Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking merge from David Miller:
 "1) Move ixgbe driver over to purely page based buffering on receive.
     From Alexander Duyck.

  2) Add receive packet steering support to e1000e, from Bruce Allan.

  3) Convert TCP MD5 support over to RCU, from Eric Dumazet.

  4) Reduce cpu usage in handling out-of-order TCP packets on modern
     systems, also from Eric Dumazet.

  5) Support the IP{,V6}_UNICAST_IF socket options, making the wine
     folks happy, from Erich Hoover.

  6) Support VLAN trunking from guests in hyperv driver, from Haiyang
     Zhang.

  7) Support byte-queue-limtis in r8169, from Igor Maravic.

  8) Outline code intended for IP_RECVTOS in IP_PKTOPTIONS existed but
     was never properly implemented, Jiri Benc fixed that.

  9) 64-bit statistics support in r8169 and 8139too, from Junchang Wang.

  10) Support kernel side dump filtering by ctmark in netfilter
      ctnetlink, from Pablo Neira Ayuso.

  11) Support byte-queue-limits in gianfar driver, from Paul Gortmaker.

  12) Add new peek socket options to assist with socket migration, from
      Pavel Emelyanov.

  13) Add sch_plug packet scheduler whose queue is controlled by
      userland daemons using explicit freeze and release commands.  From
      Shriram Rajagopalan.

  14) Fix FCOE checksum offload handling on transmit, from Yi Zou."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1846 commits)
  Fix pppol2tp getsockname()
  Remove printk from rds_sendmsg
  ipv6: fix incorrent ipv6 ipsec packet fragment
  cpsw: Hook up default ndo_change_mtu.
  net: qmi_wwan: fix build error due to cdc-wdm dependecy
  netdev: driver: ethernet: Add TI CPSW driver
  netdev: driver: ethernet: add cpsw address lookup engine support
  phy: add am79c874 PHY support
  mlx4_core: fix race on comm channel
  bonding: send igmp report for its master
  fs_enet: Add MPC5125 FEC support and PHY interface selection
  net: bpf_jit: fix BPF_S_LDX_B_MSH compilation
  net: update the usage of CHECKSUM_UNNECESSARY
  fcoe: use CHECKSUM_UNNECESSARY instead of CHECKSUM_PARTIAL on tx
  net: do not do gso for CHECKSUM_UNNECESSARY in netif_needs_gso
  ixgbe: Fix issues with SR-IOV loopback when flow control is disabled
  net/hyperv: Fix the code handling tx busy
  ixgbe: fix namespace issues when FCoE/DCB is not enabled
  rtlwifi: Remove unused ETH_ADDR_LEN defines
  igbvf: Use ETH_ALEN
  ...

Fix up fairly trivial conflicts in drivers/isdn/gigaset/interface.c and
drivers/net/usb/{Kconfig,qmi_wwan.c} as per David.

88 files changed, 2151 insertions, 1028 deletions

diff --git a/include/asm-generic/socket.h b/include/asm-generic/socket.h
index 49c1704173e7..b1bea03274d5 100644
--- a/include/asm-generic/socket.h
+++ b/include/asm-generic/socket.h
@@ -67,4 +67,9 @@
 
 #define SO_WIFI_STATUS          41
 #define SCM_WIFI_STATUS SO_WIFI_STATUS
+#define SO_PEEK_OFF             42
+
+/* Instruct lower device to use last 4-bytes of skb data as FCS */
+#define SO_NOFCS                43
+
 #endif /* __ASM_GENERIC_SOCKET_H */
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index c94e71781b79..a25555381097 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -238,6 +238,7 @@ header-y += magic.h
 header-y += major.h
 header-y += map_to_7segment.h
 header-y += matroxfb.h
+header-y += mdio.h
 header-y += media.h
 header-y += mempolicy.h
 header-y += meye.h
@@ -304,6 +305,7 @@ header-y += poll.h
 header-y += posix_types.h
 header-y += ppdev.h
 header-y += ppp-comp.h
+header-y += ppp-ioctl.h
 header-y += ppp_defs.h
 header-y += pps.h
 header-y += prctl.h
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 83c209f39493..5af9a075498f 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -136,6 +136,7 @@ struct bcma_device {
         bool dev_registered;
 
         u8 core_index;
+        u8 core_unit;
 
         u32 addr;
         u32 wrap;
@@ -175,6 +176,12 @@ int __bcma_driver_register(struct bcma_driver *drv, struct module *owner);
 
 extern void bcma_driver_unregister(struct bcma_driver *drv);
 
+/* Set a fallback SPROM.
+ * See kdoc at the function definition for complete documentation. */
+extern int bcma_arch_register_fallback_sprom(
+                int (*sprom_callback)(struct bcma_bus *bus,
+                struct ssb_sprom *out));
+
 struct bcma_bus {
         /* The MMIO area. */
         void __iomem *mmio;
@@ -195,6 +202,7 @@ struct bcma_bus {
         struct list_head cores;
         u8 nr_cores;
         u8 init_done:1;
+        u8 num;
 
         struct bcma_drv_cc drv_cc;
         struct bcma_drv_pci drv_pci;
@@ -282,6 +290,7 @@ static inline void bcma_maskset16(struct bcma_device *cc,
         bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 }
 
+extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
 extern bool bcma_core_is_enabled(struct bcma_device *core);
 extern void bcma_core_disable(struct bcma_device *core, u32 flags);
 extern int bcma_core_enable(struct bcma_device *core, u32 flags);
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index a33086a7530b..8bbfe31fbac8 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -56,6 +56,9 @@
 #define  BCMA_CC_OTPS_HW_PROTECT        0x00000001
 #define  BCMA_CC_OTPS_SW_PROTECT        0x00000002
 #define  BCMA_CC_OTPS_CID_PROTECT       0x00000004
+#define  BCMA_CC_OTPS_GU_PROG_IND       0x00000F00      /* General Use programmed indication */
+#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT 8
+#define  BCMA_CC_OTPS_GU_PROG_HW        0x00000100      /* HW region programmed */
 #define BCMA_CC_OTPC                    0x0014          /* OTP control */
 #define  BCMA_CC_OTPC_RECWAIT           0xFF000000
 #define  BCMA_CC_OTPC_PROGWAIT          0x00FFFF00
@@ -72,6 +75,8 @@
 #define  BCMA_CC_OTPP_READ              0x40000000
 #define  BCMA_CC_OTPP_START             0x80000000
 #define  BCMA_CC_OTPP_BUSY              0x80000000
+#define BCMA_CC_OTPL                    0x001C          /* OTP layout */
+#define  BCMA_CC_OTPL_GURGN_OFFSET      0x00000FFF      /* offset of general use region */
 #define BCMA_CC_IRQSTAT                 0x0020
 #define BCMA_CC_IRQMASK                 0x0024
 #define  BCMA_CC_IRQ_GPIO               0x00000001      /* gpio intr */
@@ -79,6 +84,10 @@
 #define  BCMA_CC_IRQ_WDRESET            0x80000000      /* watchdog reset occurred */
 #define BCMA_CC_CHIPCTL                 0x0028          /* Rev >= 11 only */
 #define BCMA_CC_CHIPSTAT                0x002C          /* Rev >= 11 only */
+#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT      1
+#define  BCMA_CC_CHIPST_4313_OTP_PRESENT        2
+#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT      2
+#define  BCMA_CC_CHIPST_4331_OTP_PRESENT        4
 #define BCMA_CC_JCMD                    0x0030          /* Rev >= 10 only */
 #define  BCMA_CC_JCMD_START             0x80000000
 #define  BCMA_CC_JCMD_BUSY              0x80000000
@@ -181,6 +190,22 @@
 #define BCMA_CC_FLASH_CFG               0x0128
 #define  BCMA_CC_FLASH_CFG_DS           0x0010  /* Data size, 0=8bit, 1=16bit */
 #define BCMA_CC_FLASH_WAITCNT           0x012C
+#define BCMA_CC_SROM_CONTROL            0x0190
+#define  BCMA_CC_SROM_CONTROL_START     0x80000000
+#define  BCMA_CC_SROM_CONTROL_BUSY      0x80000000
+#define  BCMA_CC_SROM_CONTROL_OPCODE    0x60000000
+#define  BCMA_CC_SROM_CONTROL_OP_READ   0x00000000
+#define  BCMA_CC_SROM_CONTROL_OP_WRITE  0x20000000
+#define  BCMA_CC_SROM_CONTROL_OP_WRDIS  0x40000000
+#define  BCMA_CC_SROM_CONTROL_OP_WREN   0x60000000
+#define  BCMA_CC_SROM_CONTROL_OTPSEL    0x00000010
+#define  BCMA_CC_SROM_CONTROL_LOCK      0x00000008
+#define  BCMA_CC_SROM_CONTROL_SIZE_MASK 0x00000006
+#define  BCMA_CC_SROM_CONTROL_SIZE_1K   0x00000000
+#define  BCMA_CC_SROM_CONTROL_SIZE_4K   0x00000002
+#define  BCMA_CC_SROM_CONTROL_SIZE_16K  0x00000004
+#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT        1
+#define  BCMA_CC_SROM_CONTROL_PRESENT   0x00000001
 /* 0x1E0 is defined as shared BCMA_CLKCTLST */
 #define BCMA_CC_HW_WORKAROUND           0x01E4 /* Hardware workaround (rev >= 20) */
 #define BCMA_CC_UART0_DATA              0x0300
@@ -240,7 +265,6 @@
 #define BCMA_CC_PLLCTL_ADDR             0x0660
 #define BCMA_CC_PLLCTL_DATA             0x0664
 #define BCMA_CC_SPROM                   0x0800 /* SPROM beginning */
-#define BCMA_CC_SPROM_PCIE6             0x0830 /* SPROM beginning on PCIe rev >= 6 */
 
 /* Divider allocation in 4716/47162/5356 */
 #define BCMA_CC_PMU5_MAINPLL_CPU        1
diff --git a/include/linux/bcma/bcma_driver_pci.h b/include/linux/bcma/bcma_driver_pci.h
index 3871b668caf9..46c71e27d31f 100644
--- a/include/linux/bcma/bcma_driver_pci.h
+++ b/include/linux/bcma/bcma_driver_pci.h
@@ -53,6 +53,35 @@ struct pci_dev;
 #define  BCMA_CORE_PCI_SBTOPCI1_MASK            0xFC000000
 #define BCMA_CORE_PCI_SBTOPCI2                  0x0108  /* Backplane to PCI translation 2 (sbtopci2) */
 #define  BCMA_CORE_PCI_SBTOPCI2_MASK            0xC0000000
+#define BCMA_CORE_PCI_CONFIG_ADDR               0x0120  /* pcie config space access */
+#define BCMA_CORE_PCI_CONFIG_DATA               0x0124  /* pcie config space access */
+#define BCMA_CORE_PCI_MDIO_CONTROL              0x0128  /* controls the mdio access */
+#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK     0x7f    /* clock to be used on MDIO */
+#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL      0x2
+#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN         0x80    /* Enable preamble sequnce */
+#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE      0x100   /* Tranaction complete */
+#define BCMA_CORE_PCI_MDIO_DATA                 0x012c  /* Data to the mdio access */
+#define  BCMA_CORE_PCI_MDIODATA_MASK            0x0000ffff /* data 2 bytes */
+#define  BCMA_CORE_PCI_MDIODATA_TA              0x00020000 /* Turnaround */
+#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD 18      /* Regaddr shift (rev < 10) */
+#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD        0x003c0000 /* Regaddr Mask (rev < 10) */
+#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD 22      /* Physmedia devaddr shift (rev < 10) */
+#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD        0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
+#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF     18      /* Regaddr shift */
+#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK    0x007c0000 /* Regaddr Mask */
+#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF     23      /* Physmedia devaddr shift */
+#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK    0x0f800000 /* Physmedia devaddr Mask */
+#define  BCMA_CORE_PCI_MDIODATA_WRITE           0x10000000 /* write Transaction */
+#define  BCMA_CORE_PCI_MDIODATA_READ            0x20000000 /* Read Transaction */
+#define  BCMA_CORE_PCI_MDIODATA_START           0x40000000 /* start of Transaction */
+#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR        0x0     /* dev address for serdes */
+#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR        0x1F    /* blk address for serdes */
+#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL         0x1d    /* SERDES PLL Dev */
+#define  BCMA_CORE_PCI_MDIODATA_DEV_TX          0x1e    /* SERDES TX Dev */
+#define  BCMA_CORE_PCI_MDIODATA_DEV_RX          0x1f    /* SERDES RX Dev */
+#define BCMA_CORE_PCI_PCIEIND_ADDR              0x0130  /* indirect access to the internal register */
+#define BCMA_CORE_PCI_PCIEIND_DATA              0x0134  /* Data to/from the internal regsiter */
+#define BCMA_CORE_PCI_CLKREQENCTRL              0x0138  /*  >= rev 6, Clkreq rdma control */
 #define BCMA_CORE_PCI_PCICFG0                   0x0400  /* PCI config space 0 (rev >= 8) */
 #define BCMA_CORE_PCI_PCICFG1                   0x0500  /* PCI config space 1 (rev >= 8) */
 #define BCMA_CORE_PCI_PCICFG2                   0x0600  /* PCI config space 2 (rev >= 8) */
@@ -72,20 +101,114 @@ struct pci_dev;
 #define  BCMA_CORE_PCI_SBTOPCI_RC_READL         0x00000010 /* Memory read line */
 #define  BCMA_CORE_PCI_SBTOPCI_RC_READM         0x00000020 /* Memory read multiple */
 
+/* PCIE protocol PHY diagnostic registers */
+#define BCMA_CORE_PCI_PLP_MODEREG               0x200   /* Mode */
+#define BCMA_CORE_PCI_PLP_STATUSREG             0x204   /* Status */
+#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT     0x10    /* Status reg PCIE_PLP_STATUSREG */
+#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG          0x208   /* LTSSM control */
+#define BCMA_CORE_PCI_PLP_LTLINKNUMREG          0x20c   /* Link Training Link number */
+#define BCMA_CORE_PCI_PLP_LTLANENUMREG          0x210   /* Link Training Lane number */
+#define BCMA_CORE_PCI_PLP_LTNFTSREG             0x214   /* Link Training N_FTS */
+#define BCMA_CORE_PCI_PLP_ATTNREG               0x218   /* Attention */
+#define BCMA_CORE_PCI_PLP_ATTNMASKREG           0x21C   /* Attention Mask */
+#define BCMA_CORE_PCI_PLP_RXERRCTR              0x220   /* Rx Error */
+#define BCMA_CORE_PCI_PLP_RXFRMERRCTR           0x224   /* Rx Framing Error */
+#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG        0x228   /* Rx Error threshold */
+#define BCMA_CORE_PCI_PLP_TESTCTRLREG           0x22C   /* Test Control reg */
+#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG     0x230   /* SERDES Control Override */
+#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG         0x234   /* Timing param override */
+#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG         0x238   /* RXTX State Machine Diag */
+#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG          0x23C   /* LTSSM State Machine Diag */
+
+/* PCIE protocol DLLP diagnostic registers */
+#define BCMA_CORE_PCI_DLLP_LCREG                0x100   /* Link Control */
+#define BCMA_CORE_PCI_DLLP_LSREG                0x104   /* Link Status */
+#define BCMA_CORE_PCI_DLLP_LAREG                0x108   /* Link Attention */
+#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP        (1 << 16)
+#define BCMA_CORE_PCI_DLLP_LAMASKREG            0x10C   /* Link Attention Mask */
+#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG      0x110   /* Next Tx Seq Num */
+#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG     0x114   /* Acked Tx Seq Num */
+#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG    0x118   /* Purged Tx Seq Num */
+#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG          0x11C   /* Rx Sequence Number */
+#define BCMA_CORE_PCI_DLLP_LRREG                0x120   /* Link Replay */
+#define BCMA_CORE_PCI_DLLP_LACKTOREG            0x124   /* Link Ack Timeout */
+#define BCMA_CORE_PCI_DLLP_PMTHRESHREG          0x128   /* Power Management Threshold */
+#define BCMA_CORE_PCI_DLLP_RTRYWPREG            0x12C   /* Retry buffer write ptr */
+#define BCMA_CORE_PCI_DLLP_RTRYRPREG            0x130   /* Retry buffer Read ptr */
+#define BCMA_CORE_PCI_DLLP_RTRYPPREG            0x134   /* Retry buffer Purged ptr */
+#define BCMA_CORE_PCI_DLLP_RTRRWREG             0x138   /* Retry buffer Read/Write */
+#define BCMA_CORE_PCI_DLLP_ECTHRESHREG          0x13C   /* Error Count Threshold */
+#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG         0x140   /* TLP Error Counter */
+#define BCMA_CORE_PCI_DLLP_ERRCTRREG            0x144   /* Error Counter */
+#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG          0x148   /* NAK Received Counter */
+#define BCMA_CORE_PCI_DLLP_TESTREG              0x14C   /* Test */
+#define BCMA_CORE_PCI_DLLP_PKTBIST              0x150   /* Packet BIST */
+#define BCMA_CORE_PCI_DLLP_PCIE11               0x154   /* DLLP PCIE 1.1 reg */
+
+/* SERDES RX registers */
+#define BCMA_CORE_PCI_SERDES_RX_CTRL            1       /* Rx cntrl */
+#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE     0x80    /* rxpolarity_force */
+#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY  0x40    /* rxpolarity_value */
+#define BCMA_CORE_PCI_SERDES_RX_TIMER1          2       /* Rx Timer1 */
+#define BCMA_CORE_PCI_SERDES_RX_CDR             6       /* CDR */
+#define BCMA_CORE_PCI_SERDES_RX_CDRBW           7       /* CDR BW */
+
+/* SERDES PLL registers */
+#define BCMA_CORE_PCI_SERDES_PLL_CTRL           1       /* PLL control reg */
+#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN       0x4000  /* bit 14 is FREQDET on */
+
 /* PCIcore specific boardflags */
 #define BCMA_CORE_PCI_BFL_NOPCI                 0x00000400 /* Board leaves PCI floating */
 
+/* PCIE Config space accessing MACROS */
+#define BCMA_CORE_PCI_CFG_BUS_SHIFT             24      /* Bus shift */
+#define BCMA_CORE_PCI_CFG_SLOT_SHIFT            19      /* Slot/Device shift */
+#define BCMA_CORE_PCI_CFG_FUN_SHIFT             16      /* Function shift */
+#define BCMA_CORE_PCI_CFG_OFF_SHIFT             0       /* Register shift */
+
+#define BCMA_CORE_PCI_CFG_BUS_MASK              0xff    /* Bus mask */
+#define BCMA_CORE_PCI_CFG_SLOT_MASK             0x1f    /* Slot/Device mask */
+#define BCMA_CORE_PCI_CFG_FUN_MASK              7       /* Function mask */
+#define BCMA_CORE_PCI_CFG_OFF_MASK              0xfff   /* Register mask */
+
+/* PCIE Root Capability Register bits (Host mode only) */
+#define BCMA_CORE_PCI_RC_CRS_VISIBILITY         0x0001
+
+struct bcma_drv_pci;
+
+#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
+struct bcma_drv_pci_host {
+        struct bcma_drv_pci *pdev;
+
+        u32 host_cfg_addr;
+        spinlock_t cfgspace_lock;
+
+        struct pci_controller pci_controller;
+        struct pci_ops pci_ops;
+        struct resource mem_resource;
+        struct resource io_resource;
+};
+#endif
+
 struct bcma_drv_pci {
         struct bcma_device *core;
         u8 setup_done:1;
+        u8 hostmode:1;
+
+#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
+        struct bcma_drv_pci_host *host_controller;
+#endif
 };
 
 /* Register access */
 #define pcicore_read32(pc, offset)              bcma_read32((pc)->core, offset)
 #define pcicore_write32(pc, offset, val)        bcma_write32((pc)->core, offset, val)
 
-extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
+extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
 extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
                                  struct bcma_device *core, bool enable);
 
+extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
+extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
+
 #endif /* LINUX_BCMA_DRIVER_PCI_H_ */
diff --git a/include/linux/bcma/bcma_regs.h b/include/linux/bcma/bcma_regs.h
index 9faae2ae02e8..5a71d5719640 100644
--- a/include/linux/bcma/bcma_regs.h
+++ b/include/linux/bcma/bcma_regs.h
@@ -56,4 +56,31 @@
 #define  BCMA_PCI_GPIO_XTAL             0x40    /* PCI config space GPIO 14 for Xtal powerup */
 #define  BCMA_PCI_GPIO_PLL              0x80    /* PCI config space GPIO 15 for PLL powerdown */
 
+/* SiliconBackplane Address Map.
+ * All regions may not exist on all chips.
+ */
+#define BCMA_SOC_SDRAM_BASE             0x00000000U     /* Physical SDRAM */
+#define BCMA_SOC_PCI_MEM                0x08000000U     /* Host Mode sb2pcitranslation0 (64 MB) */
+#define BCMA_SOC_PCI_MEM_SZ             (64 * 1024 * 1024)
+#define BCMA_SOC_PCI_CFG                0x0c000000U     /* Host Mode sb2pcitranslation1 (64 MB) */
+#define BCMA_SOC_SDRAM_SWAPPED          0x10000000U     /* Byteswapped Physical SDRAM */
+#define BCMA_SOC_SDRAM_R2               0x80000000U     /* Region 2 for sdram (512 MB) */
+
+
+#define BCMA_SOC_PCI_DMA                0x40000000U     /* Client Mode sb2pcitranslation2 (1 GB) */
+#define BCMA_SOC_PCI_DMA2               0x80000000U     /* Client Mode sb2pcitranslation2 (1 GB) */
+#define BCMA_SOC_PCI_DMA_SZ             0x40000000U     /* Client Mode sb2pcitranslation2 size in bytes */
+#define BCMA_SOC_PCIE_DMA_L32           0x00000000U     /* PCIE Client Mode sb2pcitranslation2
+                                                         * (2 ZettaBytes), low 32 bits
+                                                         */
+#define BCMA_SOC_PCIE_DMA_H32           0x80000000U     /* PCIE Client Mode sb2pcitranslation2
+                                                         * (2 ZettaBytes), high 32 bits
+                                                         */
+
+#define BCMA_SOC_PCI1_MEM               0x40000000U     /* Host Mode sb2pcitranslation0 (64 MB) */
+#define BCMA_SOC_PCI1_CFG               0x44000000U     /* Host Mode sb2pcitranslation1 (64 MB) */
+#define BCMA_SOC_PCIE1_DMA_H32          0xc0000000U     /* PCIE Client Mode sb2pcitranslation2
+                                                         * (2 ZettaBytes), high 32 bits
+                                                         */
+
 #endif /* LINUX_BCMA_REGS_H_ */
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index a0969fcb72b9..5d2efe7e3f1b 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -92,7 +92,7 @@ void can_bus_off(struct net_device *dev);
 
 void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
                       unsigned int idx);
-void can_get_echo_skb(struct net_device *dev, unsigned int idx);
+unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx);
 void can_free_echo_skb(struct net_device *dev, unsigned int idx);
 
 struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf);
diff --git a/include/linux/dccp.h b/include/linux/dccp.h
index 710c04302a15..eaf95a023af4 100644
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -376,8 +376,10 @@ static inline unsigned int dccp_hdr_len(const struct sk_buff *skb)
 /**
  * struct dccp_request_sock  -  represent DCCP-specific connection request
  * @dreq_inet_rsk: structure inherited from
- * @dreq_iss: initial sequence number sent on the Response (RFC 4340, 7.1)
- * @dreq_isr: initial sequence number received on the Request
+ * @dreq_iss: initial sequence number, sent on the first Response (RFC 4340, 7.1)
+ * @dreq_gss: greatest sequence number sent (for retransmitted Responses)
+ * @dreq_isr: initial sequence number received in the first Request
+ * @dreq_gsr: greatest sequence number received (for retransmitted Request(s))
  * @dreq_service: service code present on the Request (there is just one)
  * @dreq_featneg: feature negotiation options for this connection
  * The following two fields are analogous to the ones in dccp_sock:
@@ -387,7 +389,9 @@ static inline unsigned int dccp_hdr_len(const struct sk_buff *skb)
 struct dccp_request_sock {
         struct inet_request_sock dreq_inet_rsk;
         __u64                    dreq_iss;
+        __u64                    dreq_gss;
         __u64                    dreq_isr;
+        __u64                    dreq_gsr;
         __be32                   dreq_service;
         struct list_head         dreq_featneg;
         __u32                    dreq_timestamp_echo;
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 05955cf09937..8a1835855faa 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -140,17 +140,18 @@ static inline void random_ether_addr(u8 *addr)
 }
 
 /**
- * dev_hw_addr_random - Create random MAC and set device flag
+ * eth_hw_addr_random - Generate software assigned random Ethernet and
+ * set device flag
  * @dev: pointer to net_device structure
- * @hwaddr: Pointer to a six-byte array containing the Ethernet address
  *
- * Generate random MAC to be used by a device and set addr_assign_type
- * so the state can be read by sysfs and be used by udev.
+ * Generate a random Ethernet address (MAC) to be used by a net device
+ * and set addr_assign_type so the state can be read by sysfs and be
+ * used by userspace.
  */
-static inline void dev_hw_addr_random(struct net_device *dev, u8 *hwaddr)
+static inline void eth_hw_addr_random(struct net_device *dev)
 {
         dev->addr_assign_type |= NET_ADDR_RANDOM;
-        random_ether_addr(hwaddr);
+        random_ether_addr(dev->dev_addr);
 }
 
 /**
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index da5b2de99ae4..e1d9e0ede309 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -30,10 +30,15 @@ struct ethtool_cmd {
                                  * access it */
         __u8    duplex;         /* Duplex, half or full */
         __u8    port;           /* Which connector port */
-        __u8    phy_address;
+        __u8    phy_address;    /* MDIO PHY address (PRTAD for clause 45).
+                                 * May be read-only or read-write
+                                 * depending on the driver.
+                                 */
         __u8    transceiver;    /* Which transceiver to use */
         __u8    autoneg;        /* Enable or disable autonegotiation */
-        __u8    mdio_support;
+        __u8    mdio_support;   /* MDIO protocols supported.  Read-only.
+                                 * Not set by all drivers.
+                                 */
         __u32   maxtxpkt;       /* Tx pkts before generating tx int */
         __u32   maxrxpkt;       /* Rx pkts before generating rx int */
         __u16   speed_hi;       /* The forced speed (upper
@@ -59,6 +64,20 @@ static inline __u32 ethtool_cmd_speed(const struct ethtool_cmd *ep)
         return (ep->speed_hi << 16) | ep->speed;
 }
 
+/* Device supports clause 22 register access to PHY or peripherals
+ * using the interface defined in <linux/mii.h>.  This should not be
+ * set if there are known to be no such peripherals present or if
+ * the driver only emulates clause 22 registers for compatibility.
+ */
+#define ETH_MDIO_SUPPORTS_C22   1
+
+/* Device supports clause 45 register access to PHY or peripherals
+ * using the interface defined in <linux/mii.h> and <linux/mdio.h>.
+ * This should not be set if there are known to be no such peripherals
+ * present.
+ */
+#define ETH_MDIO_SUPPORTS_C45   2
+
 #define ETHTOOL_FWVERS_LEN      32
 #define ETHTOOL_BUSINFO_LEN     32
 /* these strings are set to whatever the driver author decides... */
diff --git a/include/linux/if.h b/include/linux/if.h
index 06b6ef60c821..f995c663c493 100644
--- a/include/linux/if.h
+++ b/include/linux/if.h
@@ -80,6 +80,8 @@
                                          * skbs on transmit */
 #define IFF_UNICAST_FLT 0x20000         /* Supports unicast filtering   */
 #define IFF_TEAM_PORT   0x40000         /* device used as team port */
+#define IFF_SUPP_NOFCS  0x80000         /* device supports sending custom FCS */
+
 
 #define IF_GET_IFACE    0x0001          /* for querying only */
 #define IF_GET_PROTO    0x0002
diff --git a/include/linux/if_ppp.h b/include/linux/if_ppp.h
index c9ad38322576..9048fabb7a4e 100644
--- a/include/linux/if_ppp.h
+++ b/include/linux/if_ppp.h
@@ -1,173 +1 @@
-/*
- * if_ppp.h - Point-to-Point Protocol definitions.
- *
- * Copyright (c) 1989 Carnegie Mellon University.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms are permitted
- * provided that the above copyright notice and this paragraph are
- * duplicated in all such forms and that any documentation,
- * advertising materials, and other materials related to such
- * distribution and use acknowledge that the software was developed
- * by Carnegie Mellon University.  The name of the
- * University may not be used to endorse or promote products derived
- * from this software without specific prior written permission.
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- *
- */
-
-/*
- *  ==FILEVERSION 20050812==
- *
- *  NOTE TO MAINTAINERS:
- *     If you modify this file at all, please set the above date.
- *     if_ppp.h is shipped with a PPP distribution as well as with the kernel;
- *     if everyone increases the FILEVERSION number above, then scripts
- *     can do the right thing when deciding whether to install a new if_ppp.h
- *     file.  Don't change the format of that line otherwise, so the
- *     installation script can recognize it.
- */
-
-#ifndef _IF_PPP_H_
-#define _IF_PPP_H_
-
-#include <linux/types.h>
-#include <linux/compiler.h>
-
-/*
- * Packet sizes
- */
-
-#define PPP_MTU         1500    /* Default MTU (size of Info field) */
-#define PPP_MAXMRU      65000   /* Largest MRU we allow */
-#define PROTO_IPX       0x002b  /* protocol numbers */
-#define PROTO_DNA_RT    0x0027  /* DNA Routing */
-
-
-/*
- * Bit definitions for flags.
- */
-
-#define SC_COMP_PROT    0x00000001      /* protocol compression (output) */
-#define SC_COMP_AC      0x00000002      /* header compression (output) */
-#define SC_COMP_TCP     0x00000004      /* TCP (VJ) compression (output) */
-#define SC_NO_TCP_CCID  0x00000008      /* disable VJ connection-id comp. */
-#define SC_REJ_COMP_AC  0x00000010      /* reject adrs/ctrl comp. on input */
-#define SC_REJ_COMP_TCP 0x00000020      /* reject TCP (VJ) comp. on input */
-#define SC_CCP_OPEN     0x00000040      /* Look at CCP packets */
-#define SC_CCP_UP       0x00000080      /* May send/recv compressed packets */
-#define SC_ENABLE_IP    0x00000100      /* IP packets may be exchanged */
-#define SC_LOOP_TRAFFIC 0x00000200      /* send traffic to pppd */
-#define SC_MULTILINK    0x00000400      /* do multilink encapsulation */
-#define SC_MP_SHORTSEQ  0x00000800      /* use short MP sequence numbers */
-#define SC_COMP_RUN     0x00001000      /* compressor has been inited */
-#define SC_DECOMP_RUN   0x00002000      /* decompressor has been inited */
-#define SC_MP_XSHORTSEQ 0x00004000      /* transmit short MP seq numbers */
-#define SC_DEBUG        0x00010000      /* enable debug messages */
-#define SC_LOG_INPKT    0x00020000      /* log contents of good pkts recvd */
-#define SC_LOG_OUTPKT   0x00040000      /* log contents of pkts sent */
-#define SC_LOG_RAWIN    0x00080000      /* log all chars received */
-#define SC_LOG_FLUSH    0x00100000      /* log all chars flushed */
-#define SC_SYNC         0x00200000      /* synchronous serial mode */
-#define SC_MUST_COMP    0x00400000      /* no uncompressed packets may be sent or received */
-#define SC_MASK         0x0f600fff      /* bits that user can change */
-
-/* state bits */
-#define SC_XMIT_BUSY    0x10000000      /* (used by isdn_ppp?) */
-#define SC_RCV_ODDP     0x08000000      /* have rcvd char with odd parity */
-#define SC_RCV_EVNP     0x04000000      /* have rcvd char with even parity */
-#define SC_RCV_B7_1     0x02000000      /* have rcvd char with bit 7 = 1 */
-#define SC_RCV_B7_0     0x01000000      /* have rcvd char with bit 7 = 0 */
-#define SC_DC_FERROR    0x00800000      /* fatal decomp error detected */
-#define SC_DC_ERROR     0x00400000      /* non-fatal decomp error detected */
-
-/*
- * Ioctl definitions.
- */
-
-struct npioctl {
-        int             protocol;       /* PPP protocol, e.g. PPP_IP */
-        enum NPmode     mode;
-};
-
-/* Structure describing a CCP configuration option, for PPPIOCSCOMPRESS */
-struct ppp_option_data {
-        __u8    __user *ptr;
-        __u32   length;
-        int     transmit;
-};
-
-struct ifpppstatsreq {
-        struct ifreq     b;
-        struct ppp_stats stats;                 /* statistic information */
-};
-
-struct ifpppcstatsreq {
-        struct ifreq          b;
-        struct ppp_comp_stats stats;
-};
-
-/* For PPPIOCGL2TPSTATS */
-struct pppol2tp_ioc_stats {
-        __u16           tunnel_id;      /* redundant */
-        __u16           session_id;     /* if zero, get tunnel stats */
-        __u32           using_ipsec:1;  /* valid only for session_id == 0 */
-        __aligned_u64   tx_packets;
-        __aligned_u64   tx_bytes;
-        __aligned_u64   tx_errors;
-        __aligned_u64   rx_packets;
-        __aligned_u64   rx_bytes;
-        __aligned_u64   rx_seq_discards;
-        __aligned_u64   rx_oos_packets;
-        __aligned_u64   rx_errors;
-};
-
-#define ifr__name       b.ifr_ifrn.ifrn_name
-#define stats_ptr       b.ifr_ifru.ifru_data
-
-/*
- * Ioctl definitions.
- */
-
-#define PPPIOCGFLAGS    _IOR('t', 90, int)      /* get configuration flags */
-#define PPPIOCSFLAGS    _IOW('t', 89, int)      /* set configuration flags */
-#define PPPIOCGASYNCMAP _IOR('t', 88, int)      /* get async map */
-#define PPPIOCSASYNCMAP _IOW('t', 87, int)      /* set async map */
-#define PPPIOCGUNIT     _IOR('t', 86, int)      /* get ppp unit number */
-#define PPPIOCGRASYNCMAP _IOR('t', 85, int)     /* get receive async map */
-#define PPPIOCSRASYNCMAP _IOW('t', 84, int)     /* set receive async map */
-#define PPPIOCGMRU      _IOR('t', 83, int)      /* get max receive unit */
-#define PPPIOCSMRU      _IOW('t', 82, int)      /* set max receive unit */
-#define PPPIOCSMAXCID   _IOW('t', 81, int)      /* set VJ max slot ID */
-#define PPPIOCGXASYNCMAP _IOR('t', 80, ext_accm) /* get extended ACCM */
-#define PPPIOCSXASYNCMAP _IOW('t', 79, ext_accm) /* set extended ACCM */
-#define PPPIOCXFERUNIT  _IO('t', 78)            /* transfer PPP unit */
-#define PPPIOCSCOMPRESS _IOW('t', 77, struct ppp_option_data)
-#define PPPIOCGNPMODE   _IOWR('t', 76, struct npioctl) /* get NP mode */
-#define PPPIOCSNPMODE   _IOW('t', 75, struct npioctl)  /* set NP mode */
-#define PPPIOCSPASS     _IOW('t', 71, struct sock_fprog) /* set pass filter */
-#define PPPIOCSACTIVE   _IOW('t', 70, struct sock_fprog) /* set active filt */
-#define PPPIOCGDEBUG    _IOR('t', 65, int)      /* Read debug level */
-#define PPPIOCSDEBUG    _IOW('t', 64, int)      /* Set debug level */
-#define PPPIOCGIDLE     _IOR('t', 63, struct ppp_idle) /* get idle time */
-#define PPPIOCNEWUNIT   _IOWR('t', 62, int)     /* create new ppp unit */
-#define PPPIOCATTACH    _IOW('t', 61, int)      /* attach to ppp unit */
-#define PPPIOCDETACH    _IOW('t', 60, int)      /* detach from ppp unit/chan */
-#define PPPIOCSMRRU     _IOW('t', 59, int)      /* set multilink MRU */
-#define PPPIOCCONNECT   _IOW('t', 58, int)      /* connect channel to unit */
-#define PPPIOCDISCONN   _IO('t', 57)            /* disconnect channel */
-#define PPPIOCATTCHAN   _IOW('t', 56, int)      /* attach to ppp channel */
-#define PPPIOCGCHAN     _IOR('t', 55, int)      /* get ppp channel number */
-#define PPPIOCGL2TPSTATS _IOR('t', 54, struct pppol2tp_ioc_stats)
-
-#define SIOCGPPPSTATS   (SIOCDEVPRIVATE + 0)
-#define SIOCGPPPVER     (SIOCDEVPRIVATE + 1)    /* NEVER change this!! */
-#define SIOCGPPPCSTATS  (SIOCDEVPRIVATE + 2)
-
-#if !defined(ifr_mtu)
-#define ifr_mtu ifr_ifru.ifru_metric
-#endif
-
-#endif /* _IF_PPP_H_ */
+#include <linux/ppp-ioctl.h>
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 13aff1e2183b..33a6e1951d4d 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -18,10 +18,9 @@
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
 
-#define VLAN_HLEN       4               /* The additional bytes (on top of the Ethernet header)
-                                         * that VLAN requires.
+#define VLAN_HLEN       4               /* The additional bytes required by VLAN
+                                         * (in addition to the Ethernet header)
                                          */
-#define VLAN_ETH_ALEN   6               /* Octets in one ethernet addr   */
 #define VLAN_ETH_HLEN   18              /* Total octets in header.       */
 #define VLAN_ETH_ZLEN   64              /* Min. octets in frame sans FCS */
 
@@ -177,7 +176,7 @@ static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb, u16 vlan_tci)
         veth = (struct vlan_ethhdr *)skb_push(skb, VLAN_HLEN);
 
         /* Move the mac addresses to the beginning of the new header. */
-        memmove(skb->data, skb->data + VLAN_HLEN, 2 * VLAN_ETH_ALEN);
+        memmove(skb->data, skb->data + VLAN_HLEN, 2 * ETH_ALEN);
         skb->mac_header -= VLAN_HLEN;
 
         /* first, the ethernet type */
diff --git a/include/linux/in.h b/include/linux/in.h
index 01129c0ea87c..e0337f11d92e 100644
--- a/include/linux/in.h
+++ b/include/linux/in.h
@@ -111,6 +111,7 @@ struct in_addr {
 #define MCAST_LEAVE_SOURCE_GROUP        47
 #define MCAST_MSFILTER                  48
 #define IP_MULTICAST_ALL                49
+#define IP_UNICAST_IF                   50
 
 #define MCAST_EXCLUDE   0
 #define MCAST_INCLUDE   1
diff --git a/include/linux/in6.h b/include/linux/in6.h
index 097a34b55560..5c83d9e3eb8f 100644
--- a/include/linux/in6.h
+++ b/include/linux/in6.h
@@ -271,6 +271,7 @@ struct in6_flowlabel_req {
 #define IPV6_ORIGDSTADDR        74
 #define IPV6_RECVORIGDSTADDR    IPV6_ORIGDSTADDR
 #define IPV6_TRANSPARENT        75
+#define IPV6_UNICAST_IF         76
 
 /*
  * Multicast Routing:
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 5f8146695b7f..597f4a9f3240 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -139,6 +139,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
           IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS)))
 
 #define IN_DEV_ARPFILTER(in_dev)        IN_DEV_ORCONF((in_dev), ARPFILTER)
+#define IN_DEV_ARP_ACCEPT(in_dev)       IN_DEV_ORCONF((in_dev), ARP_ACCEPT)
 #define IN_DEV_ARP_ANNOUNCE(in_dev)     IN_DEV_MAXCONF((in_dev), ARP_ANNOUNCE)
 #define IN_DEV_ARP_IGNORE(in_dev)       IN_DEV_MAXCONF((in_dev), ARP_IGNORE)
 #define IN_DEV_ARP_NOTIFY(in_dev)       IN_DEV_MAXCONF((in_dev), ARP_NOTIFY)
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 6318268dcaf5..8260ef779762 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -233,6 +233,11 @@ static inline struct ipv6hdr *ipipv6_hdr(const struct sk_buff *skb)
         return (struct ipv6hdr *)skb_transport_header(skb);
 }
 
+static inline __u8 ipv6_tclass(const struct ipv6hdr *iph)
+{
+        return (ntohl(*(__be32 *)iph) >> 20) & 0xff;
+}
+
 /* 
    This structure contains results of exthdrs parsing
    as offsets from skb->nh.
@@ -324,6 +329,7 @@ struct ipv6_pinfo {
                                 __unused_2:6;
         __s16                   mcast_hops:9;
 #endif
+        int                     ucast_oif;
         int                     mcast_oif;
 
         /* pktoption flags */
@@ -360,7 +366,7 @@ struct ipv6_pinfo {
                                 dontfrag:1;
         __u8                    min_hopcount;
         __u8                    tclass;
-        __u8                    padding;
+        __u8                    rcv_tclass;
 
         __u32                   dst_cookie;
 
diff --git a/include/linux/isdn.h b/include/linux/isdn.h
index 4ccf95d681b4..292f27a793d4 100644
--- a/include/linux/isdn.h
+++ b/include/linux/isdn.h
@@ -187,7 +187,7 @@ typedef struct {
 #endif
 
 #include <linux/ppp_defs.h>
-#include <linux/if_ppp.h>
+#include <linux/ppp-ioctl.h>
 
 #include <linux/isdn_ppp.h>
 #endif
diff --git a/include/linux/mdio.h b/include/linux/mdio.h
index b1494aced217..dfb947959ec9 100644
--- a/include/linux/mdio.h
+++ b/include/linux/mdio.h
@@ -10,6 +10,7 @@
 #ifndef __LINUX_MDIO_H__
 #define __LINUX_MDIO_H__
 
+#include <linux/types.h>
 #include <linux/mii.h>
 
 /* MDIO Manageable Devices (MMDs). */
@@ -273,6 +274,8 @@ static inline __u16 mdio_phy_id_c45(int prtad, int devad)
         return MDIO_PHY_ID_C45 | (prtad << 5) | devad;
 }
 
+#ifdef __KERNEL__
+
 static inline bool mdio_phy_id_is_c45(int phy_id)
 {
         return (phy_id & MDIO_PHY_ID_C45) && !(phy_id & ~MDIO_PHY_ID_C45_MASK);
@@ -288,11 +291,6 @@ static inline __u16 mdio_phy_id_devad(int phy_id)
         return phy_id & MDIO_PHY_ID_DEVAD;
 }
 
-#define MDIO_SUPPORTS_C22               1
-#define MDIO_SUPPORTS_C45               2
-
-#ifdef __KERNEL__ 
-
 /**
  * struct mdio_if_info - Ethernet controller MDIO interface
  * @prtad: PRTAD of the PHY (%MDIO_PRTAD_NONE if not present/unknown)
@@ -321,6 +319,8 @@ struct mdio_if_info {
 
 #define MDIO_PRTAD_NONE                 (-1)
 #define MDIO_DEVAD_NONE                 (-1)
+#define MDIO_SUPPORTS_C22               1
+#define MDIO_SUPPORTS_C45               2
 #define MDIO_EMULATE_C22                4
 
 struct ethtool_cmd;
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index aea61905499b..44d8144e9ae8 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -622,7 +622,10 @@ int mlx4_replace_mac(struct mlx4_dev *dev, u8 port, int qpn, u64 new_mac);
 int mlx4_get_eth_qp(struct mlx4_dev *dev, u8 port, u64 mac, int *qpn);
 void mlx4_put_eth_qp(struct mlx4_dev *dev, u8 port, u64 mac, int qpn);
 void mlx4_set_stats_bitmap(struct mlx4_dev *dev, u64 *stats_bitmap);
-
+int mlx4_SET_PORT_general(struct mlx4_dev *dev, u8 port, int mtu,
+                          u8 pptx, u8 pfctx, u8 pprx, u8 pfcrx);
+int mlx4_SET_PORT_qpn_calc(struct mlx4_dev *dev, u8 port, u32 base_qpn,
+                           u8 promisc);
 int mlx4_find_cached_vlan(struct mlx4_dev *dev, u8 port, u16 vid, int *idx);
 int mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan, int *index);
 void mlx4_unregister_vlan(struct mlx4_dev *dev, u8 port, int index);
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index bee8fa231276..091f9e7dc8b9 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -212,7 +212,10 @@ struct mlx4_wqe_ctrl_seg {
          * [1]   SE (solicited event)
          * [0]   FL (force loopback)
          */
-        __be32                  srcrb_flags;
+        union {
+                __be32                  srcrb_flags;
+                __be16                  srcrb_flags16[2];
+        };
         /*
          * imm is immediate data for send/RDMA write w/ immediate;
          * also invalidation key for send with invalidate; input
diff --git a/include/linux/net.h b/include/linux/net.h
index b29923006b11..be60c7f5e145 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -206,6 +206,7 @@ struct proto_ops {
                                       int offset, size_t size, int flags);
         ssize_t         (*splice_read)(struct socket *sock,  loff_t *ppos,
                                        struct pipe_inode_info *pipe, size_t len, unsigned int flags);
+        void            (*set_peek_off)(struct sock *sk, int val);
 };
 
 #define DECLARE_SOCKADDR(type, dst, src)        \
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 77f5202977ce..5ac32123035a 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -54,6 +54,8 @@ enum {
         NETIF_F_RXCSUM_BIT,             /* Receive checksumming offload */
         NETIF_F_NOCACHE_COPY_BIT,       /* Use no-cache copyfromuser */
         NETIF_F_LOOPBACK_BIT,           /* Enable loopback */
+        NETIF_F_RXFCS_BIT,              /* Append FCS to skb pkt data */
+        NETIF_F_RXALL_BIT,              /* Receive errored frames too */
 
         /*
          * Add your fresh new feature above and remember to update
@@ -98,6 +100,8 @@ enum {
 #define NETIF_F_TSO             __NETIF_F(TSO)
 #define NETIF_F_UFO             __NETIF_F(UFO)
 #define NETIF_F_VLAN_CHALLENGED __NETIF_F(VLAN_CHALLENGED)
+#define NETIF_F_RXFCS           __NETIF_F(RXFCS)
+#define NETIF_F_RXALL           __NETIF_F(RXALL)
 
 /* Features valid for ethtool to change */
 /* = all defined minus driver/device-class-related */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3e5cb2546e4f..8debe299676d 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -417,7 +417,7 @@ typedef rx_handler_result_t rx_handler_func_t(struct sk_buff **pskb);
 
 extern void __napi_schedule(struct napi_struct *n);
 
-static inline int napi_disable_pending(struct napi_struct *n)
+static inline bool napi_disable_pending(struct napi_struct *n)
 {
         return test_bit(NAPI_STATE_DISABLE, &n->state);
 }
@@ -431,7 +431,7 @@ static inline int napi_disable_pending(struct napi_struct *n)
  * insure only one NAPI poll instance runs.  We also make
  * sure there is no pending NAPI disable.
  */
-static inline int napi_schedule_prep(struct napi_struct *n)
+static inline bool napi_schedule_prep(struct napi_struct *n)
 {
         return !napi_disable_pending(n) &&
                 !test_and_set_bit(NAPI_STATE_SCHED, &n->state);
@@ -451,13 +451,13 @@ static inline void napi_schedule(struct napi_struct *n)
 }
 
 /* Try to reschedule poll. Called by dev->poll() after napi_complete().  */
-static inline int napi_reschedule(struct napi_struct *napi)
+static inline bool napi_reschedule(struct napi_struct *napi)
 {
         if (napi_schedule_prep(napi)) {
                 __napi_schedule(napi);
-                return 1;
+                return true;
         }
-        return 0;
+        return false;
 }
 
 /**
@@ -1082,7 +1082,8 @@ struct net_device {
         const struct header_ops *header_ops;
 
         unsigned int            flags;  /* interface flags (a la BSD)   */
-        unsigned int            priv_flags; /* Like 'flags' but invisible to userspace. */
+        unsigned int            priv_flags; /* Like 'flags' but invisible to userspace.
+                                             * See if.h for definitions. */
         unsigned short          gflags;
         unsigned short          padded; /* How much padding added by alloc_netdev() */
 
@@ -1867,7 +1868,7 @@ static inline void netif_tx_stop_all_queues(struct net_device *dev)
         }
 }
 
-static inline int netif_tx_queue_stopped(const struct netdev_queue *dev_queue)
+static inline bool netif_tx_queue_stopped(const struct netdev_queue *dev_queue)
 {
         return test_bit(__QUEUE_STATE_DRV_XOFF, &dev_queue->state);
 }
@@ -1878,17 +1879,17 @@ static inline int netif_tx_queue_stopped(const struct netdev_queue *dev_queue)
  *
  *      Test if transmit queue on device is currently unable to send.
  */
-static inline int netif_queue_stopped(const struct net_device *dev)
+static inline bool netif_queue_stopped(const struct net_device *dev)
 {
         return netif_tx_queue_stopped(netdev_get_tx_queue(dev, 0));
 }
 
-static inline int netif_xmit_stopped(const struct netdev_queue *dev_queue)
+static inline bool netif_xmit_stopped(const struct netdev_queue *dev_queue)
 {
         return dev_queue->state & QUEUE_STATE_ANY_XOFF;
 }
 
-static inline int netif_xmit_frozen_or_stopped(const struct netdev_queue *dev_queue)
+static inline bool netif_xmit_frozen_or_stopped(const struct netdev_queue *dev_queue)
 {
         return dev_queue->state & QUEUE_STATE_ANY_XOFF_OR_FROZEN;
 }
@@ -1898,12 +1899,22 @@ static inline void netdev_tx_sent_queue(struct netdev_queue *dev_queue,
 {
 #ifdef CONFIG_BQL
         dql_queued(&dev_queue->dql, bytes);
-        if (unlikely(dql_avail(&dev_queue->dql) < 0)) {
-                set_bit(__QUEUE_STATE_STACK_XOFF, &dev_queue->state);
-                if (unlikely(dql_avail(&dev_queue->dql) >= 0))
-                        clear_bit(__QUEUE_STATE_STACK_XOFF,
-                            &dev_queue->state);
-        }
+
+        if (likely(dql_avail(&dev_queue->dql) >= 0))
+                return;
+
+        set_bit(__QUEUE_STATE_STACK_XOFF, &dev_queue->state);
+
+        /*
+         * The XOFF flag must be set before checking the dql_avail below,
+         * because in netdev_tx_completed_queue we update the dql_completed
+         * before checking the XOFF flag.
+         */
+        smp_mb();
+
+        /* check again in case another CPU has just made room avail */
+        if (unlikely(dql_avail(&dev_queue->dql) >= 0))
+                clear_bit(__QUEUE_STATE_STACK_XOFF, &dev_queue->state);
 #endif
 }
 
@@ -1916,16 +1927,23 @@ static inline void netdev_tx_completed_queue(struct netdev_queue *dev_queue,
                                              unsigned pkts, unsigned bytes)
 {
 #ifdef CONFIG_BQL
-        if (likely(bytes)) {
-                dql_completed(&dev_queue->dql, bytes);
-                if (unlikely(test_bit(__QUEUE_STATE_STACK_XOFF,
-                    &dev_queue->state) &&
-                    dql_avail(&dev_queue->dql) >= 0)) {
-                        if (test_and_clear_bit(__QUEUE_STATE_STACK_XOFF,
-                             &dev_queue->state))
-                                netif_schedule_queue(dev_queue);
-                }
-        }
+        if (unlikely(!bytes))
+                return;
+
+        dql_completed(&dev_queue->dql, bytes);
+
+        /*
+         * Without the memory barrier there is a small possiblity that
+         * netdev_tx_sent_queue will miss the update and cause the queue to
+         * be stopped forever
+         */
+        smp_mb();
+
+        if (dql_avail(&dev_queue->dql) < 0)
+                return;
+
+        if (test_and_clear_bit(__QUEUE_STATE_STACK_XOFF, &dev_queue->state))
+                netif_schedule_queue(dev_queue);
 #endif
 }
 
@@ -1938,6 +1956,7 @@ static inline void netdev_completed_queue(struct net_device *dev,
 static inline void netdev_tx_reset_queue(struct netdev_queue *q)
 {
 #ifdef CONFIG_BQL
+        clear_bit(__QUEUE_STATE_STACK_XOFF, &q->state);
         dql_reset(&q->dql);
 #endif
 }
@@ -1953,7 +1972,7 @@ static inline void netdev_reset_queue(struct net_device *dev_queue)
  *
  *      Test if the device has been brought up.
  */
-static inline int netif_running(const struct net_device *dev)
+static inline bool netif_running(const struct net_device *dev)
 {
         return test_bit(__LINK_STATE_START, &dev->state);
 }
@@ -2003,16 +2022,16 @@ static inline void netif_stop_subqueue(struct net_device *dev, u16 queue_index)
  *
  * Check individual transmit queue of a device with multiple transmit queues.
  */
-static inline int __netif_subqueue_stopped(const struct net_device *dev,
-                                         u16 queue_index)
+static inline bool __netif_subqueue_stopped(const struct net_device *dev,
+                                            u16 queue_index)
 {
         struct netdev_queue *txq = netdev_get_tx_queue(dev, queue_index);
 
         return netif_tx_queue_stopped(txq);
 }
 
-static inline int netif_subqueue_stopped(const struct net_device *dev,
-                                         struct sk_buff *skb)
+static inline bool netif_subqueue_stopped(const struct net_device *dev,
+                                          struct sk_buff *skb)
 {
         return __netif_subqueue_stopped(dev, skb_get_queue_mapping(skb));
 }
@@ -2051,7 +2070,7 @@ static inline u16 skb_tx_hash(const struct net_device *dev,
  *
  * Check if device has multiple transmit queues
  */
-static inline int netif_is_multiqueue(const struct net_device *dev)
+static inline bool netif_is_multiqueue(const struct net_device *dev)
 {
         return dev->num_tx_queues > 1;
 }
@@ -2121,7 +2140,7 @@ extern int netdev_rx_handler_register(struct net_device *dev,
                                       void *rx_handler_data);
 extern void netdev_rx_handler_unregister(struct net_device *dev);
 
-extern int              dev_valid_name(const char *name);
+extern bool             dev_valid_name(const char *name);
 extern int              dev_ioctl(struct net *net, unsigned int cmd, void __user *);
 extern int              dev_ethtool(struct net *net, struct ifreq *);
 extern unsigned         dev_get_flags(const struct net_device *);
@@ -2187,7 +2206,7 @@ extern void linkwatch_forget_dev(struct net_device *dev);
  *
  * Check if carrier is present on device
  */
-static inline int netif_carrier_ok(const struct net_device *dev)
+static inline bool netif_carrier_ok(const struct net_device *dev)
 {
         return !test_bit(__LINK_STATE_NOCARRIER, &dev->state);
 }
@@ -2239,7 +2258,7 @@ static inline void netif_dormant_off(struct net_device *dev)
  *
  * Check if carrier is present on device
  */
-static inline int netif_dormant(const struct net_device *dev)
+static inline bool netif_dormant(const struct net_device *dev)
 {
         return test_bit(__LINK_STATE_DORMANT, &dev->state);
 }
@@ -2251,7 +2270,7 @@ static inline int netif_dormant(const struct net_device *dev)
  *
  * Check if carrier is operational
  */
-static inline int netif_oper_up(const struct net_device *dev)
+static inline bool netif_oper_up(const struct net_device *dev)
 {
         return (dev->operstate == IF_OPER_UP ||
                 dev->operstate == IF_OPER_UNKNOWN /* backward compat */);
@@ -2263,7 +2282,7 @@ static inline int netif_oper_up(const struct net_device *dev)
  *
  * Check if device has not been removed from system.
  */
-static inline int netif_device_present(struct net_device *dev)
+static inline bool netif_device_present(struct net_device *dev)
 {
         return test_bit(__LINK_STATE_PRESENT, &dev->state);
 }
@@ -2333,9 +2352,9 @@ static inline void __netif_tx_lock_bh(struct netdev_queue *txq)
         txq->xmit_lock_owner = smp_processor_id();
 }
 
-static inline int __netif_tx_trylock(struct netdev_queue *txq)
+static inline bool __netif_tx_trylock(struct netdev_queue *txq)
 {
-        int ok = spin_trylock(&txq->_xmit_lock);
+        bool ok = spin_trylock(&txq->_xmit_lock);
         if (likely(ok))
                 txq->xmit_lock_owner = smp_processor_id();
         return ok;
@@ -2556,6 +2575,8 @@ extern void		dev_load(struct net *net, const char *name);
 extern void             dev_mcast_init(void);
 extern struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
                                                struct rtnl_link_stats64 *storage);
+extern void netdev_stats_to_stats64(struct rtnl_link_stats64 *stats64,
+                                    const struct net_device_stats *netdev_stats);
 
 extern int              netdev_max_backlog;
 extern int              netdev_tstamp_prequeue;
@@ -2611,7 +2632,7 @@ void netif_stacked_transfer_operstate(const struct net_device *rootdev,
 
 netdev_features_t netif_skb_features(struct sk_buff *skb);
 
-static inline int net_gso_ok(netdev_features_t features, int gso_type)
+static inline bool net_gso_ok(netdev_features_t features, int gso_type)
 {
         netdev_features_t feature = gso_type << NETIF_F_GSO_SHIFT;
 
@@ -2626,17 +2647,18 @@ static inline int net_gso_ok(netdev_features_t features, int gso_type)
         return (features & feature) == feature;
 }
 
-static inline int skb_gso_ok(struct sk_buff *skb, netdev_features_t features)
+static inline bool skb_gso_ok(struct sk_buff *skb, netdev_features_t features)
 {
         return net_gso_ok(features, skb_shinfo(skb)->gso_type) &&
                (!skb_has_frag_list(skb) || (features & NETIF_F_FRAGLIST));
 }
 
-static inline int netif_needs_gso(struct sk_buff *skb,
-        netdev_features_t features)
+static inline bool netif_needs_gso(struct sk_buff *skb,
+                                   netdev_features_t features)
 {
         return skb_is_gso(skb) && (!skb_gso_ok(skb, features) ||
-                unlikely(skb->ip_summed != CHECKSUM_PARTIAL));
+                unlikely((skb->ip_summed != CHECKSUM_PARTIAL) &&
+                         (skb->ip_summed != CHECKSUM_UNNECESSARY)));
 }
 
 static inline void netif_set_gso_max_size(struct net_device *dev,
@@ -2645,11 +2667,16 @@ static inline void netif_set_gso_max_size(struct net_device *dev,
         dev->gso_max_size = size;
 }
 
-static inline int netif_is_bond_slave(struct net_device *dev)
+static inline bool netif_is_bond_slave(struct net_device *dev)
 {
         return dev->flags & IFF_SLAVE && dev->priv_flags & IFF_BONDING;
 }
 
+static inline bool netif_supports_nofcs(struct net_device *dev)
+{
+        return dev->priv_flags & IFF_SUPP_NOFCS;
+}
+
 extern struct pernet_operations __net_initdata loopback_net_ops;
 
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index e144f54185c0..1697036336b6 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -10,6 +10,7 @@ header-y += nfnetlink.h
 header-y += nfnetlink_acct.h
 header-y += nfnetlink_compat.h
 header-y += nfnetlink_conntrack.h
+header-y += nfnetlink_cttimeout.h
 header-y += nfnetlink_log.h
 header-y += nfnetlink_queue.h
 header-y += x_tables.h
@@ -22,6 +23,7 @@ header-y += xt_CT.h
 header-y += xt_DSCP.h
 header-y += xt_IDLETIMER.h
 header-y += xt_LED.h
+header-y += xt_LOG.h
 header-y += xt_MARK.h
 header-y += xt_nfacct.h
 header-y += xt_NFLOG.h
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index 3540c6e262f7..2f8e18a23227 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -11,6 +11,8 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/types.h>
+
 /* The protocol version */
 #define IPSET_PROTOCOL          6
 
@@ -148,6 +150,7 @@ enum ipset_cmd_flags {
         IPSET_FLAG_LIST_SETNAME = (1 << IPSET_FLAG_BIT_LIST_SETNAME),
         IPSET_FLAG_BIT_LIST_HEADER = 2,
         IPSET_FLAG_LIST_HEADER  = (1 << IPSET_FLAG_BIT_LIST_HEADER),
+        IPSET_FLAG_CMD_MAX = 15,        /* Lower half */
 };
 
 /* Flags at CADT attribute level */
@@ -156,6 +159,9 @@ enum ipset_cadt_flags {
         IPSET_FLAG_BEFORE       = (1 << IPSET_FLAG_BIT_BEFORE),
         IPSET_FLAG_BIT_PHYSDEV  = 1,
         IPSET_FLAG_PHYSDEV      = (1 << IPSET_FLAG_BIT_PHYSDEV),
+        IPSET_FLAG_BIT_NOMATCH  = 2,
+        IPSET_FLAG_NOMATCH      = (1 << IPSET_FLAG_BIT_NOMATCH),
+        IPSET_FLAG_CADT_MAX     = 15,   /* Upper half */
 };
 
 /* Commands with settype-specific attributes */
@@ -168,19 +174,10 @@ enum ipset_adt {
         IPSET_CADT_MAX,
 };
 
-#ifdef __KERNEL__
-#include <linux/ip.h>
-#include <linux/ipv6.h>
-#include <linux/netlink.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter/x_tables.h>
-#include <linux/vmalloc.h>
-#include <net/netlink.h>
-
 /* Sets are identified by an index in kernel space. Tweak with ip_set_id_t
  * and IPSET_INVALID_ID if you want to increase the max number of sets.
  */
-typedef u16 ip_set_id_t;
+typedef __u16 ip_set_id_t;
 
 #define IPSET_INVALID_ID                65535
 
@@ -203,6 +200,15 @@ enum ip_set_kopt {
         IPSET_DIM_THREE_SRC = (1 << IPSET_DIM_THREE),
 };
 
+#ifdef __KERNEL__
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/vmalloc.h>
+#include <net/netlink.h>
+
 /* Set features */
 enum ip_set_feature {
         IPSET_TYPE_IP_FLAG = 0,
@@ -288,7 +294,10 @@ struct ip_set_type {
         u8 features;
         /* Set type dimension */
         u8 dimension;
-        /* Supported family: may be AF_UNSPEC for both AF_INET/AF_INET6 */
+        /*
+         * Supported family: may be NFPROTO_UNSPEC for both
+         * NFPROTO_IPV4/NFPROTO_IPV6.
+         */
         u8 family;
         /* Type revisions */
         u8 revision_min, revision_max;
@@ -450,6 +459,8 @@ bitmap_bytes(u32 a, u32 b)
         return 4 * ((((b - a + 8) / 8) + 3) / 4);
 }
 
+#endif /* __KERNEL__ */
+
 /* Interface to iptables/ip6tables */
 
 #define SO_IP_SET               83
@@ -475,6 +486,4 @@ struct ip_set_req_version {
         unsigned version;
 };
 
-#endif  /* __KERNEL__ */
-
 #endif /*_IP_SET_H */
diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
index b89fb79cb44f..05a5d72680be 100644
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ b/include/linux/netfilter/ipset/ip_set_ahash.h
@@ -113,6 +113,12 @@ htable_bits(u32 hashsize)
 }
 
 #ifdef IP_SET_HASH_WITH_NETS
+#ifdef IP_SET_HASH_WITH_NETS_PACKED
+/* When cidr is packed with nomatch, cidr - 1 is stored in the entry */
+#define CIDR(cidr)      (cidr + 1)
+#else
+#define CIDR(cidr)      (cidr)
+#endif
 
 #define SET_HOST_MASK(family)   (family == AF_INET ? 32 : 128)
 
@@ -262,6 +268,12 @@ ip_set_hash_destroy(struct ip_set *set)
 #define type_pf_data_list       TOKEN(TYPE, PF, _data_list)
 #define type_pf_data_tlist      TOKEN(TYPE, PF, _data_tlist)
 #define type_pf_data_next       TOKEN(TYPE, PF, _data_next)
+#define type_pf_data_flags      TOKEN(TYPE, PF, _data_flags)
+#ifdef IP_SET_HASH_WITH_NETS
+#define type_pf_data_match      TOKEN(TYPE, PF, _data_match)
+#else
+#define type_pf_data_match(d)   1
+#endif
 
 #define type_pf_elem            TOKEN(TYPE, PF, _elem)
 #define type_pf_telem           TOKEN(TYPE, PF, _telem)
@@ -308,8 +320,10 @@ ip_set_hash_destroy(struct ip_set *set)
  * we spare the maintenance of the internal counters. */
 static int
 type_pf_elem_add(struct hbucket *n, const struct type_pf_elem *value,
-                 u8 ahash_max)
+                 u8 ahash_max, u32 cadt_flags)
 {
+        struct type_pf_elem *data;
+
         if (n->pos >= n->size) {
                 void *tmp;
 
@@ -330,7 +344,13 @@ type_pf_elem_add(struct hbucket *n, const struct type_pf_elem *value,
                 n->value = tmp;
                 n->size += AHASH_INIT_SIZE;
         }
-        type_pf_data_copy(ahash_data(n, n->pos++), value);
+        data = ahash_data(n, n->pos++);
+        type_pf_data_copy(data, value);
+#ifdef IP_SET_HASH_WITH_NETS
+        /* Resizing won't overwrite stored flags */
+        if (cadt_flags)
+                type_pf_data_flags(data, cadt_flags);
+#endif
         return 0;
 }
 
@@ -353,9 +373,12 @@ retry:
         htable_bits++;
         pr_debug("attempt to resize set %s from %u to %u, t %p\n",
                  set->name, orig->htable_bits, htable_bits, orig);
-        if (!htable_bits)
+        if (!htable_bits) {
                 /* In case we have plenty of memory :-) */
+                pr_warning("Cannot increase the hashsize of set %s further\n",
+                           set->name);
                 return -IPSET_ERR_HASH_FULL;
+        }
         t = ip_set_alloc(sizeof(*t)
                          + jhash_size(htable_bits) * sizeof(struct hbucket));
         if (!t)
@@ -368,7 +391,7 @@ retry:
                 for (j = 0; j < n->pos; j++) {
                         data = ahash_data(n, j);
                         m = hbucket(t, HKEY(data, h->initval, htable_bits));
-                        ret = type_pf_elem_add(m, data, AHASH_MAX(h));
+                        ret = type_pf_elem_add(m, data, AHASH_MAX(h), 0);
                         if (ret < 0) {
                                 read_unlock_bh(&set->lock);
                                 ahash_destroy(t);
@@ -406,9 +429,14 @@ type_pf_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
         struct hbucket *n;
         int i, ret = 0;
         u32 key, multi = 0;
+        u32 cadt_flags = flags >> 16;
 
-        if (h->elements >= h->maxelem)
+        if (h->elements >= h->maxelem) {
+                if (net_ratelimit())
+                        pr_warning("Set %s is full, maxelem %u reached\n",
+                                   set->name, h->maxelem);
                 return -IPSET_ERR_HASH_FULL;
+        }
 
         rcu_read_lock_bh();
         t = rcu_dereference_bh(h->table);
@@ -416,11 +444,17 @@ type_pf_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
         n = hbucket(t, key);
         for (i = 0; i < n->pos; i++)
                 if (type_pf_data_equal(ahash_data(n, i), d, &multi)) {
+#ifdef IP_SET_HASH_WITH_NETS
+                        if (flags & IPSET_FLAG_EXIST)
+                                /* Support overwriting just the flags */
+                                type_pf_data_flags(ahash_data(n, i),
+                                                   cadt_flags);
+#endif
                         ret = -IPSET_ERR_EXIST;
                         goto out;
                 }
         TUNE_AHASH_MAX(h, multi);
-        ret = type_pf_elem_add(n, value, AHASH_MAX(h));
+        ret = type_pf_elem_add(n, value, AHASH_MAX(h), cadt_flags);
         if (ret != 0) {
                 if (ret == -EAGAIN)
                         type_pf_data_next(h, d);
@@ -428,7 +462,7 @@ type_pf_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
         }
 
 #ifdef IP_SET_HASH_WITH_NETS
-        add_cidr(h, d->cidr, HOST_MASK);
+        add_cidr(h, CIDR(d->cidr), HOST_MASK);
 #endif
         h->elements++;
 out:
@@ -463,7 +497,7 @@ type_pf_del(struct ip_set *set, void *value, u32 timeout, u32 flags)
                 n->pos--;
                 h->elements--;
 #ifdef IP_SET_HASH_WITH_NETS
-                del_cidr(h, d->cidr, HOST_MASK);
+                del_cidr(h, CIDR(d->cidr), HOST_MASK);
 #endif
                 if (n->pos + AHASH_INIT_SIZE < n->size) {
                         void *tmp = kzalloc((n->size - AHASH_INIT_SIZE)
@@ -506,7 +540,7 @@ type_pf_test_cidrs(struct ip_set *set, struct type_pf_elem *d, u32 timeout)
                 for (i = 0; i < n->pos; i++) {
                         data = ahash_data(n, i);
                         if (type_pf_data_equal(data, d, &multi))
-                                return 1;
+                                return type_pf_data_match(data);
                 }
         }
         return 0;
@@ -528,7 +562,7 @@ type_pf_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
 #ifdef IP_SET_HASH_WITH_NETS
         /* If we test an IP address and not a network address,
          * try all possible network sizes */
-        if (d->cidr == SET_HOST_MASK(set->family))
+        if (CIDR(d->cidr) == SET_HOST_MASK(set->family))
                 return type_pf_test_cidrs(set, d, timeout);
 #endif
 
@@ -537,7 +571,7 @@ type_pf_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
         for (i = 0; i < n->pos; i++) {
                 data = ahash_data(n, i);
                 if (type_pf_data_equal(data, d, &multi))
-                        return 1;
+                        return type_pf_data_match(data);
         }
         return 0;
 }
@@ -693,7 +727,7 @@ type_pf_data_timeout_set(struct type_pf_elem *data, u32 timeout)
 
 static int
 type_pf_elem_tadd(struct hbucket *n, const struct type_pf_elem *value,
-                  u8 ahash_max, u32 timeout)
+                  u8 ahash_max, u32 cadt_flags, u32 timeout)
 {
         struct type_pf_elem *data;
 
@@ -720,6 +754,11 @@ type_pf_elem_tadd(struct hbucket *n, const struct type_pf_elem *value,
         data = ahash_tdata(n, n->pos++);
         type_pf_data_copy(data, value);
         type_pf_data_timeout_set(data, timeout);
+#ifdef IP_SET_HASH_WITH_NETS
+        /* Resizing won't overwrite stored flags */
+        if (cadt_flags)
+                type_pf_data_flags(data, cadt_flags);
+#endif
         return 0;
 }
 
@@ -740,7 +779,7 @@ type_pf_expire(struct ip_set_hash *h)
                         if (type_pf_data_expired(data)) {
                                 pr_debug("expired %u/%u\n", i, j);
 #ifdef IP_SET_HASH_WITH_NETS
-                                del_cidr(h, data->cidr, HOST_MASK);
+                                del_cidr(h, CIDR(data->cidr), HOST_MASK);
 #endif
                                 if (j != n->pos - 1)
                                         /* Not last one */
@@ -790,9 +829,12 @@ type_pf_tresize(struct ip_set *set, bool retried)
 retry:
         ret = 0;
         htable_bits++;
-        if (!htable_bits)
+        if (!htable_bits) {
                 /* In case we have plenty of memory :-) */
+                pr_warning("Cannot increase the hashsize of set %s further\n",
+                           set->name);
                 return -IPSET_ERR_HASH_FULL;
+        }
         t = ip_set_alloc(sizeof(*t)
                          + jhash_size(htable_bits) * sizeof(struct hbucket));
         if (!t)
@@ -805,7 +847,7 @@ retry:
                 for (j = 0; j < n->pos; j++) {
                         data = ahash_tdata(n, j);
                         m = hbucket(t, HKEY(data, h->initval, htable_bits));
-                        ret = type_pf_elem_tadd(m, data, AHASH_MAX(h),
+                        ret = type_pf_elem_tadd(m, data, AHASH_MAX(h), 0,
                                                 type_pf_data_timeout(data));
                         if (ret < 0) {
                                 read_unlock_bh(&set->lock);
@@ -839,12 +881,17 @@ type_pf_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
         int ret = 0, i, j = AHASH_MAX(h) + 1;
         bool flag_exist = flags & IPSET_FLAG_EXIST;
         u32 key, multi = 0;
+        u32 cadt_flags = flags >> 16;
 
         if (h->elements >= h->maxelem)
                 /* FIXME: when set is full, we slow down here */
                 type_pf_expire(h);
-        if (h->elements >= h->maxelem)
+        if (h->elements >= h->maxelem) {
+                if (net_ratelimit())
+                        pr_warning("Set %s is full, maxelem %u reached\n",
+                                   set->name, h->maxelem);
                 return -IPSET_ERR_HASH_FULL;
+        }
 
         rcu_read_lock_bh();
         t = rcu_dereference_bh(h->table);
@@ -854,6 +901,7 @@ type_pf_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
                 data = ahash_tdata(n, i);
                 if (type_pf_data_equal(data, d, &multi)) {
                         if (type_pf_data_expired(data) || flag_exist)
+                                /* Just timeout value may be updated */
                                 j = i;
                         else {
                                 ret = -IPSET_ERR_EXIST;
@@ -866,15 +914,18 @@ type_pf_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
         if (j != AHASH_MAX(h) + 1) {
                 data = ahash_tdata(n, j);
 #ifdef IP_SET_HASH_WITH_NETS
-                del_cidr(h, data->cidr, HOST_MASK);
-                add_cidr(h, d->cidr, HOST_MASK);
+                del_cidr(h, CIDR(data->cidr), HOST_MASK);
+                add_cidr(h, CIDR(d->cidr), HOST_MASK);
 #endif
                 type_pf_data_copy(data, d);
                 type_pf_data_timeout_set(data, timeout);
+#ifdef IP_SET_HASH_WITH_NETS
+                type_pf_data_flags(data, cadt_flags);
+#endif
                 goto out;
         }
         TUNE_AHASH_MAX(h, multi);
-        ret = type_pf_elem_tadd(n, d, AHASH_MAX(h), timeout);
+        ret = type_pf_elem_tadd(n, d, AHASH_MAX(h), cadt_flags, timeout);
         if (ret != 0) {
                 if (ret == -EAGAIN)
                         type_pf_data_next(h, d);
@@ -882,7 +933,7 @@ type_pf_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
         }
 
 #ifdef IP_SET_HASH_WITH_NETS
-        add_cidr(h, d->cidr, HOST_MASK);
+        add_cidr(h, CIDR(d->cidr), HOST_MASK);
 #endif
         h->elements++;
 out:
@@ -916,7 +967,7 @@ type_pf_tdel(struct ip_set *set, void *value, u32 timeout, u32 flags)
                 n->pos--;
                 h->elements--;
 #ifdef IP_SET_HASH_WITH_NETS
-                del_cidr(h, d->cidr, HOST_MASK);
+                del_cidr(h, CIDR(d->cidr), HOST_MASK);
 #endif
                 if (n->pos + AHASH_INIT_SIZE < n->size) {
                         void *tmp = kzalloc((n->size - AHASH_INIT_SIZE)
@@ -954,8 +1005,17 @@ type_pf_ttest_cidrs(struct ip_set *set, struct type_pf_elem *d, u32 timeout)
                 n = hbucket(t, key);
                 for (i = 0; i < n->pos; i++) {
                         data = ahash_tdata(n, i);
-                        if (type_pf_data_equal(data, d, &multi))
-                                return !type_pf_data_expired(data);
+#ifdef IP_SET_HASH_WITH_MULTI
+                        if (type_pf_data_equal(data, d, &multi)) {
+                                if (!type_pf_data_expired(data))
+                                        return type_pf_data_match(data);
+                                multi = 0;
+                        }
+#else
+                        if (type_pf_data_equal(data, d, &multi) &&
+                            !type_pf_data_expired(data))
+                                return type_pf_data_match(data);
+#endif
                 }
         }
         return 0;
@@ -973,15 +1033,16 @@ type_pf_ttest(struct ip_set *set, void *value, u32 timeout, u32 flags)
         u32 key, multi = 0;
 
 #ifdef IP_SET_HASH_WITH_NETS
-        if (d->cidr == SET_HOST_MASK(set->family))
+        if (CIDR(d->cidr) == SET_HOST_MASK(set->family))
                 return type_pf_ttest_cidrs(set, d, timeout);
 #endif
         key = HKEY(d, h->initval, t->htable_bits);
         n = hbucket(t, key);
         for (i = 0; i < n->pos; i++) {
                 data = ahash_tdata(n, i);
-                if (type_pf_data_equal(data, d, &multi))
-                        return !type_pf_data_expired(data);
+                if (type_pf_data_equal(data, d, &multi) &&
+                    !type_pf_data_expired(data))
+                        return type_pf_data_match(data);
         }
         return 0;
 }
@@ -1094,14 +1155,17 @@ type_pf_gc_init(struct ip_set *set)
 #undef type_pf_data_isnull
 #undef type_pf_data_copy
 #undef type_pf_data_zero_out
+#undef type_pf_data_netmask
 #undef type_pf_data_list
 #undef type_pf_data_tlist
+#undef type_pf_data_next
+#undef type_pf_data_flags
+#undef type_pf_data_match
 
 #undef type_pf_elem
 #undef type_pf_telem
 #undef type_pf_data_timeout
 #undef type_pf_data_expired
-#undef type_pf_data_netmask
 #undef type_pf_data_timeout_set
 
 #undef type_pf_elem_add
@@ -1111,6 +1175,7 @@ type_pf_gc_init(struct ip_set *set)
 #undef type_pf_test
 
 #undef type_pf_elem_tadd
+#undef type_pf_del_telem
 #undef type_pf_expire
 #undef type_pf_tadd
 #undef type_pf_tdel
diff --git a/include/linux/netfilter/nf_conntrack_tcp.h b/include/linux/netfilter/nf_conntrack_tcp.h
index 6e135f97e59a..e59868ae12d4 100644
--- a/include/linux/netfilter/nf_conntrack_tcp.h
+++ b/include/linux/netfilter/nf_conntrack_tcp.h
@@ -18,7 +18,10 @@ enum tcp_conntrack {
         TCP_CONNTRACK_LISTEN,   /* obsolete */
 #define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN
         TCP_CONNTRACK_MAX,
-        TCP_CONNTRACK_IGNORE
+        TCP_CONNTRACK_IGNORE,
+        TCP_CONNTRACK_RETRANS,
+        TCP_CONNTRACK_UNACK,
+        TCP_CONNTRACK_TIMEOUT_MAX
 };
 
 /* Window scaling is advertised by the sender */
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index b64454c2f79f..6fd1f0d07e64 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -49,7 +49,8 @@ struct nfgenmsg {
 #define NFNL_SUBSYS_OSF                 5
 #define NFNL_SUBSYS_IPSET               6
 #define NFNL_SUBSYS_ACCT                7
-#define NFNL_SUBSYS_COUNT               8
+#define NFNL_SUBSYS_CTNETLINK_TIMEOUT   8
+#define NFNL_SUBSYS_COUNT               9
 
 #ifdef __KERNEL__
 
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h
index debf1aefd753..e58e4b93c108 100644
--- a/include/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/linux/netfilter/nfnetlink_conntrack.h
@@ -43,6 +43,7 @@ enum ctattr_type {
         CTA_ZONE,
         CTA_SECCTX,
         CTA_TIMESTAMP,
+        CTA_MARK_MASK,
         __CTA_MAX
 };
 #define CTA_MAX (__CTA_MAX - 1)
@@ -172,10 +173,21 @@ enum ctattr_expect {
         CTA_EXPECT_HELP_NAME,
         CTA_EXPECT_ZONE,
         CTA_EXPECT_FLAGS,
+        CTA_EXPECT_CLASS,
+        CTA_EXPECT_NAT,
+        CTA_EXPECT_FN,
         __CTA_EXPECT_MAX
 };
 #define CTA_EXPECT_MAX (__CTA_EXPECT_MAX - 1)
 
+enum ctattr_expect_nat {
+        CTA_EXPECT_NAT_UNSPEC,
+        CTA_EXPECT_NAT_DIR,
+        CTA_EXPECT_NAT_TUPLE,
+        __CTA_EXPECT_NAT_MAX
+};
+#define CTA_EXPECT_NAT_MAX (__CTA_EXPECT_NAT_MAX - 1)
+
 enum ctattr_help {
         CTA_HELP_UNSPEC,
         CTA_HELP_NAME,
diff --git a/include/linux/netfilter/nfnetlink_cttimeout.h b/include/linux/netfilter/nfnetlink_cttimeout.h
new file mode 100644
index 000000000000..a2810a7c5e30
--- /dev/null
+++ b/include/linux/netfilter/nfnetlink_cttimeout.h
@@ -0,0 +1,114 @@
+#ifndef _CTTIMEOUT_NETLINK_H
+#define _CTTIMEOUT_NETLINK_H
+#include <linux/netfilter/nfnetlink.h>
+
+enum ctnl_timeout_msg_types {
+        IPCTNL_MSG_TIMEOUT_NEW,
+        IPCTNL_MSG_TIMEOUT_GET,
+        IPCTNL_MSG_TIMEOUT_DELETE,
+
+        IPCTNL_MSG_TIMEOUT_MAX
+};
+
+enum ctattr_timeout {
+        CTA_TIMEOUT_UNSPEC,
+        CTA_TIMEOUT_NAME,
+        CTA_TIMEOUT_L3PROTO,
+        CTA_TIMEOUT_L4PROTO,
+        CTA_TIMEOUT_DATA,
+        CTA_TIMEOUT_USE,
+        __CTA_TIMEOUT_MAX
+};
+#define CTA_TIMEOUT_MAX (__CTA_TIMEOUT_MAX - 1)
+
+enum ctattr_timeout_generic {
+        CTA_TIMEOUT_GENERIC_UNSPEC,
+        CTA_TIMEOUT_GENERIC_TIMEOUT,
+        __CTA_TIMEOUT_GENERIC_MAX
+};
+#define CTA_TIMEOUT_GENERIC_MAX (__CTA_TIMEOUT_GENERIC_MAX - 1)
+
+enum ctattr_timeout_tcp {
+        CTA_TIMEOUT_TCP_UNSPEC,
+        CTA_TIMEOUT_TCP_SYN_SENT,
+        CTA_TIMEOUT_TCP_SYN_RECV,
+        CTA_TIMEOUT_TCP_ESTABLISHED,
+        CTA_TIMEOUT_TCP_FIN_WAIT,
+        CTA_TIMEOUT_TCP_CLOSE_WAIT,
+        CTA_TIMEOUT_TCP_LAST_ACK,
+        CTA_TIMEOUT_TCP_TIME_WAIT,
+        CTA_TIMEOUT_TCP_CLOSE,
+        CTA_TIMEOUT_TCP_SYN_SENT2,
+        CTA_TIMEOUT_TCP_RETRANS,
+        CTA_TIMEOUT_TCP_UNACK,
+        __CTA_TIMEOUT_TCP_MAX
+};
+#define CTA_TIMEOUT_TCP_MAX (__CTA_TIMEOUT_TCP_MAX - 1)
+
+enum ctattr_timeout_udp {
+        CTA_TIMEOUT_UDP_UNSPEC,
+        CTA_TIMEOUT_UDP_UNREPLIED,
+        CTA_TIMEOUT_UDP_REPLIED,
+        __CTA_TIMEOUT_UDP_MAX
+};
+#define CTA_TIMEOUT_UDP_MAX (__CTA_TIMEOUT_UDP_MAX - 1)
+
+enum ctattr_timeout_udplite {
+        CTA_TIMEOUT_UDPLITE_UNSPEC,
+        CTA_TIMEOUT_UDPLITE_UNREPLIED,
+        CTA_TIMEOUT_UDPLITE_REPLIED,
+        __CTA_TIMEOUT_UDPLITE_MAX
+};
+#define CTA_TIMEOUT_UDPLITE_MAX (__CTA_TIMEOUT_UDPLITE_MAX - 1)
+
+enum ctattr_timeout_icmp {
+        CTA_TIMEOUT_ICMP_UNSPEC,
+        CTA_TIMEOUT_ICMP_TIMEOUT,
+        __CTA_TIMEOUT_ICMP_MAX
+};
+#define CTA_TIMEOUT_ICMP_MAX (__CTA_TIMEOUT_ICMP_MAX - 1)
+
+enum ctattr_timeout_dccp {
+        CTA_TIMEOUT_DCCP_UNSPEC,
+        CTA_TIMEOUT_DCCP_REQUEST,
+        CTA_TIMEOUT_DCCP_RESPOND,
+        CTA_TIMEOUT_DCCP_PARTOPEN,
+        CTA_TIMEOUT_DCCP_OPEN,
+        CTA_TIMEOUT_DCCP_CLOSEREQ,
+        CTA_TIMEOUT_DCCP_CLOSING,
+        CTA_TIMEOUT_DCCP_TIMEWAIT,
+        __CTA_TIMEOUT_DCCP_MAX
+};
+#define CTA_TIMEOUT_DCCP_MAX (__CTA_TIMEOUT_DCCP_MAX - 1)
+
+enum ctattr_timeout_sctp {
+        CTA_TIMEOUT_SCTP_UNSPEC,
+        CTA_TIMEOUT_SCTP_CLOSED,
+        CTA_TIMEOUT_SCTP_COOKIE_WAIT,
+        CTA_TIMEOUT_SCTP_COOKIE_ECHOED,
+        CTA_TIMEOUT_SCTP_ESTABLISHED,
+        CTA_TIMEOUT_SCTP_SHUTDOWN_SENT,
+        CTA_TIMEOUT_SCTP_SHUTDOWN_RECD,
+        CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT,
+        __CTA_TIMEOUT_SCTP_MAX
+};
+#define CTA_TIMEOUT_SCTP_MAX (__CTA_TIMEOUT_SCTP_MAX - 1)
+
+enum ctattr_timeout_icmpv6 {
+        CTA_TIMEOUT_ICMPV6_UNSPEC,
+        CTA_TIMEOUT_ICMPV6_TIMEOUT,
+        __CTA_TIMEOUT_ICMPV6_MAX
+};
+#define CTA_TIMEOUT_ICMPV6_MAX (__CTA_TIMEOUT_ICMPV6_MAX - 1)
+
+enum ctattr_timeout_gre {
+        CTA_TIMEOUT_GRE_UNSPEC,
+        CTA_TIMEOUT_GRE_UNREPLIED,
+        CTA_TIMEOUT_GRE_REPLIED,
+        __CTA_TIMEOUT_GRE_MAX
+};
+#define CTA_TIMEOUT_GRE_MAX (__CTA_TIMEOUT_GRE_MAX - 1)
+
+#define CTNL_TIMEOUT_NAME_MAX   32
+
+#endif
diff --git a/include/linux/netfilter/xt_CT.h b/include/linux/netfilter/xt_CT.h
index b56e76811c04..a064b8af360c 100644
--- a/include/linux/netfilter/xt_CT.h
+++ b/include/linux/netfilter/xt_CT.h
@@ -16,4 +16,16 @@ struct xt_ct_target_info {
         struct nf_conn  *ct __attribute__((aligned(8)));
 };
 
+struct xt_ct_target_info_v1 {
+        __u16 flags;
+        __u16 zone;
+        __u32 ct_events;
+        __u32 exp_events;
+        char helper[16];
+        char timeout[32];
+
+        /* Used internally by the kernel */
+        struct nf_conn  *ct __attribute__((aligned(8)));
+};
+
 #endif /* _XT_CT_H */
diff --git a/include/linux/netfilter/xt_LOG.h b/include/linux/netfilter/xt_LOG.h
new file mode 100644
index 000000000000..cac079095305
--- /dev/null
+++ b/include/linux/netfilter/xt_LOG.h
@@ -0,0 +1,19 @@
+#ifndef _XT_LOG_H
+#define _XT_LOG_H
+
+/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */
+#define XT_LOG_TCPSEQ           0x01    /* Log TCP sequence numbers */
+#define XT_LOG_TCPOPT           0x02    /* Log TCP options */
+#define XT_LOG_IPOPT            0x04    /* Log IP options */
+#define XT_LOG_UID              0x08    /* Log UID owning local socket */
+#define XT_LOG_NFLOG            0x10    /* Unsupported, don't reuse */
+#define XT_LOG_MACDECODE        0x20    /* Decode MAC header */
+#define XT_LOG_MASK             0x2f
+
+struct xt_log_info {
+        unsigned char level;
+        unsigned char logflags;
+        char prefix[30];
+};
+
+#endif /* _XT_LOG_H */
diff --git a/include/linux/netfilter_ipv4/Kbuild b/include/linux/netfilter_ipv4/Kbuild
index f9930c87fff3..31f8bec95650 100644
--- a/include/linux/netfilter_ipv4/Kbuild
+++ b/include/linux/netfilter_ipv4/Kbuild
@@ -4,11 +4,9 @@ header-y += ipt_CLUSTERIP.h
 header-y += ipt_ECN.h
 header-y += ipt_LOG.h
 header-y += ipt_REJECT.h
-header-y += ipt_SAME.h
 header-y += ipt_TTL.h
 header-y += ipt_ULOG.h
 header-y += ipt_addrtype.h
 header-y += ipt_ah.h
 header-y += ipt_ecn.h
-header-y += ipt_realm.h
 header-y += ipt_ttl.h
diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h
index dcdbadf9fd4a..5d8152077d71 100644
--- a/include/linux/netfilter_ipv4/ipt_LOG.h
+++ b/include/linux/netfilter_ipv4/ipt_LOG.h
@@ -1,6 +1,8 @@
 #ifndef _IPT_LOG_H
 #define _IPT_LOG_H
 
+#warning "Please update iptables, this file will be removed soon!"
+
 /* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */
 #define IPT_LOG_TCPSEQ          0x01    /* Log TCP sequence numbers */
 #define IPT_LOG_TCPOPT          0x02    /* Log TCP options */
diff --git a/include/linux/netfilter_ipv4/ipt_SAME.h b/include/linux/netfilter_ipv4/ipt_SAME.h
deleted file mode 100644
index 5bca78267afd..000000000000
--- a/include/linux/netfilter_ipv4/ipt_SAME.h
+++ /dev/null
@@ -1,20 +0,0 @@
-#ifndef _IPT_SAME_H
-#define _IPT_SAME_H
-
-#include <linux/types.h>
-
-#define IPT_SAME_MAX_RANGE      10
-
-#define IPT_SAME_NODST          0x01
-
-struct ipt_same_info {
-        unsigned char info;
-        __u32 rangesize;
-        __u32 ipnum;
-        __u32 *iparray;
-
-        /* hangs off end. */
-        struct nf_nat_range range[IPT_SAME_MAX_RANGE];
-};
-
-#endif /*_IPT_SAME_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_realm.h b/include/linux/netfilter_ipv4/ipt_realm.h
deleted file mode 100644
index b3996eaa0188..000000000000
--- a/include/linux/netfilter_ipv4/ipt_realm.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef _IPT_REALM_H
-#define _IPT_REALM_H
-
-#include <linux/netfilter/xt_realm.h>
-#define ipt_realm_info xt_realm_info
-
-#endif /* _IPT_REALM_H */
diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h
index 9dd5579e02ec..3dd0bc4e0735 100644
--- a/include/linux/netfilter_ipv6/ip6t_LOG.h
+++ b/include/linux/netfilter_ipv6/ip6t_LOG.h
@@ -1,6 +1,8 @@
 #ifndef _IP6T_LOG_H
 #define _IP6T_LOG_H
 
+#warning "Please update iptables, this file will be removed soon!"
+
 /* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */
 #define IP6T_LOG_TCPSEQ         0x01    /* Log TCP sequence numbers */
 #define IP6T_LOG_TCPOPT         0x02    /* Log TCP options */
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 52e48959cfa1..a2092f582a78 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -225,6 +225,7 @@ struct netlink_callback {
         int                     (*dump)(struct sk_buff * skb,
                                         struct netlink_callback *cb);
         int                     (*done)(struct netlink_callback *cb);
+        void                    *data;
         u16                     family;
         u16                     min_dump_alloc;
         unsigned int            prev_seq, seq;
@@ -237,22 +238,8 @@ struct netlink_notify {
         int protocol;
 };
 
-static __inline__ struct nlmsghdr *
-__nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len, int flags)
-{
-        struct nlmsghdr *nlh;
-        int size = NLMSG_LENGTH(len);
-
-        nlh = (struct nlmsghdr*)skb_put(skb, NLMSG_ALIGN(size));
-        nlh->nlmsg_type = type;
-        nlh->nlmsg_len = size;
-        nlh->nlmsg_flags = flags;
-        nlh->nlmsg_pid = pid;
-        nlh->nlmsg_seq = seq;
-        if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
-                memset(NLMSG_DATA(nlh) + len, 0, NLMSG_ALIGN(size) - size);
-        return nlh;
-}
+struct nlmsghdr *
+__nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len, int flags);
 
 #define NLMSG_NEW(skb, pid, seq, type, len, flags) \
 ({      if (unlikely(skb_tailroom(skb) < (int)NLMSG_SPACE(len))) \
@@ -262,11 +249,16 @@ __nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len, int flags)
 #define NLMSG_PUT(skb, pid, seq, type, len) \
         NLMSG_NEW(skb, pid, seq, type, len, 0)
 
+struct netlink_dump_control {
+        int (*dump)(struct sk_buff *skb, struct netlink_callback *);
+        int (*done)(struct netlink_callback*);
+        void *data;
+        u16 min_dump_alloc;
+};
+
 extern int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
                               const struct nlmsghdr *nlh,
-                              int (*dump)(struct sk_buff *skb, struct netlink_callback*),
-                              int (*done)(struct netlink_callback*),
-                              u16 min_dump_alloc);
+                              struct netlink_dump_control *control);
 
 
 #define NL_NONROOT_RECV 0x1
diff --git a/include/linux/nfc.h b/include/linux/nfc.h
index 01d4e5d60325..39c1fcf089c0 100644
--- a/include/linux/nfc.h
+++ b/include/linux/nfc.h
@@ -89,6 +89,8 @@ enum nfc_commands {
  * @NFC_ATTR_TARGET_SEL_RES: NFC-A targets extra information (useful if the
  *      target is not NFC-Forum compliant)
  * @NFC_ATTR_TARGET_NFCID1: NFC-A targets identifier, max 10 bytes
+ * @NFC_ATTR_TARGET_SENSB_RES: NFC-B targets extra information, max 12 bytes
+ * @NFC_ATTR_TARGET_SENSF_RES: NFC-F targets extra information, max 18 bytes
  * @NFC_ATTR_COMM_MODE: Passive or active mode
  * @NFC_ATTR_RF_MODE: Initiator or target
  */
@@ -101,14 +103,20 @@ enum nfc_attrs {
         NFC_ATTR_TARGET_SENS_RES,
         NFC_ATTR_TARGET_SEL_RES,
         NFC_ATTR_TARGET_NFCID1,
+        NFC_ATTR_TARGET_SENSB_RES,
+        NFC_ATTR_TARGET_SENSF_RES,
         NFC_ATTR_COMM_MODE,
         NFC_ATTR_RF_MODE,
+        NFC_ATTR_DEVICE_POWERED,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
 #define NFC_ATTR_MAX (__NFC_ATTR_AFTER_LAST - 1)
 
 #define NFC_DEVICE_NAME_MAXSIZE 8
+#define NFC_NFCID1_MAXSIZE 10
+#define NFC_SENSB_RES_MAXSIZE 12
+#define NFC_SENSF_RES_MAXSIZE 18
 
 /* NFC protocols */
 #define NFC_PROTO_JEWEL         1
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 0f5ff3739820..e474f6e780cc 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -156,21 +156,23 @@
  * @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX
  *      or %NL80211_ATTR_MAC.
  *
- * @NL80211_CMD_GET_BEACON: retrieve beacon information (returned in a
- *      %NL80222_CMD_NEW_BEACON message)
- * @NL80211_CMD_SET_BEACON: set the beacon on an access point interface
- *      using the %NL80211_ATTR_BEACON_INTERVAL, %NL80211_ATTR_DTIM_PERIOD,
- *      %NL80211_ATTR_BEACON_HEAD and %NL80211_ATTR_BEACON_TAIL attributes.
- *      Following attributes are provided for drivers that generate full Beacon
- *      and Probe Response frames internally: %NL80211_ATTR_SSID,
+ * @NL80211_CMD_GET_BEACON: (not used)
+ * @NL80211_CMD_SET_BEACON: change the beacon on an access point interface
+ *      using the %NL80211_ATTR_BEACON_HEAD and %NL80211_ATTR_BEACON_TAIL
+ *      attributes. For drivers that generate the beacon and probe responses
+ *      internally, the following attributes must be provided: %NL80211_ATTR_IE,
+ *      %NL80211_ATTR_IE_PROBE_RESP and %NL80211_ATTR_IE_ASSOC_RESP.
+ * @NL80211_CMD_START_AP: Start AP operation on an AP interface, parameters
+ *      are like for %NL80211_CMD_SET_BEACON, and additionally parameters that
+ *      do not change are used, these include %NL80211_ATTR_BEACON_INTERVAL,
+ *      %NL80211_ATTR_DTIM_PERIOD, %NL80211_ATTR_SSID,
  *      %NL80211_ATTR_HIDDEN_SSID, %NL80211_ATTR_CIPHERS_PAIRWISE,
  *      %NL80211_ATTR_CIPHER_GROUP, %NL80211_ATTR_WPA_VERSIONS,
  *      %NL80211_ATTR_AKM_SUITES, %NL80211_ATTR_PRIVACY,
- *      %NL80211_ATTR_AUTH_TYPE, %NL80211_ATTR_IE, %NL80211_ATTR_IE_PROBE_RESP,
- *      %NL80211_ATTR_IE_ASSOC_RESP.
- * @NL80211_CMD_NEW_BEACON: add a new beacon to an access point interface,
- *      parameters are like for %NL80211_CMD_SET_BEACON.
- * @NL80211_CMD_DEL_BEACON: remove the beacon, stop sending it
+ *      %NL80211_ATTR_AUTH_TYPE and %NL80211_ATTR_INACTIVITY_TIMEOUT.
+ * @NL80211_CMD_NEW_BEACON: old alias for %NL80211_CMD_START_AP
+ * @NL80211_CMD_STOP_AP: Stop AP operation on the given interface
+ * @NL80211_CMD_DEL_BEACON: old alias for %NL80211_CMD_STOP_AP
  *
  * @NL80211_CMD_GET_STATION: Get station attributes for station identified by
  *      %NL80211_ATTR_MAC on the interface identified by %NL80211_ATTR_IFINDEX.
@@ -367,6 +369,11 @@
  *      %NL80211_ATTR_WIPHY_FREQ, %NL80211_ATTR_CONTROL_PORT,
  *      %NL80211_ATTR_CONTROL_PORT_ETHERTYPE and
  *      %NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT.
+ *      Background scan period can optionally be
+ *      specified in %NL80211_ATTR_BG_SCAN_PERIOD,
+ *      if not specified default background scan configuration
+ *      in driver is used and if period value is 0, bg scan will be disabled.
+ *      This attribute is ignored if driver does not support roam scan.
  *      It is also sent as an event, with the BSSID and response IEs when the
  *      connection is established or failed to be established. This can be
  *      determined by the STATUS_CODE attribute.
@@ -565,8 +572,10 @@ enum nl80211_commands {
 
         NL80211_CMD_GET_BEACON,
         NL80211_CMD_SET_BEACON,
-        NL80211_CMD_NEW_BEACON,
-        NL80211_CMD_DEL_BEACON,
+        NL80211_CMD_START_AP,
+        NL80211_CMD_NEW_BEACON = NL80211_CMD_START_AP,
+        NL80211_CMD_STOP_AP,
+        NL80211_CMD_DEL_BEACON = NL80211_CMD_STOP_AP,
 
         NL80211_CMD_GET_STATION,
         NL80211_CMD_SET_STATION,
@@ -1193,6 +1202,19 @@ enum nl80211_commands {
  * @NL80211_ATTR_NOACK_MAP: This u16 bitmap contains the No Ack Policy of
  *      up to 16 TIDs.
  *
+ * @NL80211_ATTR_INACTIVITY_TIMEOUT: timeout value in seconds, this can be
+ *      used by the drivers which has MLME in firmware and does not have support
+ *      to report per station tx/rx activity to free up the staion entry from
+ *      the list. This needs to be used when the driver advertises the
+ *      capability to timeout the stations.
+ *
+ * @NL80211_ATTR_RX_SIGNAL_DBM: signal strength in dBm (as a 32-bit int);
+ *      this attribute is (depending on the driver capabilities) added to
+ *      received frames indicated with %NL80211_CMD_FRAME.
+ *
+ * @NL80211_ATTR_BG_SCAN_PERIOD: Background scan period in seconds
+ *      or 0 to disable background scan.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1438,6 +1460,12 @@ enum nl80211_attrs {
 
         NL80211_ATTR_NOACK_MAP,
 
+        NL80211_ATTR_INACTIVITY_TIMEOUT,
+
+        NL80211_ATTR_RX_SIGNAL_DBM,
+
+        NL80211_ATTR_BG_SCAN_PERIOD,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1475,6 +1503,7 @@ enum nl80211_attrs {
 #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS
 
 #define NL80211_MAX_SUPP_RATES                  32
+#define NL80211_MAX_SUPP_HT_RATES               77
 #define NL80211_MAX_SUPP_REG_RULES              32
 #define NL80211_TKIP_DATA_OFFSET_ENCR_KEY       0
 #define NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY     16
@@ -2104,6 +2133,13 @@ enum nl80211_mntr_flags {
  * TUs) during which a mesh STA can send only one Action frame containing a
  * PERR element.
  *
+ * @NL80211_MESHCONF_FORWARDING: set Mesh STA as forwarding or non-forwarding
+ * or forwarding entity (default is TRUE - forwarding entity)
+ *
+ * @NL80211_MESHCONF_RSSI_THRESHOLD: RSSI threshold in dBm. This specifies the
+ * threshold for average signal strength of candidate station to establish
+ * a peer link.
+ *
  * @NL80211_MESHCONF_ATTR_MAX: highest possible mesh configuration attribute
  *
  * @__NL80211_MESHCONF_ATTR_AFTER_LAST: internal use
@@ -2128,6 +2164,8 @@ enum nl80211_meshconf_params {
         NL80211_MESHCONF_HWMP_RANN_INTERVAL,
         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
         NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
+        NL80211_MESHCONF_FORWARDING,
+        NL80211_MESHCONF_RSSI_THRESHOLD,
 
         /* keep last */
         __NL80211_MESHCONF_ATTR_AFTER_LAST,
@@ -2401,12 +2439,15 @@ enum nl80211_key_attributes {
  *      in an array of rates as defined in IEEE 802.11 7.3.2.2 (u8 values with
  *      1 = 500 kbps) but without the IE length restriction (at most
  *      %NL80211_MAX_SUPP_RATES in a single array).
+ * @NL80211_TXRATE_MCS: HT (MCS) rates allowed for TX rate selection
+ *      in an array of MCS numbers.
  * @__NL80211_TXRATE_AFTER_LAST: internal
  * @NL80211_TXRATE_MAX: highest TX rate attribute
  */
 enum nl80211_tx_rate_attributes {
         __NL80211_TXRATE_INVALID,
         NL80211_TXRATE_LEGACY,
+        NL80211_TXRATE_MCS,
 
         /* keep last */
         __NL80211_TXRATE_AFTER_LAST,
@@ -2792,10 +2833,13 @@ enum nl80211_ap_sme_features {
  *      TX status to the socket error queue when requested with the
  *      socket option.
  * @NL80211_FEATURE_HT_IBSS: This driver supports IBSS with HT datarates.
+ * @NL80211_FEATURE_INACTIVITY_TIMER: This driver takes care of freeing up
+ *      the connected inactive stations in AP mode.
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS    = 1 << 0,
         NL80211_FEATURE_HT_IBSS         = 1 << 1,
+        NL80211_FEATURE_INACTIVITY_TIMER = 1 << 2,
 };
 
 /**
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 31d77af2ef42..3329965ed63f 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2105,6 +2105,7 @@
 #define PCI_DEVICE_ID_NX2_57711E        0x1650
 #define PCI_DEVICE_ID_TIGON3_5705       0x1653
 #define PCI_DEVICE_ID_TIGON3_5705_2     0x1654
+#define PCI_DEVICE_ID_TIGON3_5719       0x1657
 #define PCI_DEVICE_ID_TIGON3_5721       0x1659
 #define PCI_DEVICE_ID_TIGON3_5722       0x165a
 #define PCI_DEVICE_ID_TIGON3_5723       0x165b
diff --git a/include/linux/pkt_sched.h b/include/linux/pkt_sched.h
index 0d5b79365d03..410b33d014d2 100644
--- a/include/linux/pkt_sched.h
+++ b/include/linux/pkt_sched.h
@@ -127,6 +127,27 @@ struct tc_multiq_qopt {
         __u16   max_bands;              /* Maximum number of queues */
 };
 
+/* PLUG section */
+
+#define TCQ_PLUG_BUFFER                0
+#define TCQ_PLUG_RELEASE_ONE           1
+#define TCQ_PLUG_RELEASE_INDEFINITE    2
+#define TCQ_PLUG_LIMIT                 3
+
+struct tc_plug_qopt {
+        /* TCQ_PLUG_BUFFER: Inset a plug into the queue and
+         *  buffer any incoming packets
+         * TCQ_PLUG_RELEASE_ONE: Dequeue packets from queue head
+         *   to beginning of the next plug.
+         * TCQ_PLUG_RELEASE_INDEFINITE: Dequeue all packets from queue.
+         *   Stop buffering packets until the next TCQ_PLUG_BUFFER
+         *   command is received (just act as a pass-thru queue).
+         * TCQ_PLUG_LIMIT: Increase/decrease queue size
+         */
+        int             action;
+        __u32           limit;
+};
+
 /* TBF section */
 
 struct tc_tbf_qopt {
diff --git a/include/linux/platform_data/cpsw.h b/include/linux/platform_data/cpsw.h
new file mode 100644
index 000000000000..c4e23d029498
--- /dev/null
+++ b/include/linux/platform_data/cpsw.h
@@ -0,0 +1,55 @@
+/*
+ * Texas Instruments Ethernet Switch Driver
+ *
+ * Copyright (C) 2012 Texas Instruments
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation version 2.
+ *
+ * This program is distributed "as is" WITHOUT ANY WARRANTY of any
+ * kind, whether express or implied; without even the implied warranty
+ * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#ifndef __CPSW_H__
+#define __CPSW_H__
+
+#include <linux/if_ether.h>
+
+struct cpsw_slave_data {
+        u32             slave_reg_ofs;
+        u32             sliver_reg_ofs;
+        const char      *phy_id;
+        int             phy_if;
+        u8              mac_addr[ETH_ALEN];
+};
+
+struct cpsw_platform_data {
+        u32     ss_reg_ofs;     /* Subsystem control register offset */
+        u32     channels;       /* number of cpdma channels (symmetric) */
+        u32     cpdma_reg_ofs;  /* cpdma register offset */
+        u32     cpdma_sram_ofs; /* cpdma sram offset */
+
+        u32     slaves;         /* number of slave cpgmac ports */
+        struct cpsw_slave_data  *slave_data;
+
+        u32     ale_reg_ofs;    /* address lookup engine reg offset */
+        u32     ale_entries;    /* ale table size */
+
+        u32     host_port_reg_ofs; /* cpsw cpdma host port registers */
+        u32     host_port_num; /* The port number for the host port */
+
+        u32     hw_stats_reg_ofs;  /* cpsw hardware statistics counters */
+
+        u32     bd_ram_ofs;   /* embedded buffer descriptor RAM offset*/
+        u32     bd_ram_size;  /*buffer descriptor ram size */
+        u32     hw_ram_addr; /*if the HW address for BD RAM is different */
+        bool    no_bd_ram; /* no embedded BD ram*/
+
+        u32     rx_descs;       /* Number of Rx Descriptios */
+
+        u32     mac_control;    /* Mac control register */
+};
+
+#endif /* __CPSW_H__ */
diff --git a/include/linux/ppp-comp.h b/include/linux/ppp-comp.h
index b8d4ddd22736..e53ff65935dd 100644
--- a/include/linux/ppp-comp.h
+++ b/include/linux/ppp-comp.h
@@ -1,42 +1,12 @@
 /*
  * ppp-comp.h - Definitions for doing PPP packet compression.
  *
- * Copyright (c) 1994 The Australian National University.
- * All rights reserved.
+ * Copyright 1994-1998 Paul Mackerras.
  *
- * Permission to use, copy, modify, and distribute this software and its
- * documentation is hereby granted, provided that the above copyright
- * notice appears in all copies.  This software is provided without any
- * warranty, express or implied. The Australian National University
- * makes no representations about the suitability of this software for
- * any purpose.
- *
- * IN NO EVENT SHALL THE AUSTRALIAN NATIONAL UNIVERSITY BE LIABLE TO ANY
- * PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
- * ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF
- * THE AUSTRALIAN NATIONAL UNIVERSITY HAVE BEEN ADVISED OF THE POSSIBILITY
- * OF SUCH DAMAGE.
- *
- * THE AUSTRALIAN NATIONAL UNIVERSITY SPECIFICALLY DISCLAIMS ANY WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
- * ON AN "AS IS" BASIS, AND THE AUSTRALIAN NATIONAL UNIVERSITY HAS NO
- * OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS,
- * OR MODIFICATIONS.
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  version 2 as published by the Free Software Foundation.
  */
-
-/*
- *  ==FILEVERSION 980319==
- *
- *  NOTE TO MAINTAINERS:
- *     If you modify this file at all, please set the above date.
- *     ppp-comp.h is shipped with a PPP distribution as well as with the kernel;
- *     if everyone increases the FILEVERSION number above, then scripts
- *     can do the right thing when deciding whether to install a new ppp-comp.h
- *     file.  Don't change the format of that line otherwise, so the
- *     installation script can recognize it.
- */
-
 #ifndef _NET_PPP_COMP_H
 #define _NET_PPP_COMP_H
 
diff --git a/include/linux/ppp-ioctl.h b/include/linux/ppp-ioctl.h
new file mode 100644
index 000000000000..2d9a8859550a
--- /dev/null
+++ b/include/linux/ppp-ioctl.h
@@ -0,0 +1,119 @@
+/*
+ * ppp-ioctl.h - PPP ioctl definitions.
+ *
+ * Copyright 1999-2002 Paul Mackerras.
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  version 2 as published by the Free Software Foundation.
+ */
+#ifndef _PPP_IOCTL_H
+#define _PPP_IOCTL_H
+
+#include <linux/types.h>
+#include <linux/compiler.h>
+
+/*
+ * Bit definitions for flags argument to PPPIOCGFLAGS/PPPIOCSFLAGS.
+ */
+#define SC_COMP_PROT    0x00000001      /* protocol compression (output) */
+#define SC_COMP_AC      0x00000002      /* header compression (output) */
+#define SC_COMP_TCP     0x00000004      /* TCP (VJ) compression (output) */
+#define SC_NO_TCP_CCID  0x00000008      /* disable VJ connection-id comp. */
+#define SC_REJ_COMP_AC  0x00000010      /* reject adrs/ctrl comp. on input */
+#define SC_REJ_COMP_TCP 0x00000020      /* reject TCP (VJ) comp. on input */
+#define SC_CCP_OPEN     0x00000040      /* Look at CCP packets */
+#define SC_CCP_UP       0x00000080      /* May send/recv compressed packets */
+#define SC_ENABLE_IP    0x00000100      /* IP packets may be exchanged */
+#define SC_LOOP_TRAFFIC 0x00000200      /* send traffic to pppd */
+#define SC_MULTILINK    0x00000400      /* do multilink encapsulation */
+#define SC_MP_SHORTSEQ  0x00000800      /* use short MP sequence numbers */
+#define SC_COMP_RUN     0x00001000      /* compressor has been inited */
+#define SC_DECOMP_RUN   0x00002000      /* decompressor has been inited */
+#define SC_MP_XSHORTSEQ 0x00004000      /* transmit short MP seq numbers */
+#define SC_DEBUG        0x00010000      /* enable debug messages */
+#define SC_LOG_INPKT    0x00020000      /* log contents of good pkts recvd */
+#define SC_LOG_OUTPKT   0x00040000      /* log contents of pkts sent */
+#define SC_LOG_RAWIN    0x00080000      /* log all chars received */
+#define SC_LOG_FLUSH    0x00100000      /* log all chars flushed */
+#define SC_SYNC         0x00200000      /* synchronous serial mode */
+#define SC_MUST_COMP    0x00400000      /* no uncompressed packets may be sent or received */
+#define SC_MASK         0x0f600fff      /* bits that user can change */
+
+/* state bits */
+#define SC_XMIT_BUSY    0x10000000      /* (used by isdn_ppp?) */
+#define SC_RCV_ODDP     0x08000000      /* have rcvd char with odd parity */
+#define SC_RCV_EVNP     0x04000000      /* have rcvd char with even parity */
+#define SC_RCV_B7_1     0x02000000      /* have rcvd char with bit 7 = 1 */
+#define SC_RCV_B7_0     0x01000000      /* have rcvd char with bit 7 = 0 */
+#define SC_DC_FERROR    0x00800000      /* fatal decomp error detected */
+#define SC_DC_ERROR     0x00400000      /* non-fatal decomp error detected */
+
+/* Used with PPPIOCGNPMODE/PPPIOCSNPMODE */
+struct npioctl {
+        int             protocol;       /* PPP protocol, e.g. PPP_IP */
+        enum NPmode     mode;
+};
+
+/* Structure describing a CCP configuration option, for PPPIOCSCOMPRESS */
+struct ppp_option_data {
+        __u8    __user *ptr;
+        __u32   length;
+        int     transmit;
+};
+
+/* For PPPIOCGL2TPSTATS */
+struct pppol2tp_ioc_stats {
+        __u16           tunnel_id;      /* redundant */
+        __u16           session_id;     /* if zero, get tunnel stats */
+        __u32           using_ipsec:1;  /* valid only for session_id == 0 */
+        __aligned_u64   tx_packets;
+        __aligned_u64   tx_bytes;
+        __aligned_u64   tx_errors;
+        __aligned_u64   rx_packets;
+        __aligned_u64   rx_bytes;
+        __aligned_u64   rx_seq_discards;
+        __aligned_u64   rx_oos_packets;
+        __aligned_u64   rx_errors;
+};
+
+/*
+ * Ioctl definitions.
+ */
+
+#define PPPIOCGFLAGS    _IOR('t', 90, int)      /* get configuration flags */
+#define PPPIOCSFLAGS    _IOW('t', 89, int)      /* set configuration flags */
+#define PPPIOCGASYNCMAP _IOR('t', 88, int)      /* get async map */
+#define PPPIOCSASYNCMAP _IOW('t', 87, int)      /* set async map */
+#define PPPIOCGUNIT     _IOR('t', 86, int)      /* get ppp unit number */
+#define PPPIOCGRASYNCMAP _IOR('t', 85, int)     /* get receive async map */
+#define PPPIOCSRASYNCMAP _IOW('t', 84, int)     /* set receive async map */
+#define PPPIOCGMRU      _IOR('t', 83, int)      /* get max receive unit */
+#define PPPIOCSMRU      _IOW('t', 82, int)      /* set max receive unit */
+#define PPPIOCSMAXCID   _IOW('t', 81, int)      /* set VJ max slot ID */
+#define PPPIOCGXASYNCMAP _IOR('t', 80, ext_accm) /* get extended ACCM */
+#define PPPIOCSXASYNCMAP _IOW('t', 79, ext_accm) /* set extended ACCM */
+#define PPPIOCXFERUNIT  _IO('t', 78)            /* transfer PPP unit */
+#define PPPIOCSCOMPRESS _IOW('t', 77, struct ppp_option_data)
+#define PPPIOCGNPMODE   _IOWR('t', 76, struct npioctl) /* get NP mode */
+#define PPPIOCSNPMODE   _IOW('t', 75, struct npioctl)  /* set NP mode */
+#define PPPIOCSPASS     _IOW('t', 71, struct sock_fprog) /* set pass filter */
+#define PPPIOCSACTIVE   _IOW('t', 70, struct sock_fprog) /* set active filt */
+#define PPPIOCGDEBUG    _IOR('t', 65, int)      /* Read debug level */
+#define PPPIOCSDEBUG    _IOW('t', 64, int)      /* Set debug level */
+#define PPPIOCGIDLE     _IOR('t', 63, struct ppp_idle) /* get idle time */
+#define PPPIOCNEWUNIT   _IOWR('t', 62, int)     /* create new ppp unit */
+#define PPPIOCATTACH    _IOW('t', 61, int)      /* attach to ppp unit */
+#define PPPIOCDETACH    _IOW('t', 60, int)      /* detach from ppp unit/chan */
+#define PPPIOCSMRRU     _IOW('t', 59, int)      /* set multilink MRU */
+#define PPPIOCCONNECT   _IOW('t', 58, int)      /* connect channel to unit */
+#define PPPIOCDISCONN   _IO('t', 57)            /* disconnect channel */
+#define PPPIOCATTCHAN   _IOW('t', 56, int)      /* attach to ppp channel */
+#define PPPIOCGCHAN     _IOR('t', 55, int)      /* get ppp channel number */
+#define PPPIOCGL2TPSTATS _IOR('t', 54, struct pppol2tp_ioc_stats)
+
+#define SIOCGPPPSTATS   (SIOCDEVPRIVATE + 0)
+#define SIOCGPPPVER     (SIOCDEVPRIVATE + 1)    /* NEVER change this!! */
+#define SIOCGPPPCSTATS  (SIOCDEVPRIVATE + 2)
+
+#endif /* _PPP_IOCTL_H */
diff --git a/include/linux/ppp_defs.h b/include/linux/ppp_defs.h
index 0f93ed6b4a88..ba416f67eb62 100644
--- a/include/linux/ppp_defs.h
+++ b/include/linux/ppp_defs.h
@@ -1,44 +1,14 @@
 /*
  * ppp_defs.h - PPP definitions.
  *
- * Copyright (c) 1994 The Australian National University.
- * All rights reserved.
+ * Copyright 1994-2000 Paul Mackerras.
  *
- * Permission to use, copy, modify, and distribute this software and its
- * documentation is hereby granted, provided that the above copyright
- * notice appears in all copies.  This software is provided without any
- * warranty, express or implied. The Australian National University
- * makes no representations about the suitability of this software for
- * any purpose.
- *
- * IN NO EVENT SHALL THE AUSTRALIAN NATIONAL UNIVERSITY BE LIABLE TO ANY
- * PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
- * ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF
- * THE AUSTRALIAN NATIONAL UNIVERSITY HAVE BEEN ADVISED OF THE POSSIBILITY
- * OF SUCH DAMAGE.
- *
- * THE AUSTRALIAN NATIONAL UNIVERSITY SPECIFICALLY DISCLAIMS ANY WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
- * ON AN "AS IS" BASIS, AND THE AUSTRALIAN NATIONAL UNIVERSITY HAS NO
- * OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS,
- * OR MODIFICATIONS.
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  version 2 as published by the Free Software Foundation.
  */
-
 #include <linux/types.h>
 
-/*
- *  ==FILEVERSION 20000114==
- *
- *  NOTE TO MAINTAINERS:
- *     If you modify this file at all, please set the above date.
- *     ppp_defs.h is shipped with a PPP distribution as well as with the kernel;
- *     if everyone increases the FILEVERSION number above, then scripts
- *     can do the right thing when deciding whether to install a new ppp_defs.h
- *     file.  Don't change the format of that line otherwise, so the
- *     installation script can recognize it.
- */
-
 #ifndef _PPP_DEFS_H_
 #define _PPP_DEFS_H_
 
diff --git a/include/linux/sh_eth.h b/include/linux/sh_eth.h
index 2076acf8294d..b17d765ded84 100644
--- a/include/linux/sh_eth.h
+++ b/include/linux/sh_eth.h
@@ -20,6 +20,7 @@ struct sh_eth_plat_data {
         unsigned char mac_addr[6];
         unsigned no_ether_link:1;
         unsigned ether_link_active_low:1;
+        unsigned needs_init:1;
 };
 
 #endif
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index ae86adee3746..a2b9953b582d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -94,6 +94,13 @@
  *                        about CHECKSUM_UNNECESSARY. 8)
  *      NETIF_F_IPV6_CSUM about as dumb as the last one but does IPv6 instead.
  *
+ *      UNNECESSARY: device will do per protocol specific csum. Protocol drivers
+ *      that do not want net to perform the checksum calculation should use
+ *      this flag in their outgoing skbs.
+ *      NETIF_F_FCOE_CRC  this indicates the device can do FCoE FC CRC
+ *                        offload. Correspondingly, the FCoE protocol driver
+ *                        stack should use CHECKSUM_UNNECESSARY.
+ *
  *      Any questions? No questions, good.              --ANK
  */
 
@@ -361,6 +368,7 @@ typedef unsigned char *sk_buff_data_t;
  *              ports.
  *      @wifi_acked_valid: wifi_acked was set
  *      @wifi_acked: whether frame was acked on wifi or not
+ *      @no_fcs:  Request NIC to treat last 4 bytes as Ethernet FCS
  *      @dma_cookie: a cookie to one of several possible DMA operations
  *              done by skb DMA functions
  *      @secmark: security marking
@@ -438,6 +446,11 @@ struct sk_buff {
 #endif
 
         int                     skb_iif;
+
+        __u32                   rxhash;
+
+        __u16                   vlan_tci;
+
 #ifdef CONFIG_NET_SCHED
         __u16                   tc_index;       /* traffic control index */
 #ifdef CONFIG_NET_CLS_ACT
@@ -445,8 +458,6 @@ struct sk_buff {
 #endif
 #endif
 
-        __u32                   rxhash;
-
         __u16                   queue_mapping;
         kmemcheck_bitfield_begin(flags2);
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
@@ -456,7 +467,8 @@ struct sk_buff {
         __u8                    l4_rxhash:1;
         __u8                    wifi_acked_valid:1;
         __u8                    wifi_acked:1;
-        /* 10/12 bit hole (depending on ndisc_nodetype presence) */
+        __u8                    no_fcs:1;
+        /* 9/11 bit hole (depending on ndisc_nodetype presence) */
         kmemcheck_bitfield_end(flags2);
 
 #ifdef CONFIG_NET_DMA
@@ -470,8 +482,6 @@ struct sk_buff {
                 __u32           dropcount;
         };
 
-        __u16                   vlan_tci;
-
         sk_buff_data_t          transport_header;
         sk_buff_data_t          network_header;
         sk_buff_data_t          mac_header;
@@ -876,6 +886,24 @@ static inline struct sk_buff *skb_peek(const struct sk_buff_head *list_)
 }
 
 /**
+ *      skb_peek_next - peek skb following the given one from a queue
+ *      @skb: skb to start from
+ *      @list_: list to peek at
+ *
+ *      Returns %NULL when the end of the list is met or a pointer to the
+ *      next element. The reference count is not incremented and the
+ *      reference is therefore volatile. Use with caution.
+ */
+static inline struct sk_buff *skb_peek_next(struct sk_buff *skb,
+                const struct sk_buff_head *list_)
+{
+        struct sk_buff *next = skb->next;
+        if (next == (struct sk_buff *)list_)
+                next = NULL;
+        return next;
+}
+
+/**
  *      skb_peek_tail - peek at the tail of an &sk_buff_head
  *      @list_: list to peek at
  *
@@ -1152,7 +1180,7 @@ static inline struct sk_buff *__skb_dequeue_tail(struct sk_buff_head *list)
 }
 
 
-static inline int skb_is_nonlinear(const struct sk_buff *skb)
+static inline bool skb_is_nonlinear(const struct sk_buff *skb)
 {
         return skb->data_len;
 }
@@ -2055,7 +2083,7 @@ static inline void skb_frag_add_head(struct sk_buff *skb, struct sk_buff *frag)
         for (iter = skb_shinfo(skb)->frag_list; iter; iter = iter->next)
 
 extern struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
-                                           int *peeked, int *err);
+                                           int *peeked, int *off, int *err);
 extern struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
                                          int noblock, int *err);
 extern unsigned int    datagram_poll(struct file *file, struct socket *sock,
@@ -2448,12 +2476,12 @@ static inline struct sec_path *skb_sec_path(struct sk_buff *skb)
 }
 #endif
 
-static inline int skb_is_gso(const struct sk_buff *skb)
+static inline bool skb_is_gso(const struct sk_buff *skb)
 {
         return skb_shinfo(skb)->gso_size;
 }
 
-static inline int skb_is_gso_v6(const struct sk_buff *skb)
+static inline bool skb_is_gso_v6(const struct sk_buff *skb)
 {
         return skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6;
 }
diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index c1241c428179..2e68f5ba0389 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -232,6 +232,8 @@ enum
         LINUX_MIB_TCPTIMEWAITOVERFLOW,          /* TCPTimeWaitOverflow */
         LINUX_MIB_TCPREQQFULLDOCOOKIES,         /* TCPReqQFullDoCookies */
         LINUX_MIB_TCPREQQFULLDROP,              /* TCPReqQFullDrop */
+        LINUX_MIB_TCPRETRANSFAIL,               /* TCPRetransFail */
+        LINUX_MIB_TCPRCVCOALESCE,                       /* TCPRcvCoalesce */
         __LINUX_MIB_MAX
 };
 
diff --git a/include/linux/socket.h b/include/linux/socket.h
index d0e77f607a79..da2d3e2543f3 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -326,11 +326,11 @@ extern int csum_partial_copy_fromiovecend(unsigned char *kdata,
                                           int offset, 
                                           unsigned int len, __wsum *csump);
 
-extern int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode);
+extern int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *address, int mode);
 extern int memcpy_toiovec(struct iovec *v, unsigned char *kdata, int len);
 extern int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
                              int offset, int len);
-extern int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr *kaddr);
+extern int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr);
 extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
 
 struct timespec;
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index dcf35b0f303a..d27683180025 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -16,6 +16,12 @@ struct pcmcia_device;
 struct ssb_bus;
 struct ssb_driver;
 
+struct ssb_sprom_core_pwr_info {
+        u8 itssi_2g, itssi_5g;
+        u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
+        u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
+};
+
 struct ssb_sprom {
         u8 revision;
         u8 il0mac[6];           /* MAC address for 802.11b/g */
@@ -26,9 +32,12 @@ struct ssb_sprom {
         u8 et0mdcport;          /* MDIO for enet0 */
         u8 et1mdcport;          /* MDIO for enet1 */
         u16 board_rev;          /* Board revision number from SPROM. */
+        u16 board_num;          /* Board number from SPROM. */
+        u16 board_type;         /* Board type from SPROM. */
         u8 country_code;        /* Country Code */
-        u16 leddc_on_time;      /* LED Powersave Duty Cycle On Count */
-        u16 leddc_off_time;     /* LED Powersave Duty Cycle Off Count */
+        char alpha2[2];         /* Country Code as two chars like EU or US */
+        u8 leddc_on_time;       /* LED Powersave Duty Cycle On Count */
+        u8 leddc_off_time;      /* LED Powersave Duty Cycle Off Count */
         u8 ant_available_a;     /* 2GHz antenna available bits (up to 4) */
         u8 ant_available_bg;    /* 5GHz antenna available bits (up to 4) */
         u16 pa0b0;
@@ -47,10 +56,10 @@ struct ssb_sprom {
         u8 gpio1;               /* GPIO pin 1 */
         u8 gpio2;               /* GPIO pin 2 */
         u8 gpio3;               /* GPIO pin 3 */
-        u16 maxpwr_bg;          /* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
-        u16 maxpwr_al;          /* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
-        u16 maxpwr_a;           /* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
-        u16 maxpwr_ah;          /* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+        u8 maxpwr_bg;           /* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+        u8 maxpwr_al;           /* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+        u8 maxpwr_a;            /* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+        u8 maxpwr_ah;           /* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
         u8 itssi_a;             /* Idle TSSI Target for A-PHY */
         u8 itssi_bg;            /* Idle TSSI Target for B/G-PHY */
         u8 tri2g;               /* 2.4GHz TX isolation */
@@ -61,8 +70,8 @@ struct ssb_sprom {
         u8 txpid5gl[4];         /* 4.9 - 5.1GHz TX power index */
         u8 txpid5g[4];          /* 5.1 - 5.5GHz TX power index */
         u8 txpid5gh[4];         /* 5.5 - ...GHz TX power index */
-        u8 rxpo2g;              /* 2GHz RX power offset */
-        u8 rxpo5g;              /* 5GHz RX power offset */
+        s8 rxpo2g;              /* 2GHz RX power offset */
+        s8 rxpo5g;              /* 5GHz RX power offset */
         u8 rssisav2g;           /* 2GHz RSSI params */
         u8 rssismc2g;
         u8 rssismf2g;
@@ -82,16 +91,13 @@ struct ssb_sprom {
         u16 boardflags2_hi;     /* Board flags (bits 48-63) */
         /* TODO store board flags in a single u64 */
 
+        struct ssb_sprom_core_pwr_info core_pwr_info[4];
+
         /* Antenna gain values for up to 4 antennas
          * on each band. Values in dBm/4 (Q5.2). Negative gain means the
          * loss in the connectors is bigger than the gain. */
         struct {
-                struct {
-                        s8 a0, a1, a2, a3;
-                } ghz24;        /* 2.4GHz band */
-                struct {
-                        s8 a0, a1, a2, a3;
-                } ghz5;         /* 5GHz band */
+                s8 a0, a1, a2, a3;
         } antenna_gain;
 
         struct {
@@ -103,7 +109,79 @@ struct ssb_sprom {
                 } ghz5;
         } fem;
 
-        /* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
+        u16 mcs2gpo[8];
+        u16 mcs5gpo[8];
+        u16 mcs5glpo[8];
+        u16 mcs5ghpo[8];
+        u8 opo;
+
+        u8 rxgainerr2ga[3];
+        u8 rxgainerr5gla[3];
+        u8 rxgainerr5gma[3];
+        u8 rxgainerr5gha[3];
+        u8 rxgainerr5gua[3];
+
+        u8 noiselvl2ga[3];
+        u8 noiselvl5gla[3];
+        u8 noiselvl5gma[3];
+        u8 noiselvl5gha[3];
+        u8 noiselvl5gua[3];
+
+        u8 regrev;
+        u8 txchain;
+        u8 rxchain;
+        u8 antswitch;
+        u16 cddpo;
+        u16 stbcpo;
+        u16 bw40po;
+        u16 bwduppo;
+
+        u8 tempthresh;
+        u8 tempoffset;
+        u16 rawtempsense;
+        u8 measpower;
+        u8 tempsense_slope;
+        u8 tempcorrx;
+        u8 tempsense_option;
+        u8 freqoffset_corr;
+        u8 iqcal_swp_dis;
+        u8 hw_iqcal_en;
+        u8 elna2g;
+        u8 elna5g;
+        u8 phycal_tempdelta;
+        u8 temps_period;
+        u8 temps_hysteresis;
+        u8 measpower1;
+        u8 measpower2;
+        u8 pcieingress_war;
+
+        /* power per rate from sromrev 9 */
+        u16 cckbw202gpo;
+        u16 cckbw20ul2gpo;
+        u32 legofdmbw202gpo;
+        u32 legofdmbw20ul2gpo;
+        u32 legofdmbw205glpo;
+        u32 legofdmbw20ul5glpo;
+        u32 legofdmbw205gmpo;
+        u32 legofdmbw20ul5gmpo;
+        u32 legofdmbw205ghpo;
+        u32 legofdmbw20ul5ghpo;
+        u32 mcsbw202gpo;
+        u32 mcsbw20ul2gpo;
+        u32 mcsbw402gpo;
+        u32 mcsbw205glpo;
+        u32 mcsbw20ul5glpo;
+        u32 mcsbw405glpo;
+        u32 mcsbw205gmpo;
+        u32 mcsbw20ul5gmpo;
+        u32 mcsbw405gmpo;
+        u32 mcsbw205ghpo;
+        u32 mcsbw20ul5ghpo;
+        u32 mcsbw405ghpo;
+        u16 mcs32po;
+        u16 legofdm40duppo;
+        u8 sar2g;
+        u8 sar5g;
 };
 
 /* Information about the PCB the circuitry is soldered on. */
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index c814ae6eeb22..40b1ef8595ee 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -449,6 +449,39 @@
 #define SSB_SPROM8_TS_SLP_OPT_CORRX     0x00B6
 #define SSB_SPROM8_FOC_HWIQ_IQSWP       0x00B8
 #define SSB_SPROM8_PHYCAL_TEMPDELTA     0x00BA
+
+/* There are 4 blocks with power info sharing the same layout */
+#define SSB_SROM8_PWR_INFO_CORE0        0x00C0
+#define SSB_SROM8_PWR_INFO_CORE1        0x00E0
+#define SSB_SROM8_PWR_INFO_CORE2        0x0100
+#define SSB_SROM8_PWR_INFO_CORE3        0x0120
+
+#define SSB_SROM8_2G_MAXP_ITSSI         0x00
+#define  SSB_SPROM8_2G_MAXP             0x00FF
+#define  SSB_SPROM8_2G_ITSSI            0xFF00
+#define  SSB_SPROM8_2G_ITSSI_SHIFT      8
+#define SSB_SROM8_2G_PA_0               0x02    /* 2GHz power amp settings */
+#define SSB_SROM8_2G_PA_1               0x04
+#define SSB_SROM8_2G_PA_2               0x06
+#define SSB_SROM8_5G_MAXP_ITSSI         0x08    /* 5GHz ITSSI and 5.3GHz Max Power */
+#define  SSB_SPROM8_5G_MAXP             0x00FF
+#define  SSB_SPROM8_5G_ITSSI            0xFF00
+#define  SSB_SPROM8_5G_ITSSI_SHIFT      8
+#define SSB_SPROM8_5GHL_MAXP            0x0A    /* 5.2GHz and 5.8GHz Max Power */
+#define  SSB_SPROM8_5GH_MAXP            0x00FF
+#define  SSB_SPROM8_5GL_MAXP            0xFF00
+#define  SSB_SPROM8_5GL_MAXP_SHIFT      8
+#define SSB_SROM8_5G_PA_0               0x0C    /* 5.3GHz power amp settings */
+#define SSB_SROM8_5G_PA_1               0x0E
+#define SSB_SROM8_5G_PA_2               0x10
+#define SSB_SROM8_5GL_PA_0              0x12    /* 5.2GHz power amp settings */
+#define SSB_SROM8_5GL_PA_1              0x14
+#define SSB_SROM8_5GL_PA_2              0x16
+#define SSB_SROM8_5GH_PA_0              0x18    /* 5.8GHz power amp settings */
+#define SSB_SROM8_5GH_PA_1              0x1A
+#define SSB_SROM8_5GH_PA_2              0x1C
+
+/* TODO: Make it deprecated */
 #define SSB_SPROM8_MAXP_BG              0x00C0  /* Max Power 2GHz in path 1 */
 #define  SSB_SPROM8_MAXP_BG_MASK        0x00FF  /* Mask for Max Power 2GHz */
 #define  SSB_SPROM8_ITSSI_BG            0xFF00  /* Mask for path 1 itssi_bg */
@@ -473,6 +506,7 @@
 #define SSB_SPROM8_PA1HIB0              0x00D8  /* 5.8GHz power amp settings */
 #define SSB_SPROM8_PA1HIB1              0x00DA
 #define SSB_SPROM8_PA1HIB2              0x00DC
+
 #define SSB_SPROM8_CCK2GPO              0x0140  /* CCK power offset */
 #define SSB_SPROM8_OFDM2GPO             0x0142  /* 2.4GHz OFDM power offset */
 #define SSB_SPROM8_OFDM5GPO             0x0146  /* 5.3GHz OFDM power offset */
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 3c7ffdb40dc6..b6c62d294380 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -464,7 +464,7 @@ struct tcp_sock {
         const struct tcp_sock_af_ops    *af_specific;
 
 /* TCP MD5 Signature Option information */
-        struct tcp_md5sig_info  *md5sig_info;
+        struct tcp_md5sig_info  __rcu *md5sig_info;
 #endif
 
         /* When the cookie options are generated and exchanged, then this
@@ -487,8 +487,7 @@ struct tcp_timewait_sock {
         u32                       tw_ts_recent;
         long                      tw_ts_recent_stamp;
 #ifdef CONFIG_TCP_MD5SIG
-        u16                       tw_md5_keylen;
-        u8                        tw_md5_key[TCP_MD5SIG_MAXKEYLEN];
+        struct tcp_md5sig_key   *tw_md5_key;
 #endif
         /* Few sockets in timewait have cookies; in that case, then this
          * object holds a reference to them (tw_cookie_values->kref).
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index f68dce2d8d88..757a17638b1b 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -160,7 +160,6 @@ extern void addrconf_prefix_rcv(struct net_device *dev,
 extern int ipv6_sock_ac_join(struct sock *sk,int ifindex, const struct in6_addr *addr);
 extern int ipv6_sock_ac_drop(struct sock *sk,int ifindex, const struct in6_addr *addr);
 extern void ipv6_sock_ac_close(struct sock *sk);
-extern int inet6_ac_check(struct sock *sk, const struct in6_addr *addr, int ifindex);
 
 extern int ipv6_dev_ac_inc(struct net_device *dev, const struct in6_addr *addr);
 extern int __ipv6_dev_ac_dec(struct inet6_dev *idev, const struct in6_addr *addr);
diff --git a/include/net/arp.h b/include/net/arp.h
index 0013dc87940b..4a1f3fb562eb 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -15,14 +15,14 @@ static inline u32 arp_hashfn(u32 key, const struct net_device *dev, u32 hash_rnd
         return val * hash_rnd;
 }
 
-static inline struct neighbour *__ipv4_neigh_lookup(struct neigh_table *tbl, struct net_device *dev, u32 key)
+static inline struct neighbour *__ipv4_neigh_lookup(struct net_device *dev, u32 key)
 {
         struct neigh_hash_table *nht;
         struct neighbour *n;
         u32 hash_val;
 
         rcu_read_lock_bh();
-        nht = rcu_dereference_bh(tbl->nht);
+        nht = rcu_dereference_bh(arp_tbl.nht);
         hash_val = arp_hashfn(key, dev, nht->hash_rnd[0]) >> (32 - nht->hash_shift);
         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
              n != NULL;
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 4a82ca0bb0b2..262ebd1747d4 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -109,12 +109,14 @@ struct bt_power {
  */
 #define BT_CHANNEL_POLICY_AMP_PREFERRED         2
 
-__printf(2, 3)
-int bt_printk(const char *level, const char *fmt, ...);
+__printf(1, 2)
+int bt_info(const char *fmt, ...);
+__printf(1, 2)
+int bt_err(const char *fmt, ...);
 
-#define BT_INFO(fmt, arg...)   bt_printk(KERN_INFO, pr_fmt(fmt), ##arg)
-#define BT_ERR(fmt, arg...)    bt_printk(KERN_ERR, pr_fmt(fmt), ##arg)
-#define BT_DBG(fmt, arg...)    pr_debug(fmt "\n", ##arg)
+#define BT_INFO(fmt, ...)       bt_info(fmt "\n", ##__VA_ARGS__)
+#define BT_ERR(fmt, ...)        bt_err(fmt "\n", ##__VA_ARGS__)
+#define BT_DBG(fmt, ...)        pr_debug(fmt "\n", ##__VA_ARGS__)
 
 /* Connection and socket states */
 enum {
@@ -129,6 +131,33 @@ enum {
         BT_CLOSED
 };
 
+/* If unused will be removed by compiler */
+static inline const char *state_to_string(int state)
+{
+        switch (state) {
+        case BT_CONNECTED:
+                return "BT_CONNECTED";
+        case BT_OPEN:
+                return "BT_OPEN";
+        case BT_BOUND:
+                return "BT_BOUND";
+        case BT_LISTEN:
+                return "BT_LISTEN";
+        case BT_CONNECT:
+                return "BT_CONNECT";
+        case BT_CONNECT2:
+                return "BT_CONNECT2";
+        case BT_CONFIG:
+                return "BT_CONFIG";
+        case BT_DISCONN:
+                return "BT_DISCONN";
+        case BT_CLOSED:
+                return "BT_CLOSED";
+        }
+
+        return "invalid state";
+}
+
 /* BD Address */
 typedef struct {
         __u8 b[6];
@@ -193,7 +222,6 @@ struct bt_skb_cb {
         __u16 tx_seq;
         __u8 retries;
         __u8 sar;
-        unsigned short channel;
         __u8 force_active;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 00596e816b4d..344b0f972828 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -77,14 +77,6 @@ enum {
 
         HCI_RAW,
 
-        HCI_SETUP,
-        HCI_AUTO_OFF,
-        HCI_MGMT,
-        HCI_PAIRABLE,
-        HCI_SERVICE_CACHE,
-        HCI_LINK_KEYS,
-        HCI_DEBUG_KEYS,
-
         HCI_RESET,
 };
 
@@ -93,7 +85,22 @@ enum {
  * states from the controller.
  */
 enum {
+        HCI_SETUP,
+        HCI_AUTO_OFF,
+        HCI_MGMT,
+        HCI_PAIRABLE,
+        HCI_SERVICE_CACHE,
+        HCI_LINK_KEYS,
+        HCI_DEBUG_KEYS,
+
         HCI_LE_SCAN,
+        HCI_SSP_ENABLED,
+        HCI_HS_ENABLED,
+        HCI_LE_ENABLED,
+        HCI_CONNECTABLE,
+        HCI_DISCOVERABLE,
+        HCI_LINK_SECURITY,
+        HCI_PENDING_CLASS,
 };
 
 /* HCI ioctl defines */
@@ -130,6 +137,7 @@ enum {
 #define HCI_IDLE_TIMEOUT        (6000)  /* 6 seconds */
 #define HCI_INIT_TIMEOUT        (10000) /* 10 seconds */
 #define HCI_CMD_TIMEOUT         (1000)  /* 1 seconds */
+#define HCI_ACL_TX_TIMEOUT      (45000) /* 45 seconds */
 
 /* HCI data types */
 #define HCI_COMMAND_PKT         0x01
@@ -229,7 +237,9 @@ enum {
 #define LMP_EXTFEATURES 0x80
 
 /* Extended LMP features */
-#define LMP_HOST_LE     0x02
+#define LMP_HOST_SSP            0x01
+#define LMP_HOST_LE             0x02
+#define LMP_HOST_LE_BREDR       0x04
 
 /* Connection modes */
 #define HCI_CM_ACTIVE   0x0000
@@ -268,10 +278,11 @@ enum {
 #define HCI_LK_UNAUTH_COMBINATION       0x04
 #define HCI_LK_AUTH_COMBINATION         0x05
 #define HCI_LK_CHANGED_COMBINATION      0x06
-/* The spec doesn't define types for SMP keys */
-#define HCI_LK_SMP_LTK                  0x81
-#define HCI_LK_SMP_IRK                  0x82
-#define HCI_LK_SMP_CSRK                 0x83
+/* The spec doesn't define types for SMP keys, the _MASTER suffix is implied */
+#define HCI_SMP_STK                     0x80
+#define HCI_SMP_STK_SLAVE               0x81
+#define HCI_SMP_LTK                     0x82
+#define HCI_SMP_LTK_SLAVE               0x83
 
 /* ---- HCI Error Codes ---- */
 #define HCI_ERROR_AUTH_FAILURE          0x05
@@ -284,6 +295,22 @@ enum {
 #define HCI_FLOW_CTL_MODE_PACKET_BASED  0x00
 #define HCI_FLOW_CTL_MODE_BLOCK_BASED   0x01
 
+/* Extended Inquiry Response field types */
+#define EIR_FLAGS               0x01 /* flags */
+#define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
+#define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
+#define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
+#define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
+#define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
+#define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
+#define EIR_NAME_SHORT          0x08 /* shortened local name */
+#define EIR_NAME_COMPLETE       0x09 /* complete local name */
+#define EIR_TX_POWER            0x0A /* transmit power level */
+#define EIR_CLASS_OF_DEV        0x0D /* Class of Device */
+#define EIR_SSP_HASH_C          0x0E /* Simple Pairing Hash C */
+#define EIR_SSP_RAND_R          0x0F /* Simple Pairing Randomizer R */
+#define EIR_DEVICE_ID           0x10 /* device ID */
+
 /* -----  HCI Commands ---- */
 #define HCI_OP_NOP                      0x0000
 
@@ -666,8 +693,8 @@ struct hci_cp_host_buffer_size {
 
 #define HCI_OP_WRITE_EIR                0x0c52
 struct hci_cp_write_eir {
-        uint8_t         fec;
-        uint8_t         data[HCI_MAX_EIR_LENGTH];
+        __u8    fec;
+        __u8    data[HCI_MAX_EIR_LENGTH];
 } __packed;
 
 #define HCI_OP_READ_SSP_MODE            0x0c55
@@ -698,8 +725,8 @@ struct hci_rp_read_flow_control_mode {
 
 #define HCI_OP_WRITE_LE_HOST_SUPPORTED  0x0c6d
 struct hci_cp_write_le_host_supported {
-        __u8 le;
-        __u8 simul;
+        __u8    le;
+        __u8    simul;
 } __packed;
 
 #define HCI_OP_READ_LOCAL_VERSION       0x1001
@@ -1155,6 +1182,19 @@ struct hci_ev_le_meta {
         __u8     subevent;
 } __packed;
 
+#define HCI_EV_NUM_COMP_BLOCKS          0x48
+struct hci_comp_blocks_info {
+        __le16   handle;
+        __le16   pkts;
+        __le16   blocks;
+} __packed;
+
+struct hci_ev_num_comp_blocks {
+        __le16   num_blocks;
+        __u8     num_hndl;
+        struct hci_comp_blocks_info handles[0];
+} __packed;
+
 /* Low energy meta events */
 #define HCI_EV_LE_CONN_COMPLETE         0x01
 struct hci_ev_le_conn_complete {
@@ -1288,6 +1328,7 @@ struct sockaddr_hci {
 
 #define HCI_CHANNEL_RAW         0
 #define HCI_CHANNEL_CONTROL     1
+#define HCI_CHANNEL_MONITOR     2
 
 struct hci_filter {
         unsigned long type_mask;
@@ -1389,5 +1430,6 @@ struct hci_inquiry_req {
 #define IREQ_CACHE_FLUSH 0x0001
 
 extern bool enable_hs;
+extern bool enable_le;
 
 #endif /* __HCI_H */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 453893b3120e..daefaac51131 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -44,14 +44,31 @@ struct inquiry_data {
 };
 
 struct inquiry_entry {
-        struct inquiry_entry    *next;
+        struct list_head        all;            /* inq_cache.all */
+        struct list_head        list;           /* unknown or resolve */
+        enum {
+                NAME_NOT_KNOWN,
+                NAME_NEEDED,
+                NAME_PENDING,
+                NAME_KNOWN,
+        } name_state;
         __u32                   timestamp;
         struct inquiry_data     data;
 };
 
-struct inquiry_cache {
+struct discovery_state {
+        int                     type;
+        enum {
+                DISCOVERY_STOPPED,
+                DISCOVERY_STARTING,
+                DISCOVERY_FINDING,
+                DISCOVERY_RESOLVING,
+                DISCOVERY_STOPPING,
+        } state;
+        struct list_head        all;            /* All devices found during inquiry */
+        struct list_head        unknown;        /* Name state not known */
+        struct list_head        resolve;        /* Name needs to be resolved */
         __u32                   timestamp;
-        struct inquiry_entry    *list;
 };
 
 struct hci_conn_hash {
@@ -72,18 +89,16 @@ struct bt_uuid {
         u8 svc_hint;
 };
 
-struct key_master_id {
-        __le16 ediv;
-        u8 rand[8];
-} __packed;
-
-struct link_key_data {
+struct smp_ltk {
+        struct list_head list;
         bdaddr_t bdaddr;
+        u8 bdaddr_type;
+        u8 authenticated;
         u8 type;
+        u8 enc_size;
+        __le16 ediv;
+        u8 rand[8];
         u8 val[16];
-        u8 pin_len;
-        u8 dlen;
-        u8 data[0];
 } __packed;
 
 struct link_key {
@@ -92,8 +107,6 @@ struct link_key {
         u8 type;
         u8 val[16];
         u8 pin_len;
-        u8 dlen;
-        u8 data[0];
 };
 
 struct oob_data {
@@ -109,11 +122,19 @@ struct adv_entry {
         u8 bdaddr_type;
 };
 
+struct le_scan_params {
+        u8 type;
+        u16 interval;
+        u16 window;
+        int timeout;
+};
+
+#define HCI_MAX_SHORT_NAME_LENGTH       10
+
 #define NUM_REASSEMBLY 4
 struct hci_dev {
         struct list_head list;
         struct mutex    lock;
-        atomic_t        refcnt;
 
         char            name[8];
         unsigned long   flags;
@@ -122,6 +143,7 @@ struct hci_dev {
         __u8            dev_type;
         bdaddr_t        bdaddr;
         __u8            dev_name[HCI_MAX_NAME_LENGTH];
+        __u8            short_name[HCI_MAX_SHORT_NAME_LENGTH];
         __u8            eir[HCI_MAX_EIR_LENGTH];
         __u8            dev_class[3];
         __u8            major_class;
@@ -129,7 +151,6 @@ struct hci_dev {
         __u8            features[8];
         __u8            host_features[8];
         __u8            commands[64];
-        __u8            ssp_mode;
         __u8            hci_ver;
         __u16           hci_rev;
         __u8            lmp_ver;
@@ -217,7 +238,7 @@ struct hci_dev {
 
         struct list_head        mgmt_pending;
 
-        struct inquiry_cache    inq_cache;
+        struct discovery_state  discovery;
         struct hci_conn_hash    conn_hash;
         struct list_head        blacklist;
 
@@ -225,6 +246,8 @@ struct hci_dev {
 
         struct list_head        link_keys;
 
+        struct list_head        long_term_keys;
+
         struct list_head        remote_oob_data;
 
         struct list_head        adv_entries;
@@ -234,7 +257,6 @@ struct hci_dev {
 
         struct sk_buff_head     driver_init;
 
-        void                    *driver_data;
         void                    *core_data;
 
         atomic_t                promisc;
@@ -246,15 +268,17 @@ struct hci_dev {
 
         struct rfkill           *rfkill;
 
-        struct module           *owner;
-
         unsigned long           dev_flags;
 
+        struct delayed_work     le_scan_disable;
+
+        struct work_struct      le_scan;
+        struct le_scan_params   le_scan_params;
+
         int (*open)(struct hci_dev *hdev);
         int (*close)(struct hci_dev *hdev);
         int (*flush)(struct hci_dev *hdev);
         int (*send)(struct sk_buff *skb);
-        void (*destruct)(struct hci_dev *hdev);
         void (*notify)(struct hci_dev *hdev, unsigned int evt);
         int (*ioctl)(struct hci_dev *hdev, unsigned int cmd, unsigned long arg);
 };
@@ -270,11 +294,10 @@ struct hci_conn {
         __u16           state;
         __u8            mode;
         __u8            type;
-        __u8            out;
+        bool            out;
         __u8            attempt;
         __u8            dev_class[3];
         __u8            features[8];
-        __u8            ssp_mode;
         __u16           interval;
         __u16           pkt_type;
         __u16           link_policy;
@@ -286,12 +309,10 @@ struct hci_conn {
         __u8            pin_length;
         __u8            enc_key_size;
         __u8            io_capability;
-        __u8            power_save;
         __u16           disc_timeout;
-        unsigned long   pend;
+        unsigned long   flags;
 
         __u8            remote_cap;
-        __u8            remote_oob;
         __u8            remote_auth;
 
         unsigned int    sent;
@@ -348,21 +369,26 @@ extern int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb);
 #define INQUIRY_CACHE_AGE_MAX   (HZ*30)   /* 30 seconds */
 #define INQUIRY_ENTRY_AGE_MAX   (HZ*60)   /* 60 seconds */
 
-static inline void inquiry_cache_init(struct hci_dev *hdev)
+static inline void discovery_init(struct hci_dev *hdev)
 {
-        struct inquiry_cache *c = &hdev->inq_cache;
-        c->list = NULL;
+        hdev->discovery.state = DISCOVERY_STOPPED;
+        INIT_LIST_HEAD(&hdev->discovery.all);
+        INIT_LIST_HEAD(&hdev->discovery.unknown);
+        INIT_LIST_HEAD(&hdev->discovery.resolve);
 }
 
+bool hci_discovery_active(struct hci_dev *hdev);
+
+void hci_discovery_set_state(struct hci_dev *hdev, int state);
+
 static inline int inquiry_cache_empty(struct hci_dev *hdev)
 {
-        struct inquiry_cache *c = &hdev->inq_cache;
-        return c->list == NULL;
+        return list_empty(&hdev->discovery.all);
 }
 
 static inline long inquiry_cache_age(struct hci_dev *hdev)
 {
-        struct inquiry_cache *c = &hdev->inq_cache;
+        struct discovery_state *c = &hdev->discovery;
         return jiffies - c->timestamp;
 }
 
@@ -372,8 +398,16 @@ static inline long inquiry_entry_age(struct inquiry_entry *e)
 }
 
 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
-                                                        bdaddr_t *bdaddr);
-void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data);
+                                               bdaddr_t *bdaddr);
+struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
+                                                       bdaddr_t *bdaddr);
+struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
+                                                       bdaddr_t *bdaddr,
+                                                       int state);
+void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
+                                      struct inquiry_entry *ie);
+bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
+                              bool name_known, bool *ssp);
 
 /* ----- HCI Connections ----- */
 enum {
@@ -384,8 +418,19 @@ enum {
         HCI_CONN_MODE_CHANGE_PEND,
         HCI_CONN_SCO_SETUP_PEND,
         HCI_CONN_LE_SMP_PEND,
+        HCI_CONN_MGMT_CONNECTED,
+        HCI_CONN_SSP_ENABLED,
+        HCI_CONN_POWER_SAVE,
+        HCI_CONN_REMOTE_OOB,
 };
 
+static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        return (test_bit(HCI_SSP_ENABLED, &hdev->flags) &&
+                                test_bit(HCI_CONN_SSP_ENABLED, &conn->flags));
+}
+
 static inline void hci_conn_hash_init(struct hci_dev *hdev)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
@@ -566,36 +611,33 @@ static inline void hci_conn_put(struct hci_conn *conn)
 }
 
 /* ----- HCI Devices ----- */
-static inline void __hci_dev_put(struct hci_dev *d)
+static inline void hci_dev_put(struct hci_dev *d)
 {
-        if (atomic_dec_and_test(&d->refcnt))
-                d->destruct(d);
+        put_device(&d->dev);
 }
 
-/*
- * hci_dev_put and hci_dev_hold are macros to avoid dragging all the
- * overhead of all the modular infrastructure into this header.
- */
-#define hci_dev_put(d)          \
-do {                            \
-        __hci_dev_put(d);       \
-        module_put(d->owner);   \
-} while (0)
-
-static inline struct hci_dev *__hci_dev_hold(struct hci_dev *d)
+static inline struct hci_dev *hci_dev_hold(struct hci_dev *d)
 {
-        atomic_inc(&d->refcnt);
+        get_device(&d->dev);
         return d;
 }
 
-#define hci_dev_hold(d)                                         \
-({                                                              \
-        try_module_get(d->owner) ? __hci_dev_hold(d) : NULL;    \
-})
-
 #define hci_dev_lock(d)         mutex_lock(&d->lock)
 #define hci_dev_unlock(d)       mutex_unlock(&d->lock)
 
+#define to_hci_dev(d) container_of(d, struct hci_dev, dev)
+#define to_hci_conn(c) container_of(c, struct hci_conn, dev)
+
+static inline void *hci_get_drvdata(struct hci_dev *hdev)
+{
+        return dev_get_drvdata(&hdev->dev);
+}
+
+static inline void hci_set_drvdata(struct hci_dev *hdev, void *data)
+{
+        dev_set_drvdata(&hdev->dev, data);
+}
+
 struct hci_dev *hci_dev_get(int index);
 struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
 
@@ -619,20 +661,23 @@ int hci_inquiry(void __user *arg);
 
 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_blacklist_clear(struct hci_dev *hdev);
-int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr);
-int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
+int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 
 int hci_uuids_clear(struct hci_dev *hdev);
 
 int hci_link_keys_clear(struct hci_dev *hdev);
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
-                        bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
-struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
-struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
-                                        bdaddr_t *bdaddr, u8 type);
-int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
-                        u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16]);
+                     bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
+struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
+int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
+                int new_key, u8 authenticated, u8 tk[16], u8 enc_size, u16 ediv,
+                u8 rand[8]);
+struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                     u8 addr_type);
+int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int hci_smp_ltks_clear(struct hci_dev *hdev);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
 int hci_remote_oob_data_clear(struct hci_dev *hdev);
@@ -674,6 +719,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define lmp_ssp_capable(dev)       ((dev)->features[6] & LMP_SIMPLE_PAIR)
 #define lmp_no_flush_capable(dev)  ((dev)->features[6] & LMP_NO_FLUSH)
 #define lmp_le_capable(dev)        ((dev)->features[4] & LMP_LE)
+#define lmp_bredr_capable(dev)     (!((dev)->features[4] & LMP_NO_BREDR))
 
 /* ----- Extended LMP capabilities ----- */
 #define lmp_host_le_capable(dev)   ((dev)->host_features[0] & LMP_HOST_LE)
@@ -755,7 +801,7 @@ static inline void hci_proto_auth_cfm(struct hci_conn *conn, __u8 status)
         if (conn->type != ACL_LINK && conn->type != LE_LINK)
                 return;
 
-        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
                 return;
 
         encrypt = (conn->link_mode & HCI_LM_ENCRYPT) ? 0x01 : 0x00;
@@ -796,7 +842,7 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
 
         hci_proto_auth_cfm(conn, status);
 
-        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
                 return;
 
         encrypt = (conn->link_mode & HCI_LM_ENCRYPT) ? 0x01 : 0x00;
@@ -859,25 +905,71 @@ static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
         read_unlock(&hci_cb_list_lock);
 }
 
+static inline bool eir_has_data_type(u8 *data, size_t data_len, u8 type)
+{
+        u8 field_len;
+        size_t parsed;
+
+        for (parsed = 0; parsed < data_len - 1; parsed += field_len) {
+                field_len = data[0];
+
+                if (field_len == 0)
+                        break;
+
+                parsed += field_len + 1;
+
+                if (parsed > data_len)
+                        break;
+
+                if (data[1] == type)
+                        return true;
+
+                data += field_len + 1;
+        }
+
+        return false;
+}
+
+static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
+                                  u8 data_len)
+{
+        eir[eir_len++] = sizeof(type) + data_len;
+        eir[eir_len++] = type;
+        memcpy(&eir[eir_len], data, data_len);
+        eir_len += data_len;
+
+        return eir_len;
+}
+
 int hci_register_cb(struct hci_cb *hcb);
 int hci_unregister_cb(struct hci_cb *hcb);
 
-int hci_register_notifier(struct notifier_block *nb);
-int hci_unregister_notifier(struct notifier_block *nb);
-
 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param);
 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags);
 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb);
 
 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode);
 
-void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data);
-
 /* ----- HCI Sockets ----- */
-void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb,
-                                                        struct sock *skip_sk);
+void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb);
+void hci_send_to_control(struct sk_buff *skb, struct sock *skip_sk);
+void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb);
+
+void hci_sock_dev_event(struct hci_dev *hdev, int event);
 
 /* Management interface */
+#define MGMT_ADDR_BREDR                 0x00
+#define MGMT_ADDR_LE_PUBLIC             0x01
+#define MGMT_ADDR_LE_RANDOM             0x02
+#define MGMT_ADDR_INVALID               0xff
+
+#define DISCOV_TYPE_BREDR               (BIT(MGMT_ADDR_BREDR))
+#define DISCOV_TYPE_LE                  (BIT(MGMT_ADDR_LE_PUBLIC) | \
+                                                BIT(MGMT_ADDR_LE_RANDOM))
+#define DISCOV_TYPE_INTERLEAVED         (BIT(MGMT_ADDR_BREDR) | \
+                                                BIT(MGMT_ADDR_LE_PUBLIC) | \
+                                                BIT(MGMT_ADDR_LE_RANDOM))
+
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
 int mgmt_index_added(struct hci_dev *hdev);
 int mgmt_index_removed(struct hci_dev *hdev);
@@ -886,56 +978,67 @@ int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable);
 int mgmt_connectable(struct hci_dev *hdev, u8 connectable);
 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status);
 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
-                                                                u8 persistent);
-int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                                                                u8 addr_type);
-int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                                                                u8 addr_type);
-int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status);
+                      u8 persistent);
+int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+                          u8 addr_type, u32 flags, u8 *name, u8 name_len,
+                          u8 *dev_class);
+int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                             u8 link_type, u8 addr_type);
+int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                           u8 link_type, u8 addr_type, u8 status);
 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                                                u8 addr_type, u8 status);
+                        u8 addr_type, u8 status);
 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure);
 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                u8 status);
+                                 u8 status);
 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                u8 status);
+                                     u8 status);
 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                __le32 value, u8 confirm_hint);
+                              u8 link_type, u8 addr_type, __le32 value,
+                              u8 confirm_hint);
 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                u8 status);
-int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
-                                                bdaddr_t *bdaddr, u8 status);
-int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr);
+                                     u8 link_type, u8 addr_type, u8 status);
+int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                         u8 link_type, u8 addr_type, u8 status);
+int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                              u8 link_type, u8 addr_type);
 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                u8 status);
-int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev,
-                                                bdaddr_t *bdaddr, u8 status);
-int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status);
+                                     u8 link_type, u8 addr_type, u8 status);
+int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                         u8 link_type, u8 addr_type, u8 status);
+int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+                     u8 addr_type, u8 status);
+int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status);
+int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
+int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
+                                   u8 status);
 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status);
 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
-                                                u8 *randomizer, u8 status);
+                                            u8 *randomizer, u8 status);
+int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                                u8 addr_type, u8 *dev_class, s8 rssi, u8 *eir);
-int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name);
+                      u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
+                      u8 ssp, u8 *eir, u16 eir_len);
+int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+                     u8 addr_type, s8 rssi, u8 *name, u8 name_len);
 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status);
 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status);
 int mgmt_discovering(struct hci_dev *hdev, u8 discovering);
-int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr);
-int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int mgmt_interleaved_discovery(struct hci_dev *hdev);
+int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
+int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
+
+int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent);
 
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
 
-/* HCI socket flags */
-#define HCI_PI_MGMT_INIT        0
-
 struct hci_pinfo {
         struct bt_sock    bt;
         struct hci_dev    *hdev;
         struct hci_filter filter;
         __u32             cmsg_mask;
         unsigned short   channel;
-        unsigned long     flags;
 };
 
 /* HCI security filter */
@@ -966,5 +1069,7 @@ void hci_le_ltk_neg_reply(struct hci_conn *conn);
 
 int hci_do_inquiry(struct hci_dev *hdev, u8 length);
 int hci_cancel_inquiry(struct hci_dev *hdev);
+int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
+                int timeout);
 
 #endif /* __HCI_CORE_H */
diff --git a/include/net/bluetooth/hci_mon.h b/include/net/bluetooth/hci_mon.h
new file mode 100644
index 000000000000..77d1e5764185
--- /dev/null
+++ b/include/net/bluetooth/hci_mon.h
@@ -0,0 +1,51 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+
+   Copyright (C) 2011-2012  Intel Corporation
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#ifndef __HCI_MON_H
+#define __HCI_MON_H
+
+struct hci_mon_hdr {
+        __le16  opcode;
+        __le16  index;
+        __le16  len;
+} __packed;
+#define HCI_MON_HDR_SIZE 6
+
+#define HCI_MON_NEW_INDEX       0
+#define HCI_MON_DEL_INDEX       1
+#define HCI_MON_COMMAND_PKT     2
+#define HCI_MON_EVENT_PKT       3
+#define HCI_MON_ACL_TX_PKT      4
+#define HCI_MON_ACL_RX_PKT      5
+#define HCI_MON_SCO_TX_PKT      6
+#define HCI_MON_SCO_RX_PKT      7
+
+struct hci_mon_new_index {
+        __u8            type;
+        __u8            bus;
+        bdaddr_t        bdaddr;
+        char            name[8];
+} __packed;
+#define HCI_MON_NEW_INDEX_SIZE 16
+
+#endif /* __HCI_MON_H */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index b1664ed884e6..9b242c6bf55b 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -45,11 +45,11 @@
 #define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
 #define L2CAP_DEFAULT_ACC_LAT           0xFFFFFFFF
 
-#define L2CAP_DISC_TIMEOUT             (100)
-#define L2CAP_DISC_REJ_TIMEOUT         (5000)  /*  5 seconds */
-#define L2CAP_ENC_TIMEOUT              (5000)  /*  5 seconds */
-#define L2CAP_CONN_TIMEOUT             (40000) /* 40 seconds */
-#define L2CAP_INFO_TIMEOUT             (4000)  /*  4 seconds */
+#define L2CAP_DISC_TIMEOUT              msecs_to_jiffies(100)
+#define L2CAP_DISC_REJ_TIMEOUT          msecs_to_jiffies(5000)
+#define L2CAP_ENC_TIMEOUT               msecs_to_jiffies(5000)
+#define L2CAP_CONN_TIMEOUT              msecs_to_jiffies(40000)
+#define L2CAP_INFO_TIMEOUT              msecs_to_jiffies(4000)
 
 /* L2CAP socket address */
 struct sockaddr_l2 {
@@ -492,51 +492,56 @@ struct l2cap_chan {
         struct sk_buff_head     srej_q;
         struct list_head        srej_l;
 
-        struct list_head list;
-        struct list_head global_l;
+        struct list_head        list;
+        struct list_head        global_l;
 
-        void            *data;
-        struct l2cap_ops *ops;
+        void                    *data;
+        struct l2cap_ops        *ops;
+        struct mutex            lock;
 };
 
 struct l2cap_ops {
-        char            *name;
+        char                    *name;
 
         struct l2cap_chan       *(*new_connection) (void *data);
         int                     (*recv) (void *data, struct sk_buff *skb);
         void                    (*close) (void *data);
         void                    (*state_change) (void *data, int state);
+        struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
+                                        unsigned long len, int nb, int *err);
+
 };
 
 struct l2cap_conn {
-        struct hci_conn *hcon;
-        struct hci_chan *hchan;
+        struct hci_conn         *hcon;
+        struct hci_chan         *hchan;
 
-        bdaddr_t        *dst;
-        bdaddr_t        *src;
+        bdaddr_t                *dst;
+        bdaddr_t                *src;
 
-        unsigned int    mtu;
+        unsigned int            mtu;
 
-        __u32           feat_mask;
+        __u32                   feat_mask;
+        __u8                    fixed_chan_mask;
 
-        __u8            info_state;
-        __u8            info_ident;
+        __u8                    info_state;
+        __u8                    info_ident;
 
-        struct delayed_work info_timer;
+        struct delayed_work     info_timer;
 
-        spinlock_t      lock;
+        spinlock_t              lock;
 
-        struct sk_buff *rx_skb;
-        __u32           rx_len;
-        __u8            tx_ident;
+        struct sk_buff          *rx_skb;
+        __u32                   rx_len;
+        __u8                    tx_ident;
 
-        __u8            disc_reason;
+        __u8                    disc_reason;
 
-        struct delayed_work  security_timer;
-        struct smp_chan *smp_chan;
+        struct delayed_work     security_timer;
+        struct smp_chan         *smp_chan;
 
-        struct list_head chan_l;
-        struct mutex    chan_lock;
+        struct list_head        chan_l;
+        struct mutex            chan_lock;
 };
 
 #define L2CAP_INFO_CL_MTU_REQ_SENT      0x01
@@ -551,9 +556,9 @@ struct l2cap_conn {
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
 
 struct l2cap_pinfo {
-        struct bt_sock  bt;
+        struct bt_sock          bt;
         struct l2cap_chan       *chan;
-        struct sk_buff  *rx_busy_skb;
+        struct sk_buff          *rx_busy_skb;
 };
 
 enum {
@@ -606,21 +611,37 @@ static inline void l2cap_chan_put(struct l2cap_chan *c)
                 kfree(c);
 }
 
+static inline void l2cap_chan_lock(struct l2cap_chan *chan)
+{
+        mutex_lock(&chan->lock);
+}
+
+static inline void l2cap_chan_unlock(struct l2cap_chan *chan)
+{
+        mutex_unlock(&chan->lock);
+}
+
 static inline void l2cap_set_timer(struct l2cap_chan *chan,
                                         struct delayed_work *work, long timeout)
 {
-        BT_DBG("chan %p state %d timeout %ld", chan, chan->state, timeout);
+        BT_DBG("chan %p state %s timeout %ld", chan,
+                                        state_to_string(chan->state), timeout);
 
         if (!cancel_delayed_work(work))
                 l2cap_chan_hold(chan);
         schedule_delayed_work(work, timeout);
 }
 
-static inline void l2cap_clear_timer(struct l2cap_chan *chan,
+static inline bool l2cap_clear_timer(struct l2cap_chan *chan,
                                         struct delayed_work *work)
 {
-        if (cancel_delayed_work(work))
+        bool ret;
+
+        ret = cancel_delayed_work(work);
+        if (ret)
                 l2cap_chan_put(chan);
+
+        return ret;
 }
 
 #define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index be65d3417883..ffc1377e092e 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -2,6 +2,7 @@
    BlueZ - Bluetooth protocol stack for Linux
 
    Copyright (C) 2010  Nokia Corporation
+   Copyright (C) 2011-2012  Intel Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License version 2 as
@@ -39,29 +40,47 @@
 #define MGMT_STATUS_INVALID_PARAMS      0x0d
 #define MGMT_STATUS_DISCONNECTED        0x0e
 #define MGMT_STATUS_NOT_POWERED         0x0f
+#define MGMT_STATUS_CANCELLED           0x10
+#define MGMT_STATUS_INVALID_INDEX       0x11
 
 struct mgmt_hdr {
-        __le16 opcode;
-        __le16 index;
-        __le16 len;
+        __le16  opcode;
+        __le16  index;
+        __le16  len;
 } __packed;
 
+struct mgmt_addr_info {
+        bdaddr_t        bdaddr;
+        __u8            type;
+} __packed;
+#define MGMT_ADDR_INFO_SIZE             7
+
 #define MGMT_OP_READ_VERSION            0x0001
+#define MGMT_READ_VERSION_SIZE          0
 struct mgmt_rp_read_version {
-        __u8 version;
-        __le16 revision;
+        __u8    version;
+        __le16  revision;
+} __packed;
+
+#define MGMT_OP_READ_COMMANDS           0x0002
+#define MGMT_READ_COMMANDS_SIZE         0
+struct mgmt_rp_read_commands {
+        __le16  num_commands;
+        __le16  num_events;
+        __le16  opcodes[0];
 } __packed;
 
 #define MGMT_OP_READ_INDEX_LIST         0x0003
+#define MGMT_READ_INDEX_LIST_SIZE       0
 struct mgmt_rp_read_index_list {
-        __le16 num_controllers;
-        __le16 index[0];
+        __le16  num_controllers;
+        __le16  index[0];
 } __packed;
 
 /* Reserve one extra byte for names in management messages so that they
  * are always guaranteed to be nul-terminated */
 #define MGMT_MAX_NAME_LENGTH            (HCI_MAX_NAME_LENGTH + 1)
-#define MGMT_MAX_SHORT_NAME_LENGTH      (10 + 1)
+#define MGMT_MAX_SHORT_NAME_LENGTH      (HCI_MAX_SHORT_NAME_LENGTH + 1)
 
 #define MGMT_SETTING_POWERED            0x00000001
 #define MGMT_SETTING_CONNECTABLE        0x00000002
@@ -75,28 +94,32 @@ struct mgmt_rp_read_index_list {
 #define MGMT_SETTING_LE                 0x00000200
 
 #define MGMT_OP_READ_INFO               0x0004
+#define MGMT_READ_INFO_SIZE             0
 struct mgmt_rp_read_info {
-        bdaddr_t bdaddr;
-        __u8 version;
-        __le16 manufacturer;
-        __le32 supported_settings;
-        __le32 current_settings;
-        __u8 dev_class[3];
-        __u8 name[MGMT_MAX_NAME_LENGTH];
-        __u8 short_name[MGMT_MAX_SHORT_NAME_LENGTH];
+        bdaddr_t        bdaddr;
+        __u8            version;
+        __le16          manufacturer;
+        __le32          supported_settings;
+        __le32          current_settings;
+        __u8            dev_class[3];
+        __u8            name[MGMT_MAX_NAME_LENGTH];
+        __u8            short_name[MGMT_MAX_SHORT_NAME_LENGTH];
 } __packed;
 
 struct mgmt_mode {
         __u8 val;
 } __packed;
 
+#define MGMT_SETTING_SIZE               1
+
 #define MGMT_OP_SET_POWERED             0x0005
 
 #define MGMT_OP_SET_DISCOVERABLE        0x0006
 struct mgmt_cp_set_discoverable {
-        __u8 val;
-        __u16 timeout;
+        __u8    val;
+        __u16   timeout;
 } __packed;
+#define MGMT_SET_DISCOVERABLE_SIZE      3
 
 #define MGMT_OP_SET_CONNECTABLE         0x0007
 
@@ -111,73 +134,76 @@ struct mgmt_cp_set_discoverable {
 #define MGMT_OP_SET_HS                  0x000C
 
 #define MGMT_OP_SET_LE                  0x000D
-
 #define MGMT_OP_SET_DEV_CLASS           0x000E
 struct mgmt_cp_set_dev_class {
-        __u8 major;
-        __u8 minor;
+        __u8    major;
+        __u8    minor;
 } __packed;
+#define MGMT_SET_DEV_CLASS_SIZE         2
 
 #define MGMT_OP_SET_LOCAL_NAME          0x000F
 struct mgmt_cp_set_local_name {
-        __u8 name[MGMT_MAX_NAME_LENGTH];
+        __u8    name[MGMT_MAX_NAME_LENGTH];
+        __u8    short_name[MGMT_MAX_SHORT_NAME_LENGTH];
 } __packed;
+#define MGMT_SET_LOCAL_NAME_SIZE        260
 
 #define MGMT_OP_ADD_UUID                0x0010
 struct mgmt_cp_add_uuid {
-        __u8 uuid[16];
-        __u8 svc_hint;
+        __u8    uuid[16];
+        __u8    svc_hint;
 } __packed;
+#define MGMT_ADD_UUID_SIZE              17
 
 #define MGMT_OP_REMOVE_UUID             0x0011
 struct mgmt_cp_remove_uuid {
-        __u8 uuid[16];
+        __u8    uuid[16];
 } __packed;
+#define MGMT_REMOVE_UUID_SIZE           16
 
 struct mgmt_link_key_info {
-        bdaddr_t bdaddr;
-        u8 type;
-        u8 val[16];
-        u8 pin_len;
+        struct mgmt_addr_info addr;
+        __u8    type;
+        __u8    val[16];
+        __u8    pin_len;
 } __packed;
 
 #define MGMT_OP_LOAD_LINK_KEYS          0x0012
 struct mgmt_cp_load_link_keys {
-        __u8 debug_keys;
-        __le16 key_count;
-        struct mgmt_link_key_info keys[0];
+        __u8    debug_keys;
+        __le16  key_count;
+        struct  mgmt_link_key_info keys[0];
 } __packed;
+#define MGMT_LOAD_LINK_KEYS_SIZE        3
 
-#define MGMT_OP_REMOVE_KEYS             0x0013
-struct mgmt_cp_remove_keys {
-        bdaddr_t bdaddr;
-        __u8 disconnect;
+struct mgmt_ltk_info {
+        struct mgmt_addr_info addr;
+        __u8    authenticated;
+        __u8    master;
+        __u8    enc_size;
+        __le16  ediv;
+        __u8    rand[8];
+        __u8    val[16];
 } __packed;
-struct mgmt_rp_remove_keys {
-        bdaddr_t bdaddr;
-        __u8 status;
-};
+
+#define MGMT_OP_LOAD_LONG_TERM_KEYS     0x0013
+struct mgmt_cp_load_long_term_keys {
+        __le16  key_count;
+        struct  mgmt_ltk_info keys[0];
+} __packed;
+#define MGMT_LOAD_LONG_TERM_KEYS_SIZE   2
 
 #define MGMT_OP_DISCONNECT              0x0014
 struct mgmt_cp_disconnect {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
 } __packed;
+#define MGMT_DISCONNECT_SIZE            MGMT_ADDR_INFO_SIZE
 struct mgmt_rp_disconnect {
-        bdaddr_t bdaddr;
-        __u8 status;
-} __packed;
-
-#define MGMT_ADDR_BREDR                 0x00
-#define MGMT_ADDR_LE_PUBLIC             0x01
-#define MGMT_ADDR_LE_RANDOM             0x02
-#define MGMT_ADDR_INVALID               0xff
-
-struct mgmt_addr_info {
-        bdaddr_t bdaddr;
-        __u8 type;
+        struct mgmt_addr_info addr;
 } __packed;
 
 #define MGMT_OP_GET_CONNECTIONS         0x0015
+#define MGMT_GET_CONNECTIONS_SIZE       0
 struct mgmt_rp_get_connections {
         __le16 conn_count;
         struct mgmt_addr_info addr[0];
@@ -185,124 +211,152 @@ struct mgmt_rp_get_connections {
 
 #define MGMT_OP_PIN_CODE_REPLY          0x0016
 struct mgmt_cp_pin_code_reply {
-        bdaddr_t bdaddr;
-        __u8 pin_len;
-        __u8 pin_code[16];
+        struct mgmt_addr_info addr;
+        __u8    pin_len;
+        __u8    pin_code[16];
 } __packed;
+#define MGMT_PIN_CODE_REPLY_SIZE        (MGMT_ADDR_INFO_SIZE + 17)
 struct mgmt_rp_pin_code_reply {
-        bdaddr_t bdaddr;
-        uint8_t status;
+        struct mgmt_addr_info addr;
 } __packed;
 
 #define MGMT_OP_PIN_CODE_NEG_REPLY      0x0017
 struct mgmt_cp_pin_code_neg_reply {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
 } __packed;
+#define MGMT_PIN_CODE_NEG_REPLY_SIZE    MGMT_ADDR_INFO_SIZE
 
 #define MGMT_OP_SET_IO_CAPABILITY       0x0018
 struct mgmt_cp_set_io_capability {
-        __u8 io_capability;
+        __u8    io_capability;
 } __packed;
+#define MGMT_SET_IO_CAPABILITY_SIZE     1
 
 #define MGMT_OP_PAIR_DEVICE             0x0019
 struct mgmt_cp_pair_device {
         struct mgmt_addr_info addr;
-        __u8 io_cap;
+        __u8    io_cap;
 } __packed;
+#define MGMT_PAIR_DEVICE_SIZE           (MGMT_ADDR_INFO_SIZE + 1)
 struct mgmt_rp_pair_device {
         struct mgmt_addr_info addr;
-        __u8 status;
 } __packed;
 
-#define MGMT_OP_USER_CONFIRM_REPLY      0x001A
+#define MGMT_OP_CANCEL_PAIR_DEVICE      0x001A
+#define MGMT_CANCEL_PAIR_DEVICE_SIZE    MGMT_ADDR_INFO_SIZE
+
+#define MGMT_OP_UNPAIR_DEVICE           0x001B
+struct mgmt_cp_unpair_device {
+        struct mgmt_addr_info addr;
+        __u8 disconnect;
+} __packed;
+#define MGMT_UNPAIR_DEVICE_SIZE         (MGMT_ADDR_INFO_SIZE + 1)
+struct mgmt_rp_unpair_device {
+        struct mgmt_addr_info addr;
+};
+
+#define MGMT_OP_USER_CONFIRM_REPLY      0x001C
 struct mgmt_cp_user_confirm_reply {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
 } __packed;
+#define MGMT_USER_CONFIRM_REPLY_SIZE    MGMT_ADDR_INFO_SIZE
 struct mgmt_rp_user_confirm_reply {
-        bdaddr_t bdaddr;
-        __u8 status;
+        struct mgmt_addr_info addr;
 } __packed;
 
-#define MGMT_OP_USER_CONFIRM_NEG_REPLY  0x001B
+#define MGMT_OP_USER_CONFIRM_NEG_REPLY  0x001D
 struct mgmt_cp_user_confirm_neg_reply {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
 } __packed;
+#define MGMT_USER_CONFIRM_NEG_REPLY_SIZE MGMT_ADDR_INFO_SIZE
 
-#define MGMT_OP_USER_PASSKEY_REPLY      0x001C
+#define MGMT_OP_USER_PASSKEY_REPLY      0x001E
 struct mgmt_cp_user_passkey_reply {
-        bdaddr_t bdaddr;
-        __le32 passkey;
+        struct mgmt_addr_info addr;
+        __le32  passkey;
 } __packed;
+#define MGMT_USER_PASSKEY_REPLY_SIZE    (MGMT_ADDR_INFO_SIZE + 4)
 struct mgmt_rp_user_passkey_reply {
-        bdaddr_t bdaddr;
-        __u8 status;
+        struct mgmt_addr_info addr;
 } __packed;
 
-#define MGMT_OP_USER_PASSKEY_NEG_REPLY  0x001D
+#define MGMT_OP_USER_PASSKEY_NEG_REPLY  0x001F
 struct mgmt_cp_user_passkey_neg_reply {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
 } __packed;
+#define MGMT_USER_PASSKEY_NEG_REPLY_SIZE MGMT_ADDR_INFO_SIZE
 
-#define MGMT_OP_READ_LOCAL_OOB_DATA     0x001E
+#define MGMT_OP_READ_LOCAL_OOB_DATA     0x0020
+#define MGMT_READ_LOCAL_OOB_DATA_SIZE   0
 struct mgmt_rp_read_local_oob_data {
-        __u8 hash[16];
-        __u8 randomizer[16];
+        __u8    hash[16];
+        __u8    randomizer[16];
 } __packed;
 
-#define MGMT_OP_ADD_REMOTE_OOB_DATA     0x001F
+#define MGMT_OP_ADD_REMOTE_OOB_DATA     0x0021
 struct mgmt_cp_add_remote_oob_data {
-        bdaddr_t bdaddr;
-        __u8 hash[16];
-        __u8 randomizer[16];
+        struct mgmt_addr_info addr;
+        __u8    hash[16];
+        __u8    randomizer[16];
 } __packed;
+#define MGMT_ADD_REMOTE_OOB_DATA_SIZE   (MGMT_ADDR_INFO_SIZE + 32)
 
-#define MGMT_OP_REMOVE_REMOTE_OOB_DATA  0x0020
+#define MGMT_OP_REMOVE_REMOTE_OOB_DATA  0x0022
 struct mgmt_cp_remove_remote_oob_data {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
 } __packed;
+#define MGMT_REMOVE_REMOTE_OOB_DATA_SIZE MGMT_ADDR_INFO_SIZE
 
-#define MGMT_OP_START_DISCOVERY         0x0021
+#define MGMT_OP_START_DISCOVERY         0x0023
 struct mgmt_cp_start_discovery {
         __u8 type;
 } __packed;
+#define MGMT_START_DISCOVERY_SIZE       1
 
-#define MGMT_OP_STOP_DISCOVERY          0x0022
+#define MGMT_OP_STOP_DISCOVERY          0x0024
+struct mgmt_cp_stop_discovery {
+        __u8 type;
+} __packed;
+#define MGMT_STOP_DISCOVERY_SIZE        1
 
-#define MGMT_OP_CONFIRM_NAME            0x0023
+#define MGMT_OP_CONFIRM_NAME            0x0025
 struct mgmt_cp_confirm_name {
-        bdaddr_t bdaddr;
-        __u8 name_known;
+        struct mgmt_addr_info addr;
+        __u8    name_known;
 } __packed;
+#define MGMT_CONFIRM_NAME_SIZE          (MGMT_ADDR_INFO_SIZE + 1)
 struct mgmt_rp_confirm_name {
-        bdaddr_t bdaddr;
-        __u8 status;
+        struct mgmt_addr_info addr;
 } __packed;
 
-#define MGMT_OP_BLOCK_DEVICE            0x0024
+#define MGMT_OP_BLOCK_DEVICE            0x0026
 struct mgmt_cp_block_device {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
 } __packed;
+#define MGMT_BLOCK_DEVICE_SIZE          MGMT_ADDR_INFO_SIZE
 
-#define MGMT_OP_UNBLOCK_DEVICE          0x0025
+#define MGMT_OP_UNBLOCK_DEVICE          0x0027
 struct mgmt_cp_unblock_device {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
 } __packed;
+#define MGMT_UNBLOCK_DEVICE_SIZE        MGMT_ADDR_INFO_SIZE
 
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
-        __le16 opcode;
-        __u8 data[0];
+        __le16  opcode;
+        __u8    status;
+        __u8    data[0];
 } __packed;
 
 #define MGMT_EV_CMD_STATUS              0x0002
 struct mgmt_ev_cmd_status {
-        __u8 status;
-        __le16 opcode;
+        __le16  opcode;
+        __u8    status;
 } __packed;
 
 #define MGMT_EV_CONTROLLER_ERROR        0x0003
 struct mgmt_ev_controller_error {
-        __u8 error_code;
+        __u8    error_code;
 } __packed;
 
 #define MGMT_EV_INDEX_ADDED             0x0004
@@ -313,78 +367,96 @@ struct mgmt_ev_controller_error {
 
 #define MGMT_EV_CLASS_OF_DEV_CHANGED    0x0007
 struct mgmt_ev_class_of_dev_changed {
-        __u8 dev_class[3];
+        __u8    dev_class[3];
 };
 
 #define MGMT_EV_LOCAL_NAME_CHANGED      0x0008
 struct mgmt_ev_local_name_changed {
-        __u8 name[MGMT_MAX_NAME_LENGTH];
-        __u8 short_name[MGMT_MAX_SHORT_NAME_LENGTH];
+        __u8    name[MGMT_MAX_NAME_LENGTH];
+        __u8    short_name[MGMT_MAX_SHORT_NAME_LENGTH];
 } __packed;
 
 #define MGMT_EV_NEW_LINK_KEY            0x0009
 struct mgmt_ev_new_link_key {
-        __u8 store_hint;
+        __u8    store_hint;
         struct mgmt_link_key_info key;
 } __packed;
 
-#define MGMT_EV_CONNECTED               0x000A
+#define MGMT_EV_NEW_LONG_TERM_KEY       0x000A
+struct mgmt_ev_new_long_term_key {
+        __u8    store_hint;
+        struct mgmt_ltk_info key;
+} __packed;
 
-#define MGMT_EV_DISCONNECTED            0x000B
+#define MGMT_EV_DEVICE_CONNECTED        0x000B
+struct mgmt_ev_device_connected {
+        struct mgmt_addr_info addr;
+        __le32  flags;
+        __le16  eir_len;
+        __u8    eir[0];
+} __packed;
+
+#define MGMT_EV_DEVICE_DISCONNECTED     0x000C
 
-#define MGMT_EV_CONNECT_FAILED          0x000C
+#define MGMT_EV_CONNECT_FAILED          0x000D
 struct mgmt_ev_connect_failed {
         struct mgmt_addr_info addr;
-        __u8 status;
+        __u8    status;
 } __packed;
 
-#define MGMT_EV_PIN_CODE_REQUEST        0x000D
+#define MGMT_EV_PIN_CODE_REQUEST        0x000E
 struct mgmt_ev_pin_code_request {
-        bdaddr_t bdaddr;
-        __u8 secure;
+        struct mgmt_addr_info addr;
+        __u8    secure;
 } __packed;
 
-#define MGMT_EV_USER_CONFIRM_REQUEST    0x000E
+#define MGMT_EV_USER_CONFIRM_REQUEST    0x000F
 struct mgmt_ev_user_confirm_request {
-        bdaddr_t bdaddr;
-        __u8 confirm_hint;
-        __le32 value;
+        struct mgmt_addr_info addr;
+        __u8    confirm_hint;
+        __le32  value;
 } __packed;
 
-#define MGMT_EV_USER_PASSKEY_REQUEST    0x000F
+#define MGMT_EV_USER_PASSKEY_REQUEST    0x0010
 struct mgmt_ev_user_passkey_request {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
 } __packed;
 
-#define MGMT_EV_AUTH_FAILED             0x0010
+#define MGMT_EV_AUTH_FAILED             0x0011
 struct mgmt_ev_auth_failed {
-        bdaddr_t bdaddr;
-        __u8 status;
+        struct mgmt_addr_info addr;
+        __u8    status;
 } __packed;
 
-#define MGMT_EV_DEVICE_FOUND            0x0011
+#define MGMT_DEV_FOUND_CONFIRM_NAME    0x01
+#define MGMT_DEV_FOUND_LEGACY_PAIRING  0x02
+
+#define MGMT_EV_DEVICE_FOUND            0x0012
 struct mgmt_ev_device_found {
         struct mgmt_addr_info addr;
-        __u8 dev_class[3];
-        __s8 rssi;
-        __u8 confirm_name;
-        __u8 eir[HCI_MAX_EIR_LENGTH];
-} __packed;
-
-#define MGMT_EV_REMOTE_NAME             0x0012
-struct mgmt_ev_remote_name {
-        bdaddr_t bdaddr;
-        __u8 name[MGMT_MAX_NAME_LENGTH];
+        __s8    rssi;
+        __u8    flags[4];
+        __le16  eir_len;
+        __u8    eir[0];
 } __packed;
 
 #define MGMT_EV_DISCOVERING             0x0013
+struct mgmt_ev_discovering {
+        __u8    type;
+        __u8    discovering;
+} __packed;
 
 #define MGMT_EV_DEVICE_BLOCKED          0x0014
 struct mgmt_ev_device_blocked {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
 } __packed;
 
 #define MGMT_EV_DEVICE_UNBLOCKED        0x0015
 struct mgmt_ev_device_unblocked {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
+} __packed;
+
+#define MGMT_EV_DEVICE_UNPAIRED         0x0016
+struct mgmt_ev_device_unpaired {
+        struct mgmt_addr_info addr;
 } __packed;
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
index aeaf5fa2b9f1..7b3acdd29134 100644
--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -127,7 +127,7 @@ struct smp_chan {
         u8              rrnd[16]; /* SMP Pairing Random (remote) */
         u8              pcnf[16]; /* SMP Pairing Confirm */
         u8              tk[16]; /* SMP Temporary Key */
-        u8              smp_key_size;
+        u8              enc_key_size;
         unsigned long   smp_flags;
         struct crypto_blkcipher *tfm;
         struct work_struct confirm;
diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
index 8d552519ff67..6db8ecf52aa2 100644
--- a/include/net/caif/caif_hsi.h
+++ b/include/net/caif/caif_hsi.h
@@ -138,6 +138,7 @@ struct cfhsi {
         u8 *rx_ptr;
         u8 *tx_buf;
         u8 *rx_buf;
+        u8 *rx_flip_buf;
         spinlock_t lock;
         int flow_off_sent;
         u32 q_low_mark;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index a067d30ce73e..69b7ad3a9925 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -120,6 +120,7 @@ enum ieee80211_channel_flags {
  * @band: band this channel belongs to.
  * @max_antenna_gain: maximum antenna gain in dBi
  * @max_power: maximum transmission power (in dBm)
+ * @max_reg_power: maximum regulatory transmission power (in dBm)
  * @beacon_found: helper to regulatory code to indicate when a beacon
  *      has been found on this channel. Use regulatory_hint_found_beacon()
  *      to enable this, this is useful only on 5 GHz band.
@@ -133,6 +134,7 @@ struct ieee80211_channel {
         u32 flags;
         int max_antenna_gain;
         int max_power;
+        int max_reg_power;
         bool beacon_found;
         u32 orig_flags;
         int orig_mag, orig_mpwr;
@@ -364,25 +366,13 @@ struct cfg80211_crypto_settings {
 };
 
 /**
- * struct beacon_parameters - beacon parameters
- *
- * Used to configure the beacon for an interface.
- *
+ * struct cfg80211_beacon_data - beacon data
  * @head: head portion of beacon (before TIM IE)
  *     or %NULL if not changed
  * @tail: tail portion of beacon (after TIM IE)
  *     or %NULL if not changed
- * @interval: beacon interval or zero if not changed
- * @dtim_period: DTIM period or zero if not changed
  * @head_len: length of @head
  * @tail_len: length of @tail
- * @ssid: SSID to be used in the BSS (note: may be %NULL if not provided from
- *      user space)
- * @ssid_len: length of @ssid
- * @hidden_ssid: whether to hide the SSID in Beacon/Probe Response frames
- * @crypto: crypto settings
- * @privacy: the BSS uses privacy
- * @auth_type: Authentication type (algorithm)
  * @beacon_ies: extra information element(s) to add into Beacon frames or %NULL
  * @beacon_ies_len: length of beacon_ies in octets
  * @proberesp_ies: extra information element(s) to add into Probe Response
@@ -394,24 +384,48 @@ struct cfg80211_crypto_settings {
  * @probe_resp_len: length of probe response template (@probe_resp)
  * @probe_resp: probe response template (AP mode only)
  */
-struct beacon_parameters {
-        u8 *head, *tail;
-        int interval, dtim_period;
-        int head_len, tail_len;
+struct cfg80211_beacon_data {
+        const u8 *head, *tail;
+        const u8 *beacon_ies;
+        const u8 *proberesp_ies;
+        const u8 *assocresp_ies;
+        const u8 *probe_resp;
+
+        size_t head_len, tail_len;
+        size_t beacon_ies_len;
+        size_t proberesp_ies_len;
+        size_t assocresp_ies_len;
+        size_t probe_resp_len;
+};
+
+/**
+ * struct cfg80211_ap_settings - AP configuration
+ *
+ * Used to configure an AP interface.
+ *
+ * @beacon: beacon data
+ * @beacon_interval: beacon interval
+ * @dtim_period: DTIM period
+ * @ssid: SSID to be used in the BSS (note: may be %NULL if not provided from
+ *      user space)
+ * @ssid_len: length of @ssid
+ * @hidden_ssid: whether to hide the SSID in Beacon/Probe Response frames
+ * @crypto: crypto settings
+ * @privacy: the BSS uses privacy
+ * @auth_type: Authentication type (algorithm)
+ * @inactivity_timeout: time in seconds to determine station's inactivity.
+ */
+struct cfg80211_ap_settings {
+        struct cfg80211_beacon_data beacon;
+
+        int beacon_interval, dtim_period;
         const u8 *ssid;
         size_t ssid_len;
         enum nl80211_hidden_ssid hidden_ssid;
         struct cfg80211_crypto_settings crypto;
         bool privacy;
         enum nl80211_auth_type auth_type;
-        const u8 *beacon_ies;
-        size_t beacon_ies_len;
-        const u8 *proberesp_ies;
-        size_t proberesp_ies_len;
-        const u8 *assocresp_ies;
-        size_t assocresp_ies_len;
-        int probe_resp_len;
-        u8 *probe_resp;
+        int inactivity_timeout;
 };
 
 /**
@@ -796,6 +810,8 @@ struct mesh_config {
          * mesh gate, but not necessarily using the gate announcement protocol.
          * Still keeping the same nomenclature to be in sync with the spec. */
         bool  dot11MeshGateAnnouncementProtocol;
+        bool dot11MeshForwarding;
+        s32 rssi_threshold;
 };
 
 /**
@@ -1036,10 +1052,6 @@ const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
  * @key_len: length of WEP key for shared key authentication
  * @key_idx: index of WEP key for shared key authentication
  * @key: WEP key for shared key authentication
- * @local_state_change: This is a request for a local state only, i.e., no
- *      Authentication frame is to be transmitted and authentication state is
- *      to be changed without having to wait for a response from the peer STA
- *      (AP).
  */
 struct cfg80211_auth_request {
         struct cfg80211_bss *bss;
@@ -1048,7 +1060,6 @@ struct cfg80211_auth_request {
         enum nl80211_auth_type auth_type;
         const u8 *key;
         u8 key_len, key_idx;
-        bool local_state_change;
 };
 
 /**
@@ -1065,7 +1076,11 @@ enum cfg80211_assoc_req_flags {
  *
  * This structure provides information needed to complete IEEE 802.11
  * (re)association.
- * @bss: The BSS to associate with.
+ * @bss: The BSS to associate with. If the call is successful the driver
+ *      is given a reference that it must release, normally via a call to
+ *      cfg80211_send_rx_assoc(), or, if association timed out, with a
+ *      call to cfg80211_put_bss() (in addition to calling
+ *      cfg80211_send_assoc_timeout())
  * @ie: Extra IEs to add to (Re)Association Request frame or %NULL
  * @ie_len: Length of ie buffer in octets
  * @use_mfp: Use management frame protection (IEEE 802.11w) in this association
@@ -1093,19 +1108,16 @@ struct cfg80211_assoc_request {
  * This structure provides information needed to complete IEEE 802.11
  * deauthentication.
  *
- * @bss: the BSS to deauthenticate from
+ * @bssid: the BSSID of the BSS to deauthenticate from
  * @ie: Extra IEs to add to Deauthentication frame or %NULL
  * @ie_len: Length of ie buffer in octets
  * @reason_code: The reason code for the deauthentication
- * @local_state_change: This is a request for a local state only, i.e., no
- *      Deauthentication frame is to be transmitted.
  */
 struct cfg80211_deauth_request {
-        struct cfg80211_bss *bss;
+        const u8 *bssid;
         const u8 *ie;
         size_t ie_len;
         u16 reason_code;
-        bool local_state_change;
 };
 
 /**
@@ -1148,6 +1160,10 @@ struct cfg80211_disassoc_request {
  * @beacon_interval: beacon interval to use
  * @privacy: this is a protected network, keys will be configured
  *      after joining
+ * @control_port: whether user space controls IEEE 802.1X port, i.e.,
+ *      sets/clears %NL80211_STA_FLAG_AUTHORIZED. If true, the driver is
+ *      required to assume that the port is unauthorized until authorized by
+ *      user space. Otherwise, port is marked authorized by default.
  * @basic_rates: bitmap of basic rates to use when creating the IBSS
  * @mcast_rate: per-band multicast rate index + 1 (0: disabled)
  */
@@ -1162,6 +1178,7 @@ struct cfg80211_ibss_params {
         u32 basic_rates;
         bool channel_fixed;
         bool privacy;
+        bool control_port;
         int mcast_rate[IEEE80211_NUM_BANDS];
 };
 
@@ -1186,6 +1203,8 @@ struct cfg80211_ibss_params {
  * @key_idx: index of WEP key for shared key authentication
  * @key: WEP key for shared key authentication
  * @flags:  See &enum cfg80211_assoc_req_flags
+ * @bg_scan_period:  Background scan period in seconds
+ *   or -1 to indicate that default value is to be used.
  * @ht_capa:  HT Capabilities over-rides.  Values set in ht_capa_mask
  *   will be used in ht_capa.  Un-supported values will be ignored.
  * @ht_capa_mask:  The bits of ht_capa which are to be used.
@@ -1203,6 +1222,7 @@ struct cfg80211_connect_params {
         const u8 *key;
         u8 key_len, key_idx;
         u32 flags;
+        int bg_scan_period;
         struct ieee80211_ht_cap ht_capa;
         struct ieee80211_ht_cap ht_capa_mask;
 };
@@ -1229,8 +1249,7 @@ enum wiphy_params_flags {
 struct cfg80211_bitrate_mask {
         struct {
                 u32 legacy;
-                /* TODO: add support for masking MCS rates; e.g.: */
-                /* u8 mcs[IEEE80211_HT_MCS_MASK_LEN]; */
+                u8 mcs[IEEE80211_HT_MCS_MASK_LEN];
         } control[IEEE80211_NUM_BANDS];
 };
 /**
@@ -1343,12 +1362,10 @@ struct cfg80211_gtk_rekey_data {
  *
  * @set_rekey_data: give the data necessary for GTK rekeying to the driver
  *
- * @add_beacon: Add a beacon with given parameters, @head, @interval
- *      and @dtim_period will be valid, @tail is optional.
- * @set_beacon: Change the beacon parameters for an access point mode
- *      interface. This should reject the call when no beacon has been
- *      configured.
- * @del_beacon: Remove beacon configuration and stop sending the beacon.
+ * @start_ap: Start acting in AP mode defined by the parameters.
+ * @change_beacon: Change the beacon parameters for an access point mode
+ *      interface. This should reject the call when AP mode wasn't started.
+ * @stop_ap: Stop being an AP, including stopping beaconing.
  *
  * @add_station: Add a new station.
  * @del_station: Remove a station; @mac may be NULL to remove all stations.
@@ -1515,11 +1532,11 @@ struct cfg80211_ops {
                                         struct net_device *netdev,
                                         u8 key_index);
 
-        int     (*add_beacon)(struct wiphy *wiphy, struct net_device *dev,
-                              struct beacon_parameters *info);
-        int     (*set_beacon)(struct wiphy *wiphy, struct net_device *dev,
-                              struct beacon_parameters *info);
-        int     (*del_beacon)(struct wiphy *wiphy, struct net_device *dev);
+        int     (*start_ap)(struct wiphy *wiphy, struct net_device *dev,
+                            struct cfg80211_ap_settings *settings);
+        int     (*change_beacon)(struct wiphy *wiphy, struct net_device *dev,
+                                 struct cfg80211_beacon_data *info);
+        int     (*stop_ap)(struct wiphy *wiphy, struct net_device *dev);
 
 
         int     (*add_station)(struct wiphy *wiphy, struct net_device *dev,
@@ -1574,11 +1591,9 @@ struct cfg80211_ops {
         int     (*assoc)(struct wiphy *wiphy, struct net_device *dev,
                          struct cfg80211_assoc_request *req);
         int     (*deauth)(struct wiphy *wiphy, struct net_device *dev,
-                          struct cfg80211_deauth_request *req,
-                          void *cookie);
+                          struct cfg80211_deauth_request *req);
         int     (*disassoc)(struct wiphy *wiphy, struct net_device *dev,
-                            struct cfg80211_disassoc_request *req,
-                            void *cookie);
+                            struct cfg80211_disassoc_request *req);
 
         int     (*connect)(struct wiphy *wiphy, struct net_device *dev,
                            struct cfg80211_connect_params *sme);
@@ -2204,8 +2219,6 @@ struct cfg80211_conn;
 struct cfg80211_internal_bss;
 struct cfg80211_cached_keys;
 
-#define MAX_AUTH_BSSES          4
-
 /**
  * struct wireless_dev - wireless per-netdev state
  *
@@ -2269,8 +2282,6 @@ struct wireless_dev {
         struct list_head event_list;
         spinlock_t event_lock;
 
-        struct cfg80211_internal_bss *authtry_bsses[MAX_AUTH_BSSES];
-        struct cfg80211_internal_bss *auth_bsses[MAX_AUTH_BSSES];
         struct cfg80211_internal_bss *current_bss; /* associated / joined */
         struct ieee80211_channel *channel;
 
@@ -2686,7 +2697,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
  * @wiphy: the wiphy reporting the BSS
  * @channel: The channel the frame was received on
  * @bssid: the BSSID of the BSS
- * @timestamp: the TSF timestamp sent by the peer
+ * @tsf: the TSF sent by the peer in the beacon/probe response (or 0)
  * @capability: the capability field sent by the peer
  * @beacon_interval: the beacon interval announced by the peer
  * @ie: additional IEs sent by the peer
@@ -2702,9 +2713,8 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
 struct cfg80211_bss * __must_check
 cfg80211_inform_bss(struct wiphy *wiphy,
                     struct ieee80211_channel *channel,
-                    const u8 *bssid,
-                    u64 timestamp, u16 capability, u16 beacon_interval,
-                    const u8 *ie, size_t ielen,
+                    const u8 *bssid, u64 tsf, u16 capability,
+                    u16 beacon_interval, const u8 *ie, size_t ielen,
                     s32 signal, gfp_t gfp);
 
 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
@@ -2725,6 +2735,20 @@ struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
                                        struct ieee80211_channel *channel,
                                        const u8 *meshid, size_t meshidlen,
                                        const u8 *meshcfg);
+/**
+ * cfg80211_ref_bss - reference BSS struct
+ * @bss: the BSS struct to reference
+ *
+ * Increments the refcount of the given BSS struct.
+ */
+void cfg80211_ref_bss(struct cfg80211_bss *bss);
+
+/**
+ * cfg80211_put_bss - unref BSS struct
+ * @bss: the BSS struct
+ *
+ * Decrements the refcount of the given BSS struct.
+ */
 void cfg80211_put_bss(struct cfg80211_bss *bss);
 
 /**
@@ -2762,20 +2786,10 @@ void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr);
 
 /**
- * __cfg80211_auth_canceled - notify cfg80211 that authentication was canceled
- * @dev: network device
- * @addr: The MAC address of the device with which the authentication timed out
- *
- * When a pending authentication had no action yet, the driver may decide
- * to not send a deauth frame, but in that case must calls this function
- * to tell cfg80211 about this decision. It is only valid to call this
- * function within the deauth() callback.
- */
-void __cfg80211_auth_canceled(struct net_device *dev, const u8 *addr);
-
-/**
  * cfg80211_send_rx_assoc - notification of processed association
  * @dev: network device
+ * @bss: the BSS struct association was requested for, the struct reference
+ *      is owned by cfg80211 after this call
  * @buf: (re)association response frame (header + body)
  * @len: length of the frame data
  *
@@ -2784,7 +2798,8 @@ void __cfg80211_auth_canceled(struct net_device *dev, const u8 *addr);
  * function or cfg80211_send_assoc_timeout() to indicate the result of
  * cfg80211_ops::assoc() call. This function may sleep.
  */
-void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len);
+void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
+                            const u8 *buf, size_t len);
 
 /**
  * cfg80211_send_assoc_timeout - notification of timed out association
@@ -3176,6 +3191,7 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
  * cfg80211_rx_mgmt - notification of received, unprocessed management frame
  * @dev: network device
  * @freq: Frequency on which the frame was received in MHz
+ * @sig_dbm: signal strength in mBm, or 0 if unknown
  * @buf: Management frame (header + body)
  * @len: length of the frame data
  * @gfp: context flags
@@ -3188,8 +3204,8 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
  * This function is called whenever an Action frame is received for a station
  * mode interface, but is not processed in kernel.
  */
-bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
-                      size_t len, gfp_t gfp);
+bool cfg80211_rx_mgmt(struct net_device *dev, int freq, int sig_dbm,
+                      const u8 *buf, size_t len, gfp_t gfp);
 
 /**
  * cfg80211_mgmt_tx_status - notification of TX status for management frame
@@ -3302,6 +3318,7 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
  * @frame: the frame
  * @len: length of the frame
  * @freq: frequency the frame was received on
+ * @sig_dbm: signal strength in mBm, or 0 if unknown
  * @gfp: allocation flags
  *
  * Use this function to report to userspace when a beacon was
@@ -3310,7 +3327,7 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
  */
 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
                                  const u8 *frame, size_t len,
-                                 int freq, gfp_t gfp);
+                                 int freq, int sig_dbm, gfp_t gfp);
 
 /*
  * cfg80211_can_beacon_sec_chan - test if ht40 on extension channel can be used
@@ -3322,6 +3339,14 @@ int cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
                                  struct ieee80211_channel *chan,
                                  enum nl80211_channel_type channel_type);
 
+/*
+ * cfg80211_calculate_bitrate - calculate actual bitrate (in 100Kbps units)
+ * @rate: given rate_info to calculate bitrate from
+ *
+ * return 0 if MCS index >= 32
+ */
+u16 cfg80211_calculate_bitrate(struct rate_info *rate);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/compat.h b/include/net/compat.h
index 9ee75edcc295..a974ae92d182 100644
--- a/include/net/compat.h
+++ b/include/net/compat.h
@@ -41,7 +41,7 @@ extern int compat_sock_get_timestampns(struct sock *, struct timespec __user *);
 #endif /* defined(CONFIG_COMPAT) */
 
 extern int get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *);
-extern int verify_compat_iovec(struct msghdr *, struct iovec *, struct sockaddr *, int);
+extern int verify_compat_iovec(struct msghdr *, struct iovec *, struct sockaddr_storage *, int);
 extern asmlinkage long compat_sys_sendmsg(int,struct compat_msghdr __user *,unsigned);
 extern asmlinkage long compat_sys_sendmmsg(int, struct compat_mmsghdr __user *,
                                            unsigned, unsigned);
diff --git a/include/net/dcbnl.h b/include/net/dcbnl.h
index 2cd66d0be348..f55c980d8e23 100644
--- a/include/net/dcbnl.h
+++ b/include/net/dcbnl.h
@@ -72,8 +72,8 @@ struct dcbnl_rtnl_ops {
         void (*getpfccfg)(struct net_device *, int, u8 *);
         u8   (*setall)(struct net_device *);
         u8   (*getcap)(struct net_device *, int, u8 *);
-        u8   (*getnumtcs)(struct net_device *, int, u8 *);
-        u8   (*setnumtcs)(struct net_device *, int, u8);
+        int  (*getnumtcs)(struct net_device *, int, u8 *);
+        int  (*setnumtcs)(struct net_device *, int, u8);
         u8   (*getpfcstate)(struct net_device *);
         void (*setpfcstate)(struct net_device *, u8);
         void (*getbcncfg)(struct net_device *, int, u32 *);
diff --git a/include/net/dn.h b/include/net/dn.h
index 298521e0d8a2..814af0b9387d 100644
--- a/include/net/dn.h
+++ b/include/net/dn.h
@@ -3,6 +3,7 @@
 
 #include <linux/dn.h>
 #include <net/sock.h>
+#include <net/flow.h>
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
 
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 7db32995ccd3..ccb68880abf5 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -131,35 +131,8 @@ extern void genl_unregister_mc_group(struct genl_family *family,
 extern void genl_notify(struct sk_buff *skb, struct net *net, u32 pid,
                         u32 group, struct nlmsghdr *nlh, gfp_t flags);
 
-/**
- * genlmsg_put - Add generic netlink header to netlink message
- * @skb: socket buffer holding the message
- * @pid: netlink pid the message is addressed to
- * @seq: sequence number (usually the one of the sender)
- * @family: generic netlink family
- * @flags netlink message flags
- * @cmd: generic netlink command
- *
- * Returns pointer to user specific header
- */
-static inline void *genlmsg_put(struct sk_buff *skb, u32 pid, u32 seq,
-                                struct genl_family *family, int flags, u8 cmd)
-{
-        struct nlmsghdr *nlh;
-        struct genlmsghdr *hdr;
-
-        nlh = nlmsg_put(skb, pid, seq, family->id, GENL_HDRLEN +
-                        family->hdrsize, flags);
-        if (nlh == NULL)
-                return NULL;
-
-        hdr = nlmsg_data(nlh);
-        hdr->cmd = cmd;
-        hdr->version = family->version;
-        hdr->reserved = 0;
-
-        return (char *) hdr + GENL_HDRLEN;
-}
+void *genlmsg_put(struct sk_buff *skb, u32 pid, u32 seq,
+                                struct genl_family *family, int flags, u8 cmd);
 
 /**
  * genlmsg_nlhdr - Obtain netlink header from user specified header
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index e3e405106afe..ae17e1352d7e 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -132,6 +132,7 @@ struct rtable;
  * @tos - TOS
  * @mc_ttl - Multicasting TTL
  * @is_icsk - is this an inet_connection_sock?
+ * @uc_index - Unicast outgoing device index
  * @mc_index - Multicast device index
  * @mc_list - Group array
  * @cork - info to build ip hdr on each ip frag while socket is corked
@@ -167,6 +168,8 @@ struct inet_sock {
                                 transparent:1,
                                 mc_all:1,
                                 nodefrag:1;
+        __u8                    rcv_tos;
+        int                     uc_index;
         int                     mc_index;
         __be32                  mc_addr;
         struct ip_mc_socklist __rcu     *mc_list;
diff --git a/include/net/ip.h b/include/net/ip.h
index 775009f9eaba..b53d65f24f7b 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -388,7 +388,7 @@ static inline int sk_mc_loop(struct sock *sk)
         return 1;
 }
 
-extern int      ip_call_ra_chain(struct sk_buff *skb);
+extern bool ip_call_ra_chain(struct sk_buff *skb);
 
 /*
  *      Functions provided by ip_fragment.c
diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
index 0954ec959159..cc7c19732389 100644
--- a/include/net/iucv/af_iucv.h
+++ b/include/net/iucv/af_iucv.h
@@ -62,6 +62,7 @@ struct sock_msg_q {
 #define AF_IUCV_FLAG_SYN 0x2
 #define AF_IUCV_FLAG_FIN 0x4
 #define AF_IUCV_FLAG_WIN 0x8
+#define AF_IUCV_FLAG_SHT 0x10
 
 struct af_iucv_trans_hdr {
         u16 magic;
@@ -113,6 +114,7 @@ struct iucv_sock {
         spinlock_t              accept_q_lock;
         struct sock             *parent;
         struct iucv_path        *path;
+        struct net_device       *hs_dev;
         struct sk_buff_head     send_skb_q;
         struct sk_buff_head     backlog_skb_q;
         struct sock_msg_q       message_q;
@@ -131,6 +133,7 @@ struct iucv_sock {
 /* iucv socket options (SOL_IUCV) */
 #define SO_IPRMDATA_MSG 0x0080          /* send/recv IPRM_DATA msgs */
 #define SO_MSGLIMIT     0x1000          /* get/set IUCV MSGLIMIT */
+#define SO_MSGSIZE      0x0800          /* get maximum msgsize */
 
 /* iucv related control messages (scm) */
 #define SCM_IUCV_TRGCLS 0x0001          /* target class control message */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index d49928ba5d09..9a012be615ff 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -229,7 +229,8 @@ enum ieee80211_rssi_event {
  *      valid in station mode only while @assoc is true and if also
  *      requested by %IEEE80211_HW_NEED_DTIM_PERIOD (cf. also hw conf
  *      @ps_dtim_period)
- * @timestamp: beacon timestamp
+ * @last_tsf: last beacon's/probe response's TSF timestamp (could be old
+ *      as it may have been received during scanning long ago)
  * @beacon_int: beacon interval
  * @assoc_capability: capabilities taken from assoc resp
  * @basic_rates: bitmap of basic rates, each bit stands for an
@@ -276,7 +277,7 @@ struct ieee80211_bss_conf {
         u8 dtim_period;
         u16 beacon_int;
         u16 assoc_capability;
-        u64 timestamp;
+        u64 last_tsf;
         u32 basic_rates;
         int mcast_rate[IEEE80211_NUM_BANDS];
         u16 ht_operation_mode;
@@ -341,9 +342,9 @@ struct ieee80211_bss_conf {
  *      used to indicate that a frame was already retried due to PS
  * @IEEE80211_TX_INTFL_DONT_ENCRYPT: completely internal to mac80211,
  *      used to indicate frame should not be encrypted
- * @IEEE80211_TX_CTL_POLL_RESPONSE: This frame is a response to a poll
- *      frame (PS-Poll or uAPSD) and should be sent although the station
- *      is in powersave mode.
+ * @IEEE80211_TX_CTL_NO_PS_BUFFER: This frame is a response to a poll
+ *      frame (PS-Poll or uAPSD) or a non-bufferable MMPDU and must
+ *      be sent although the station is in powersave mode.
  * @IEEE80211_TX_CTL_MORE_FRAMES: More frames will be passed to the
  *      transmit function after the current frame, this can be used
  *      by drivers to kick the DMA queue only if unset or when the
@@ -399,7 +400,7 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
         IEEE80211_TX_INTFL_RETRIED              = BIT(15),
         IEEE80211_TX_INTFL_DONT_ENCRYPT         = BIT(16),
-        IEEE80211_TX_CTL_POLL_RESPONSE          = BIT(17),
+        IEEE80211_TX_CTL_NO_PS_BUFFER           = BIT(17),
         IEEE80211_TX_CTL_MORE_FRAMES            = BIT(18),
         IEEE80211_TX_INTFL_RETRANSMISSION       = BIT(19),
         /* hole at 20, use later */
@@ -425,7 +426,7 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_SEND_AFTER_DTIM | IEEE80211_TX_CTL_AMPDU |           \
         IEEE80211_TX_STAT_TX_FILTERED | IEEE80211_TX_STAT_ACK |               \
         IEEE80211_TX_STAT_AMPDU | IEEE80211_TX_STAT_AMPDU_NO_BACK |           \
-        IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_POLL_RESPONSE |   \
+        IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_NO_PS_BUFFER |    \
         IEEE80211_TX_CTL_MORE_FRAMES | IEEE80211_TX_CTL_LDPC |                \
         IEEE80211_TX_CTL_STBC | IEEE80211_TX_STATUS_EOSP)
 
@@ -659,6 +660,8 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  * @RX_FLAG_HT: HT MCS was used and rate_idx is MCS index
  * @RX_FLAG_40MHZ: HT40 (40 MHz) was used
  * @RX_FLAG_SHORT_GI: Short guard interval was used
+ * @RX_FLAG_NO_SIGNAL_VAL: The signal strength value is not present.
+ *      Valid only for data frames (mainly A-MPDU)
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR      = 1<<0,
@@ -672,6 +675,7 @@ enum mac80211_rx_flags {
         RX_FLAG_HT              = 1<<9,
         RX_FLAG_40MHZ           = 1<<10,
         RX_FLAG_SHORT_GI        = 1<<11,
+        RX_FLAG_NO_SIGNAL_VAL   = 1<<12,
 };
 
 /**
@@ -852,6 +856,21 @@ struct ieee80211_channel_switch {
 };
 
 /**
+ * enum ieee80211_vif_flags - virtual interface flags
+ *
+ * @IEEE80211_VIF_BEACON_FILTER: the device performs beacon filtering
+ *      on this virtual interface to avoid unnecessary CPU wakeups
+ * @IEEE80211_VIF_SUPPORTS_CQM_RSSI: the device can do connection quality
+ *      monitoring on this virtual interface -- i.e. it can monitor
+ *      connection quality related parameters, such as the RSSI level and
+ *      provide notifications if configured trigger levels are reached.
+ */
+enum ieee80211_vif_flags {
+        IEEE80211_VIF_BEACON_FILTER             = BIT(0),
+        IEEE80211_VIF_SUPPORTS_CQM_RSSI         = BIT(1),
+};
+
+/**
  * struct ieee80211_vif - per-interface data
  *
  * Data in this structure is continually present for driver
@@ -863,6 +882,10 @@ struct ieee80211_channel_switch {
  * @addr: address of this interface
  * @p2p: indicates whether this AP or STA interface is a p2p
  *      interface, i.e. a GO or p2p-sta respectively
+ * @driver_flags: flags/capabilities the driver has for this interface,
+ *      these need to be set (or cleared) when the interface is added
+ *      or, if supported by the driver, the interface type is changed
+ *      at runtime, mac80211 will never touch this field
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *).
  */
@@ -871,6 +894,7 @@ struct ieee80211_vif {
         struct ieee80211_bss_conf bss_conf;
         u8 addr[ETH_ALEN];
         bool p2p;
+        u32 driver_flags;
         /* must be last */
         u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
 };
@@ -962,6 +986,25 @@ enum set_key_cmd {
 };
 
 /**
+ * enum ieee80211_sta_state - station state
+ *
+ * @IEEE80211_STA_NOTEXIST: station doesn't exist at all,
+ *      this is a special state for add/remove transitions
+ * @IEEE80211_STA_NONE: station exists without special state
+ * @IEEE80211_STA_AUTH: station is authenticated
+ * @IEEE80211_STA_ASSOC: station is associated
+ * @IEEE80211_STA_AUTHORIZED: station is authorized (802.1X)
+ */
+enum ieee80211_sta_state {
+        /* NOTE: These need to be ordered correctly! */
+        IEEE80211_STA_NOTEXIST,
+        IEEE80211_STA_NONE,
+        IEEE80211_STA_AUTH,
+        IEEE80211_STA_ASSOC,
+        IEEE80211_STA_AUTHORIZED,
+};
+
+/**
  * struct ieee80211_sta - station table entry
  *
  * A station table entry represents a station we are possibly
@@ -1079,10 +1122,6 @@ enum sta_notify_cmd {
  * @IEEE80211_HW_MFP_CAPABLE:
  *      Hardware supports management frame protection (MFP, IEEE 802.11w).
  *
- * @IEEE80211_HW_BEACON_FILTER:
- *      Hardware supports dropping of irrelevant beacon frames to
- *      avoid waking up cpu.
- *
  * @IEEE80211_HW_SUPPORTS_STATIC_SMPS:
  *      Hardware supports static spatial multiplexing powersave,
  *      ie. can turn off all but one chain even on HT connections
@@ -1108,11 +1147,6 @@ enum sta_notify_cmd {
  *      When this flag is set, signaling beacon-loss will cause an immediate
  *      change to disassociated state.
  *
- * @IEEE80211_HW_SUPPORTS_CQM_RSSI:
- *      Hardware can do connection quality monitoring - i.e. it can monitor
- *      connection quality related parameters, such as the RSSI level and
- *      provide notifications if configured trigger levels are reached.
- *
  * @IEEE80211_HW_NEED_DTIM_PERIOD:
  *      This device needs to know the DTIM period for the BSS before
  *      associating.
@@ -1134,6 +1168,10 @@ enum sta_notify_cmd {
  * @IEEE80211_HW_TX_AMPDU_SETUP_IN_HW: The device handles TX A-MPDU session
  *      setup strictly in HW. mac80211 should not attempt to do this in
  *      software.
+ *
+ * @IEEE80211_HW_SCAN_WHILE_IDLE: The device can do hw scan while
+ *      being idle (i.e. mac80211 doesn't have to go idle-off during the
+ *      the scan).
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1150,16 +1188,17 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_PS_NULLFUNC_STACK                  = 1<<11,
         IEEE80211_HW_SUPPORTS_DYNAMIC_PS                = 1<<12,
         IEEE80211_HW_MFP_CAPABLE                        = 1<<13,
-        IEEE80211_HW_BEACON_FILTER                      = 1<<14,
+        /* reuse bit 14 */
         IEEE80211_HW_SUPPORTS_STATIC_SMPS               = 1<<15,
         IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS              = 1<<16,
         IEEE80211_HW_SUPPORTS_UAPSD                     = 1<<17,
         IEEE80211_HW_REPORTS_TX_ACK_STATUS              = 1<<18,
         IEEE80211_HW_CONNECTION_MONITOR                 = 1<<19,
-        IEEE80211_HW_SUPPORTS_CQM_RSSI                  = 1<<20,
+        /* reuse bit 20 */
         IEEE80211_HW_SUPPORTS_PER_STA_GTK               = 1<<21,
         IEEE80211_HW_AP_LINK_PS                         = 1<<22,
         IEEE80211_HW_TX_AMPDU_SETUP_IN_HW               = 1<<23,
+        IEEE80211_HW_SCAN_WHILE_IDLE                    = 1<<24,
 };
 
 /**
@@ -1446,8 +1485,8 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * way the host will only receive beacons where some relevant information
  * (for example ERP protection or WMM settings) have changed.
  *
- * Beacon filter support is advertised with the %IEEE80211_HW_BEACON_FILTER
- * hardware capability. The driver needs to enable beacon filter support
+ * Beacon filter support is advertised with the %IEEE80211_VIF_BEACON_FILTER
+ * interface capability. The driver needs to enable beacon filter support
  * whenever power save is enabled, that is %IEEE80211_CONF_PS is set. When
  * power save is enabled, the stack will not check for beacon loss and the
  * driver needs to notify about loss of beacons with ieee80211_beacon_loss().
@@ -1599,7 +1638,7 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * the station sends a PS-Poll or a uAPSD trigger frame, mac80211
  * will inform the driver of this with the @allow_buffered_frames
  * callback; this callback is optional. mac80211 will then transmit
- * the frames as usual and set the %IEEE80211_TX_CTL_POLL_RESPONSE
+ * the frames as usual and set the %IEEE80211_TX_CTL_NO_PS_BUFFER
  * on each frame. The last frame in the service period (or the only
  * response to a PS-Poll) also has %IEEE80211_TX_STATUS_EOSP set to
  * indicate that it ends the service period; as this frame must have
@@ -1607,6 +1646,9 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * When TX status is reported for this frame, the service period is
  * marked has having ended and a new one can be started by the peer.
  *
+ * Additionally, non-bufferable MMPDUs can also be transmitted by
+ * mac80211 with the %IEEE80211_TX_CTL_NO_PS_BUFFER set in them.
+ *
  * Another race condition can happen on some devices like iwlwifi
  * when there are frames queued for the station and it wakes up
  * or polls; the frames that are already queued could end up being
@@ -1725,20 +1767,6 @@ enum ieee80211_ampdu_mlme_action {
 };
 
 /**
- * enum ieee80211_tx_sync_type - TX sync type
- * @IEEE80211_TX_SYNC_AUTH: sync TX for authentication
- *      (and possibly also before direct probe)
- * @IEEE80211_TX_SYNC_ASSOC: sync TX for association
- * @IEEE80211_TX_SYNC_ACTION: sync TX for action frame
- *      (not implemented yet)
- */
-enum ieee80211_tx_sync_type {
-        IEEE80211_TX_SYNC_AUTH,
-        IEEE80211_TX_SYNC_ASSOC,
-        IEEE80211_TX_SYNC_ACTION,
-};
-
-/**
  * enum ieee80211_frame_release_type - frame release reason
  * @IEEE80211_FRAME_RELEASE_PSPOLL: frame released for PS-Poll
  * @IEEE80211_FRAME_RELEASE_UAPSD: frame(s) released due to
@@ -1848,26 +1876,6 @@ enum ieee80211_frame_release_type {
  *      of the bss parameters has changed when a call is made. The callback
  *      can sleep.
  *
- * @tx_sync: Called before a frame is sent to an AP/GO. In the GO case, the
- *      driver should sync with the GO's powersaving so the device doesn't
- *      transmit the frame while the GO is asleep. In the regular AP case
- *      it may be used by drivers for devices implementing other restrictions
- *      on talking to APs, e.g. due to regulatory enforcement or just HW
- *      restrictions.
- *      This function is called for every authentication, association and
- *      action frame separately since applications might attempt to auth
- *      with multiple APs before chosing one to associate to. If it returns
- *      an error, the corresponding authentication, association or frame
- *      transmission is aborted and reported as having failed. It is always
- *      called after tuning to the correct channel.
- *      The callback might be called multiple times before @finish_tx_sync
- *      (but @finish_tx_sync will be called once for each) but in practice
- *      this is unlikely to happen. It can also refuse in that case if the
- *      driver cannot handle that situation.
- *      This callback can sleep.
- * @finish_tx_sync: Called as a counterpart to @tx_sync, unless that returned
- *      an error. This callback can sleep.
- *
  * @prepare_multicast: Prepare for multicast filter configuration.
  *      This callback is optional, and its return value is passed
  *      to configure_filter(). This callback must be atomic.
@@ -1963,6 +1971,13 @@ enum ieee80211_frame_release_type {
  *      in AP mode, this callback will not be called when the flag
  *      %IEEE80211_HW_AP_LINK_PS is set. Must be atomic.
  *
+ * @sta_state: Notifies low level driver about state transition of a
+ *      station (which can be the AP, a client, IBSS/WDS/mesh peer etc.)
+ *      This callback is mutually exclusive with @sta_add/@sta_remove.
+ *      It must not fail for down transitions but may fail for transitions
+ *      up the list of states.
+ *      The callback can sleep.
+ *
  * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
  *      bursting) for a hardware TX queue.
  *      Returns a negative error code on failure.
@@ -2098,7 +2113,7 @@ enum ieee80211_frame_release_type {
  * @allow_buffered_frames: Prepare device to allow the given number of frames
  *      to go out to the given station. The frames will be sent by mac80211
  *      via the usual TX path after this call. The TX information for frames
- *      released will also have the %IEEE80211_TX_CTL_POLL_RESPONSE flag set
+ *      released will also have the %IEEE80211_TX_CTL_NO_PS_BUFFER flag set
  *      and the last one will also have %IEEE80211_TX_STATUS_EOSP set. In case
  *      frames from multiple TIDs are released and the driver might reorder
  *      them between the TIDs, it must set the %IEEE80211_TX_STATUS_EOSP flag
@@ -2132,13 +2147,6 @@ struct ieee80211_ops {
                                  struct ieee80211_bss_conf *info,
                                  u32 changed);
 
-        int (*tx_sync)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                       const u8 *bssid, enum ieee80211_tx_sync_type type);
-        void (*finish_tx_sync)(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
-                               const u8 *bssid,
-                               enum ieee80211_tx_sync_type type);
-
         u64 (*prepare_multicast)(struct ieee80211_hw *hw,
                                  struct netdev_hw_addr_list *mc_list);
         void (*configure_filter)(struct ieee80211_hw *hw,
@@ -2182,6 +2190,10 @@ struct ieee80211_ops {
                           struct ieee80211_sta *sta);
         void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         enum sta_notify_cmd, struct ieee80211_sta *sta);
+        int (*sta_state)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                         struct ieee80211_sta *sta,
+                         enum ieee80211_sta_state old_state,
+                         enum ieee80211_sta_state new_state);
         int (*conf_tx)(struct ieee80211_hw *hw,
                        struct ieee80211_vif *vif, u16 queue,
                        const struct ieee80211_tx_queue_params *params);
@@ -3316,7 +3328,7 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
  *
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
- * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTER and
+ * When beacon filtering is enabled with %IEEE80211_VIF_BEACON_FILTER and
  * %IEEE80211_CONF_PS is set, the driver needs to inform whenever the
  * hardware is not receiving beacons with this function.
  */
@@ -3327,7 +3339,7 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif);
  *
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
- * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTER, and
+ * When beacon filtering is enabled with %IEEE80211_VIF_BEACON_FILTER, and
  * %IEEE80211_CONF_PS and %IEEE80211_HW_CONNECTION_MONITOR are set, the driver
  * needs to inform if the connection to the AP has been lost.
  *
@@ -3397,7 +3409,7 @@ void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif);
  * @rssi_event: the RSSI trigger event type
  * @gfp: context flags
  *
- * When the %IEEE80211_HW_SUPPORTS_CQM_RSSI is set, and a connection quality
+ * When the %IEEE80211_VIF_SUPPORTS_CQM_RSSI is set, and a connection quality
  * monitoring is configured with an rssi threshold, the driver will inform
  * whenever the rssi level reaches the threshold.
  */
@@ -3516,6 +3528,8 @@ enum rate_control_changed {
  * @hw: The hardware the algorithm is invoked for.
  * @sband: The band this frame is being transmitted on.
  * @bss_conf: the current BSS configuration
+ * @skb: the skb that will be transmitted, the control information in it needs
+ *      to be filled in
  * @reported_rate: The rate control algorithm can fill this in to indicate
  *      which rate should be reported to userspace as the current rate and
  *      used for rate calculations in the mesh network.
@@ -3523,12 +3537,11 @@ enum rate_control_changed {
  *      RTS threshold
  * @short_preamble: whether mac80211 will request short-preamble transmission
  *      if the selected rate supports it
- * @max_rate_idx: user-requested maximum rate (not MCS for now)
+ * @max_rate_idx: user-requested maximum (legacy) rate
  *      (deprecated; this will be removed once drivers get updated to use
  *      rate_idx_mask)
- * @rate_idx_mask: user-requested rate mask (not MCS for now)
- * @skb: the skb that will be transmitted, the control information in it needs
- *      to be filled in
+ * @rate_idx_mask: user-requested (legacy) rate mask
+ * @rate_idx_mcs_mask: user-requested MCS rate mask
  * @bss: whether this frame is sent out in AP or IBSS mode
  */
 struct ieee80211_tx_rate_control {
@@ -3540,6 +3553,7 @@ struct ieee80211_tx_rate_control {
         bool rts, short_preamble;
         u8 max_rate_idx;
         u32 rate_idx_mask;
+        u8 rate_idx_mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
         bool bss;
 };
 
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index e3133c23980e..6f9c25a76cd1 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -133,7 +133,6 @@ extern void			ndisc_send_rs(struct net_device *dev,
                                               const struct in6_addr *daddr);
 
 extern void                     ndisc_send_redirect(struct sk_buff *skb,
-                                                    struct neighbour *neigh,
                                                     const struct in6_addr *target);
 
 extern int                      ndisc_mc_map(const struct in6_addr *addr, char *buf,
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index 2dcf31703acb..96755c3798a5 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -20,6 +20,9 @@ enum nf_ct_ext_id {
 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
         NF_CT_EXT_TSTAMP,
 #endif
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        NF_CT_EXT_TIMEOUT,
+#endif
         NF_CT_EXT_NUM,
 };
 
@@ -29,6 +32,7 @@ enum nf_ct_ext_id {
 #define NF_CT_EXT_ECACHE_TYPE struct nf_conntrack_ecache
 #define NF_CT_EXT_ZONE_TYPE struct nf_conntrack_zone
 #define NF_CT_EXT_TSTAMP_TYPE struct nf_conn_tstamp
+#define NF_CT_EXT_TIMEOUT_TYPE struct nf_conn_timeout
 
 /* Extensions: optional stuff which isn't permanently in struct. */
 struct nf_ct_ext {
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index f1c1311adc2c..5767dc242dee 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -69,4 +69,17 @@ extern int nf_conntrack_broadcast_help(struct sk_buff *skb,
                                        enum ip_conntrack_info ctinfo,
                                        unsigned int timeout);
 
+struct nf_ct_helper_expectfn {
+        struct list_head head;
+        const char *name;
+        void (*expectfn)(struct nf_conn *ct, struct nf_conntrack_expect *exp);
+};
+
+void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n);
+void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n);
+struct nf_ct_helper_expectfn *
+nf_ct_helper_expectfn_find_by_name(const char *name);
+struct nf_ct_helper_expectfn *
+nf_ct_helper_expectfn_find_by_symbol(const void *symbol);
+
 #endif /*_NF_CONNTRACK_HELPER_H*/
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index e3d3ee3c06a2..90c67c7db7e9 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -39,12 +39,13 @@ struct nf_conntrack_l4proto {
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
                       u_int8_t pf,
-                      unsigned int hooknum);
+                      unsigned int hooknum,
+                      unsigned int *timeouts);
 
         /* Called when a new connection for this protocol found;
          * returns TRUE if it's OK.  If so, packet() called next. */
         bool (*new)(struct nf_conn *ct, const struct sk_buff *skb,
-                    unsigned int dataoff);
+                    unsigned int dataoff, unsigned int *timeouts);
 
         /* Called when a conntrack entry is destroyed */
         void (*destroy)(struct nf_conn *ct);
@@ -60,6 +61,9 @@ struct nf_conntrack_l4proto {
         /* Print out the private part of the conntrack. */
         int (*print_conntrack)(struct seq_file *s, struct nf_conn *);
 
+        /* Return the array of timeouts for this protocol. */
+        unsigned int *(*get_timeouts)(struct net *net);
+
         /* convert protoinfo to nfnetink attributes */
         int (*to_nlattr)(struct sk_buff *skb, struct nlattr *nla,
                          struct nf_conn *ct);
@@ -79,6 +83,17 @@ struct nf_conntrack_l4proto {
 
         size_t nla_size;
 
+#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+        struct {
+                size_t obj_size;
+                int (*nlattr_to_obj)(struct nlattr *tb[], void *data);
+                int (*obj_to_nlattr)(struct sk_buff *skb, const void *data);
+
+                unsigned int nlattr_max;
+                const struct nla_policy *nla_policy;
+        } ctnl_timeout;
+#endif
+
 #ifdef CONFIG_SYSCTL
         struct ctl_table_header **ctl_table_header;
         struct ctl_table        *ctl_table;
diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h
new file mode 100644
index 000000000000..0e04db4a0865
--- /dev/null
+++ b/include/net/netfilter/nf_conntrack_timeout.h
@@ -0,0 +1,78 @@
+#ifndef _NF_CONNTRACK_TIMEOUT_H
+#define _NF_CONNTRACK_TIMEOUT_H
+
+#include <net/net_namespace.h>
+#include <linux/netfilter/nf_conntrack_common.h>
+#include <linux/netfilter/nf_conntrack_tuple_common.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_extend.h>
+
+#define CTNL_TIMEOUT_NAME_MAX   32
+
+struct ctnl_timeout {
+        struct list_head        head;
+        struct rcu_head         rcu_head;
+        atomic_t                refcnt;
+        char                    name[CTNL_TIMEOUT_NAME_MAX];
+        __u16                   l3num;
+        __u8                    l4num;
+        char                    data[0];
+};
+
+struct nf_conn_timeout {
+        struct ctnl_timeout     *timeout;
+};
+
+#define NF_CT_TIMEOUT_EXT_DATA(__t) (unsigned int *) &((__t)->timeout->data)
+
+static inline
+struct nf_conn_timeout *nf_ct_timeout_find(const struct nf_conn *ct)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        return nf_ct_ext_find(ct, NF_CT_EXT_TIMEOUT);
+#else
+        return NULL;
+#endif
+}
+
+static inline
+struct nf_conn_timeout *nf_ct_timeout_ext_add(struct nf_conn *ct,
+                                              struct ctnl_timeout *timeout,
+                                              gfp_t gfp)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        struct nf_conn_timeout *timeout_ext;
+
+        timeout_ext = nf_ct_ext_add(ct, NF_CT_EXT_TIMEOUT, gfp);
+        if (timeout_ext == NULL)
+                return NULL;
+
+        timeout_ext->timeout = timeout;
+
+        return timeout_ext;
+#else
+        return NULL;
+#endif
+};
+
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+extern int nf_conntrack_timeout_init(struct net *net);
+extern void nf_conntrack_timeout_fini(struct net *net);
+#else
+static inline int nf_conntrack_timeout_init(struct net *net)
+{
+        return 0;
+}
+
+static inline void nf_conntrack_timeout_fini(struct net *net)
+{
+        return;
+}
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
+
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+extern struct ctnl_timeout *(*nf_ct_timeout_find_get_hook)(const char *name);
+extern void (*nf_ct_timeout_put_hook)(struct ctnl_timeout *timeout);
+#endif
+
+#endif /* _NF_CONNTRACK_TIMEOUT_H */
diff --git a/include/net/netfilter/xt_log.h b/include/net/netfilter/xt_log.h
index 0dfb34a5b53c..7e1544e8f70d 100644
--- a/include/net/netfilter/xt_log.h
+++ b/include/net/netfilter/xt_log.h
@@ -6,7 +6,7 @@ struct sbuff {
 };
 static struct sbuff emergency, *emergency_ptr = &emergency;
 
-static int sb_add(struct sbuff *m, const char *f, ...)
+static __printf(2, 3) int sb_add(struct sbuff *m, const char *f, ...)
 {
         va_list args;
         int len;
diff --git a/include/net/netlink.h b/include/net/netlink.h
index cb1f3504687f..f394fe5d7641 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -441,41 +441,6 @@ static inline int nlmsg_report(const struct nlmsghdr *nlh)
         nla_for_each_attr(pos, nlmsg_attrdata(nlh, hdrlen), \
                           nlmsg_attrlen(nlh, hdrlen), rem)
 
-#if 0
-/* FIXME: Enable once all users have been converted */
-
-/**
- * __nlmsg_put - Add a new netlink message to an skb
- * @skb: socket buffer to store message in
- * @pid: netlink process id
- * @seq: sequence number of message
- * @type: message type
- * @payload: length of message payload
- * @flags: message flags
- *
- * The caller is responsible to ensure that the skb provides enough
- * tailroom for both the netlink header and payload.
- */
-static inline struct nlmsghdr *__nlmsg_put(struct sk_buff *skb, u32 pid,
-                                           u32 seq, int type, int payload,
-                                           int flags)
-{
-        struct nlmsghdr *nlh;
-
-        nlh = (struct nlmsghdr *) skb_put(skb, nlmsg_total_size(payload));
-        nlh->nlmsg_type = type;
-        nlh->nlmsg_len = nlmsg_msg_size(payload);
-        nlh->nlmsg_flags = flags;
-        nlh->nlmsg_pid = pid;
-        nlh->nlmsg_seq = seq;
-
-        memset((unsigned char *) nlmsg_data(nlh) + payload, 0,
-               nlmsg_padlen(payload));
-
-        return nlh;
-}
-#endif
-
 /**
  * nlmsg_put - Add a new netlink message to an skb
  * @skb: socket buffer to store message in
diff --git a/include/net/nfc/nci.h b/include/net/nfc/nci.h
index 2be95e2626c0..276094b91d7c 100644
--- a/include/net/nfc/nci.h
+++ b/include/net/nfc/nci.h
@@ -116,6 +116,11 @@
 #define NCI_DISC_MAP_MODE_POLL                                  0x01
 #define NCI_DISC_MAP_MODE_LISTEN                                0x02
 
+/* NCI Discover Notification Type */
+#define NCI_DISCOVER_NTF_TYPE_LAST                              0x00
+#define NCI_DISCOVER_NTF_TYPE_LAST_NFCC                         0x01
+#define NCI_DISCOVER_NTF_TYPE_MORE                              0x02
+
 /* NCI Deactivation Type */
 #define NCI_DEACTIVATE_TYPE_IDLE_MODE                           0x00
 #define NCI_DEACTIVATE_TYPE_SLEEP_MODE                          0x01
@@ -207,6 +212,13 @@ struct nci_rf_disc_cmd {
         struct disc_config              disc_configs[NCI_MAX_NUM_RF_CONFIGS];
 } __packed;
 
+#define NCI_OP_RF_DISCOVER_SELECT_CMD   nci_opcode_pack(NCI_GID_RF_MGMT, 0x04)
+struct nci_rf_discover_select_cmd {
+        __u8    rf_discovery_id;
+        __u8    rf_protocol;
+        __u8    rf_interface;
+} __packed;
+
 #define NCI_OP_RF_DEACTIVATE_CMD        nci_opcode_pack(NCI_GID_RF_MGMT, 0x06)
 struct nci_rf_deactivate_cmd {
         __u8    type;
@@ -244,6 +256,8 @@ struct nci_core_init_rsp_2 {
 
 #define NCI_OP_RF_DISCOVER_RSP          nci_opcode_pack(NCI_GID_RF_MGMT, 0x03)
 
+#define NCI_OP_RF_DISCOVER_SELECT_RSP   nci_opcode_pack(NCI_GID_RF_MGMT, 0x04)
+
 #define NCI_OP_RF_DEACTIVATE_RSP        nci_opcode_pack(NCI_GID_RF_MGMT, 0x06)
 
 /* --------------------------- */
@@ -260,13 +274,15 @@ struct nci_core_conn_credit_ntf {
         struct conn_credit_entry        conn_entries[NCI_MAX_NUM_CONN];
 } __packed;
 
+#define NCI_OP_CORE_GENERIC_ERROR_NTF   nci_opcode_pack(NCI_GID_CORE, 0x07)
+
 #define NCI_OP_CORE_INTF_ERROR_NTF      nci_opcode_pack(NCI_GID_CORE, 0x08)
 struct nci_core_intf_error_ntf {
         __u8    status;
         __u8    conn_id;
 } __packed;
 
-#define NCI_OP_RF_INTF_ACTIVATED_NTF    nci_opcode_pack(NCI_GID_RF_MGMT, 0x05)
+#define NCI_OP_RF_DISCOVER_NTF          nci_opcode_pack(NCI_GID_RF_MGMT, 0x03)
 struct rf_tech_specific_params_nfca_poll {
         __u16   sens_res;
         __u8    nfcid1_len;     /* 0, 4, 7, or 10 Bytes */
@@ -275,11 +291,43 @@ struct rf_tech_specific_params_nfca_poll {
         __u8    sel_res;
 } __packed;
 
+struct rf_tech_specific_params_nfcb_poll {
+        __u8    sensb_res_len;
+        __u8    sensb_res[12];  /* 11 or 12 Bytes */
+} __packed;
+
+struct rf_tech_specific_params_nfcf_poll {
+        __u8    bit_rate;
+        __u8    sensf_res_len;
+        __u8    sensf_res[18];  /* 16 or 18 Bytes */
+} __packed;
+
+struct nci_rf_discover_ntf {
+        __u8    rf_discovery_id;
+        __u8    rf_protocol;
+        __u8    rf_tech_and_mode;
+        __u8    rf_tech_specific_params_len;
+
+        union {
+                struct rf_tech_specific_params_nfca_poll nfca_poll;
+                struct rf_tech_specific_params_nfcb_poll nfcb_poll;
+                struct rf_tech_specific_params_nfcf_poll nfcf_poll;
+        } rf_tech_specific_params;
+
+        __u8    ntf_type;
+} __packed;
+
+#define NCI_OP_RF_INTF_ACTIVATED_NTF    nci_opcode_pack(NCI_GID_RF_MGMT, 0x05)
 struct activation_params_nfca_poll_iso_dep {
         __u8    rats_res_len;
         __u8    rats_res[20];
 };
 
+struct activation_params_nfcb_poll_iso_dep {
+        __u8    attrib_res_len;
+        __u8    attrib_res[50];
+};
+
 struct nci_rf_intf_activated_ntf {
         __u8    rf_discovery_id;
         __u8    rf_interface;
@@ -291,6 +339,8 @@ struct nci_rf_intf_activated_ntf {
 
         union {
                 struct rf_tech_specific_params_nfca_poll nfca_poll;
+                struct rf_tech_specific_params_nfcb_poll nfcb_poll;
+                struct rf_tech_specific_params_nfcf_poll nfcf_poll;
         } rf_tech_specific_params;
 
         __u8    data_exch_rf_tech_and_mode;
@@ -300,6 +350,7 @@ struct nci_rf_intf_activated_ntf {
 
         union {
                 struct activation_params_nfca_poll_iso_dep nfca_poll_iso_dep;
+                struct activation_params_nfcb_poll_iso_dep nfcb_poll_iso_dep;
         } activation_params;
 
 } __packed;
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index bccd89e9d4c2..feba74027ff8 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -34,21 +34,31 @@
 #include <net/nfc/nfc.h>
 #include <net/nfc/nci.h>
 
-/* NCI device state */
-enum {
+/* NCI device flags */
+enum nci_flag {
         NCI_INIT,
         NCI_UP,
+        NCI_DATA_EXCHANGE,
+        NCI_DATA_EXCHANGE_TO,
+};
+
+/* NCI device states */
+enum nci_state {
+        NCI_IDLE,
         NCI_DISCOVERY,
+        NCI_W4_ALL_DISCOVERIES,
+        NCI_W4_HOST_SELECT,
         NCI_POLL_ACTIVE,
-        NCI_DATA_EXCHANGE,
 };
 
 /* NCI timeouts */
 #define NCI_RESET_TIMEOUT                       5000
 #define NCI_INIT_TIMEOUT                        5000
 #define NCI_RF_DISC_TIMEOUT                     5000
-#define NCI_RF_DEACTIVATE_TIMEOUT               5000
+#define NCI_RF_DISC_SELECT_TIMEOUT              5000
+#define NCI_RF_DEACTIVATE_TIMEOUT               30000
 #define NCI_CMD_TIMEOUT                         5000
+#define NCI_DATA_TIMEOUT                        700
 
 struct nci_dev;
 
@@ -59,6 +69,7 @@ struct nci_ops {
 };
 
 #define NCI_MAX_SUPPORTED_RF_INTERFACES         4
+#define NCI_MAX_DISCOVERED_TARGETS              10
 
 /* NCI Core structures */
 struct nci_dev {
@@ -68,12 +79,14 @@ struct nci_dev {
         int                     tx_headroom;
         int                     tx_tailroom;
 
+        atomic_t                state;
         unsigned long           flags;
 
         atomic_t                cmd_cnt;
         atomic_t                credits_cnt;
 
         struct timer_list       cmd_timer;
+        struct timer_list       data_timer;
 
         struct workqueue_struct *cmd_wq;
         struct work_struct      cmd_work;
@@ -96,9 +109,11 @@ struct nci_dev {
         void                    *driver_data;
 
         __u32                   poll_prots;
-        __u32                   target_available_prots;
         __u32                   target_active_prot;
 
+        struct nfc_target       targets[NCI_MAX_DISCOVERED_TARGETS];
+        int                     n_targets;
+
         /* received during NCI_OP_CORE_RESET_RSP */
         __u8                    nci_ver;
 
@@ -126,17 +141,17 @@ struct nci_dev {
 
 /* ----- NCI Devices ----- */
 struct nci_dev *nci_allocate_device(struct nci_ops *ops,
-                                __u32 supported_protocols,
-                                int tx_headroom,
-                                int tx_tailroom);
+                                    __u32 supported_protocols,
+                                    int tx_headroom,
+                                    int tx_tailroom);
 void nci_free_device(struct nci_dev *ndev);
 int nci_register_device(struct nci_dev *ndev);
 void nci_unregister_device(struct nci_dev *ndev);
 int nci_recv_frame(struct sk_buff *skb);
 
 static inline struct sk_buff *nci_skb_alloc(struct nci_dev *ndev,
-                                                unsigned int len,
-                                                gfp_t how)
+                                            unsigned int len,
+                                            gfp_t how)
 {
         struct sk_buff *skb;
 
@@ -169,6 +184,7 @@ int nci_send_cmd(struct nci_dev *ndev, __u16 opcode, __u8 plen, void *payload);
 int nci_send_data(struct nci_dev *ndev, __u8 conn_id, struct sk_buff *skb);
 void nci_data_exchange_complete(struct nci_dev *ndev, struct sk_buff *skb,
                                 int err);
+void nci_clear_target_list(struct nci_dev *ndev);
 
 /* ----- NCI requests ----- */
 #define NCI_REQ_DONE            0
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 8696b773a695..bac070bf3514 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -24,6 +24,7 @@
 #ifndef __NET_NFC_H
 #define __NET_NFC_H
 
+#include <linux/nfc.h>
 #include <linux/device.h>
 #include <linux/skbuff.h>
 
@@ -52,20 +53,19 @@ struct nfc_ops {
         int (*dev_down)(struct nfc_dev *dev);
         int (*start_poll)(struct nfc_dev *dev, u32 protocols);
         void (*stop_poll)(struct nfc_dev *dev);
-        int (*dep_link_up)(struct nfc_dev *dev, int target_idx,
-                                u8 comm_mode, u8 rf_mode);
+        int (*dep_link_up)(struct nfc_dev *dev, int target_idx, u8 comm_mode,
+                           u8 *gb, size_t gb_len);
         int (*dep_link_down)(struct nfc_dev *dev);
         int (*activate_target)(struct nfc_dev *dev, u32 target_idx,
-                                                        u32 protocol);
+                               u32 protocol);
         void (*deactivate_target)(struct nfc_dev *dev, u32 target_idx);
         int (*data_exchange)(struct nfc_dev *dev, u32 target_idx,
-                                struct sk_buff *skb, data_exchange_cb_t cb,
-                                                        void *cb_context);
+                             struct sk_buff *skb, data_exchange_cb_t cb,
+                             void *cb_context);
 };
 
 #define NFC_TARGET_IDX_ANY -1
 #define NFC_MAX_GT_LEN 48
-#define NFC_MAX_NFCID1_LEN 10
 
 struct nfc_target {
         u32 idx;
@@ -73,7 +73,11 @@ struct nfc_target {
         u16 sens_res;
         u8 sel_res;
         u8 nfcid1_len;
-        u8 nfcid1[NFC_MAX_NFCID1_LEN];
+        u8 nfcid1[NFC_NFCID1_MAXSIZE];
+        u8 sensb_res_len;
+        u8 sensb_res[NFC_SENSB_RES_MAXSIZE];
+        u8 sensf_res_len;
+        u8 sensf_res[NFC_SENSF_RES_MAXSIZE];
 };
 
 struct nfc_genl_data {
@@ -83,7 +87,6 @@ struct nfc_genl_data {
 
 struct nfc_dev {
         unsigned idx;
-        unsigned target_idx;
         struct nfc_target *targets;
         int n_targets;
         int targets_generation;
@@ -107,9 +110,9 @@ struct nfc_dev {
 extern struct class nfc_class;
 
 struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
-                                        u32 supported_protocols,
-                                        int tx_headroom,
-                                        int tx_tailroom);
+                                    u32 supported_protocols,
+                                    int tx_headroom,
+                                    int tx_tailroom);
 
 /**
  * nfc_free_device - free nfc device
@@ -132,7 +135,7 @@ void nfc_unregister_device(struct nfc_dev *dev);
  * @dev: The parent device
  */
 static inline void nfc_set_parent_dev(struct nfc_dev *nfc_dev,
-                                        struct device *dev)
+                                      struct device *dev)
 {
         nfc_dev->dev.parent = dev;
 }
@@ -169,17 +172,15 @@ static inline const char *nfc_device_name(struct nfc_dev *dev)
 }
 
 struct sk_buff *nfc_alloc_send_skb(struct nfc_dev *dev, struct sock *sk,
-                                        unsigned int flags, unsigned int size,
-                                        unsigned int *err);
+                                   unsigned int flags, unsigned int size,
+                                   unsigned int *err);
 struct sk_buff *nfc_alloc_recv_skb(unsigned int size, gfp_t gfp);
 
 int nfc_set_remote_general_bytes(struct nfc_dev *dev,
-                                        u8 *gt, u8 gt_len);
+                                 u8 *gt, u8 gt_len);
 
-u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, u8 *gt_len);
-
-int nfc_targets_found(struct nfc_dev *dev, struct nfc_target *targets,
-                                                        int ntargets);
+int nfc_targets_found(struct nfc_dev *dev,
+                      struct nfc_target *targets, int ntargets);
 
 int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx,
                        u8 comm_mode, u8 rf_mode);
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index d3685615a8b0..6ee44b24864a 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -413,6 +413,7 @@ static inline sctp_assoc_t sctp_assoc2id(const struct sctp_association *asoc)
 /* Look up the association by its id.  */
 struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id);
 
+int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp);
 
 /* A macro to walk a list of skbs.  */
 #define sctp_skb_for_each(pos, head, tmp) \
diff --git a/include/net/sock.h b/include/net/sock.h
index 7ef5c58f3f49..f84be9ed6110 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -357,6 +357,7 @@ struct sock {
         struct page             *sk_sndmsg_page;
         struct sk_buff          *sk_send_head;
         __u32                   sk_sndmsg_off;
+        __s32                   sk_peek_off;
         int                     sk_write_pending;
 #ifdef CONFIG_SECURITY
         void                    *sk_security;
@@ -373,6 +374,30 @@ struct sock {
         void                    (*sk_destruct)(struct sock *sk);
 };
 
+static inline int sk_peek_offset(struct sock *sk, int flags)
+{
+        if ((flags & MSG_PEEK) && (sk->sk_peek_off >= 0))
+                return sk->sk_peek_off;
+        else
+                return 0;
+}
+
+static inline void sk_peek_offset_bwd(struct sock *sk, int val)
+{
+        if (sk->sk_peek_off >= 0) {
+                if (sk->sk_peek_off >= val)
+                        sk->sk_peek_off -= val;
+                else
+                        sk->sk_peek_off = 0;
+        }
+}
+
+static inline void sk_peek_offset_fwd(struct sock *sk, int val)
+{
+        if (sk->sk_peek_off >= 0)
+                sk->sk_peek_off += val;
+}
+
 /*
  * Hashed lists helper routines
  */
@@ -590,6 +615,10 @@ enum sock_flags {
         SOCK_RXQ_OVFL,
         SOCK_ZEROCOPY, /* buffers from userspace */
         SOCK_WIFI_STATUS, /* push wifi status to userspace */
+        SOCK_NOFCS, /* Tell NIC not to do the Ethernet FCS.
+                     * Will use last 4 bytes of packet sent from
+                     * user-space instead.
+                     */
 };
 
 static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 2d80c291fffb..8607e6aad42b 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1138,35 +1138,27 @@ static inline void tcp_clear_all_retrans_hints(struct tcp_sock *tp)
 /* MD5 Signature */
 struct crypto_hash;
 
+union tcp_md5_addr {
+        struct in_addr  a4;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct in6_addr a6;
+#endif
+};
+
 /* - key database */
 struct tcp_md5sig_key {
-        u8                      *key;
+        struct hlist_node       node;
         u8                      keylen;
-};
-
-struct tcp4_md5sig_key {
-        struct tcp_md5sig_key   base;
-        __be32                  addr;
-};
-
-struct tcp6_md5sig_key {
-        struct tcp_md5sig_key   base;
-#if 0
-        u32                     scope_id;       /* XXX */
-#endif
-        struct in6_addr         addr;
+        u8                      family; /* AF_INET or AF_INET6 */
+        union tcp_md5_addr      addr;
+        u8                      key[TCP_MD5SIG_MAXKEYLEN];
+        struct rcu_head         rcu;
 };
 
 /* - sock block */
 struct tcp_md5sig_info {
-        struct tcp4_md5sig_key  *keys4;
-#if IS_ENABLED(CONFIG_IPV6)
-        struct tcp6_md5sig_key  *keys6;
-        u32                     entries6;
-        u32                     alloced6;
-#endif
-        u32                     entries4;
-        u32                     alloced4;
+        struct hlist_head       head;
+        struct rcu_head         rcu;
 };
 
 /* - pseudo header */
@@ -1203,19 +1195,25 @@ extern int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
                                const struct sock *sk,
                                const struct request_sock *req,
                                const struct sk_buff *skb);
-extern struct tcp_md5sig_key * tcp_v4_md5_lookup(struct sock *sk,
-                                                 struct sock *addr_sk);
-extern int tcp_v4_md5_do_add(struct sock *sk, __be32 addr, u8 *newkey,
-                             u8 newkeylen);
-extern int tcp_v4_md5_do_del(struct sock *sk, __be32 addr);
+extern int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
+                          int family, const u8 *newkey,
+                          u8 newkeylen, gfp_t gfp);
+extern int tcp_md5_do_del(struct sock *sk, const union tcp_md5_addr *addr,
+                          int family);
+extern struct tcp_md5sig_key *tcp_v4_md5_lookup(struct sock *sk,
+                                         struct sock *addr_sk);
 
 #ifdef CONFIG_TCP_MD5SIG
-#define tcp_twsk_md5_key(twsk)  ((twsk)->tw_md5_keylen ?                 \
-                                 &(struct tcp_md5sig_key) {              \
-                                        .key = (twsk)->tw_md5_key,       \
-                                        .keylen = (twsk)->tw_md5_keylen, \
-                                } : NULL)
+extern struct tcp_md5sig_key *tcp_md5_do_lookup(struct sock *sk,
+                        const union tcp_md5_addr *addr, int family);
+#define tcp_twsk_md5_key(twsk)  ((twsk)->tw_md5_key)
 #else
+static inline struct tcp_md5sig_key *tcp_md5_do_lookup(struct sock *sk,
+                                         const union tcp_md5_addr *addr,
+                                         int family)
+{
+        return NULL;
+}
 #define tcp_twsk_md5_key(twsk)  NULL
 #endif
 
@@ -1471,10 +1469,6 @@ struct tcp_sock_af_ops {
                                                   const struct sock *sk,
                                                   const struct request_sock *req,
                                                   const struct sk_buff *skb);
-        int                     (*md5_add) (struct sock *sk,
-                                            struct sock *addr_sk,
-                                            u8 *newkey,
-                                            u8 len);
         int                     (*md5_parse) (struct sock *sk,
                                               char __user *optval,
                                               int optlen);
diff --git a/include/net/udplite.h b/include/net/udplite.h
index 5f097ca7d5c5..71375459a884 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -40,7 +40,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
          * checksum. UDP-Lite (like IPv6) mandates checksums, hence packets
          * with a zero checksum field are illegal.                            */
         if (uh->check == 0) {
-                LIMIT_NETDEBUG(KERN_DEBUG "UDPLITE: zeroed checksum field\n");
+                LIMIT_NETDEBUG(KERN_DEBUG "UDPLite: zeroed checksum field\n");
                 return 1;
         }
 
@@ -52,7 +52,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
                 /*
                  * Coverage length violates RFC 3828: log and discard silently.
                  */
-                LIMIT_NETDEBUG(KERN_DEBUG "UDPLITE: bad csum coverage %d/%d\n",
+                LIMIT_NETDEBUG(KERN_DEBUG "UDPLite: bad csum coverage %d/%d\n",
                                cscov, skb->len);
                 return 1;
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 89174e29dca9..96239e78e621 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1566,11 +1566,6 @@ extern struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
 extern struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
                                                    int probe);
 
-struct hash_desc;
-struct scatterlist;
-typedef int (icv_update_fn_t)(struct hash_desc *, struct scatterlist *,
-                              unsigned int);
-
 static inline int xfrm_addr_cmp(const xfrm_address_t *a,
                                 const xfrm_address_t *b,
                                 int family)