strings to describe stats
  *      and perhaps other supported types of ethtool data-sets.
  *
+ * @get_rssi: Get current signal strength in dBm, the function is optional
+ *      and can sleep.
+ *
+ * @mgd_prepare_tx: Prepare for transmitting a management frame for association
+ *      before associated. In multi-channel scenarios, a virtual interface is
+ *      bound to a channel before it is associated, but as it isn't associated
+ *      yet it need not necessarily be given airtime, in particular since any
+ *      transmission to a P2P GO needs to be synchronized against the GO's
+ *      powersave state. mac80211 will call this function before transmitting a
+ *      management frame prior to having successfully associated to allow the
+ *      driver to give it channel time for the transmission, to get a response
+ *      and to be able to synchronize with the GO.
+ *      The callback will be called before each transmission and upon return
+ *      mac80211 will transmit the frame right away.
+ *      The callback is optional and can (should!) sleep.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
-        void (*tx_frags)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                         struct ieee80211_sta *sta, struct sk_buff_head *skbs);
         int (*start)(struct ieee80211_hw *hw);
         void (*stop)(struct ieee80211_hw *hw);
 #ifdef CONFIG_PM
@@ -2385,6 +2399,11 @@ struct ieee80211_ops {
         void    (*get_et_strings)(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif,
                                   u32 sset, u8 *data);
+        int     (*get_rssi)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta, s8 *rssi_dbm);
+
+        void    (*mgd_prepare_tx)(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif);
 };
 
 /**
@@ -3557,16 +3576,6 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
                                gfp_t gfp);
 
 /**
- * ieee80211_get_operstate - get the operstate of the vif
- *
- * @vif: &struct ieee80211_vif pointer from the add_interface callback.
- *
- * The driver might need to know the operstate of the net_device
- * (specifically, whether the link is IF_OPER_UP after resume)
- */
-unsigned char ieee80211_get_operstate(struct ieee80211_vif *vif);
-
-/**
  * ieee80211_chswitch_done - Complete channel switch process
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @success: make the channel switch successful or not
@@ -3589,22 +3598,6 @@ void ieee80211_request_smps(struct ieee80211_vif *vif,
                             enum ieee80211_smps_mode smps_mode);
 
 /**
- * ieee80211_key_removed - disable hw acceleration for key
- * @key_conf: The key hw acceleration should be disabled for
- *
- * This allows drivers to indicate that the given key has been
- * removed from hardware acceleration, due to a new key that
- * was added. Don't use this if the key can continue to be used
- * for TX, if the key restriction is on RX only it is permitted
- * to keep the key for TX only and not call this function.
- *
- * Due to locking constraints, it may only be called during
- * @set_key. This function must be allowed to sleep, and the
- * key it tries to disable may still be used until it returns.
- */
-void ieee80211_key_removed(struct ieee80211_key_conf *key_conf);
-
-/**
  * ieee80211_ready_on_channel - notification of remain-on-channel start
  * @hw: pointer as obtained from ieee80211_alloc_hw()
  */
@@ -3829,12 +3822,6 @@ void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
 
 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif);
 
-int ieee80211_add_srates_ie(struct ieee80211_vif *vif,
-                            struct sk_buff *skb, bool need_basic);
-
-int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif,
-                                struct sk_buff *skb, bool need_basic);
-
 /**
  * ieee80211_ave_rssi - report the average rssi for the specified interface
  *
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index c9f8ab5cc687..d0d11df9cba1 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -21,6 +21,14 @@
 
 #include <net/af_ieee802154.h>
 
+/* General MAC frame format:
+ *  2 bytes: Frame Control
+ *  1 byte:  Sequence Number
+ * 20 bytes: Addressing fields
+ * 14 bytes: Auxiliary Security Header
+ */
+#define MAC802154_FRAME_HARD_HEADER_LEN         (2 + 1 + 20 + 14)
+
 /* The following flags are used to indicate changed address settings from
  * the stack to the hardware.
  */
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index c02b6ad3f6c5..96a3b5c03e37 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -47,6 +47,8 @@ enum {
 #include <linux/icmpv6.h>
 #include <linux/in6.h>
 #include <linux/types.h>
+#include <linux/if_arp.h>
+#include <linux/netdevice.h>
 
 #include <net/neighbour.h>
 
@@ -80,6 +82,54 @@ struct nd_opt_hdr {
         __u8            nd_opt_len;
 } __packed;
 
+/* ND options */
+struct ndisc_options {
+        struct nd_opt_hdr *nd_opt_array[__ND_OPT_ARRAY_MAX];
+#ifdef CONFIG_IPV6_ROUTE_INFO
+        struct nd_opt_hdr *nd_opts_ri;
+        struct nd_opt_hdr *nd_opts_ri_end;
+#endif
+        struct nd_opt_hdr *nd_useropts;
+        struct nd_opt_hdr *nd_useropts_end;
+};
+
+#define nd_opts_src_lladdr      nd_opt_array[ND_OPT_SOURCE_LL_ADDR]
+#define nd_opts_tgt_lladdr      nd_opt_array[ND_OPT_TARGET_LL_ADDR]
+#define nd_opts_pi              nd_opt_array[ND_OPT_PREFIX_INFO]
+#define nd_opts_pi_end          nd_opt_array[__ND_OPT_PREFIX_INFO_END]
+#define nd_opts_rh              nd_opt_array[ND_OPT_REDIRECT_HDR]
+#define nd_opts_mtu             nd_opt_array[ND_OPT_MTU]
+
+#define NDISC_OPT_SPACE(len) (((len)+2+7)&~7)
+
+extern struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
+                                                 struct ndisc_options *ndopts);
+
+/*
+ * Return the padding between the option length and the start of the
+ * link addr.  Currently only IP-over-InfiniBand needs this, although
+ * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
+ * also need a pad of 2.
+ */
+static int ndisc_addr_option_pad(unsigned short type)
+{
+        switch (type) {
+        case ARPHRD_INFINIBAND: return 2;
+        default:                return 0;
+        }
+}
+
+static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
+                                      struct net_device *dev)
+{
+        u8 *lladdr = (u8 *)(p + 1);
+        int lladdrlen = p->nd_opt_len << 3;
+        int prepad = ndisc_addr_option_pad(dev->type);
+        if (lladdrlen != NDISC_OPT_SPACE(dev->addr_len + prepad))
+                return NULL;
+        return lladdr + prepad;
+}
+
 static inline u32 ndisc_hashfn(const void *pkey, const struct net_device *dev, __u32 *hash_rnd)
 {
         const u32 *p32 = pkey;
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 6cdfeedb650b..344d8988842a 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -202,9 +202,16 @@ extern struct neighbour *	neigh_lookup(struct neigh_table *tbl,
 extern struct neighbour *       neigh_lookup_nodev(struct neigh_table *tbl,
                                                    struct net *net,
                                                    const void *pkey);
-extern struct neighbour *       neigh_create(struct neigh_table *tbl,
+extern struct neighbour *       __neigh_create(struct neigh_table *tbl,
+                                               const void *pkey,
+                                               struct net_device *dev,
+                                               bool want_ref);
+static inline struct neighbour *neigh_create(struct neigh_table *tbl,
                                              const void *pkey,
-                                             struct net_device *dev);
+                                             struct net_device *dev)
+{
+        return __neigh_create(tbl, pkey, dev, true);
+}
 extern void                     neigh_destroy(struct neighbour *neigh);
 extern int                      __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb);
 extern int                      neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, 
@@ -302,12 +309,6 @@ static inline struct neighbour * neigh_clone(struct neighbour *neigh)
 
 #define neigh_hold(n)   atomic_inc(&(n)->refcnt)
 
-static inline void neigh_confirm(struct neighbour *neigh)
-{
-        if (neigh)
-                neigh->confirmed = jiffies;
-}
-
 static inline int neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 {
         unsigned long now = jiffies;
@@ -351,15 +352,6 @@ static inline int neigh_hh_output(struct hh_cache *hh, struct sk_buff *skb)
         return dev_queue_xmit(skb);
 }
 
-static inline int neigh_output(struct neighbour *n, struct sk_buff *skb)
-{
-        struct hh_cache *hh = &n->hh;
-        if ((n->nud_state & NUD_CONNECTED) && hh->hh_len)
-                return neigh_hh_output(hh, skb);
-        else
-                return n->output(n, skb);
-}
-
 static inline struct neighbour *
 __neigh_lookup(struct neigh_table *tbl, const void *pkey, struct net_device *dev, int creat)
 {
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index ac9195e6a062..ae1cd6c9ba52 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -101,6 +101,7 @@ struct net {
         struct netns_xfrm       xfrm;
 #endif
         struct netns_ipvs       *ipvs;
+        struct sock             *diag_nlsk;
 };
 
 
diff --git a/include/net/netevent.h b/include/net/netevent.h
index 086f8a5b59dc..3ce4988c9c08 100644
--- a/include/net/netevent.h
+++ b/include/net/netevent.h
@@ -12,10 +12,14 @@
  */
 
 struct dst_entry;
+struct neighbour;
 
 struct netevent_redirect {
         struct dst_entry *old;
+        struct neighbour *old_neigh;
         struct dst_entry *new;
+        struct neighbour *new_neigh;
+        const void *daddr;
 };
 
 enum netevent_notif_type {
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index cce7f6a798bf..f1494feba79f 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -39,36 +39,6 @@ union nf_conntrack_expect_proto {
         /* insert expect proto private data here */
 };
 
-/* Add protocol helper include file here */
-#include <linux/netfilter/nf_conntrack_ftp.h>
-#include <linux/netfilter/nf_conntrack_pptp.h>
-#include <linux/netfilter/nf_conntrack_h323.h>
-#include <linux/netfilter/nf_conntrack_sane.h>
-#include <linux/netfilter/nf_conntrack_sip.h>
-
-/* per conntrack: application helper private data */
-union nf_conntrack_help {
-        /* insert conntrack helper private data (master) here */
-#if defined(CONFIG_NF_CONNTRACK_FTP) || defined(CONFIG_NF_CONNTRACK_FTP_MODULE)
-        struct nf_ct_ftp_master ct_ftp_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_PPTP) || \
-    defined(CONFIG_NF_CONNTRACK_PPTP_MODULE)
-        struct nf_ct_pptp_master ct_pptp_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_H323) || \
-    defined(CONFIG_NF_CONNTRACK_H323_MODULE)
-        struct nf_ct_h323_master ct_h323_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_SANE) || \
-    defined(CONFIG_NF_CONNTRACK_SANE_MODULE)
-        struct nf_ct_sane_master ct_sane_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_SIP) || defined(CONFIG_NF_CONNTRACK_SIP_MODULE)
-        struct nf_ct_sip_master ct_sip_info;
-#endif
-};
-
 #include <linux/types.h>
 #include <linux/skbuff.h>
 #include <linux/timer.h>
@@ -89,12 +59,13 @@ struct nf_conn_help {
         /* Helper. if any */
         struct nf_conntrack_helper __rcu *helper;
 
-        union nf_conntrack_help help;
-
         struct hlist_head expectations;
 
         /* Current number of expected connections */
         u8 expecting[NF_CT_MAX_EXPECT_CLASSES];
+
+        /* private helper information. */
+        char data[];
 };
 
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index aced085132e7..d8f5b9f52169 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -28,8 +28,8 @@ extern unsigned int nf_conntrack_in(struct net *net,
 extern int nf_conntrack_init(struct net *net);
 extern void nf_conntrack_cleanup(struct net *net);
 
-extern int nf_conntrack_proto_init(void);
-extern void nf_conntrack_proto_fini(void);
+extern int nf_conntrack_proto_init(struct net *net);
+extern void nf_conntrack_proto_fini(struct net *net);
 
 extern bool
 nf_ct_get_tuple(const struct sk_buff *skb,
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index 4619caadd9d1..983f00263243 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -59,10 +59,12 @@ static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
         return nf_ct_net(exp->master);
 }
 
+#define NF_CT_EXP_POLICY_NAME_LEN       16
+
 struct nf_conntrack_expect_policy {
         unsigned int    max_expected;
         unsigned int    timeout;
-        const char      *name;
+        char            name[NF_CT_EXP_POLICY_NAME_LEN];
 };
 
 #define NF_CT_EXPECT_CLASS_DEFAULT      0
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index 96755c3798a5..8b4d1fc29096 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -80,10 +80,13 @@ static inline void nf_ct_ext_free(struct nf_conn *ct)
 }
 
 /* Add this type, returns pointer to data or NULL. */
-void *
-__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp);
+void *__nf_ct_ext_add_length(struct nf_conn *ct, enum nf_ct_ext_id id,
+                             size_t var_alloc_len, gfp_t gfp);
+
 #define nf_ct_ext_add(ct, id, gfp) \
-        ((id##_TYPE *)__nf_ct_ext_add((ct), (id), (gfp)))
+        ((id##_TYPE *)__nf_ct_ext_add_length((ct), (id), 0, (gfp)))
+#define nf_ct_ext_add_length(ct, id, len, gfp) \
+        ((id##_TYPE *)__nf_ct_ext_add_length((ct), (id), (len), (gfp)))
 
 #define NF_CT_EXT_F_PREALLOC    0x0001
 
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index 1d1889409b9e..9aad956d1008 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -11,18 +11,27 @@
 #define _NF_CONNTRACK_HELPER_H
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_extend.h>
+#include <net/netfilter/nf_conntrack_expect.h>
 
 struct module;
 
+enum nf_ct_helper_flags {
+        NF_CT_HELPER_F_USERSPACE        = (1 << 0),
+        NF_CT_HELPER_F_CONFIGURED       = (1 << 1),
+};
+
 #define NF_CT_HELPER_NAME_LEN   16
 
 struct nf_conntrack_helper {
         struct hlist_node hnode;        /* Internal use. */
 
-        const char *name;               /* name of the module */
+        char name[NF_CT_HELPER_NAME_LEN]; /* name of the module */
         struct module *me;              /* pointer to self */
         const struct nf_conntrack_expect_policy *expect_policy;
 
+        /* length of internal data, ie. sizeof(struct nf_ct_*_master) */
+        size_t data_len;
+
         /* Tuple of things we will help (compared against server response) */
         struct nf_conntrack_tuple tuple;
 
@@ -35,8 +44,12 @@ struct nf_conntrack_helper {
 
         void (*destroy)(struct nf_conn *ct);
 
+        int (*from_nlattr)(struct nlattr *attr, struct nf_conn *ct);
         int (*to_nlattr)(struct sk_buff *skb, const struct nf_conn *ct);
         unsigned int expect_class_max;
+
+        unsigned int flags;
+        unsigned int queue_num;         /* For user-space helpers. */
 };
 
 extern struct nf_conntrack_helper *
@@ -48,7 +61,7 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum);
 extern int nf_conntrack_helper_register(struct nf_conntrack_helper *);
 extern void nf_conntrack_helper_unregister(struct nf_conntrack_helper *);
 
-extern struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp);
+extern struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, struct nf_conntrack_helper *helper, gfp_t gfp);
 
 extern int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
                                      gfp_t flags);
@@ -60,6 +73,15 @@ static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
         return nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
 }
 
+static inline void *nfct_help_data(const struct nf_conn *ct)
+{
+        struct nf_conn_help *help;
+
+        help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
+
+        return (void *)help->data;
+}
+
 extern int nf_conntrack_helper_init(struct net *net);
 extern void nf_conntrack_helper_fini(struct net *net);
 
@@ -82,4 +104,7 @@ nf_ct_helper_expectfn_find_by_name(const char *name);
 struct nf_ct_helper_expectfn *
 nf_ct_helper_expectfn_find_by_symbol(const void *symbol);
 
+extern struct hlist_head *nf_ct_helper_hash;
+extern unsigned int nf_ct_helper_hsize;
+
 #endif /*_NF_CONNTRACK_HELPER_H*/
diff --git a/include/net/netfilter/nf_conntrack_l3proto.h b/include/net/netfilter/nf_conntrack_l3proto.h
index 9699c028b74b..6f7c13f4ac03 100644
--- a/include/net/netfilter/nf_conntrack_l3proto.h
+++ b/include/net/netfilter/nf_conntrack_l3proto.h
@@ -64,11 +64,12 @@ struct nf_conntrack_l3proto {
         size_t nla_size;
 
 #ifdef CONFIG_SYSCTL
-        struct ctl_table_header *ctl_table_header;
         const char              *ctl_table_path;
-        struct ctl_table        *ctl_table;
 #endif /* CONFIG_SYSCTL */
 
+        /* Init l3proto pernet data */
+        int (*init_net)(struct net *net);
+
         /* Module (if any) which this is connected to. */
         struct module *me;
 };
@@ -76,8 +77,10 @@ struct nf_conntrack_l3proto {
 extern struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX];
 
 /* Protocol registration. */
-extern int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto);
-extern void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto);
+extern int nf_conntrack_l3proto_register(struct net *net,
+                                         struct nf_conntrack_l3proto *proto);
+extern void nf_conntrack_l3proto_unregister(struct net *net,
+                                            struct nf_conntrack_l3proto *proto);
 extern struct nf_conntrack_l3proto *nf_ct_l3proto_find_get(u_int16_t l3proto);
 extern void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p);
 
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index 3b572bb20aa2..c3be4aef6bf7 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -12,6 +12,7 @@
 #include <linux/netlink.h>
 #include <net/netlink.h>
 #include <net/netfilter/nf_conntrack.h>
+#include <net/netns/generic.h>
 
 struct seq_file;
 
@@ -86,23 +87,21 @@ struct nf_conntrack_l4proto {
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
         struct {
                 size_t obj_size;
-                int (*nlattr_to_obj)(struct nlattr *tb[], void *data);
+                int (*nlattr_to_obj)(struct nlattr *tb[],
+                                     struct net *net, void *data);
                 int (*obj_to_nlattr)(struct sk_buff *skb, const void *data);
 
                 unsigned int nlattr_max;
                 const struct nla_policy *nla_policy;
         } ctnl_timeout;
 #endif
+        int     *net_id;
+        /* Init l4proto pernet data */
+        int (*init_net)(struct net *net, u_int16_t proto);
+
+        /* Return the per-net protocol part. */
+        struct nf_proto_net *(*get_net_proto)(struct net *net);
 
-#ifdef CONFIG_SYSCTL
-        struct ctl_table_header **ctl_table_header;
-        struct ctl_table        *ctl_table;
-        unsigned int            *ctl_table_users;
-#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
-        struct ctl_table_header *ctl_compat_table_header;
-        struct ctl_table        *ctl_compat_table;
-#endif
-#endif
         /* Protocol name */
         const char *name;
 
@@ -123,8 +122,18 @@ nf_ct_l4proto_find_get(u_int16_t l3proto, u_int8_t l4proto);
 extern void nf_ct_l4proto_put(struct nf_conntrack_l4proto *p);
 
 /* Protocol registration. */
-extern int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *proto);
-extern void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *proto);
+extern int nf_conntrack_l4proto_register(struct net *net,
+                                         struct nf_conntrack_l4proto *proto);
+extern void nf_conntrack_l4proto_unregister(struct net *net,
+                                            struct nf_conntrack_l4proto *proto);
+
+static inline void nf_ct_kfree_compat_sysctl_table(struct nf_proto_net *pn)
+{
+#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
+        kfree(pn->ctl_compat_table);
+        pn->ctl_compat_table = NULL;
+#endif
+}
 
 /* Generic netlink helpers */
 extern int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
diff --git a/include/net/netfilter/nf_nat_helper.h b/include/net/netfilter/nf_nat_helper.h
index 02bb6c29dc3d..7d8fb7b46c44 100644
--- a/include/net/netfilter/nf_nat_helper.h
+++ b/include/net/netfilter/nf_nat_helper.h
@@ -54,4 +54,8 @@ extern void nf_nat_follow_master(struct nf_conn *ct,
 extern s16 nf_nat_get_offset(const struct nf_conn *ct,
                              enum ip_conntrack_dir dir,
                              u32 seq);
+
+extern void nf_nat_tcp_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
+                                  u32 dir, int off);
+
 #endif
diff --git a/include/net/netfilter/nfnetlink_queue.h b/include/net/netfilter/nfnetlink_queue.h
new file mode 100644
index 000000000000..86267a529514
--- /dev/null
+++ b/include/net/netfilter/nfnetlink_queue.h
@@ -0,0 +1,43 @@
+#ifndef _NET_NFNL_QUEUE_H_
+#define _NET_NFNL_QUEUE_H_
+
+#include <linux/netfilter/nf_conntrack_common.h>
+
+struct nf_conn;
+
+#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
+struct nf_conn *nfqnl_ct_get(struct sk_buff *entskb, size_t *size,
+                             enum ip_conntrack_info *ctinfo);
+struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb,
+                               const struct nlattr *attr,
+                               enum ip_conntrack_info *ctinfo);
+int nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct,
+                 enum ip_conntrack_info ctinfo);
+void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
+                         enum ip_conntrack_info ctinfo, int diff);
+#else
+inline struct nf_conn *
+nfqnl_ct_get(struct sk_buff *entskb, size_t *size, enum ip_conntrack_info *ctinfo)
+{
+        return NULL;
+}
+
+inline struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb,
+                                      const struct nlattr *attr,
+                                      enum ip_conntrack_info *ctinfo)
+{
+        return NULL;
+}
+
+inline int
+nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info ctinfo)
+{
+        return 0;
+}
+
+inline void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
+                                enum ip_conntrack_info ctinfo, int diff)
+{
+}
+#endif /* NF_CONNTRACK */
+#endif
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index a053a19870cf..3aecdc7a84fb 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -4,10 +4,64 @@
 #include <linux/list.h>
 #include <linux/list_nulls.h>
 #include <linux/atomic.h>
+#include <linux/netfilter/nf_conntrack_tcp.h>
 
 struct ctl_table_header;
 struct nf_conntrack_ecache;
 
+struct nf_proto_net {
+#ifdef CONFIG_SYSCTL
+        struct ctl_table_header *ctl_table_header;
+        struct ctl_table        *ctl_table;
+#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
+        struct ctl_table_header *ctl_compat_header;
+        struct ctl_table        *ctl_compat_table;
+#endif
+#endif
+        unsigned int            users;
+};
+
+struct nf_generic_net {
+        struct nf_proto_net pn;
+        unsigned int timeout;
+};
+
+struct nf_tcp_net {
+        struct nf_proto_net pn;
+        unsigned int timeouts[TCP_CONNTRACK_TIMEOUT_MAX];
+        unsigned int tcp_loose;
+        unsigned int tcp_be_liberal;
+        unsigned int tcp_max_retrans;
+};
+
+enum udp_conntrack {
+        UDP_CT_UNREPLIED,
+        UDP_CT_REPLIED,
+        UDP_CT_MAX
+};
+
+struct nf_udp_net {
+        struct nf_proto_net pn;
+        unsigned int timeouts[UDP_CT_MAX];
+};
+
+struct nf_icmp_net {
+        struct nf_proto_net pn;
+        unsigned int timeout;
+};
+
+struct nf_ip_net {
+        struct nf_generic_net   generic;
+        struct nf_tcp_net       tcp;
+        struct nf_udp_net       udp;
+        struct nf_icmp_net      icmp;
+        struct nf_icmp_net      icmpv6;
+#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
+        struct ctl_table_header *ctl_table_header;
+        struct ctl_table        *ctl_table;
+#endif
+};
+
 struct netns_ct {
         atomic_t                count;
         unsigned int            expect_count;
@@ -28,6 +82,7 @@ struct netns_ct {
         unsigned int            sysctl_log_invalid; /* Log invalid packets */
         int                     sysctl_auto_assign_helper;
         bool                    auto_assign_helper_warned;
+        struct nf_ip_net        nf_ct_proto;
 #ifdef CONFIG_SYSCTL
         struct ctl_table_header *sysctl_header;
         struct ctl_table_header *acct_sysctl_header;
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index bbd023a1c9b9..0ffb8e31f3cd 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -7,10 +7,12 @@
 
 #include <net/inet_frag.h>
 
+struct tcpm_hash_bucket;
 struct ctl_table_header;
 struct ipv4_devconf;
 struct fib_rules_ops;
 struct hlist_head;
+struct fib_table;
 struct sock;
 
 struct netns_ipv4 {
@@ -24,13 +26,21 @@ struct netns_ipv4 {
         struct ipv4_devconf     *devconf_dflt;
 #ifdef CONFIG_IP_MULTIPLE_TABLES
         struct fib_rules_ops    *rules_ops;
+        bool                    fib_has_custom_rules;
+        struct fib_table        *fib_local;
+        struct fib_table        *fib_main;
+        struct fib_table        *fib_default;
+#endif
+#ifdef CONFIG_IP_ROUTE_CLASSID
+        int                     fib_num_tclassid_users;
 #endif
         struct hlist_head       *fib_table_hash;
         struct sock             *fibnl;
 
         struct sock             **icmp_sk;
-        struct sock             *tcp_sock;
-
+        struct inet_peer_base   *peers;
+        struct tcpm_hash_bucket *tcp_metrics_hash;
+        unsigned int            tcp_metrics_hash_log;
         struct netns_frags      frags;
 #ifdef CONFIG_NETFILTER
         struct xt_table         *iptable_filter;
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index b42be53587ba..df0a5456a3fd 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -33,6 +33,7 @@ struct netns_ipv6 {
         struct netns_sysctl_ipv6 sysctl;
         struct ipv6_devconf     *devconf_all;
         struct ipv6_devconf     *devconf_dflt;
+        struct inet_peer_base   *peers;
         struct netns_frags      frags;
 #ifdef CONFIG_NETFILTER
         struct xt_table         *ip6table_filter;
diff --git a/include/net/netprio_cgroup.h b/include/net/netprio_cgroup.h
index d58fdec47597..2719dec6b5a8 100644
--- a/include/net/netprio_cgroup.h
+++ b/include/net/netprio_cgroup.h
@@ -35,7 +35,7 @@ struct cgroup_netprio_state {
 extern int net_prio_subsys_id;
 #endif
 
-extern void sock_update_netprioidx(struct sock *sk);
+extern void sock_update_netprioidx(struct sock *sk, struct task_struct *task);
 
 #if IS_BUILTIN(CONFIG_NETPRIO_CGROUP)
 
@@ -82,7 +82,7 @@ static inline u32 task_netprioidx(struct task_struct *p)
 #endif /* CONFIG_NETPRIO_CGROUP */
 
 #else
-#define sock_update_netprioidx(sk)
+#define sock_update_netprioidx(sk, task)
 #endif
 
 #endif  /* _NET_CLS_CGROUP_H */
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 4467c9460857..f5169b04f082 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -31,7 +31,8 @@ struct nfc_hci_ops {
         void (*close) (struct nfc_hci_dev *hdev);
         int (*hci_ready) (struct nfc_hci_dev *hdev);
         int (*xmit) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
-        int (*start_poll) (struct nfc_hci_dev *hdev, u32 protocols);
+        int (*start_poll) (struct nfc_hci_dev *hdev,
+                           u32 im_protocols, u32 tm_protocols);
         int (*target_from_gate) (struct nfc_hci_dev *hdev, u8 gate,
                                  struct nfc_target *target);
         int (*complete_target_discovered) (struct nfc_hci_dev *hdev, u8 gate,
@@ -43,10 +44,20 @@ struct nfc_hci_ops {
                               struct nfc_target *target);
 };
 
-#define NFC_HCI_MAX_CUSTOM_GATES        15
+/* Pipes */
+#define NFC_HCI_INVALID_PIPE    0x80
+#define NFC_HCI_LINK_MGMT_PIPE  0x00
+#define NFC_HCI_ADMIN_PIPE      0x01
+
+struct nfc_hci_gate {
+        u8 gate;
+        u8 pipe;
+};
+
+#define NFC_HCI_MAX_CUSTOM_GATES        50
 struct nfc_hci_init_data {
         u8 gate_count;
-        u8 gates[NFC_HCI_MAX_CUSTOM_GATES];
+        struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES];
         char session_id[9];
 };
 
@@ -111,6 +122,8 @@ void nfc_hci_unregister_device(struct nfc_hci_dev *hdev);
 void nfc_hci_set_clientdata(struct nfc_hci_dev *hdev, void *clientdata);
 void *nfc_hci_get_clientdata(struct nfc_hci_dev *hdev);
 
+void nfc_hci_driver_failure(struct nfc_hci_dev *hdev, int err);
+
 /* Host IDs */
 #define NFC_HCI_HOST_CONTROLLER_ID      0x00
 #define NFC_HCI_TERMINAL_HOST_ID        0x01
@@ -179,7 +192,8 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
 void nfc_hci_recv_frame(struct nfc_hci_dev *hdev, struct sk_buff *skb);
 
 /* connecting to gates and sending hci instructions */
-int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate);
+int nfc_hci_connect_gate(struct nfc_hci_dev *hdev, u8 dest_host, u8 dest_gate,
+                         u8 pipe);
 int nfc_hci_disconnect_gate(struct nfc_hci_dev *hdev, u8 gate);
 int nfc_hci_disconnect_all_gates(struct nfc_hci_dev *hdev);
 int nfc_hci_get_param(struct nfc_hci_dev *hdev, u8 gate, u8 idx,
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index b7ca4a2a1d72..6431f5e39022 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -53,7 +53,8 @@ struct nfc_target;
 struct nfc_ops {
         int (*dev_up)(struct nfc_dev *dev);
         int (*dev_down)(struct nfc_dev *dev);
-        int (*start_poll)(struct nfc_dev *dev, u32 protocols);
+        int (*start_poll)(struct nfc_dev *dev,
+                          u32 im_protocols, u32 tm_protocols);
         void (*stop_poll)(struct nfc_dev *dev);
         int (*dep_link_up)(struct nfc_dev *dev, struct nfc_target *target,
                            u8 comm_mode, u8 *gb, size_t gb_len);
@@ -62,9 +63,10 @@ struct nfc_ops {
                                u32 protocol);
         void (*deactivate_target)(struct nfc_dev *dev,
                                   struct nfc_target *target);
-        int (*data_exchange)(struct nfc_dev *dev, struct nfc_target *target,
+        int (*im_transceive)(struct nfc_dev *dev, struct nfc_target *target,
                              struct sk_buff *skb, data_exchange_cb_t cb,
                              void *cb_context);
+        int (*tm_send)(struct nfc_dev *dev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_dev *dev, struct nfc_target *target);
 };
 
@@ -99,10 +101,10 @@ struct nfc_dev {
         int targets_generation;
         struct device dev;
         bool dev_up;
+        u8 rf_mode;
         bool polling;
         struct nfc_target *active_target;
         bool dep_link_up;
-        u32 dep_rf_mode;
         struct nfc_genl_data genl_data;
         u32 supported_protocols;
 
@@ -188,6 +190,7 @@ struct sk_buff *nfc_alloc_recv_skb(unsigned int size, gfp_t gfp);
 
 int nfc_set_remote_general_bytes(struct nfc_dev *dev,
                                  u8 *gt, u8 gt_len);
+u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, size_t *gb_len);
 
 int nfc_targets_found(struct nfc_dev *dev,
                       struct nfc_target *targets, int ntargets);
@@ -196,4 +199,11 @@ int nfc_target_lost(struct nfc_dev *dev, u32 target_idx);
 int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx,
                        u8 comm_mode, u8 rf_mode);
 
+int nfc_tm_activated(struct nfc_dev *dev, u32 protocol, u8 comm_mode,
+                     u8 *gb, size_t gb_len);
+int nfc_tm_deactivated(struct nfc_dev *dev);
+int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb);
+
+void nfc_driver_failure(struct nfc_dev *dev, int err);
+
 #endif /* __NET_NFC_H */
diff --git a/include/net/nfc/shdlc.h b/include/net/nfc/shdlc.h
index ab06afd462da..35e930d2f638 100644
--- a/include/net/nfc/shdlc.h
+++ b/include/net/nfc/shdlc.h
@@ -27,7 +27,8 @@ struct nfc_shdlc_ops {
         void (*close) (struct nfc_shdlc *shdlc);
         int (*hci_ready) (struct nfc_shdlc *shdlc);
         int (*xmit) (struct nfc_shdlc *shdlc, struct sk_buff *skb);
-        int (*start_poll) (struct nfc_shdlc *shdlc, u32 protocols);
+        int (*start_poll) (struct nfc_shdlc *shdlc,
+                           u32 im_protocols, u32 tm_protocols);
         int (*target_from_gate) (struct nfc_shdlc *shdlc, u8 gate,
                                  struct nfc_target *target);
         int (*complete_target_discovered) (struct nfc_shdlc *shdlc, u8 gate,
diff --git a/include/net/protocol.h b/include/net/protocol.h
index 875f4895b033..057f2d315567 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -29,11 +29,15 @@
 #include <linux/ipv6.h>
 #endif
 
-#define MAX_INET_PROTOS 256             /* Must be a power of 2         */
-
+/* This is one larger than the largest protocol value that can be
+ * found in an ipv4 or ipv6 header.  Since in both cases the protocol
+ * value is presented in a __u8, this is defined to be 256.
+ */
+#define MAX_INET_PROTOS         256
 
 /* This is used to register protocols. */
 struct net_protocol {
+        void                    (*early_demux)(struct sk_buff *skb);
         int                     (*handler)(struct sk_buff *skb);
         void                    (*err_handler)(struct sk_buff *skb, u32 info);
         int                     (*gso_send_check)(struct sk_buff *skb);
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index a5f79933e211..7dcaa2794fde 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -52,6 +52,10 @@ enum environment_cap {
  *      DFS master operation on a known DFS region (NL80211_DFS_*),
  *      dfs_region represents that region. Drivers can use this and the
  *      @alpha2 to adjust their device's DFS parameters as required.
+ * @user_reg_hint_type: if the @initiator was of type
+ *      %NL80211_REGDOM_SET_BY_USER, this classifies the type
+ *      of hint passed. This could be any of the %NL80211_USER_REG_HINT_*
+ *      types.
  * @intersect: indicates whether the wireless core should intersect
  *      the requested regulatory domain with the presently set regulatory
  *      domain.
@@ -70,6 +74,7 @@ enum environment_cap {
 struct regulatory_request {
         int wiphy_idx;
         enum nl80211_reg_initiator initiator;
+        enum nl80211_user_reg_hint_type user_reg_hint_type;
         char alpha2[2];
         u8 dfs_region;
         bool intersect;
diff --git a/include/net/route.h b/include/net/route.h
index 98705468ac03..c29ef2733f2d 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -40,45 +40,39 @@
 #define RT_CONN_FLAGS(sk)   (RT_TOS(inet_sk(sk)->tos) | sock_flag(sk, SOCK_LOCALROUTE))
 
 struct fib_nh;
-struct inet_peer;
 struct fib_info;
 struct rtable {
         struct dst_entry        dst;
 
-        /* Lookup key. */
-        __be32                  rt_key_dst;
-        __be32                  rt_key_src;
-
         int                     rt_genid;
         unsigned int            rt_flags;
         __u16                   rt_type;
-        __u8                    rt_key_tos;
+        __u16                   rt_is_input;
 
-        __be32                  rt_dst; /* Path destination     */
-        __be32                  rt_src; /* Path source          */
-        int                     rt_route_iif;
         int                     rt_iif;
-        int                     rt_oif;
-        __u32                   rt_mark;
 
         /* Info on neighbour */
         __be32                  rt_gateway;
 
         /* Miscellaneous cached information */
-        __be32                  rt_spec_dst; /* RFC1122 specific destination */
-        u32                     rt_peer_genid;
-        struct inet_peer        *peer; /* long-living peer info */
-        struct fib_info         *fi; /* for client ref to shared metrics */
+        u32                     rt_pmtu;
 };
 
 static inline bool rt_is_input_route(const struct rtable *rt)
 {
-        return rt->rt_route_iif != 0;
+        return rt->rt_is_input != 0;
 }
 
 static inline bool rt_is_output_route(const struct rtable *rt)
 {
-        return rt->rt_route_iif == 0;
+        return rt->rt_is_input == 0;
+}
+
+static inline __be32 rt_nexthop(const struct rtable *rt, __be32 daddr)
+{
+        if (rt->rt_gateway)
+                return rt->rt_gateway;
+        return daddr;
 }
 
 struct ip_rt_acct {
@@ -111,10 +105,7 @@ extern struct ip_rt_acct __percpu *ip_rt_acct;
 
 struct in_device;
 extern int              ip_rt_init(void);
-extern void             ip_rt_redirect(__be32 old_gw, __be32 dst, __be32 new_gw,
-                                       __be32 src, struct net_device *dev);
 extern void             rt_cache_flush(struct net *net, int how);
-extern void             rt_cache_flush_batch(struct net *net);
 extern struct rtable *__ip_route_output_key(struct net *, struct flowi4 *flp);
 extern struct rtable *ip_route_output_flow(struct net *, struct flowi4 *flp,
                                            struct sock *sk);
@@ -166,24 +157,16 @@ static inline struct rtable *ip_route_output_gre(struct net *net, struct flowi4
         return ip_route_output_key(net, fl4);
 }
 
-extern int ip_route_input_common(struct sk_buff *skb, __be32 dst, __be32 src,
-                                 u8 tos, struct net_device *devin, bool noref);
-
-static inline int ip_route_input(struct sk_buff *skb, __be32 dst, __be32 src,
-                                 u8 tos, struct net_device *devin)
-{
-        return ip_route_input_common(skb, dst, src, tos, devin, false);
-}
-
-static inline int ip_route_input_noref(struct sk_buff *skb, __be32 dst, __be32 src,
-                                       u8 tos, struct net_device *devin)
-{
-        return ip_route_input_common(skb, dst, src, tos, devin, true);
-}
+extern int ip_route_input(struct sk_buff *skb, __be32 dst, __be32 src,
+                          u8 tos, struct net_device *devin);
 
-extern unsigned short   ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
-                                          unsigned short new_mtu, struct net_device *dev);
-extern void             ip_rt_send_redirect(struct sk_buff *skb);
+extern void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
+                             int oif, u32 mark, u8 protocol, int flow_flags);
+extern void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu);
+extern void ipv4_redirect(struct sk_buff *skb, struct net *net,
+                          int oif, u32 mark, u8 protocol, int flow_flags);
+extern void ipv4_sk_redirect(struct sk_buff *skb, struct sock *sk);
+extern void ip_rt_send_redirect(struct sk_buff *skb);
 
 extern unsigned int             inet_addr_type(struct net *net, __be32 addr);
 extern unsigned int             inet_dev_addr_type(struct net *net, const struct net_device *dev, __be32 addr);
@@ -244,8 +227,6 @@ static inline void ip_route_connect_init(struct flowi4 *fl4, __be32 dst, __be32
 
         if (inet_sk(sk)->transparent)
                 flow_flags |= FLOWI_FLAG_ANYSRC;
-        if (protocol == IPPROTO_TCP)
-                flow_flags |= FLOWI_FLAG_PRECOW_METRICS;
         if (can_sleep)
                 flow_flags |= FLOWI_FLAG_CAN_SLEEP;
 
@@ -294,20 +275,13 @@ static inline struct rtable *ip_route_newports(struct flowi4 *fl4, struct rtable
         return rt;
 }
 
-extern void rt_bind_peer(struct rtable *rt, __be32 daddr, int create);
-
-static inline struct inet_peer *rt_get_peer(struct rtable *rt, __be32 daddr)
-{
-        if (rt->peer)
-                return rt->peer;
-
-        rt_bind_peer(rt, daddr, 0);
-        return rt->peer;
-}
-
 static inline int inet_iif(const struct sk_buff *skb)
 {
-        return skb_rtable(skb)->rt_iif;
+        int iif = skb_rtable(skb)->rt_iif;
+
+        if (iif)
+                return iif;
+        return skb->skb_iif;
 }
 
 extern int sysctl_ip_default_ttl;
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index bbcfd0993432..6b00c4fc4291 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -44,8 +44,10 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
  *      @get_xstats_size: Function to calculate required room for dumping device
  *                        specific statistics
  *      @fill_xstats: Function to dump device specific statistics
- *      @get_tx_queues: Function to determine number of transmit queues to create when
- *                      creating a new device.
+ *      @get_num_tx_queues: Function to determine number of transmit queues
+ *                          to create when creating a new device.
+ *      @get_num_rx_queues: Function to determine number of receive queues
+ *                          to create when creating a new device.
  */
 struct rtnl_link_ops {
         struct list_head        list;
@@ -77,8 +79,8 @@ struct rtnl_link_ops {
         size_t                  (*get_xstats_size)(const struct net_device *dev);
         int                     (*fill_xstats)(struct sk_buff *skb,
                                                const struct net_device *dev);
-        int                     (*get_tx_queues)(struct net *net,
-                                                 struct nlattr *tb[]);
+        unsigned int            (*get_num_tx_queues)(void);
+        unsigned int            (*get_num_rx_queues)(void);
 };
 
 extern int      __rtnl_link_register(struct rtnl_link_ops *ops);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 9d7d54a00e63..d9611e032418 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -220,7 +220,7 @@ struct tcf_proto {
 
 struct qdisc_skb_cb {
         unsigned int            pkt_len;
-        u16                     bond_queue_mapping;
+        u16                     slave_dev_queue_mapping;
         u16                     _pad;
         unsigned char           data[20];
 };
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index 942b864f6135..d053d2e99876 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -334,6 +334,7 @@ typedef enum {
 typedef enum {
         SCTP_TRANSPORT_UP,
         SCTP_TRANSPORT_DOWN,
+        SCTP_TRANSPORT_PF,
 } sctp_transport_cmd_t;
 
 /* These are the address scopes defined mainly for IPv4 addresses
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index a2ef81466b00..ff499640528b 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -162,6 +162,8 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *,
 void sctp_err_finish(struct sock *, struct sctp_association *);
 void sctp_icmp_frag_needed(struct sock *, struct sctp_association *,
                            struct sctp_transport *t, __u32 pmtu);
+void sctp_icmp_redirect(struct sock *, struct sctp_transport *,
+                        struct sk_buff *);
 void sctp_icmp_proto_unreachable(struct sock *sk,
                                  struct sctp_association *asoc,
                                  struct sctp_transport *t);
@@ -517,10 +519,10 @@ static inline int sctp_frag_point(const struct sctp_association *asoc, int pmtu)
         return frag;
 }
 
-static inline void sctp_assoc_pending_pmtu(struct sctp_association *asoc)
+static inline void sctp_assoc_pending_pmtu(struct sock *sk, struct sctp_association *asoc)
 {
 
-        sctp_assoc_sync_pmtu(asoc);
+        sctp_assoc_sync_pmtu(sk, asoc);
         asoc->pmtu_pending = 0;
 }
 
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index fecdf31816f2..fc5e60016e37 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -161,6 +161,12 @@ extern struct sctp_globals {
         int max_retrans_path;
         int max_retrans_init;
 
+        /* Potentially-Failed.Max.Retrans sysctl value
+         * taken from:
+         * http://tools.ietf.org/html/draft-nishida-tsvwg-sctp-failover-05
+         */
+        int pf_retrans;
+
         /*
          * Policy for preforming sctp/socket accounting
          * 0   - do socket level accounting, all assocs share sk_sndbuf
@@ -258,6 +264,7 @@ extern struct sctp_globals {
 #define sctp_sndbuf_policy              (sctp_globals.sndbuf_policy)
 #define sctp_rcvbuf_policy              (sctp_globals.rcvbuf_policy)
 #define sctp_max_retrans_path           (sctp_globals.max_retrans_path)
+#define sctp_pf_retrans                 (sctp_globals.pf_retrans)
 #define sctp_max_retrans_init           (sctp_globals.max_retrans_init)
 #define sctp_sack_timeout               (sctp_globals.sack_timeout)
 #define sctp_hb_interval                (sctp_globals.hb_interval)
@@ -990,10 +997,15 @@ struct sctp_transport {
 
         /* This is the max_retrans value for the transport and will
          * be initialized from the assocs value.  This can be changed
-         * using SCTP_SET_PEER_ADDR_PARAMS socket option.
+         * using the SCTP_SET_PEER_ADDR_PARAMS socket option.
          */
         __u16 pathmaxrxt;
 
+        /* This is the partially failed retrans value for the transport
+         * and will be initialized from the assocs value.  This can be changed
+         * using the SCTP_PEER_ADDR_THLDS socket option
+         */
+        int pf_retrans;
         /* PMTU       : The current known path MTU.  */
         __u32 pathmtu;
 
@@ -1091,7 +1103,7 @@ void sctp_transport_burst_limited(struct sctp_transport *);
 void sctp_transport_burst_reset(struct sctp_transport *);
 unsigned long sctp_transport_timeout(struct sctp_transport *);
 void sctp_transport_reset(struct sctp_transport *);
-void sctp_transport_update_pmtu(struct sctp_transport *, u32);
+void sctp_transport_update_pmtu(struct sock *, struct sctp_transport *, u32);
 void sctp_transport_immediate_rtx(struct sctp_transport *);
 
 
@@ -1664,6 +1676,12 @@ struct sctp_association {
          */
         int max_retrans;
 
+        /* This is the partially failed retrans value for the transport
+         * and will be initialized from the assocs value.  This can be
+         * changed using the SCTP_PEER_ADDR_THLDS socket option
+         */
+        int pf_retrans;
+
         /* Maximum number of times the endpoint will retransmit INIT  */
         __u16 max_init_attempts;
 
@@ -2003,7 +2021,7 @@ void sctp_assoc_update(struct sctp_association *old,
 
 __u32 sctp_association_get_next_tsn(struct sctp_association *);
 
-void sctp_assoc_sync_pmtu(struct sctp_association *);
+void sctp_assoc_sync_pmtu(struct sock *, struct sctp_association *);
 void sctp_assoc_rwnd_increase(struct sctp_association *, unsigned int);
 void sctp_assoc_rwnd_decrease(struct sctp_association *, unsigned int);
 void sctp_assoc_set_primary(struct sctp_association *,
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 0842ef00b2fe..1b02d7ad453b 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -93,6 +93,7 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_GET_ASSOC_NUMBER   28      /* Read only */
 #define SCTP_GET_ASSOC_ID_LIST  29      /* Read only */
 #define SCTP_AUTO_ASCONF       30
+#define SCTP_PEER_ADDR_THLDS    31
 
 /* Internal Socket Options. Some of the sctp library functions are
  * implemented using these socket options.
@@ -649,6 +650,7 @@ struct sctp_paddrinfo {
  */
 enum sctp_spinfo_state {
         SCTP_INACTIVE,
+        SCTP_PF,
         SCTP_ACTIVE,
         SCTP_UNCONFIRMED,
         SCTP_UNKNOWN = 0xffff  /* Value used for transport state unknown */
@@ -741,4 +743,13 @@ typedef struct {
         int sd;
 } sctp_peeloff_arg_t;
 
+/*
+ *  Peer Address Thresholds socket option
+ */
+struct sctp_paddrthlds {
+        sctp_assoc_t spt_assoc_id;
+        struct sockaddr_storage spt_address;
+        __u16 spt_pathmaxrxt;
+        __u16 spt_pathpfthld;
+};
 #endif /* __net_sctp_user_h__ */
diff --git a/include/net/sock.h b/include/net/sock.h
index 4a4521699563..e067f8c18f88 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -198,6 +198,7 @@ struct cg_proto;
   *     @sk_lock:       synchronizer
   *     @sk_rcvbuf: size of receive buffer in bytes
   *     @sk_wq: sock wait queue and async head
+  *     @sk_rx_dst: receive input route used by early tcp demux
   *     @sk_dst_cache: destination cache
   *     @sk_dst_lock: destination cache lock
   *     @sk_policy: flow policy
@@ -317,6 +318,7 @@ struct sock {
         struct xfrm_policy      *sk_policy[2];
 #endif
         unsigned long           sk_flags;
+        struct dst_entry        *sk_rx_dst;
         struct dst_entry        *sk_dst_cache;
         spinlock_t              sk_dst_lock;
         atomic_t                sk_wmem_alloc;
@@ -856,6 +858,9 @@ struct proto {
         int                     (*backlog_rcv) (struct sock *sk,
                                                 struct sk_buff *skb);
 
+        void            (*release_cb)(struct sock *sk);
+        void            (*mtu_reduced)(struct sock *sk);
+
         /* Keeping track of sk's, looking them up, and port selection methods. */
         void                    (*hash)(struct sock *sk);
         void                    (*unhash)(struct sock *sk);
@@ -1426,6 +1431,7 @@ extern struct sk_buff		*sock_rmalloc(struct sock *sk,
                                               gfp_t priority);
 extern void                     sock_wfree(struct sk_buff *skb);
 extern void                     sock_rfree(struct sk_buff *skb);
+extern void                     sock_edemux(struct sk_buff *skb);
 
 extern int                      sock_setsockopt(struct socket *sock, int level,
                                                 int op, char __user *optval,
@@ -2152,7 +2158,7 @@ static inline void sk_change_net(struct sock *sk, struct net *net)
 
 static inline struct sock *skb_steal_sock(struct sk_buff *skb)
 {
-        if (unlikely(skb->sk)) {
+        if (skb->sk) {
                 struct sock *sk = skb->sk;
 
                 skb->destructor = NULL;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e79aa48d9fc1..e19124b84cd2 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -170,6 +170,11 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCPOPT_TIMESTAMP        8       /* Better RTT estimations/PAWS */
 #define TCPOPT_MD5SIG           19      /* MD5 Signature (RFC2385) */
 #define TCPOPT_COOKIE           253     /* Cookie extension (experimental) */
+#define TCPOPT_EXP              254     /* Experimental */
+/* Magic number to be after the option value for sharing TCP
+ * experimental options. See draft-ietf-tcpm-experimental-options-00.txt
+ */
+#define TCPOPT_FASTOPEN_MAGIC   0xF989
 
 /*
  *     TCP option lengths
@@ -180,6 +185,7 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCPOLEN_SACK_PERM      2
 #define TCPOLEN_TIMESTAMP      10
 #define TCPOLEN_MD5SIG         18
+#define TCPOLEN_EXP_FASTOPEN_BASE  4
 #define TCPOLEN_COOKIE_BASE    2        /* Cookie-less header extension */
 #define TCPOLEN_COOKIE_PAIR    3        /* Cookie pair header extension */
 #define TCPOLEN_COOKIE_MIN     (TCPOLEN_COOKIE_BASE+TCP_COOKIE_MIN)
@@ -206,6 +212,10 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 /* TCP initial congestion window as per draft-hkchu-tcpm-initcwnd-01 */
 #define TCP_INIT_CWND           10
 
+/* Bit Flags for sysctl_tcp_fastopen */
+#define TFO_CLIENT_ENABLE       1
+#define TFO_CLIENT_NO_COOKIE    4       /* Data in SYN w/o cookie option */
+
 extern struct inet_timewait_death_row tcp_death_row;
 
 /* sysctl variables for tcp */
@@ -222,6 +232,7 @@ extern int sysctl_tcp_retries1;
 extern int sysctl_tcp_retries2;
 extern int sysctl_tcp_orphan_retries;
 extern int sysctl_tcp_syncookies;
+extern int sysctl_tcp_fastopen;
 extern int sysctl_tcp_retrans_collapse;
 extern int sysctl_tcp_stdurg;
 extern int sysctl_tcp_rfc1337;
@@ -253,6 +264,8 @@ extern int sysctl_tcp_cookie_size;
 extern int sysctl_tcp_thin_linear_timeouts;
 extern int sysctl_tcp_thin_dupack;
 extern int sysctl_tcp_early_retrans;
+extern int sysctl_tcp_limit_output_bytes;
+extern int sysctl_tcp_challenge_ack_limit;
 
 extern atomic_long_t tcp_memory_allocated;
 extern struct percpu_counter tcp_sockets_allocated;
@@ -321,19 +334,24 @@ extern struct proto tcp_prot;
 
 extern void tcp_init_mem(struct net *net);
 
+extern void tcp_tasklet_init(void);
+
 extern void tcp_v4_err(struct sk_buff *skb, u32);
 
 extern void tcp_shutdown (struct sock *sk, int how);
 
+extern void tcp_v4_early_demux(struct sk_buff *skb);
 extern int tcp_v4_rcv(struct sk_buff *skb);
 
-extern struct inet_peer *tcp_v4_get_peer(struct sock *sk, bool *release_it);
-extern void *tcp_v4_tw_get_peer(struct sock *sk);
+extern struct inet_peer *tcp_v4_get_peer(struct sock *sk);
 extern int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
 extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        size_t size);
 extern int tcp_sendpage(struct sock *sk, struct page *page, int offset,
                         size_t size, int flags);
+extern void tcp_release_cb(struct sock *sk);
+extern void tcp_write_timer_handler(struct sock *sk);
+extern void tcp_delack_timer_handler(struct sock *sk);
 extern int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 extern int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                                  const struct tcphdr *th, unsigned int len);
@@ -388,6 +406,19 @@ extern void tcp_enter_frto(struct sock *sk);
 extern void tcp_enter_loss(struct sock *sk, int how);
 extern void tcp_clear_retrans(struct tcp_sock *tp);
 extern void tcp_update_metrics(struct sock *sk);
+extern void tcp_init_metrics(struct sock *sk);
+extern void tcp_metrics_init(void);
+extern bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst, bool paws_check);
+extern bool tcp_remember_stamp(struct sock *sk);
+extern bool tcp_tw_remember_stamp(struct inet_timewait_sock *tw);
+extern void tcp_fastopen_cache_get(struct sock *sk, u16 *mss,
+                                   struct tcp_fastopen_cookie *cookie,
+                                   int *syn_loss, unsigned long *last_syn_loss);
+extern void tcp_fastopen_cache_set(struct sock *sk, u16 mss,
+                                   struct tcp_fastopen_cookie *cookie,
+                                   bool syn_lost);
+extern void tcp_fetch_timewait_stamp(struct sock *sk, struct dst_entry *dst);
+extern void tcp_disable_fack(struct tcp_sock *tp);
 extern void tcp_close(struct sock *sk, long timeout);
 extern void tcp_init_sock(struct sock *sk);
 extern unsigned int tcp_poll(struct file * file, struct socket *sock,
@@ -406,7 +437,7 @@ extern int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        size_t len, int nonblock, int flags, int *addr_len);
 extern void tcp_parse_options(const struct sk_buff *skb,
                               struct tcp_options_received *opt_rx, const u8 **hvpp,
-                              int estab);
+                              int estab, struct tcp_fastopen_cookie *foc);
 extern const u8 *tcp_parse_md5sig_option(const struct tcphdr *th);
 
 /*
@@ -556,6 +587,8 @@ static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
         return (tp->srtt >> 3) + tp->rttvar;
 }
 
+extern void tcp_set_rto(struct sock *sk);
+
 static inline void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)
 {
         tp->pred_flags = htonl((tp->tcp_header_len << 26) |
@@ -1264,6 +1297,15 @@ extern int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *, const struct sk_buff
 extern int tcp_md5_hash_key(struct tcp_md5sig_pool *hp,
                             const struct tcp_md5sig_key *key);
 
+struct tcp_fastopen_request {
+        /* Fast Open cookie. Size 0 means a cookie request */
+        struct tcp_fastopen_cookie      cookie;
+        struct msghdr                   *data;  /* data in MSG_FASTOPEN */
+        u16                             copied; /* queued in tcp_connect() */
+};
+
+void tcp_free_fastopen_req(struct tcp_sock *tp);
+
 /* write queue abstraction */
 static inline void tcp_write_queue_purge(struct sock *sk)
 {
diff --git a/include/net/timewait_sock.h b/include/net/timewait_sock.h
index 8d6689cb2c66..68f0ecad6c6e 100644
--- a/include/net/timewait_sock.h
+++ b/include/net/timewait_sock.h
@@ -22,7 +22,6 @@ struct timewait_sock_ops {
         int             (*twsk_unique)(struct sock *sk,
                                        struct sock *sktw, void *twp);
         void            (*twsk_destructor)(struct sock *sk);
-        void            *(*twsk_getpeer)(struct sock *sk);
 };
 
 static inline int twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
@@ -41,11 +40,4 @@ static inline void twsk_destructor(struct sock *sk)
                 sk->sk_prot->twsk_prot->twsk_destructor(sk);
 }
 
-static inline void *twsk_getpeer(struct sock *sk)
-{
-        if (sk->sk_prot->twsk_prot->twsk_getpeer)
-                return sk->sk_prot->twsk_prot->twsk_getpeer(sk);
-        return NULL;
-}
-
 #endif /* _TIMEWAIT_SOCK_H */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index e0a55df5bde8..d9509eb29b80 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1475,6 +1475,8 @@ extern int xfrm4_output(struct sk_buff *skb);
 extern int xfrm4_output_finish(struct sk_buff *skb);
 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
+extern int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel *handler);
+extern int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel *handler);
 extern int xfrm6_extract_header(struct sk_buff *skb);
 extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
@@ -1682,13 +1684,11 @@ static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
 
 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
 {
-        if ((m->m | m->v) &&
-            nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m))
-                goto nla_put_failure;
-        return 0;
+        int ret = 0;
 
-nla_put_failure:
-        return -1;
+        if (m->m | m->v)
+                ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
+        return ret;
 }
 
 #endif  /* _NET_XFRM_H */