Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:

 1) New offloading infrastructure and example 'rocker' driver for
    offloading of switching and routing to hardware.

    This work was done by a large group of dedicated individuals, not
    limited to: Scott Feldman, Jiri Pirko, Thomas Graf, John Fastabend,
    Jamal Hadi Salim, Andy Gospodarek, Florian Fainelli, Roopa Prabhu

 2) Start making the networking operate on IOV iterators instead of
    modifying iov objects in-situ during transfers.  Thanks to Al Viro
    and Herbert Xu.

 3) A set of new netlink interfaces for the TIPC stack, from Richard
    Alpe.

 4) Remove unnecessary looping during ipv6 routing lookups, from Martin
    KaFai Lau.

 5) Add PAUSE frame generation support to gianfar driver, from Matei
    Pavaluca.

 6) Allow for larger reordering levels in TCP, which are easily
    achievable in the real world right now, from Eric Dumazet.

 7) Add a variable of napi_schedule that doesn't need to disable cpu
    interrupts, from Eric Dumazet.

 8) Use a doubly linked list to optimize neigh_parms_release(), from
    Nicolas Dichtel.

 9) Various enhancements to the kernel BPF verifier, and allow eBPF
    programs to actually be attached to sockets.  From Alexei
    Starovoitov.

10) Support TSO/LSO in sunvnet driver, from David L Stevens.

11) Allow controlling ECN usage via routing metrics, from Florian
    Westphal.

12) Remote checksum offload, from Tom Herbert.

13) Add split-header receive, BQL, and xmit_more support to amd-xgbe
    driver, from Thomas Lendacky.

14) Add MPLS support to openvswitch, from Simon Horman.

15) Support wildcard tunnel endpoints in ipv6 tunnels, from Steffen
    Klassert.

16) Do gro flushes on a per-device basis using a timer, from Eric
    Dumazet.  This tries to resolve the conflicting goals between the
    desired handling of bulk vs.  RPC-like traffic.

17) Allow userspace to ask for the CPU upon what a packet was
    received/steered, via SO_INCOMING_CPU.  From Eric Dumazet.

18) Limit GSO packets to half the current congestion window, from Eric
    Dumazet.

19) Add a generic helper so that all drivers set their RSS keys in a
    consistent way, from Eric Dumazet.

20) Add xmit_more support to enic driver, from Govindarajulu
    Varadarajan.

21) Add VLAN packet scheduler action, from Jiri Pirko.

22) Support configurable RSS hash functions via ethtool, from Eyal
    Perry.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1820 commits)
  Fix race condition between vxlan_sock_add and vxlan_sock_release
  net/macb: fix compilation warning for print_hex_dump() called with skb->mac_header
  net/mlx4: Add support for A0 steering
  net/mlx4: Refactor QUERY_PORT
  net/mlx4_core: Add explicit error message when rule doesn't meet configuration
  net/mlx4: Add A0 hybrid steering
  net/mlx4: Add mlx4_bitmap zone allocator
  net/mlx4: Add a check if there are too many reserved QPs
  net/mlx4: Change QP allocation scheme
  net/mlx4_core: Use tasklet for user-space CQ completion events
  net/mlx4_core: Mask out host side virtualization features for guests
  net/mlx4_en: Set csum level for encapsulated packets
  be2net: Export tunnel offloads only when a VxLAN tunnel is created
  gianfar: Fix dma check map error when DMA_API_DEBUG is enabled
  cxgb4/csiostor: Don't use MASTER_MUST for fw_hello call
  net: fec: only enable mdio interrupt before phy device link up
  net: fec: clear all interrupt events to support i.MX6SX
  net: fec: reset fep link status in suspend function
  net: sock: fix access via invalid file descriptor
  net: introduce helper macro for_each_cmsghdr
  ...

118 files changed, 4186 insertions, 898 deletions

diff --git a/include/asm-generic/hash.h b/include/asm-generic/hash.h
deleted file mode 100644
index b6312843dbd9..000000000000
--- a/include/asm-generic/hash.h
+++ /dev/null
@@ -1,9 +0,0 @@
-#ifndef __ASM_GENERIC_HASH_H
-#define __ASM_GENERIC_HASH_H
-
-struct fast_hash_ops;
-static inline void setup_arch_fast_hash(struct fast_hash_ops *ops)
-{
-}
-
-#endif /* __ASM_GENERIC_HASH_H */
diff --git a/include/linux/ath9k_platform.h b/include/linux/ath9k_platform.h
index a495a959e8a7..33eb274cd0e6 100644
--- a/include/linux/ath9k_platform.h
+++ b/include/linux/ath9k_platform.h
@@ -31,8 +31,11 @@ struct ath9k_platform_data {
         u32 gpio_mask;
         u32 gpio_val;
 
+        bool endian_check;
         bool is_clk_25mhz;
         bool tx_gain_buffalo;
+        bool disable_2ghz;
+        bool disable_5ghz;
 
         int (*get_mac_revision)(void);
         int (*external_reset)(void);
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 729f48e6b20b..eb1c6a47b67f 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -447,4 +447,6 @@ extern u32 bcma_chipco_pll_read(struct bcma_drv_cc *cc, u32 offset);
 #define  BCMA_DMA_TRANSLATION_DMA64_CMT 0x80000000 /* Client Mode Translation for 64-bit DMA */
 extern u32 bcma_core_dma_translation(struct bcma_device *core);
 
+extern unsigned int bcma_core_irq(struct bcma_device *core, int num);
+
 #endif /* LINUX_BCMA_H_ */
diff --git a/include/linux/bcma/bcma_driver_mips.h b/include/linux/bcma/bcma_driver_mips.h
index fb61f3fb4ddb..0b3b32aeeb8a 100644
--- a/include/linux/bcma/bcma_driver_mips.h
+++ b/include/linux/bcma/bcma_driver_mips.h
@@ -43,12 +43,12 @@ struct bcma_drv_mips {
 extern void bcma_core_mips_init(struct bcma_drv_mips *mcore);
 extern void bcma_core_mips_early_init(struct bcma_drv_mips *mcore);
 
-extern unsigned int bcma_core_irq(struct bcma_device *core);
+extern unsigned int bcma_core_mips_irq(struct bcma_device *dev);
 #else
 static inline void bcma_core_mips_init(struct bcma_drv_mips *mcore) { }
 static inline void bcma_core_mips_early_init(struct bcma_drv_mips *mcore) { }
 
-static inline unsigned int bcma_core_irq(struct bcma_device *core)
+static inline unsigned int bcma_core_mips_irq(struct bcma_device *dev)
 {
         return 0;
 }
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 3cf91754a957..bbfceb756452 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -22,7 +22,7 @@ struct bpf_map_ops {
 
         /* funcs callable from userspace and from eBPF programs */
         void *(*map_lookup_elem)(struct bpf_map *map, void *key);
-        int (*map_update_elem)(struct bpf_map *map, void *key, void *value);
+        int (*map_update_elem)(struct bpf_map *map, void *key, void *value, u64 flags);
         int (*map_delete_elem)(struct bpf_map *map, void *key);
 };
 
@@ -128,9 +128,18 @@ struct bpf_prog_aux {
         struct work_struct work;
 };
 
+#ifdef CONFIG_BPF_SYSCALL
 void bpf_prog_put(struct bpf_prog *prog);
+#else
+static inline void bpf_prog_put(struct bpf_prog *prog) {}
+#endif
 struct bpf_prog *bpf_prog_get(u32 ufd);
 /* verify correctness of eBPF program */
 int bpf_check(struct bpf_prog *fp, union bpf_attr *attr);
 
+/* verifier prototypes for helper functions called from eBPF programs */
+extern struct bpf_func_proto bpf_map_lookup_elem_proto;
+extern struct bpf_func_proto bpf_map_update_elem_proto;
+extern struct bpf_func_proto bpf_map_delete_elem_proto;
+
 #endif /* _LINUX_BPF_H */
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index b37ea95bc348..c05ff0f9f9a5 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -127,6 +127,9 @@ void unregister_candev(struct net_device *dev);
 int can_restart_now(struct net_device *dev);
 void can_bus_off(struct net_device *dev);
 
+void can_change_state(struct net_device *dev, struct can_frame *cf,
+                      enum can_state tx_state, enum can_state rx_state);
+
 void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
                       unsigned int idx);
 unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx);
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 733980fce8e3..41c891d05f04 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -392,4 +392,16 @@ static inline unsigned long compare_ether_header(const void *a, const void *b)
 #endif
 }
 
+/**
+ * eth_skb_pad - Pad buffer to mininum number of octets for Ethernet frame
+ * @skb: Buffer to pad
+ *
+ * An Ethernet frame should have a minimum size of 60 bytes.  This function
+ * takes short frames and pads them with zeros up to the 60 byte limit.
+ */
+static inline int eth_skb_pad(struct sk_buff *skb)
+{
+        return skb_put_padto(skb, ETH_ZLEN);
+}
+
 #endif  /* _LINUX_ETHERDEVICE_H */
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index c1a2d60dfb82..653dc9c4ebac 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -59,6 +59,26 @@ enum ethtool_phys_id_state {
         ETHTOOL_ID_OFF
 };
 
+enum {
+        ETH_RSS_HASH_TOP_BIT, /* Configurable RSS hash function - Toeplitz */
+        ETH_RSS_HASH_XOR_BIT, /* Configurable RSS hash function - Xor */
+
+        /*
+         * Add your fresh new hash function bits above and remember to update
+         * rss_hash_func_strings[] in ethtool.c
+         */
+        ETH_RSS_HASH_FUNCS_COUNT
+};
+
+#define __ETH_RSS_HASH_BIT(bit) ((u32)1 << (bit))
+#define __ETH_RSS_HASH(name)    __ETH_RSS_HASH_BIT(ETH_RSS_HASH_##name##_BIT)
+
+#define ETH_RSS_HASH_TOP        __ETH_RSS_HASH(TOP)
+#define ETH_RSS_HASH_XOR        __ETH_RSS_HASH(XOR)
+
+#define ETH_RSS_HASH_UNKNOWN    0
+#define ETH_RSS_HASH_NO_CHANGE  0
+
 struct net_device;
 
 /* Some generic methods drivers may use in their ethtool_ops */
@@ -158,17 +178,14 @@ static inline u32 ethtool_rxfh_indir_default(u32 index, u32 n_rx_rings)
  *      Returns zero if not supported for this specific device.
  * @get_rxfh_indir_size: Get the size of the RX flow hash indirection table.
  *      Returns zero if not supported for this specific device.
- * @get_rxfh: Get the contents of the RX flow hash indirection table and hash
- *      key.
- *      Will only be called if one or both of @get_rxfh_indir_size and
- *      @get_rxfh_key_size are implemented and return non-zero.
- *      Returns a negative error code or zero.
- * @set_rxfh: Set the contents of the RX flow hash indirection table and/or
- *      hash key.  In case only the indirection table or hash key is to be
- *      changed, the other argument will be %NULL.
- *      Will only be called if one or both of @get_rxfh_indir_size and
- *      @get_rxfh_key_size are implemented and return non-zero.
+ * @get_rxfh: Get the contents of the RX flow hash indirection table, hash key
+ *      and/or hash function.
  *      Returns a negative error code or zero.
+ * @set_rxfh: Set the contents of the RX flow hash indirection table, hash
+ *      key, and/or hash function.  Arguments which are set to %NULL or zero
+ *      will remain unchanged.
+ *      Returns a negative error code or zero. An error code must be returned
+ *      if at least one unsupported change was requested.
  * @get_channels: Get number of channels.
  * @set_channels: Set number of channels.  Returns a negative error code or
  *      zero.
@@ -241,9 +258,10 @@ struct ethtool_ops {
         int     (*reset)(struct net_device *, u32 *);
         u32     (*get_rxfh_key_size)(struct net_device *);
         u32     (*get_rxfh_indir_size)(struct net_device *);
-        int     (*get_rxfh)(struct net_device *, u32 *indir, u8 *key);
+        int     (*get_rxfh)(struct net_device *, u32 *indir, u8 *key,
+                            u8 *hfunc);
         int     (*set_rxfh)(struct net_device *, const u32 *indir,
-                            const u8 *key);
+                            const u8 *key, const u8 hfunc);
         void    (*get_channels)(struct net_device *, struct ethtool_channels *);
         int     (*set_channels)(struct net_device *, struct ethtool_channels *);
         int     (*get_dump_flag)(struct net_device *, struct ethtool_dump *);
diff --git a/include/linux/filter.h b/include/linux/filter.h
index ca95abd2bed1..caac2087a4d5 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -381,6 +381,7 @@ int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog);
 void bpf_prog_destroy(struct bpf_prog *fp);
 
 int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk);
+int sk_attach_bpf(u32 ufd, struct sock *sk);
 int sk_detach_filter(struct sock *sk);
 
 int bpf_check_classic(const struct sock_filter *filter, unsigned int flen);
diff --git a/include/linux/hash.h b/include/linux/hash.h
index d0494c399392..1afde47e1528 100644
--- a/include/linux/hash.h
+++ b/include/linux/hash.h
@@ -15,7 +15,6 @@
  */
 
 #include <asm/types.h>
-#include <asm/hash.h>
 #include <linux/compiler.h>
 
 /* 2^31 + 2^29 - 2^25 + 2^22 - 2^19 - 2^16 + 1 */
@@ -84,38 +83,4 @@ static inline u32 hash32_ptr(const void *ptr)
         return (u32)val;
 }
 
-struct fast_hash_ops {
-        u32 (*hash)(const void *data, u32 len, u32 seed);
-        u32 (*hash2)(const u32 *data, u32 len, u32 seed);
-};
-
-/**
- *      arch_fast_hash - Caclulates a hash over a given buffer that can have
- *                       arbitrary size. This function will eventually use an
- *                       architecture-optimized hashing implementation if
- *                       available, and trades off distribution for speed.
- *
- *      @data: buffer to hash
- *      @len: length of buffer in bytes
- *      @seed: start seed
- *
- *      Returns 32bit hash.
- */
-extern u32 arch_fast_hash(const void *data, u32 len, u32 seed);
-
-/**
- *      arch_fast_hash2 - Caclulates a hash over a given buffer that has a
- *                        size that is of a multiple of 32bit words. This
- *                        function will eventually use an architecture-
- *                        optimized hashing implementation if available,
- *                        and trades off distribution for speed.
- *
- *      @data: buffer to hash (must be 32bit padded)
- *      @len: number of 32bit words
- *      @seed: start seed
- *
- *      Returns 32bit hash.
- */
-extern u32 arch_fast_hash2(const u32 *data, u32 len, u32 seed);
-
 #endif /* _LINUX_HASH_H */
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 08cfaff8a072..476c685ca6f9 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -650,6 +650,8 @@ struct vmbus_channel {
         u8 monitor_grp;
         u8 monitor_bit;
 
+        bool rescind; /* got rescind msg */
+
         u32 ringbuffer_gpadlhandle;
 
         /* Allocated memory for ring buffer */
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index b1be39c76931..4f4eea8a6288 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -19,6 +19,7 @@
 #include <linux/types.h>
 #include <linux/if_ether.h>
 #include <asm/byteorder.h>
+#include <asm/unaligned.h>
 
 /*
  * DS bit usage
@@ -1066,6 +1067,12 @@ struct ieee80211_pspoll {
 
 /* TDLS */
 
+/* Channel switch timing */
+struct ieee80211_ch_switch_timing {
+        __le16 switch_time;
+        __le16 switch_timeout;
+} __packed;
+
 /* Link-id information element */
 struct ieee80211_tdls_lnkie {
         u8 ie_type; /* Link Identifier IE */
@@ -1107,6 +1114,15 @@ struct ieee80211_tdls_data {
                         u8 dialog_token;
                         u8 variable[0];
                 } __packed discover_req;
+                struct {
+                        u8 target_channel;
+                        u8 oper_class;
+                        u8 variable[0];
+                } __packed chan_switch_req;
+                struct {
+                        __le16 status_code;
+                        u8 variable[0];
+                } __packed chan_switch_resp;
         } u;
 } __packed;
 
@@ -1274,7 +1290,7 @@ struct ieee80211_ht_cap {
 #define         IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT   2
 
 /*
- * Maximum length of AMPDU that the STA can receive.
+ * Maximum length of AMPDU that the STA can receive in high-throughput (HT).
  * Length = 2 ^ (13 + max_ampdu_length_exp) - 1 (octets)
  */
 enum ieee80211_max_ampdu_length_exp {
@@ -1284,6 +1300,21 @@ enum ieee80211_max_ampdu_length_exp {
         IEEE80211_HT_MAX_AMPDU_64K = 3
 };
 
+/*
+ * Maximum length of AMPDU that the STA can receive in VHT.
+ * Length = 2 ^ (13 + max_ampdu_length_exp) - 1 (octets)
+ */
+enum ieee80211_vht_max_ampdu_length_exp {
+        IEEE80211_VHT_MAX_AMPDU_8K = 0,
+        IEEE80211_VHT_MAX_AMPDU_16K = 1,
+        IEEE80211_VHT_MAX_AMPDU_32K = 2,
+        IEEE80211_VHT_MAX_AMPDU_64K = 3,
+        IEEE80211_VHT_MAX_AMPDU_128K = 4,
+        IEEE80211_VHT_MAX_AMPDU_256K = 5,
+        IEEE80211_VHT_MAX_AMPDU_512K = 6,
+        IEEE80211_VHT_MAX_AMPDU_1024K = 7
+};
+
 #define IEEE80211_HT_MAX_AMPDU_FACTOR 13
 
 /* Minimum MPDU start spacing */
@@ -1998,6 +2029,16 @@ enum ieee80211_tdls_actioncode {
         WLAN_TDLS_DISCOVERY_REQUEST = 10,
 };
 
+/* Extended Channel Switching capability to be set in the 1st byte of
+ * the @WLAN_EID_EXT_CAPABILITY information element
+ */
+#define WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING    BIT(2)
+
+/* TDLS capabilities in the the 4th byte of @WLAN_EID_EXT_CAPABILITY */
+#define WLAN_EXT_CAPA4_TDLS_BUFFER_STA          BIT(4)
+#define WLAN_EXT_CAPA4_TDLS_PEER_PSM            BIT(5)
+#define WLAN_EXT_CAPA4_TDLS_CHAN_SWITCH         BIT(6)
+
 /* Interworking capabilities are set in 7th bit of 4th byte of the
  * @WLAN_EID_EXT_CAPABILITY information element
  */
@@ -2009,6 +2050,7 @@ enum ieee80211_tdls_actioncode {
  */
 #define WLAN_EXT_CAPA5_TDLS_ENABLED     BIT(5)
 #define WLAN_EXT_CAPA5_TDLS_PROHIBITED  BIT(6)
+#define WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED    BIT(7)
 
 #define WLAN_EXT_CAPA8_OPMODE_NOTIF     BIT(6)
 #define WLAN_EXT_CAPA8_TDLS_WIDE_BW_ENABLED     BIT(7)
@@ -2016,6 +2058,9 @@ enum ieee80211_tdls_actioncode {
 /* TDLS specific payload type in the LLC/SNAP header */
 #define WLAN_TDLS_SNAP_RFTYPE   0x2
 
+/* BSS Coex IE information field bits */
+#define WLAN_BSS_COEX_INFORMATION_REQUEST       BIT(0)
+
 /**
  * enum - mesh synchronization method identifier
  *
@@ -2398,6 +2443,30 @@ static inline bool ieee80211_check_tim(const struct ieee80211_tim_ie *tim,
         return !!(tim->virtual_map[index] & mask);
 }
 
+/**
+ * ieee80211_get_tdls_action - get tdls packet action (or -1, if not tdls packet)
+ * @skb: the skb containing the frame, length will not be checked
+ * @hdr_size: the size of the ieee80211_hdr that starts at skb->data
+ *
+ * This function assumes the frame is a data frame, and that the network header
+ * is in the correct place.
+ */
+static inline int ieee80211_get_tdls_action(struct sk_buff *skb, u32 hdr_size)
+{
+        if (!skb_is_nonlinear(skb) &&
+            skb->len > (skb_network_offset(skb) + 2)) {
+                /* Point to where the indication of TDLS should start */
+                const u8 *tdls_data = skb_network_header(skb) - 2;
+
+                if (get_unaligned_be16(tdls_data) == ETH_P_TDLS &&
+                    tdls_data[2] == WLAN_TDLS_SNAP_RFTYPE &&
+                    tdls_data[3] == WLAN_CATEGORY_TDLS)
+                        return tdls_data[4];
+        }
+
+        return -1;
+}
+
 /* convert time units */
 #define TU_TO_JIFFIES(x)        (usecs_to_jiffies((x) * 1024))
 #define TU_TO_EXP_TIME(x)       (jiffies + TU_TO_JIFFIES(x))
diff --git a/include/net/ieee802154.h b/include/linux/ieee802154.h
index 0aa7122e8f15..6e82d888287c 100644
--- a/include/net/ieee802154.h
+++ b/include/linux/ieee802154.h
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
  * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
@@ -24,10 +20,27 @@
  * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
  */
 
-#ifndef NET_IEEE802154_H
-#define NET_IEEE802154_H
+#ifndef LINUX_IEEE802154_H
+#define LINUX_IEEE802154_H
+
+#include <linux/types.h>
+#include <linux/random.h>
+#include <asm/byteorder.h>
 
 #define IEEE802154_MTU                  127
+#define IEEE802154_MIN_PSDU_LEN         5
+
+#define IEEE802154_PAN_ID_BROADCAST     0xffff
+#define IEEE802154_ADDR_SHORT_BROADCAST 0xffff
+#define IEEE802154_ADDR_SHORT_UNSPEC    0xfffe
+
+#define IEEE802154_EXTENDED_ADDR_LEN    8
+
+#define IEEE802154_LIFS_PERIOD          40
+#define IEEE802154_SIFS_PERIOD          12
+
+#define IEEE802154_MAX_CHANNEL          26
+#define IEEE802154_MAX_PAGE             31
 
 #define IEEE802154_FC_TYPE_BEACON       0x0     /* Frame is beacon */
 #define IEEE802154_FC_TYPE_DATA         0x1     /* Frame is data */
@@ -189,7 +202,41 @@ enum {
         IEEE802154_SCAN_IN_PROGRESS = 0xfc,
 };
 
+/**
+ * ieee802154_is_valid_psdu_len - check if psdu len is valid
+ * @len: psdu len with (MHR + payload + MFR)
+ */
+static inline bool ieee802154_is_valid_psdu_len(const u8 len)
+{
+        return (len >= IEEE802154_MIN_PSDU_LEN && len <= IEEE802154_MTU);
+}
+
+/**
+ * ieee802154_is_valid_psdu_len - check if extended addr is valid
+ * @addr: extended addr to check
+ */
+static inline bool ieee802154_is_valid_extended_addr(const __le64 addr)
+{
+        /* These EUI-64 addresses are reserved by IEEE. 0xffffffffffffffff
+         * is used internally as extended to short address broadcast mapping.
+         * This is currently a workaround because neighbor discovery can't
+         * deal with short addresses types right now.
+         */
+        return ((addr != cpu_to_le64(0x0000000000000000ULL)) &&
+                (addr != cpu_to_le64(0xffffffffffffffffULL)));
+}
 
-#endif
+/**
+ * ieee802154_random_extended_addr - generates a random extended address
+ * @addr: extended addr pointer to place the random address
+ */
+static inline void ieee802154_random_extended_addr(__le64 *addr)
+{
+        get_random_bytes(addr, IEEE802154_EXTENDED_ADDR_LEN);
 
+        /* toggle some bit if we hit an invalid extended addr */
+        if (!ieee802154_is_valid_extended_addr(*addr))
+                ((u8 *)addr)[IEEE802154_EXTENDED_ADDR_LEN - 1] ^= 0x01;
+}
 
+#endif /* LINUX_IEEE802154_H */
diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
index 808dcb8cc04f..0a8ce762a47f 100644
--- a/include/linux/if_bridge.h
+++ b/include/linux/if_bridge.h
@@ -15,6 +15,7 @@
 
 #include <linux/netdevice.h>
 #include <uapi/linux/if_bridge.h>
+#include <linux/bitops.h>
 
 struct br_ip {
         union {
@@ -32,11 +33,41 @@ struct br_ip_list {
         struct br_ip addr;
 };
 
+#define BR_HAIRPIN_MODE         BIT(0)
+#define BR_BPDU_GUARD           BIT(1)
+#define BR_ROOT_BLOCK           BIT(2)
+#define BR_MULTICAST_FAST_LEAVE BIT(3)
+#define BR_ADMIN_COST           BIT(4)
+#define BR_LEARNING             BIT(5)
+#define BR_FLOOD                BIT(6)
+#define BR_AUTO_MASK            (BR_FLOOD | BR_LEARNING)
+#define BR_PROMISC              BIT(7)
+#define BR_PROXYARP             BIT(8)
+#define BR_LEARNING_SYNC        BIT(9)
+
 extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *));
 
 typedef int br_should_route_hook_t(struct sk_buff *skb);
 extern br_should_route_hook_t __rcu *br_should_route_hook;
 
+#if IS_ENABLED(CONFIG_BRIDGE)
+int br_fdb_external_learn_add(struct net_device *dev,
+                              const unsigned char *addr, u16 vid);
+int br_fdb_external_learn_del(struct net_device *dev,
+                              const unsigned char *addr, u16 vid);
+#else
+static inline int br_fdb_external_learn_add(struct net_device *dev,
+                                            const unsigned char *addr, u16 vid)
+{
+        return 0;
+}
+static inline int br_fdb_external_learn_del(struct net_device *dev,
+                                            const unsigned char *addr, u16 vid)
+{
+        return 0;
+}
+#endif
+
 #if IS_ENABLED(CONFIG_BRIDGE) && IS_ENABLED(CONFIG_BRIDGE_IGMP_SNOOPING)
 int br_multicast_list_adjacent(struct net_device *dev,
                                struct list_head *br_ip_list);
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index d69f0577a319..515a35e2a48a 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -282,28 +282,24 @@ static inline bool vlan_hw_offload_capable(netdev_features_t features,
 }
 
 /**
- * vlan_insert_tag - regular VLAN tag inserting
+ * __vlan_insert_tag - regular VLAN tag inserting
  * @skb: skbuff to tag
  * @vlan_proto: VLAN encapsulation protocol
  * @vlan_tci: VLAN TCI to insert
  *
  * Inserts the VLAN tag into @skb as part of the payload
- * Returns a VLAN tagged skb. If a new skb is created, @skb is freed.
- *
- * Following the skb_unshare() example, in case of error, the calling function
- * doesn't have to worry about freeing the original skb.
+ * Returns error if skb_cow_head failes.
  *
  * Does not change skb->protocol so this function can be used during receive.
  */
-static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb,
-                                              __be16 vlan_proto, u16 vlan_tci)
+static inline int __vlan_insert_tag(struct sk_buff *skb,
+                                    __be16 vlan_proto, u16 vlan_tci)
 {
         struct vlan_ethhdr *veth;
 
-        if (skb_cow_head(skb, VLAN_HLEN) < 0) {
-                dev_kfree_skb_any(skb);
-                return NULL;
-        }
+        if (skb_cow_head(skb, VLAN_HLEN) < 0)
+                return -ENOMEM;
+
         veth = (struct vlan_ethhdr *)skb_push(skb, VLAN_HLEN);
 
         /* Move the mac addresses to the beginning of the new header. */
@@ -316,12 +312,40 @@ static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb,
         /* now, the TCI */
         veth->h_vlan_TCI = htons(vlan_tci);
 
+        return 0;
+}
+
+/**
+ * vlan_insert_tag - regular VLAN tag inserting
+ * @skb: skbuff to tag
+ * @vlan_proto: VLAN encapsulation protocol
+ * @vlan_tci: VLAN TCI to insert
+ *
+ * Inserts the VLAN tag into @skb as part of the payload
+ * Returns a VLAN tagged skb. If a new skb is created, @skb is freed.
+ *
+ * Following the skb_unshare() example, in case of error, the calling function
+ * doesn't have to worry about freeing the original skb.
+ *
+ * Does not change skb->protocol so this function can be used during receive.
+ */
+static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb,
+                                              __be16 vlan_proto, u16 vlan_tci)
+{
+        int err;
+
+        err = __vlan_insert_tag(skb, vlan_proto, vlan_tci);
+        if (err) {
+                dev_kfree_skb_any(skb);
+                return NULL;
+        }
         return skb;
 }
 
 /**
- * __vlan_put_tag - regular VLAN tag inserting
+ * vlan_insert_tag_set_proto - regular VLAN tag inserting
  * @skb: skbuff to tag
+ * @vlan_proto: VLAN encapsulation protocol
  * @vlan_tci: VLAN TCI to insert
  *
  * Inserts the VLAN tag into @skb as part of the payload
@@ -330,8 +354,9 @@ static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb,
  * Following the skb_unshare() example, in case of error, the calling function
  * doesn't have to worry about freeing the original skb.
  */
-static inline struct sk_buff *__vlan_put_tag(struct sk_buff *skb,
-                                             __be16 vlan_proto, u16 vlan_tci)
+static inline struct sk_buff *vlan_insert_tag_set_proto(struct sk_buff *skb,
+                                                        __be16 vlan_proto,
+                                                        u16 vlan_tci)
 {
         skb = vlan_insert_tag(skb, vlan_proto, vlan_tci);
         if (skb)
@@ -339,39 +364,53 @@ static inline struct sk_buff *__vlan_put_tag(struct sk_buff *skb,
         return skb;
 }
 
-/**
- * __vlan_hwaccel_put_tag - hardware accelerated VLAN inserting
+/*
+ * __vlan_hwaccel_push_inside - pushes vlan tag to the payload
  * @skb: skbuff to tag
- * @vlan_proto: VLAN encapsulation protocol
- * @vlan_tci: VLAN TCI to insert
  *
- * Puts the VLAN TCI in @skb->vlan_tci and lets the device do the rest
+ * Pushes the VLAN tag from @skb->vlan_tci inside to the payload.
+ *
+ * Following the skb_unshare() example, in case of error, the calling function
+ * doesn't have to worry about freeing the original skb.
  */
-static inline struct sk_buff *__vlan_hwaccel_put_tag(struct sk_buff *skb,
-                                                     __be16 vlan_proto,
-                                                     u16 vlan_tci)
+static inline struct sk_buff *__vlan_hwaccel_push_inside(struct sk_buff *skb)
 {
-        skb->vlan_proto = vlan_proto;
-        skb->vlan_tci = VLAN_TAG_PRESENT | vlan_tci;
+        skb = vlan_insert_tag_set_proto(skb, skb->vlan_proto,
+                                        vlan_tx_tag_get(skb));
+        if (likely(skb))
+                skb->vlan_tci = 0;
+        return skb;
+}
+/*
+ * vlan_hwaccel_push_inside - pushes vlan tag to the payload
+ * @skb: skbuff to tag
+ *
+ * Checks is tag is present in @skb->vlan_tci and if it is, it pushes the
+ * VLAN tag from @skb->vlan_tci inside to the payload.
+ *
+ * Following the skb_unshare() example, in case of error, the calling function
+ * doesn't have to worry about freeing the original skb.
+ */
+static inline struct sk_buff *vlan_hwaccel_push_inside(struct sk_buff *skb)
+{
+        if (vlan_tx_tag_present(skb))
+                skb = __vlan_hwaccel_push_inside(skb);
         return skb;
 }
 
 /**
- * vlan_put_tag - inserts VLAN tag according to device features
+ * __vlan_hwaccel_put_tag - hardware accelerated VLAN inserting
  * @skb: skbuff to tag
+ * @vlan_proto: VLAN encapsulation protocol
  * @vlan_tci: VLAN TCI to insert
  *
- * Assumes skb->dev is the target that will xmit this frame.
- * Returns a VLAN tagged skb.
+ * Puts the VLAN TCI in @skb->vlan_tci and lets the device do the rest
  */
-static inline struct sk_buff *vlan_put_tag(struct sk_buff *skb,
-                                           __be16 vlan_proto, u16 vlan_tci)
+static inline void __vlan_hwaccel_put_tag(struct sk_buff *skb,
+                                          __be16 vlan_proto, u16 vlan_tci)
 {
-        if (vlan_hw_offload_capable(skb->dev->features, vlan_proto)) {
-                return __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
-        } else {
-                return __vlan_put_tag(skb, vlan_proto, vlan_tci);
-        }
+        skb->vlan_proto = vlan_proto;
+        skb->vlan_tci = VLAN_TAG_PRESENT | vlan_tci;
 }
 
 /**
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index ff560537dd61..c694e7baa621 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -42,6 +42,7 @@ struct ipv6_devconf {
         __s32           accept_ra_from_local;
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
         __s32           optimistic_dad;
+        __s32           use_optimistic;
 #endif
 #ifdef CONFIG_IPV6_MROUTE
         __s32           mc_forwarding;
@@ -316,14 +317,4 @@ static inline struct raw6_sock *raw6_sk(const struct sock *sk)
 #define tcp_twsk_ipv6only(__sk)         0
 #define inet_v6_ipv6only(__sk)          0
 #endif /* IS_ENABLED(CONFIG_IPV6) */
-
-#define INET6_MATCH(__sk, __net, __saddr, __daddr, __ports, __dif)      \
-        (((__sk)->sk_portpair == (__ports))                     &&      \
-         ((__sk)->sk_family == AF_INET6)                        &&      \
-         ipv6_addr_equal(&(__sk)->sk_v6_daddr, (__saddr))               &&      \
-         ipv6_addr_equal(&(__sk)->sk_v6_rcv_saddr, (__daddr))   &&      \
-         (!(__sk)->sk_bound_dev_if      ||                              \
-           ((__sk)->sk_bound_dev_if == (__dif)))                &&      \
-         net_eq(sock_net(__sk), (__net)))
-
 #endif /* _IPV6_H */
diff --git a/include/linux/marvell_phy.h b/include/linux/marvell_phy.h
index 8e9a029e093d..e6982ac3200d 100644
--- a/include/linux/marvell_phy.h
+++ b/include/linux/marvell_phy.h
@@ -16,6 +16,7 @@
 #define MARVELL_PHY_ID_88E1318S         0x01410e90
 #define MARVELL_PHY_ID_88E1116R         0x01410e40
 #define MARVELL_PHY_ID_88E1510          0x01410dd0
+#define MARVELL_PHY_ID_88E3016          0x01410e60
 
 /* struct phy_device dev_flags definitions */
 #define MARVELL_PHY_M1145_FLAGS_RESISTANCE      0x00000001
diff --git a/include/linux/micrel_phy.h b/include/linux/micrel_phy.h
index 53d33dee70e1..2e5b194b9b19 100644
--- a/include/linux/micrel_phy.h
+++ b/include/linux/micrel_phy.h
@@ -37,7 +37,6 @@
 
 /* struct phy_device dev_flags definitions */
 #define MICREL_PHY_50MHZ_CLK    0x00000001
-#define MICREL_PHY_25MHZ_CLK    0x00000002
 
 #define MICREL_KSZ9021_EXTREG_CTRL      0xB
 #define MICREL_KSZ9021_EXTREG_DATA_WRITE        0xC
diff --git a/include/linux/mlx4/cmd.h b/include/linux/mlx4/cmd.h
index 379c02648ab3..64d25941b329 100644
--- a/include/linux/mlx4/cmd.h
+++ b/include/linux/mlx4/cmd.h
@@ -67,6 +67,8 @@ enum {
         MLX4_CMD_MAP_ICM_AUX     = 0xffc,
         MLX4_CMD_UNMAP_ICM_AUX   = 0xffb,
         MLX4_CMD_SET_ICM_SIZE    = 0xffd,
+        MLX4_CMD_ACCESS_REG      = 0x3b,
+
         /*master notify fw on finish for slave's flr*/
         MLX4_CMD_INFORM_FLR_DONE = 0x5b,
         MLX4_CMD_GET_OP_REQ      = 0x59,
@@ -197,6 +199,33 @@ enum {
         MLX4_CMD_NATIVE
 };
 
+/*
+ * MLX4_RX_CSUM_MODE_VAL_NON_TCP_UDP -
+ * Receive checksum value is reported in CQE also for non TCP/UDP packets.
+ *
+ * MLX4_RX_CSUM_MODE_L4 -
+ * L4_CSUM bit in CQE, which indicates whether or not L4 checksum
+ * was validated correctly, is supported.
+ *
+ * MLX4_RX_CSUM_MODE_IP_OK_IP_NON_TCP_UDP -
+ * IP_OK CQE's field is supported also for non TCP/UDP IP packets.
+ *
+ * MLX4_RX_CSUM_MODE_MULTI_VLAN -
+ * Receive Checksum offload is supported for packets with more than 2 vlan headers.
+ */
+enum mlx4_rx_csum_mode {
+        MLX4_RX_CSUM_MODE_VAL_NON_TCP_UDP               = 1UL << 0,
+        MLX4_RX_CSUM_MODE_L4                            = 1UL << 1,
+        MLX4_RX_CSUM_MODE_IP_OK_IP_NON_TCP_UDP          = 1UL << 2,
+        MLX4_RX_CSUM_MODE_MULTI_VLAN                    = 1UL << 3
+};
+
+struct mlx4_config_dev_params {
+        u16     vxlan_udp_dport;
+        u8      rx_csum_flags_port_1;
+        u8      rx_csum_flags_port_2;
+};
+
 struct mlx4_dev;
 
 struct mlx4_cmd_mailbox {
@@ -248,6 +277,8 @@ int mlx4_set_vf_vlan(struct mlx4_dev *dev, int port, int vf, u16 vlan, u8 qos);
 int mlx4_set_vf_spoofchk(struct mlx4_dev *dev, int port, int vf, bool setting);
 int mlx4_get_vf_config(struct mlx4_dev *dev, int port, int vf, struct ifla_vf_info *ivf);
 int mlx4_set_vf_link_state(struct mlx4_dev *dev, int port, int vf, int link_state);
+int mlx4_config_dev_retrieval(struct mlx4_dev *dev,
+                              struct mlx4_config_dev_params *params);
 /*
  * mlx4_get_slave_default_vlan -
  * return true if VST ( default vlan)
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 37e4404d0227..25c791e295fd 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -95,7 +95,7 @@ enum {
 
 enum {
         MLX4_MAX_NUM_PF         = 16,
-        MLX4_MAX_NUM_VF         = 64,
+        MLX4_MAX_NUM_VF         = 126,
         MLX4_MAX_NUM_VF_P_PORT  = 64,
         MLX4_MFUNC_MAX          = 80,
         MLX4_MAX_EQ_NUM         = 1024,
@@ -117,6 +117,14 @@ enum {
         MLX4_STEERING_MODE_DEVICE_MANAGED
 };
 
+enum {
+        MLX4_STEERING_DMFS_A0_DEFAULT,
+        MLX4_STEERING_DMFS_A0_DYNAMIC,
+        MLX4_STEERING_DMFS_A0_STATIC,
+        MLX4_STEERING_DMFS_A0_DISABLE,
+        MLX4_STEERING_DMFS_A0_NOT_SUPPORTED
+};
+
 static inline const char *mlx4_steering_mode_str(int steering_mode)
 {
         switch (steering_mode) {
@@ -186,7 +194,31 @@ enum {
         MLX4_DEV_CAP_FLAG2_VXLAN_OFFLOADS       = 1LL <<  10,
         MLX4_DEV_CAP_FLAG2_MAD_DEMUX            = 1LL <<  11,
         MLX4_DEV_CAP_FLAG2_CQE_STRIDE           = 1LL <<  12,
-        MLX4_DEV_CAP_FLAG2_EQE_STRIDE           = 1LL <<  13
+        MLX4_DEV_CAP_FLAG2_EQE_STRIDE           = 1LL <<  13,
+        MLX4_DEV_CAP_FLAG2_ETH_PROT_CTRL        = 1LL <<  14,
+        MLX4_DEV_CAP_FLAG2_ETH_BACKPL_AN_REP    = 1LL <<  15,
+        MLX4_DEV_CAP_FLAG2_CONFIG_DEV           = 1LL <<  16,
+        MLX4_DEV_CAP_FLAG2_SYS_EQS              = 1LL <<  17,
+        MLX4_DEV_CAP_FLAG2_80_VFS               = 1LL <<  18,
+        MLX4_DEV_CAP_FLAG2_FS_A0                = 1LL <<  19
+};
+
+enum {
+        MLX4_QUERY_FUNC_FLAGS_BF_RES_QP         = 1LL << 0,
+        MLX4_QUERY_FUNC_FLAGS_A0_RES_QP         = 1LL << 1
+};
+
+/* bit enums for an 8-bit flags field indicating special use
+ * QPs which require special handling in qp_reserve_range.
+ * Currently, this only includes QPs used by the ETH interface,
+ * where we expect to use blueflame.  These QPs must not have
+ * bits 6 and 7 set in their qp number.
+ *
+ * This enum may use only bits 0..7.
+ */
+enum {
+        MLX4_RESERVE_A0_QP      = 1 << 6,
+        MLX4_RESERVE_ETH_BF_QP  = 1 << 7,
 };
 
 enum {
@@ -202,7 +234,8 @@ enum {
 
 enum {
         MLX4_FUNC_CAP_64B_EQE_CQE       = 1L << 0,
-        MLX4_FUNC_CAP_EQE_CQE_STRIDE    = 1L << 1
+        MLX4_FUNC_CAP_EQE_CQE_STRIDE    = 1L << 1,
+        MLX4_FUNC_CAP_DMFS_A0_STATIC    = 1L << 2
 };
 
 
@@ -328,6 +361,8 @@ enum {
 
 enum mlx4_qp_region {
         MLX4_QP_REGION_FW = 0,
+        MLX4_QP_REGION_RSS_RAW_ETH,
+        MLX4_QP_REGION_BOTTOM = MLX4_QP_REGION_RSS_RAW_ETH,
         MLX4_QP_REGION_ETH_ADDR,
         MLX4_QP_REGION_FC_ADDR,
         MLX4_QP_REGION_FC_EXCH,
@@ -379,6 +414,13 @@ enum {
 #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
                              MLX4_EQ_PORT_INFO_MSTR_SM_LID_CHANGE_MASK)
 
+enum mlx4_module_id {
+        MLX4_MODULE_ID_SFP              = 0x3,
+        MLX4_MODULE_ID_QSFP             = 0xC,
+        MLX4_MODULE_ID_QSFP_PLUS        = 0xD,
+        MLX4_MODULE_ID_QSFP28           = 0x11,
+};
+
 static inline u64 mlx4_fw_ver(u64 major, u64 minor, u64 subminor)
 {
         return (major << 32) | (minor << 16) | subminor;
@@ -433,6 +475,7 @@ struct mlx4_caps {
         int                     num_cqs;
         int                     max_cqes;
         int                     reserved_cqs;
+        int                     num_sys_eqs;
         int                     num_eqs;
         int                     reserved_eqs;
         int                     num_comp_vectors;
@@ -449,6 +492,7 @@ struct mlx4_caps {
         int                     reserved_mcgs;
         int                     num_qp_per_mgm;
         int                     steering_mode;
+        int                     dmfs_high_steer_mode;
         int                     fs_log_max_ucast_qp_range_size;
         int                     num_pds;
         int                     reserved_pds;
@@ -487,6 +531,10 @@ struct mlx4_caps {
         u16                     hca_core_clock;
         u64                     phys_port_id[MLX4_MAX_PORTS + 1];
         int                     tunnel_offload_mode;
+        u8                      rx_checksum_flags_port[MLX4_MAX_PORTS + 1];
+        u8                      alloc_res_qp_mask;
+        u32                     dmfs_high_rate_qpn_base;
+        u32                     dmfs_high_rate_qpn_range;
 };
 
 struct mlx4_buf_list {
@@ -607,6 +655,11 @@ struct mlx4_cq {
 
         atomic_t                refcount;
         struct completion       free;
+        struct {
+                struct list_head list;
+                void (*comp)(struct mlx4_cq *);
+                void            *priv;
+        } tasklet_ctx;
 };
 
 struct mlx4_qp {
@@ -799,6 +852,26 @@ struct mlx4_init_port_param {
         u64                     si_guid;
 };
 
+#define MAD_IFC_DATA_SZ 192
+/* MAD IFC Mailbox */
+struct mlx4_mad_ifc {
+        u8      base_version;
+        u8      mgmt_class;
+        u8      class_version;
+        u8      method;
+        __be16  status;
+        __be16  class_specific;
+        __be64  tid;
+        __be16  attr_id;
+        __be16  resv;
+        __be32  attr_mod;
+        __be64  mkey;
+        __be16  dr_slid;
+        __be16  dr_dlid;
+        u8      reserved[28];
+        u8      data[MAD_IFC_DATA_SZ];
+} __packed;
+
 #define mlx4_foreach_port(port, dev, type)                              \
         for ((port) = 1; (port) <= (dev)->caps.num_ports; (port)++)     \
                 if ((type) == (dev)->caps.port_mask[(port)])
@@ -835,7 +908,9 @@ static inline int mlx4_num_reserved_sqps(struct mlx4_dev *dev)
 static inline int mlx4_is_qp_reserved(struct mlx4_dev *dev, u32 qpn)
 {
         return (qpn < dev->phys_caps.base_sqpn + 8 +
-                16 * MLX4_MFUNC_MAX * !!mlx4_is_master(dev));
+                16 * MLX4_MFUNC_MAX * !!mlx4_is_master(dev) &&
+                qpn >= dev->phys_caps.base_sqpn) ||
+               (qpn < dev->caps.reserved_qps_cnt[MLX4_QP_REGION_FW]);
 }
 
 static inline int mlx4_is_guest_proxy(struct mlx4_dev *dev, int slave, u32 qpn)
@@ -911,8 +986,8 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent, struct mlx4_mtt *mtt,
                   struct mlx4_uar *uar, u64 db_rec, struct mlx4_cq *cq,
                   unsigned vector, int collapsed, int timestamp_en);
 void mlx4_cq_free(struct mlx4_dev *dev, struct mlx4_cq *cq);
-
-int mlx4_qp_reserve_range(struct mlx4_dev *dev, int cnt, int align, int *base);
+int mlx4_qp_reserve_range(struct mlx4_dev *dev, int cnt, int align,
+                          int *base, u8 flags);
 void mlx4_qp_release_range(struct mlx4_dev *dev, int base_qpn, int cnt);
 
 int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp,
@@ -1283,10 +1358,50 @@ int mlx4_mr_rereg_mem_write(struct mlx4_dev *dev, struct mlx4_mr *mr,
                             u64 iova, u64 size, int npages,
                             int page_shift, struct mlx4_mpt_entry *mpt_entry);
 
+int mlx4_get_module_info(struct mlx4_dev *dev, u8 port,
+                         u16 offset, u16 size, u8 *data);
+
 /* Returns true if running in low memory profile (kdump kernel) */
 static inline bool mlx4_low_memory_profile(void)
 {
         return is_kdump_kernel();
 }
 
+/* ACCESS REG commands */
+enum mlx4_access_reg_method {
+        MLX4_ACCESS_REG_QUERY = 0x1,
+        MLX4_ACCESS_REG_WRITE = 0x2,
+};
+
+/* ACCESS PTYS Reg command */
+enum mlx4_ptys_proto {
+        MLX4_PTYS_IB = 1<<0,
+        MLX4_PTYS_EN = 1<<2,
+};
+
+struct mlx4_ptys_reg {
+        u8 resrvd1;
+        u8 local_port;
+        u8 resrvd2;
+        u8 proto_mask;
+        __be32 resrvd3[2];
+        __be32 eth_proto_cap;
+        __be16 ib_width_cap;
+        __be16 ib_speed_cap;
+        __be32 resrvd4;
+        __be32 eth_proto_admin;
+        __be16 ib_width_admin;
+        __be16 ib_speed_admin;
+        __be32 resrvd5;
+        __be32 eth_proto_oper;
+        __be16 ib_width_oper;
+        __be16 ib_speed_oper;
+        __be32 resrvd6;
+        __be32 eth_proto_lp_adv;
+} __packed;
+
+int mlx4_ACCESS_PTYS_REG(struct mlx4_dev *dev,
+                         enum mlx4_access_reg_method method,
+                         struct mlx4_ptys_reg *ptys_reg);
+
 #endif /* MLX4_DEVICE_H */
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index 5f4e36cf0091..467ccdf94c98 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -120,13 +120,15 @@ enum {
         MLX4_RSS_QPC_FLAG_OFFSET                = 13,
 };
 
+#define MLX4_EN_RSS_KEY_SIZE 40
+
 struct mlx4_rss_context {
         __be32                  base_qpn;
         __be32                  default_qpn;
         u16                     reserved;
         u8                      hash_fn;
         u8                      flags;
-        __be32                  rss_key[10];
+        __be32                  rss_key[MLX4_EN_RSS_KEY_SIZE / sizeof(__be32)];
         __be32                  base_qpn_udp;
 };
 
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index 1d67fd32e71c..ea4f1c46f761 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -219,23 +219,15 @@ enum {
 };
 
 enum {
-        MLX5_DEV_CAP_FLAG_RC            = 1LL <<  0,
-        MLX5_DEV_CAP_FLAG_UC            = 1LL <<  1,
-        MLX5_DEV_CAP_FLAG_UD            = 1LL <<  2,
         MLX5_DEV_CAP_FLAG_XRC           = 1LL <<  3,
-        MLX5_DEV_CAP_FLAG_SRQ           = 1LL <<  6,
         MLX5_DEV_CAP_FLAG_BAD_PKEY_CNTR = 1LL <<  8,
         MLX5_DEV_CAP_FLAG_BAD_QKEY_CNTR = 1LL <<  9,
         MLX5_DEV_CAP_FLAG_APM           = 1LL << 17,
         MLX5_DEV_CAP_FLAG_ATOMIC        = 1LL << 18,
         MLX5_DEV_CAP_FLAG_BLOCK_MCAST   = 1LL << 23,
-        MLX5_DEV_CAP_FLAG_ON_DMND_PG    = 1LL << 24,
         MLX5_DEV_CAP_FLAG_CQ_MODER      = 1LL << 29,
         MLX5_DEV_CAP_FLAG_RESIZE_CQ     = 1LL << 30,
-        MLX5_DEV_CAP_FLAG_RESIZE_SRQ    = 1LL << 32,
         MLX5_DEV_CAP_FLAG_DCT           = 1LL << 37,
-        MLX5_DEV_CAP_FLAG_REMOTE_FENCE  = 1LL << 38,
-        MLX5_DEV_CAP_FLAG_TLP_HINTS     = 1LL << 39,
         MLX5_DEV_CAP_FLAG_SIG_HAND_OVER = 1LL << 40,
         MLX5_DEV_CAP_FLAG_CMDIF_CSUM    = 3LL << 46,
 };
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 246310dc8bef..b1bf41556b32 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -633,14 +633,6 @@ static inline void *mlx5_vzalloc(unsigned long size)
         return rtn;
 }
 
-static inline void mlx5_vfree(const void *addr)
-{
-        if (addr && is_vmalloc_addr(addr))
-                vfree(addr);
-        else
-                kfree(addr);
-}
-
 static inline u32 mlx5_base_mkey(const u32 key)
 {
         return key & 0xffffff00u;
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index dcfdecbfa0b7..8e30685affeb 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -47,9 +47,9 @@ enum {
         NETIF_F_GSO_SIT_BIT,            /* ... SIT tunnel with TSO */
         NETIF_F_GSO_UDP_TUNNEL_BIT,     /* ... UDP TUNNEL with TSO */
         NETIF_F_GSO_UDP_TUNNEL_CSUM_BIT,/* ... UDP TUNNEL with TSO & CSUM */
-        NETIF_F_GSO_MPLS_BIT,           /* ... MPLS segmentation */
+        NETIF_F_GSO_TUNNEL_REMCSUM_BIT, /* ... TUNNEL with TSO & REMCSUM */
         /**/NETIF_F_GSO_LAST =          /* last bit, see GSO_MASK */
-                NETIF_F_GSO_MPLS_BIT,
+                NETIF_F_GSO_TUNNEL_REMCSUM_BIT,
 
         NETIF_F_FCOE_CRC_BIT,           /* FCoE CRC32 */
         NETIF_F_SCTP_CSUM_BIT,          /* SCTP checksum offload */
@@ -118,7 +118,7 @@ enum {
 #define NETIF_F_GSO_SIT         __NETIF_F(GSO_SIT)
 #define NETIF_F_GSO_UDP_TUNNEL  __NETIF_F(GSO_UDP_TUNNEL)
 #define NETIF_F_GSO_UDP_TUNNEL_CSUM __NETIF_F(GSO_UDP_TUNNEL_CSUM)
-#define NETIF_F_GSO_MPLS        __NETIF_F(GSO_MPLS)
+#define NETIF_F_GSO_TUNNEL_REMCSUM __NETIF_F(GSO_TUNNEL_REMCSUM)
 #define NETIF_F_HW_VLAN_STAG_FILTER __NETIF_F(HW_VLAN_STAG_FILTER)
 #define NETIF_F_HW_VLAN_STAG_RX __NETIF_F(HW_VLAN_STAG_RX)
 #define NETIF_F_HW_VLAN_STAG_TX __NETIF_F(HW_VLAN_STAG_TX)
@@ -181,7 +181,6 @@ enum {
                                  NETIF_F_GSO_IPIP |                     \
                                  NETIF_F_GSO_SIT |                      \
                                  NETIF_F_GSO_UDP_TUNNEL |               \
-                                 NETIF_F_GSO_UDP_TUNNEL_CSUM |          \
-                                 NETIF_F_GSO_MPLS)
+                                 NETIF_F_GSO_UDP_TUNNEL_CSUM)
 
 #endif  /* _LINUX_NETDEV_FEATURES_H */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 74fd5d37f15a..c31f74d76ebd 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -57,6 +57,8 @@ struct device;
 struct phy_device;
 /* 802.11 specific */
 struct wireless_dev;
+/* 802.15.4 specific */
+struct wpan_dev;
 
 void netdev_set_default_ethtool_ops(struct net_device *dev,
                                     const struct ethtool_ops *ops);
@@ -314,6 +316,7 @@ struct napi_struct {
         struct net_device       *dev;
         struct sk_buff          *gro_list;
         struct sk_buff          *skb;
+        struct hrtimer          timer;
         struct list_head        dev_list;
         struct hlist_node       napi_hash_node;
         unsigned int            napi_id;
@@ -386,6 +389,7 @@ typedef enum rx_handler_result rx_handler_result_t;
 typedef rx_handler_result_t rx_handler_func_t(struct sk_buff **pskb);
 
 void __napi_schedule(struct napi_struct *n);
+void __napi_schedule_irqoff(struct napi_struct *n);
 
 static inline bool napi_disable_pending(struct napi_struct *n)
 {
@@ -420,6 +424,18 @@ static inline void napi_schedule(struct napi_struct *n)
                 __napi_schedule(n);
 }
 
+/**
+ *      napi_schedule_irqoff - schedule NAPI poll
+ *      @n: napi context
+ *
+ * Variant of napi_schedule(), assuming hard irqs are masked.
+ */
+static inline void napi_schedule_irqoff(struct napi_struct *n)
+{
+        if (napi_schedule_prep(n))
+                __napi_schedule_irqoff(n);
+}
+
 /* Try to reschedule poll. Called by dev->poll() after napi_complete().  */
 static inline bool napi_reschedule(struct napi_struct *napi)
 {
@@ -430,14 +446,19 @@ static inline bool napi_reschedule(struct napi_struct *napi)
         return false;
 }
 
+void __napi_complete(struct napi_struct *n);
+void napi_complete_done(struct napi_struct *n, int work_done);
 /**
  *      napi_complete - NAPI processing complete
  *      @n: napi context
  *
  * Mark NAPI processing as complete.
+ * Consider using napi_complete_done() instead.
  */
-void __napi_complete(struct napi_struct *n);
-void napi_complete(struct napi_struct *n);
+static inline void napi_complete(struct napi_struct *n)
+{
+        return napi_complete_done(n, 0);
+}
 
 /**
  *      napi_by_id - lookup a NAPI by napi_id
@@ -472,14 +493,7 @@ void napi_hash_del(struct napi_struct *napi);
  * Stop NAPI from being scheduled on this context.
  * Waits till any outstanding processing completes.
  */
-static inline void napi_disable(struct napi_struct *n)
-{
-        might_sleep();
-        set_bit(NAPI_STATE_DISABLE, &n->state);
-        while (test_and_set_bit(NAPI_STATE_SCHED, &n->state))
-                msleep(1);
-        clear_bit(NAPI_STATE_DISABLE, &n->state);
-}
+void napi_disable(struct napi_struct *n);
 
 /**
  *      napi_enable - enable NAPI scheduling
@@ -740,13 +754,13 @@ struct netdev_fcoe_hbainfo {
 };
 #endif
 
-#define MAX_PHYS_PORT_ID_LEN 32
+#define MAX_PHYS_ITEM_ID_LEN 32
 
-/* This structure holds a unique identifier to identify the
- * physical port used by a netdevice.
+/* This structure holds a unique identifier to identify some
+ * physical item (port for example) used by a netdevice.
  */
-struct netdev_phys_port_id {
-        unsigned char id[MAX_PHYS_PORT_ID_LEN];
+struct netdev_phys_item_id {
+        unsigned char id[MAX_PHYS_ITEM_ID_LEN];
         unsigned char id_len;
 };
 
@@ -937,11 +951,11 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
  *
  * int (*ndo_fdb_add)(struct ndmsg *ndm, struct nlattr *tb[],
  *                    struct net_device *dev,
- *                    const unsigned char *addr, u16 flags)
+ *                    const unsigned char *addr, u16 vid, u16 flags)
  *      Adds an FDB entry to dev for addr.
  * int (*ndo_fdb_del)(struct ndmsg *ndm, struct nlattr *tb[],
  *                    struct net_device *dev,
- *                    const unsigned char *addr)
+ *                    const unsigned char *addr, u16 vid)
  *      Deletes the FDB entry from dev coresponding to addr.
  * int (*ndo_fdb_dump)(struct sk_buff *skb, struct netlink_callback *cb,
  *                     struct net_device *dev, struct net_device *filter_dev,
@@ -962,7 +976,7 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
  *      USB_CDC_NOTIFY_NETWORK_CONNECTION) should NOT implement this function.
  *
  * int (*ndo_get_phys_port_id)(struct net_device *dev,
- *                             struct netdev_phys_port_id *ppid);
+ *                             struct netdev_phys_item_id *ppid);
  *      Called to get ID of physical port of this device. If driver does
  *      not implement this, it is assumed that the hw is not able to have
  *      multiple net devices on single physical port.
@@ -1004,6 +1018,15 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
  *      performing GSO on a packet. The device returns true if it is
  *      able to GSO the packet, false otherwise. If the return value is
  *      false the stack will do software GSO.
+ *
+ * int (*ndo_switch_parent_id_get)(struct net_device *dev,
+ *                                 struct netdev_phys_item_id *psid);
+ *      Called to get an ID of the switch chip this port is part of.
+ *      If driver implements this, it indicates that it represents a port
+ *      of a switch chip.
+ * int (*ndo_switch_port_stp_update)(struct net_device *dev, u8 state);
+ *      Called to notify switch device port of bridge port STP
+ *      state change.
  */
 struct net_device_ops {
         int                     (*ndo_init)(struct net_device *dev);
@@ -1114,11 +1137,13 @@ struct net_device_ops {
                                                struct nlattr *tb[],
                                                struct net_device *dev,
                                                const unsigned char *addr,
+                                               u16 vid,
                                                u16 flags);
         int                     (*ndo_fdb_del)(struct ndmsg *ndm,
                                                struct nlattr *tb[],
                                                struct net_device *dev,
-                                               const unsigned char *addr);
+                                               const unsigned char *addr,
+                                               u16 vid);
         int                     (*ndo_fdb_dump)(struct sk_buff *skb,
                                                 struct netlink_callback *cb,
                                                 struct net_device *dev,
@@ -1136,7 +1161,7 @@ struct net_device_ops {
         int                     (*ndo_change_carrier)(struct net_device *dev,
                                                       bool new_carrier);
         int                     (*ndo_get_phys_port_id)(struct net_device *dev,
-                                                        struct netdev_phys_port_id *ppid);
+                                                        struct netdev_phys_item_id *ppid);
         void                    (*ndo_add_vxlan_port)(struct  net_device *dev,
                                                       sa_family_t sa_family,
                                                       __be16 port);
@@ -1155,6 +1180,12 @@ struct net_device_ops {
         int                     (*ndo_get_lock_subclass)(struct net_device *dev);
         bool                    (*ndo_gso_check) (struct sk_buff *skb,
                                                   struct net_device *dev);
+#ifdef CONFIG_NET_SWITCHDEV
+        int                     (*ndo_switch_parent_id_get)(struct net_device *dev,
+                                                            struct netdev_phys_item_id *psid);
+        int                     (*ndo_switch_port_stp_update)(struct net_device *dev,
+                                                              u8 state);
+#endif
 };
 
 /**
@@ -1216,6 +1247,8 @@ enum netdev_priv_flags {
         IFF_LIVE_ADDR_CHANGE            = 1<<20,
         IFF_MACVLAN                     = 1<<21,
         IFF_XMIT_DST_RELEASE_PERM       = 1<<22,
+        IFF_IPVLAN_MASTER               = 1<<23,
+        IFF_IPVLAN_SLAVE                = 1<<24,
 };
 
 #define IFF_802_1Q_VLAN                 IFF_802_1Q_VLAN
@@ -1241,6 +1274,8 @@ enum netdev_priv_flags {
 #define IFF_LIVE_ADDR_CHANGE            IFF_LIVE_ADDR_CHANGE
 #define IFF_MACVLAN                     IFF_MACVLAN
 #define IFF_XMIT_DST_RELEASE_PERM       IFF_XMIT_DST_RELEASE_PERM
+#define IFF_IPVLAN_MASTER               IFF_IPVLAN_MASTER
+#define IFF_IPVLAN_SLAVE                IFF_IPVLAN_SLAVE
 
 /**
  *      struct net_device - The DEVICE structure.
@@ -1572,6 +1607,7 @@ struct net_device {
         struct inet6_dev __rcu  *ip6_ptr;
         void                    *ax25_ptr;
         struct wireless_dev     *ieee80211_ptr;
+        struct wpan_dev         *ieee802154_ptr;
 
 /*
  * Cache lines mostly used on receive path (including eth_type_trans())
@@ -1590,6 +1626,7 @@ struct net_device {
 
 #endif
 
+        unsigned long           gro_flush_timeout;
         rx_handler_func_t __rcu *rx_handler;
         void __rcu              *rx_handler_data;
 
@@ -2316,10 +2353,7 @@ extern int netdev_flow_limit_table_len;
  * Incoming packets are placed on per-cpu queues
  */
 struct softnet_data {
-        struct Qdisc            *output_queue;
-        struct Qdisc            **output_queue_tailp;
         struct list_head        poll_list;
-        struct sk_buff          *completion_queue;
         struct sk_buff_head     process_queue;
 
         /* stats */
@@ -2327,10 +2361,17 @@ struct softnet_data {
         unsigned int            time_squeeze;
         unsigned int            cpu_collision;
         unsigned int            received_rps;
-
 #ifdef CONFIG_RPS
         struct softnet_data     *rps_ipi_list;
+#endif
+#ifdef CONFIG_NET_FLOW_LIMIT
+        struct sd_flow_limit __rcu *flow_limit;
+#endif
+        struct Qdisc            *output_queue;
+        struct Qdisc            **output_queue_tailp;
+        struct sk_buff          *completion_queue;
 
+#ifdef CONFIG_RPS
         /* Elements below can be accessed between CPUs for RPS */
         struct call_single_data csd ____cacheline_aligned_in_smp;
         struct softnet_data     *rps_ipi_next;
@@ -2342,9 +2383,6 @@ struct softnet_data {
         struct sk_buff_head     input_pkt_queue;
         struct napi_struct      backlog;
 
-#ifdef CONFIG_NET_FLOW_LIMIT
-        struct sd_flow_limit __rcu *flow_limit;
-#endif
 };
 
 static inline void input_queue_head_incr(struct softnet_data *sd)
@@ -2748,23 +2786,6 @@ static inline int netif_set_real_num_rx_queues(struct net_device *dev,
 }
 #endif
 
-static inline int netif_copy_real_num_queues(struct net_device *to_dev,
-                                             const struct net_device *from_dev)
-{
-        int err;
-
-        err = netif_set_real_num_tx_queues(to_dev,
-                                           from_dev->real_num_tx_queues);
-        if (err)
-                return err;
-#ifdef CONFIG_SYSFS
-        return netif_set_real_num_rx_queues(to_dev,
-                                            from_dev->real_num_rx_queues);
-#else
-        return 0;
-#endif
-}
-
 #ifdef CONFIG_SYSFS
 static inline unsigned int get_netdev_rx_queue_index(
                 struct netdev_rx_queue *queue)
@@ -2864,7 +2885,7 @@ void dev_set_group(struct net_device *, int);
 int dev_set_mac_address(struct net_device *, struct sockaddr *);
 int dev_change_carrier(struct net_device *, bool new_carrier);
 int dev_get_phys_port_id(struct net_device *dev,
-                         struct netdev_phys_port_id *ppid);
+                         struct netdev_phys_item_id *ppid);
 struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *dev);
 struct sk_buff *dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                                     struct netdev_queue *txq, int *ret);
@@ -3425,6 +3446,12 @@ void netdev_upper_dev_unlink(struct net_device *dev,
 void netdev_adjacent_rename_links(struct net_device *dev, char *oldname);
 void *netdev_lower_dev_get_private(struct net_device *dev,
                                    struct net_device *lower_dev);
+
+/* RSS keys are 40 or 52 bytes long */
+#define NETDEV_RSS_KEY_LEN 52
+extern u8 netdev_rss_key[NETDEV_RSS_KEY_LEN];
+void netdev_rss_key_fill(void *buffer, size_t len);
+
 int dev_get_nest_level(struct net_device *dev,
                        bool (*type_check)(struct net_device *dev));
 int skb_checksum_help(struct sk_buff *skb);
@@ -3569,7 +3596,7 @@ static inline bool net_gso_ok(netdev_features_t features, int gso_type)
         BUILD_BUG_ON(SKB_GSO_SIT     != (NETIF_F_GSO_SIT >> NETIF_F_GSO_SHIFT));
         BUILD_BUG_ON(SKB_GSO_UDP_TUNNEL != (NETIF_F_GSO_UDP_TUNNEL >> NETIF_F_GSO_SHIFT));
         BUILD_BUG_ON(SKB_GSO_UDP_TUNNEL_CSUM != (NETIF_F_GSO_UDP_TUNNEL_CSUM >> NETIF_F_GSO_SHIFT));
-        BUILD_BUG_ON(SKB_GSO_MPLS    != (NETIF_F_GSO_MPLS >> NETIF_F_GSO_SHIFT));
+        BUILD_BUG_ON(SKB_GSO_TUNNEL_REMCSUM != (NETIF_F_GSO_TUNNEL_REMCSUM >> NETIF_F_GSO_SHIFT));
 
         return (features & feature) == feature;
 }
@@ -3614,6 +3641,21 @@ static inline bool netif_is_macvlan(struct net_device *dev)
         return dev->priv_flags & IFF_MACVLAN;
 }
 
+static inline bool netif_is_macvlan_port(struct net_device *dev)
+{
+        return dev->priv_flags & IFF_MACVLAN_PORT;
+}
+
+static inline bool netif_is_ipvlan(struct net_device *dev)
+{
+        return dev->priv_flags & IFF_IPVLAN_SLAVE;
+}
+
+static inline bool netif_is_ipvlan_port(struct net_device *dev)
+{
+        return dev->priv_flags & IFF_IPVLAN_MASTER;
+}
+
 static inline bool netif_is_bond_master(struct net_device *dev)
 {
         return dev->flags & IFF_MASTER && dev->priv_flags & IFF_BONDING;
diff --git a/include/linux/nl802154.h b/include/linux/nl802154.h
index 20163b9a0eae..167342c2ce6b 100644
--- a/include/linux/nl802154.h
+++ b/include/linux/nl802154.h
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  */
 
 #ifndef NL802154_H
diff --git a/include/linux/phy.h b/include/linux/phy.h
index d090cfcaa167..22af8f8f5802 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -433,6 +433,7 @@ struct phy_device {
  *   by this PHY
  * flags: A bitfield defining certain other features this PHY
  *   supports (like interrupts)
+ * driver_data: static driver data
  *
  * The drivers must implement config_aneg and read_status.  All
  * other functions are optional. Note that none of these
@@ -448,6 +449,7 @@ struct phy_driver {
         unsigned int phy_id_mask;
         u32 features;
         u32 flags;
+        const void *driver_data;
 
         /*
          * Called to issue a PHY software reset
@@ -772,4 +774,28 @@ int __init mdio_bus_init(void);
 void mdio_bus_exit(void);
 
 extern struct bus_type mdio_bus_type;
+
+/**
+ * module_phy_driver() - Helper macro for registering PHY drivers
+ * @__phy_drivers: array of PHY drivers to register
+ *
+ * Helper macro for PHY drivers which do not do anything special in module
+ * init/exit. Each module may only use this macro once, and calling it
+ * replaces module_init() and module_exit().
+ */
+#define phy_module_driver(__phy_drivers, __count)                       \
+static int __init phy_module_init(void)                                 \
+{                                                                       \
+        return phy_drivers_register(__phy_drivers, __count);            \
+}                                                                       \
+module_init(phy_module_init);                                           \
+static void __exit phy_module_exit(void)                                \
+{                                                                       \
+        phy_drivers_unregister(__phy_drivers, __count);                 \
+}                                                                       \
+module_exit(phy_module_exit)
+
+#define module_phy_driver(__phy_drivers)                                \
+        phy_module_driver(__phy_drivers, ARRAY_SIZE(__phy_drivers))
+
 #endif /* __PHY_H */
diff --git a/include/linux/platform_data/bcmgenet.h b/include/linux/platform_data/bcmgenet.h
new file mode 100644
index 000000000000..26af54321958
--- /dev/null
+++ b/include/linux/platform_data/bcmgenet.h
@@ -0,0 +1,18 @@
+#ifndef __LINUX_PLATFORM_DATA_BCMGENET_H__
+#define __LINUX_PLATFORM_DATA_BCMGENET_H__
+
+#include <linux/types.h>
+#include <linux/if_ether.h>
+#include <linux/phy.h>
+
+struct bcmgenet_platform_data {
+        bool            mdio_enabled;
+        phy_interface_t phy_interface;
+        int             phy_address;
+        int             phy_speed;
+        int             phy_duplex;
+        u8              mac_address[ETH_ALEN];
+        int             genet_version;
+};
+
+#endif
diff --git a/include/linux/platform_data/st21nfca.h b/include/linux/platform_data/st21nfca.h
index 1730312398ff..5087fff96d86 100644
--- a/include/linux/platform_data/st21nfca.h
+++ b/include/linux/platform_data/st21nfca.h
@@ -24,7 +24,6 @@
 #define ST21NFCA_HCI_DRIVER_NAME "st21nfca_hci"
 
 struct st21nfca_nfc_platform_data {
-        unsigned int gpio_irq;
         unsigned int gpio_ena;
         unsigned int irq_polarity;
 };
diff --git a/include/linux/platform_data/st21nfcb.h b/include/linux/platform_data/st21nfcb.h
index 2d11f1f5efab..c3b432f5b63e 100644
--- a/include/linux/platform_data/st21nfcb.h
+++ b/include/linux/platform_data/st21nfcb.h
@@ -24,7 +24,6 @@
 #define ST21NFCB_NCI_DRIVER_NAME "st21nfcb_nci"
 
 struct st21nfcb_nfc_platform_data {
-        unsigned int gpio_irq;
         unsigned int gpio_reset;
         unsigned int irq_polarity;
 };
diff --git a/include/linux/pxa168_eth.h b/include/linux/pxa168_eth.h
index 18d75e795606..e1ab6e86cdb3 100644
--- a/include/linux/pxa168_eth.h
+++ b/include/linux/pxa168_eth.h
@@ -4,6 +4,8 @@
 #ifndef __LINUX_PXA168_ETH_H
 #define __LINUX_PXA168_ETH_H
 
+#include <linux/phy.h>
+
 struct pxa168_eth_platform_data {
         int     port_number;
         int     phy_addr;
@@ -13,6 +15,7 @@ struct pxa168_eth_platform_data {
          */
         int     speed;          /* 0, SPEED_10, SPEED_100 */
         int     duplex;         /* DUPLEX_HALF or DUPLEX_FULL */
+        phy_interface_t intf;
 
         /*
          * Override default RX/TX queue sizes if nonzero.
diff --git a/include/linux/rculist.h b/include/linux/rculist.h
index 372ad5e0dcb8..aa79b3c24f66 100644
--- a/include/linux/rculist.h
+++ b/include/linux/rculist.h
@@ -542,6 +542,15 @@ static inline void hlist_add_behind_rcu(struct hlist_node *n,
              pos = hlist_entry_safe(rcu_dereference_bh((pos)->member.next),\
                         typeof(*(pos)), member))
 
+/**
+ * hlist_for_each_entry_from_rcu - iterate over a hlist continuing from current point
+ * @pos:        the type * to use as a loop cursor.
+ * @member:     the name of the hlist_node within the struct.
+ */
+#define hlist_for_each_entry_from_rcu(pos, member)                      \
+        for (; pos;                                                     \
+             pos = hlist_entry_safe(rcu_dereference((pos)->member.next),\
+                        typeof(*(pos)), member))
 
 #endif  /* __KERNEL__ */
 #endif
diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index fb298e9d6d3a..b93fd89b2e5e 100644
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -65,7 +65,10 @@ struct rhashtable_params {
                                                  size_t new_size);
         bool                    (*shrink_decision)(const struct rhashtable *ht,
                                                    size_t new_size);
-        int                     (*mutex_is_held)(void);
+#ifdef CONFIG_PROVE_LOCKING
+        int                     (*mutex_is_held)(void *parent);
+        void                    *parent;
+#endif
 };
 
 /**
@@ -96,16 +99,16 @@ int rhashtable_init(struct rhashtable *ht, struct rhashtable_params *params);
 u32 rhashtable_hashfn(const struct rhashtable *ht, const void *key, u32 len);
 u32 rhashtable_obj_hashfn(const struct rhashtable *ht, void *ptr);
 
-void rhashtable_insert(struct rhashtable *ht, struct rhash_head *node, gfp_t);
-bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *node, gfp_t);
+void rhashtable_insert(struct rhashtable *ht, struct rhash_head *node);
+bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *node);
 void rhashtable_remove_pprev(struct rhashtable *ht, struct rhash_head *obj,
-                             struct rhash_head __rcu **pprev, gfp_t flags);
+                             struct rhash_head __rcu **pprev);
 
 bool rht_grow_above_75(const struct rhashtable *ht, size_t new_size);
 bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size);
 
-int rhashtable_expand(struct rhashtable *ht, gfp_t flags);
-int rhashtable_shrink(struct rhashtable *ht, gfp_t flags);
+int rhashtable_expand(struct rhashtable *ht);
+int rhashtable_shrink(struct rhashtable *ht);
 
 void *rhashtable_lookup(const struct rhashtable *ht, const void *key);
 void *rhashtable_lookup_compare(const struct rhashtable *ht, u32 hash,
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 6cacbce1a06c..5db76a32fcab 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -17,6 +17,11 @@ extern int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst,
                               u32 id, long expires, u32 error);
 
 void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change, gfp_t flags);
+struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev,
+                                       unsigned change, gfp_t flags);
+void rtmsg_ifinfo_send(struct sk_buff *skb, struct net_device *dev,
+                       gfp_t flags);
+
 
 /* RTNL is used as a global lock for all changes to network configuration  */
 extern void rtnl_lock(void);
@@ -94,12 +99,15 @@ extern int ndo_dflt_fdb_add(struct ndmsg *ndm,
                             struct nlattr *tb[],
                             struct net_device *dev,
                             const unsigned char *addr,
-                             u16 flags);
+                            u16 vid,
+                            u16 flags);
 extern int ndo_dflt_fdb_del(struct ndmsg *ndm,
                             struct nlattr *tb[],
                             struct net_device *dev,
-                            const unsigned char *addr);
+                            const unsigned char *addr,
+                            u16 vid);
 
 extern int ndo_dflt_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,
-                                   struct net_device *dev, u16 mode);
+                                   struct net_device *dev, u16 mode,
+                                   u32 flags, u32 mask);
 #endif  /* __LINUX_RTNETLINK_H */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 6c8b6f604e76..85ab7d72b54c 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -20,6 +20,8 @@
 #include <linux/time.h>
 #include <linux/bug.h>
 #include <linux/cache.h>
+#include <linux/rbtree.h>
+#include <linux/socket.h>
 
 #include <linux/atomic.h>
 #include <asm/types.h>
@@ -148,6 +150,8 @@
 struct net_device;
 struct scatterlist;
 struct pipe_inode_info;
+struct iov_iter;
+struct napi_struct;
 
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 struct nf_conntrack {
@@ -341,7 +345,6 @@ enum {
         SKB_FCLONE_UNAVAILABLE, /* skb has no fclone (from head_cache) */
         SKB_FCLONE_ORIG,        /* orig skb (from fclone_cache) */
         SKB_FCLONE_CLONE,       /* companion fclone skb (from fclone_cache) */
-        SKB_FCLONE_FREE,        /* this companion fclone skb is available */
 };
 
 enum {
@@ -370,8 +373,7 @@ enum {
 
         SKB_GSO_UDP_TUNNEL_CSUM = 1 << 11,
 
-        SKB_GSO_MPLS = 1 << 12,
-
+        SKB_GSO_TUNNEL_REMCSUM = 1 << 12,
 };
 
 #if BITS_PER_LONG > 32
@@ -440,6 +442,7 @@ static inline u32 skb_mstamp_us_delta(const struct skb_mstamp *t1,
  *      @next: Next buffer in list
  *      @prev: Previous buffer in list
  *      @tstamp: Time we arrived/left
+ *      @rbnode: RB tree node, alternative to next/prev for netem/tcp
  *      @sk: Socket we are owned by
  *      @dev: Device we arrived on/are leaving by
  *      @cb: Control buffer. Free for use by every layer. Put private vars here
@@ -504,15 +507,19 @@ static inline u32 skb_mstamp_us_delta(const struct skb_mstamp *t1,
  */
 
 struct sk_buff {
-        /* These two members must be first. */
-        struct sk_buff          *next;
-        struct sk_buff          *prev;
-
         union {
-                ktime_t         tstamp;
-                struct skb_mstamp skb_mstamp;
+                struct {
+                        /* These two members must be first. */
+                        struct sk_buff          *next;
+                        struct sk_buff          *prev;
+
+                        union {
+                                ktime_t         tstamp;
+                                struct skb_mstamp skb_mstamp;
+                        };
+                };
+                struct rb_node  rbnode; /* used in netem & tcp stack */
         };
-
         struct sock             *sk;
         struct net_device       *dev;
 
@@ -597,7 +604,8 @@ struct sk_buff {
 #endif
         __u8                    ipvs_property:1;
         __u8                    inner_protocol_type:1;
-        /* 4 or 6 bit hole */
+        __u8                    remcsum_offload:1;
+        /* 3 or 5 bit hole */
 
 #ifdef CONFIG_NET_SCHED
         __u16                   tc_index;       /* traffic control index */
@@ -666,6 +674,7 @@ struct sk_buff {
 
 #define SKB_ALLOC_FCLONE        0x01
 #define SKB_ALLOC_RX            0x02
+#define SKB_ALLOC_NAPI          0x04
 
 /* Returns true if the skb was allocated from PFMEMALLOC reserves */
 static inline bool skb_pfmemalloc(const struct sk_buff *skb)
@@ -710,9 +719,6 @@ static inline void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)
         skb->_skb_refdst = (unsigned long)dst;
 }
 
-void __skb_dst_set_noref(struct sk_buff *skb, struct dst_entry *dst,
-                         bool force);
-
 /**
  * skb_dst_set_noref - sets skb dst, hopefully, without taking reference
  * @skb: buffer
@@ -725,24 +731,8 @@ void __skb_dst_set_noref(struct sk_buff *skb, struct dst_entry *dst,
  */
 static inline void skb_dst_set_noref(struct sk_buff *skb, struct dst_entry *dst)
 {
-        __skb_dst_set_noref(skb, dst, false);
-}
-
-/**
- * skb_dst_set_noref_force - sets skb dst, without taking reference
- * @skb: buffer
- * @dst: dst entry
- *
- * Sets skb dst, assuming a reference was not taken on dst.
- * No reference is taken and no dst_release will be called. While for
- * cached dsts deferred reclaim is a basic feature, for entries that are
- * not cached it is caller's job to guarantee that last dst_release for
- * provided dst happens when nobody uses it, eg. after a RCU grace period.
- */
-static inline void skb_dst_set_noref_force(struct sk_buff *skb,
-                                           struct dst_entry *dst)
-{
-        __skb_dst_set_noref(skb, dst, true);
+        WARN_ON(!rcu_read_lock_held() && !rcu_read_lock_bh_held());
+        skb->_skb_refdst = (unsigned long)dst | SKB_DST_NOREF;
 }
 
 /**
@@ -810,7 +800,7 @@ static inline bool skb_fclone_busy(const struct sock *sk,
         fclones = container_of(skb, struct sk_buff_fclones, skb1);
 
         return skb->fclone == SKB_FCLONE_ORIG &&
-               fclones->skb2.fclone == SKB_FCLONE_CLONE &&
+               atomic_read(&fclones->fclone_ref) > 1 &&
                fclones->skb2.sk == sk;
 }
 
@@ -2176,47 +2166,61 @@ static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
         return __netdev_alloc_skb_ip_align(dev, length, GFP_ATOMIC);
 }
 
+void *napi_alloc_frag(unsigned int fragsz);
+struct sk_buff *__napi_alloc_skb(struct napi_struct *napi,
+                                 unsigned int length, gfp_t gfp_mask);
+static inline struct sk_buff *napi_alloc_skb(struct napi_struct *napi,
+                                             unsigned int length)
+{
+        return __napi_alloc_skb(napi, length, GFP_ATOMIC);
+}
+
 /**
- *      __skb_alloc_pages - allocate pages for ps-rx on a skb and preserve pfmemalloc data
- *      @gfp_mask: alloc_pages_node mask. Set __GFP_NOMEMALLOC if not for network packet RX
- *      @skb: skb to set pfmemalloc on if __GFP_MEMALLOC is used
- *      @order: size of the allocation
+ * __dev_alloc_pages - allocate page for network Rx
+ * @gfp_mask: allocation priority. Set __GFP_NOMEMALLOC if not for network Rx
+ * @order: size of the allocation
  *
- *      Allocate a new page.
+ * Allocate a new page.
  *
- *      %NULL is returned if there is no free memory.
+ * %NULL is returned if there is no free memory.
 */
-static inline struct page *__skb_alloc_pages(gfp_t gfp_mask,
-                                              struct sk_buff *skb,
-                                              unsigned int order)
-{
-        struct page *page;
-
-        gfp_mask |= __GFP_COLD;
-
-        if (!(gfp_mask & __GFP_NOMEMALLOC))
-                gfp_mask |= __GFP_MEMALLOC;
+static inline struct page *__dev_alloc_pages(gfp_t gfp_mask,
+                                             unsigned int order)
+{
+        /* This piece of code contains several assumptions.
+         * 1.  This is for device Rx, therefor a cold page is preferred.
+         * 2.  The expectation is the user wants a compound page.
+         * 3.  If requesting a order 0 page it will not be compound
+         *     due to the check to see if order has a value in prep_new_page
+         * 4.  __GFP_MEMALLOC is ignored if __GFP_NOMEMALLOC is set due to
+         *     code in gfp_to_alloc_flags that should be enforcing this.
+         */
+        gfp_mask |= __GFP_COLD | __GFP_COMP | __GFP_MEMALLOC;
 
-        page = alloc_pages_node(NUMA_NO_NODE, gfp_mask, order);
-        if (skb && page && page->pfmemalloc)
-                skb->pfmemalloc = true;
+        return alloc_pages_node(NUMA_NO_NODE, gfp_mask, order);
+}
 
-        return page;
+static inline struct page *dev_alloc_pages(unsigned int order)
+{
+        return __dev_alloc_pages(GFP_ATOMIC, order);
 }
 
 /**
- *      __skb_alloc_page - allocate a page for ps-rx for a given skb and preserve pfmemalloc data
- *      @gfp_mask: alloc_pages_node mask. Set __GFP_NOMEMALLOC if not for network packet RX
- *      @skb: skb to set pfmemalloc on if __GFP_MEMALLOC is used
+ * __dev_alloc_page - allocate a page for network Rx
+ * @gfp_mask: allocation priority. Set __GFP_NOMEMALLOC if not for network Rx
  *
- *      Allocate a new page.
+ * Allocate a new page.
  *
- *      %NULL is returned if there is no free memory.
+ * %NULL is returned if there is no free memory.
  */
-static inline struct page *__skb_alloc_page(gfp_t gfp_mask,
-                                             struct sk_buff *skb)
+static inline struct page *__dev_alloc_page(gfp_t gfp_mask)
+{
+        return __dev_alloc_pages(gfp_mask, 0);
+}
+
+static inline struct page *dev_alloc_page(void)
 {
-        return __skb_alloc_pages(gfp_mask, skb, 0);
+        return __dev_alloc_page(GFP_ATOMIC);
 }
 
 /**
@@ -2448,7 +2452,6 @@ static inline int skb_cow_head(struct sk_buff *skb, unsigned int headroom)
  *      is untouched. Otherwise it is extended. Returns zero on
  *      success. The skb is freed on error.
  */
- 
 static inline int skb_padto(struct sk_buff *skb, unsigned int len)
 {
         unsigned int size = skb->len;
@@ -2457,6 +2460,29 @@ static inline int skb_padto(struct sk_buff *skb, unsigned int len)
         return skb_pad(skb, len - size);
 }
 
+/**
+ *      skb_put_padto - increase size and pad an skbuff up to a minimal size
+ *      @skb: buffer to pad
+ *      @len: minimal length
+ *
+ *      Pads up a buffer to ensure the trailing bytes exist and are
+ *      blanked. If the buffer already contains sufficient data it
+ *      is untouched. Otherwise it is extended. Returns zero on
+ *      success. The skb is freed on error.
+ */
+static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
+{
+        unsigned int size = skb->len;
+
+        if (unlikely(size < len)) {
+                len -= size;
+                if (skb_pad(skb, len))
+                        return -ENOMEM;
+                __skb_put(skb, len);
+        }
+        return 0;
+}
+
 static inline int skb_add_data(struct sk_buff *skb,
                                char __user *from, int copy)
 {
@@ -2629,18 +2655,18 @@ struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock,
                                   int *err);
 unsigned int datagram_poll(struct file *file, struct socket *sock,
                            struct poll_table_struct *wait);
-int skb_copy_datagram_iovec(const struct sk_buff *from, int offset,
-                            struct iovec *to, int size);
-int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb, int hlen,
-                                     struct iovec *iov);
-int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
-                                 const struct iovec *from, int from_offset,
-                                 int len);
-int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *frm,
-                           int offset, size_t count);
-int skb_copy_datagram_const_iovec(const struct sk_buff *from, int offset,
-                                  const struct iovec *to, int to_offset,
-                                  int size);
+int skb_copy_datagram_iter(const struct sk_buff *from, int offset,
+                           struct iov_iter *to, int size);
+static inline int skb_copy_datagram_msg(const struct sk_buff *from, int offset,
+                                        struct msghdr *msg, int size)
+{
+        return skb_copy_datagram_iter(from, offset, &msg->msg_iter, size);
+}
+int skb_copy_and_csum_datagram_msg(struct sk_buff *skb, int hlen,
+                                   struct msghdr *msg);
+int skb_copy_datagram_from_iter(struct sk_buff *skb, int offset,
+                                 struct iov_iter *from, int len);
+int zerocopy_sg_from_iter(struct sk_buff *skb, struct iov_iter *frm);
 void skb_free_datagram(struct sock *sk, struct sk_buff *skb);
 void skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb);
 int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags);
@@ -2661,6 +2687,20 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet);
 unsigned int skb_gso_transport_seglen(const struct sk_buff *skb);
 struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features);
 struct sk_buff *skb_vlan_untag(struct sk_buff *skb);
+int skb_ensure_writable(struct sk_buff *skb, int write_len);
+int skb_vlan_pop(struct sk_buff *skb);
+int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci);
+
+static inline int memcpy_from_msg(void *data, struct msghdr *msg, int len)
+{
+        /* XXX: stripping const */
+        return memcpy_fromiovec(data, (struct iovec *)msg->msg_iter.iov, len);
+}
+
+static inline int memcpy_to_msg(struct msghdr *msg, void *data, int len)
+{
+        return copy_to_iter(data, len, &msg->msg_iter) == len ? 0 : -EFAULT;
+}
 
 struct skb_checksum_ops {
         __wsum (*update)(const void *mem, int len, __wsum wsum);
diff --git a/include/linux/socket.h b/include/linux/socket.h
index bb9b83640070..6e49a14365dc 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -47,16 +47,25 @@ struct linger {
 struct msghdr {
         void            *msg_name;      /* ptr to socket address structure */
         int             msg_namelen;    /* size of socket address structure */
-        struct iovec    *msg_iov;       /* scatter/gather array */
-        __kernel_size_t msg_iovlen;     /* # elements in msg_iov */
+        struct iov_iter msg_iter;       /* data */
         void            *msg_control;   /* ancillary data */
         __kernel_size_t msg_controllen; /* ancillary data buffer length */
         unsigned int    msg_flags;      /* flags on received message */
 };
+ 
+struct user_msghdr {
+        void            __user *msg_name;       /* ptr to socket address structure */
+        int             msg_namelen;            /* size of socket address structure */
+        struct iovec    __user *msg_iov;        /* scatter/gather array */
+        __kernel_size_t msg_iovlen;             /* # elements in msg_iov */
+        void            __user *msg_control;    /* ancillary data */
+        __kernel_size_t msg_controllen;         /* ancillary data buffer length */
+        unsigned int    msg_flags;              /* flags on received message */
+};
 
 /* For recvmmsg/sendmmsg */
 struct mmsghdr {
-        struct msghdr   msg_hdr;
+        struct user_msghdr  msg_hdr;
         unsigned int        msg_len;
 };
 
@@ -94,6 +103,10 @@ struct cmsghdr {
                              (cmsg)->cmsg_len <= (unsigned long) \
                              ((mhdr)->msg_controllen - \
                               ((char *)(cmsg) - (char *)(mhdr)->msg_control)))
+#define for_each_cmsghdr(cmsg, msg) \
+        for (cmsg = CMSG_FIRSTHDR(msg); \
+             cmsg; \
+             cmsg = CMSG_NXTHDR(msg, cmsg))
 
 /*
  *      Get the next cmsg header
@@ -312,15 +325,14 @@ extern int csum_partial_copy_fromiovecend(unsigned char *kdata,
 extern unsigned long iov_pages(const struct iovec *iov, int offset,
                                unsigned long nr_segs);
 
-extern int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *address, int mode);
 extern int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr);
 extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
 
 struct timespec;
 
 /* The __sys_...msg variants allow MSG_CMSG_COMPAT */
-extern long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags);
-extern long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
+extern long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags);
+extern long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags);
 extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
                           unsigned int flags, struct timespec *timeout);
 extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg,
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index bda9b81357cc..c9afdc7a7f84 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -25,7 +25,7 @@ struct linux_dirent64;
 struct list_head;
 struct mmap_arg_struct;
 struct msgbuf;
-struct msghdr;
+struct user_msghdr;
 struct mmsghdr;
 struct msqid_ds;
 struct new_utsname;
@@ -601,13 +601,13 @@ asmlinkage long sys_getpeername(int, struct sockaddr __user *, int __user *);
 asmlinkage long sys_send(int, void __user *, size_t, unsigned);
 asmlinkage long sys_sendto(int, void __user *, size_t, unsigned,
                                 struct sockaddr __user *, int);
-asmlinkage long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
+asmlinkage long sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags);
 asmlinkage long sys_sendmmsg(int fd, struct mmsghdr __user *msg,
                              unsigned int vlen, unsigned flags);
 asmlinkage long sys_recv(int, void __user *, size_t, unsigned);
 asmlinkage long sys_recvfrom(int, void __user *, size_t, unsigned,
                                 struct sockaddr __user *, int __user *);
-asmlinkage long sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags);
+asmlinkage long sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags);
 asmlinkage long sys_recvmmsg(int fd, struct mmsghdr __user *msg,
                              unsigned int vlen, unsigned flags,
                              struct timespec __user *timeout);
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index c2dee7deefa8..67309ece0772 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -130,7 +130,7 @@ struct tcp_sock {
         /* inet_connection_sock has to be the first member of tcp_sock */
         struct inet_connection_sock     inet_conn;
         u16     tcp_header_len; /* Bytes of tcp header to send          */
-        u16     xmit_size_goal_segs; /* Goal for segmenting output packets */
+        u16     gso_segs;       /* Max number of segs per GSO packet    */
 
 /*
  *      Header prediction flags
@@ -162,7 +162,7 @@ struct tcp_sock {
         struct {
                 struct sk_buff_head     prequeue;
                 struct task_struct      *task;
-                struct iovec            *iov;
+                struct msghdr           *msg;
                 int                     memory;
                 int                     len;
         } ucopy;
@@ -204,10 +204,10 @@ struct tcp_sock {
 
         u16     urg_data;       /* Saved octet of OOB data and control flags */
         u8      ecn_flags;      /* ECN status bits.                     */
-        u8      reordering;     /* Packet reordering metric.            */
+        u8      keepalive_probes; /* num of allowed keep alive probes   */
+        u32     reordering;     /* Packet reordering metric.            */
         u32     snd_up;         /* Urgent pointer               */
 
-        u8      keepalive_probes; /* num of allowed keep alive probes   */
 /*
  *      Options received (usually on last packet, some only on SYN packets).
  */
diff --git a/include/linux/uio.h b/include/linux/uio.h
index bd8569a14c4a..a41e252396c0 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -131,7 +131,6 @@ size_t csum_and_copy_to_iter(void *addr, size_t bytes, __wsum *csum, struct iov_
 size_t csum_and_copy_from_iter(void *addr, size_t bytes, __wsum *csum, struct iov_iter *i);
 
 int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len);
-int memcpy_toiovec(struct iovec *iov, unsigned char *kdata, int len);
 int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
                         int offset, int len);
 int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
diff --git a/include/linux/vmw_vmci_api.h b/include/linux/vmw_vmci_api.h
index 023430e265fe..5691f752ce8f 100644
--- a/include/linux/vmw_vmci_api.h
+++ b/include/linux/vmw_vmci_api.h
@@ -24,6 +24,7 @@
 #define VMCI_KERNEL_API_VERSION_2 2
 #define VMCI_KERNEL_API_VERSION   VMCI_KERNEL_API_VERSION_2
 
+struct msghdr;
 typedef void (vmci_device_shutdown_fn) (void *device_registration,
                                         void *user_data);
 
@@ -75,8 +76,8 @@ ssize_t vmci_qpair_peek(struct vmci_qp *qpair, void *buf, size_t buf_size,
 ssize_t vmci_qpair_enquev(struct vmci_qp *qpair,
                           void *iov, size_t iov_size, int mode);
 ssize_t vmci_qpair_dequev(struct vmci_qp *qpair,
-                          void *iov, size_t iov_size, int mode);
-ssize_t vmci_qpair_peekv(struct vmci_qp *qpair, void *iov, size_t iov_size,
+                          struct msghdr *msg, size_t iov_size, int mode);
+ssize_t vmci_qpair_peekv(struct vmci_qp *qpair, struct msghdr *msg, size_t iov_size,
                          int mode);
 
 #endif /* !__VMW_VMCI_API_H__ */
diff --git a/include/net/6lowpan.h b/include/net/6lowpan.h
index d184df1d0d41..dc03d77ad23b 100644
--- a/include/net/6lowpan.h
+++ b/include/net/6lowpan.h
@@ -372,12 +372,12 @@ lowpan_uncompress_size(const struct sk_buff *skb, u16 *dgram_offset)
         return skb->len + uncomp_header - ret;
 }
 
-typedef int (*skb_delivery_cb)(struct sk_buff *skb, struct net_device *dev);
-
-int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
-                const u8 *saddr, const u8 saddr_type, const u8 saddr_len,
-                const u8 *daddr, const u8 daddr_type, const u8 daddr_len,
-                u8 iphc0, u8 iphc1, skb_delivery_cb skb_deliver);
+int
+lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
+                         const u8 *saddr, const u8 saddr_type,
+                         const u8 saddr_len, const u8 *daddr,
+                         const u8 daddr_type, const u8 daddr_len,
+                         u8 iphc0, u8 iphc1);
 int lowpan_header_compress(struct sk_buff *skb, struct net_device *dev,
                         unsigned short type, const void *_daddr,
                         const void *_saddr, unsigned int len);
diff --git a/include/net/af_ieee802154.h b/include/net/af_ieee802154.h
index 085940f7eeec..7d38e2ffd256 100644
--- a/include/net/af_ieee802154.h
+++ b/include/net/af_ieee802154.h
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
index 428277869400..0d87674fb775 100644
--- a/include/net/af_vsock.h
+++ b/include/net/af_vsock.h
@@ -103,14 +103,14 @@ struct vsock_transport {
         int (*dgram_dequeue)(struct kiocb *kiocb, struct vsock_sock *vsk,
                              struct msghdr *msg, size_t len, int flags);
         int (*dgram_enqueue)(struct vsock_sock *, struct sockaddr_vm *,
-                             struct iovec *, size_t len);
+                             struct msghdr *, size_t len);
         bool (*dgram_allow)(u32 cid, u32 port);
 
         /* STREAM. */
         /* TODO: stream_bind() */
-        ssize_t (*stream_dequeue)(struct vsock_sock *, struct iovec *,
+        ssize_t (*stream_dequeue)(struct vsock_sock *, struct msghdr *,
                                   size_t len, int flags);
-        ssize_t (*stream_enqueue)(struct vsock_sock *, struct iovec *,
+        ssize_t (*stream_enqueue)(struct vsock_sock *, struct msghdr *,
                                   size_t len);
         s64 (*stream_has_data)(struct vsock_sock *);
         s64 (*stream_has_space)(struct vsock_sock *);
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 6e8f24967308..40129b3838b2 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -129,6 +129,15 @@ enum {
          * during the hdev->setup vendor callback.
          */
         HCI_QUIRK_INVALID_BDADDR,
+
+        /* When this quirk is set, the duplicate filtering during
+         * scanning is based on Bluetooth devices addresses. To allow
+         * RSSI based updates, restart scanning if needed.
+         *
+         * This quirk can be set before hci_register_dev is called or
+         * during the hdev->setup vendor callback.
+         */
+        HCI_QUIRK_STRICT_DUPLICATE_FILTER,
 };
 
 /* HCI device flags */
@@ -154,6 +163,7 @@ enum {
 enum {
         HCI_DUT_MODE,
         HCI_FORCE_SC,
+        HCI_FORCE_LESC,
         HCI_FORCE_STATIC_ADDR,
 };
 
@@ -265,6 +275,7 @@ enum {
 /* Low Energy links do not have defined link type. Use invented one */
 #define LE_LINK         0x80
 #define AMP_LINK        0x81
+#define INVALID_LINK    0xff
 
 /* LMP features */
 #define LMP_3SLOT       0x01
@@ -332,6 +343,7 @@ enum {
 #define HCI_LE_ENCRYPTION               0x01
 #define HCI_LE_CONN_PARAM_REQ_PROC      0x02
 #define HCI_LE_PING                     0x10
+#define HCI_LE_EXT_SCAN_POLICY          0x80
 
 /* Connection modes */
 #define HCI_CM_ACTIVE   0x0000
@@ -401,6 +413,7 @@ enum {
 
 /* The core spec defines 127 as the "not available" value */
 #define HCI_TX_POWER_INVALID    127
+#define HCI_RSSI_INVALID        127
 
 #define HCI_ROLE_MASTER         0x00
 #define HCI_ROLE_SLAVE          0x01
@@ -629,7 +642,7 @@ struct hci_cp_user_passkey_reply {
 struct hci_cp_remote_oob_data_reply {
         bdaddr_t bdaddr;
         __u8     hash[16];
-        __u8     randomizer[16];
+        __u8     rand[16];
 } __packed;
 
 #define HCI_OP_REMOTE_OOB_DATA_NEG_REPLY        0x0433
@@ -721,9 +734,9 @@ struct hci_rp_set_csb {
 struct hci_cp_remote_oob_ext_data_reply {
         bdaddr_t bdaddr;
         __u8     hash192[16];
-        __u8     randomizer192[16];
+        __u8     rand192[16];
         __u8     hash256[16];
-        __u8     randomizer256[16];
+        __u8     rand256[16];
 } __packed;
 
 #define HCI_OP_SNIFF_MODE               0x0803
@@ -930,7 +943,7 @@ struct hci_cp_write_ssp_mode {
 struct hci_rp_read_local_oob_data {
         __u8     status;
         __u8     hash[16];
-        __u8     randomizer[16];
+        __u8     rand[16];
 } __packed;
 
 #define HCI_OP_READ_INQ_RSP_TX_POWER    0x0c58
@@ -1014,9 +1027,9 @@ struct hci_cp_write_sc_support {
 struct hci_rp_read_local_oob_ext_data {
         __u8     status;
         __u8     hash192[16];
-        __u8     randomizer192[16];
+        __u8     rand192[16];
         __u8     hash256[16];
-        __u8     randomizer256[16];
+        __u8     rand256[16];
 } __packed;
 
 #define HCI_OP_READ_LOCAL_VERSION       0x1001
@@ -1463,6 +1476,11 @@ struct hci_ev_cmd_status {
         __le16   opcode;
 } __packed;
 
+#define HCI_EV_HARDWARE_ERROR           0x10
+struct hci_ev_hardware_error {
+        __u8     code;
+} __packed;
+
 #define HCI_EV_ROLE_CHANGE              0x12
 struct hci_ev_role_change {
         __u8     status;
@@ -1734,6 +1752,25 @@ struct hci_ev_le_conn_complete {
         __u8     clk_accurancy;
 } __packed;
 
+/* Advertising report event types */
+#define LE_ADV_IND              0x00
+#define LE_ADV_DIRECT_IND       0x01
+#define LE_ADV_SCAN_IND         0x02
+#define LE_ADV_NONCONN_IND      0x03
+#define LE_ADV_SCAN_RSP         0x04
+
+#define ADDR_LE_DEV_PUBLIC      0x00
+#define ADDR_LE_DEV_RANDOM      0x01
+
+#define HCI_EV_LE_ADVERTISING_REPORT    0x02
+struct hci_ev_le_advertising_info {
+        __u8     evt_type;
+        __u8     bdaddr_type;
+        bdaddr_t bdaddr;
+        __u8     length;
+        __u8     data[0];
+} __packed;
+
 #define HCI_EV_LE_CONN_UPDATE_COMPLETE  0x03
 struct hci_ev_le_conn_update_complete {
         __u8     status;
@@ -1759,23 +1796,14 @@ struct hci_ev_le_remote_conn_param_req {
         __le16 timeout;
 } __packed;
 
-/* Advertising report event types */
-#define LE_ADV_IND              0x00
-#define LE_ADV_DIRECT_IND       0x01
-#define LE_ADV_SCAN_IND         0x02
-#define LE_ADV_NONCONN_IND      0x03
-#define LE_ADV_SCAN_RSP         0x04
-
-#define ADDR_LE_DEV_PUBLIC      0x00
-#define ADDR_LE_DEV_RANDOM      0x01
-
-#define HCI_EV_LE_ADVERTISING_REPORT    0x02
-struct hci_ev_le_advertising_info {
+#define HCI_EV_LE_DIRECT_ADV_REPORT     0x0B
+struct hci_ev_le_direct_adv_info {
         __u8     evt_type;
         __u8     bdaddr_type;
         bdaddr_t bdaddr;
-        __u8     length;
-        __u8     data[0];
+        __u8     direct_addr_type;
+        bdaddr_t direct_addr;
+        __s8     rssi;
 } __packed;
 
 /* Internal events generated by Bluetooth stack */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 37ff1aef0845..3c7827005c25 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -75,6 +75,10 @@ struct discovery_state {
         u32                     last_adv_flags;
         u8                      last_adv_data[HCI_MAX_AD_LENGTH];
         u8                      last_adv_data_len;
+        bool                    report_invalid_rssi;
+        s8                      rssi;
+        u16                     uuid_count;
+        u8                      (*uuids)[16];
 };
 
 struct hci_conn_hash {
@@ -108,6 +112,7 @@ struct smp_csrk {
 
 struct smp_ltk {
         struct list_head list;
+        struct rcu_head rcu;
         bdaddr_t bdaddr;
         u8 bdaddr_type;
         u8 authenticated;
@@ -120,6 +125,7 @@ struct smp_ltk {
 
 struct smp_irk {
         struct list_head list;
+        struct rcu_head rcu;
         bdaddr_t rpa;
         bdaddr_t bdaddr;
         u8 addr_type;
@@ -128,6 +134,7 @@ struct smp_irk {
 
 struct link_key {
         struct list_head list;
+        struct rcu_head rcu;
         bdaddr_t bdaddr;
         u8 type;
         u8 val[HCI_LINK_KEY_SIZE];
@@ -137,10 +144,11 @@ struct link_key {
 struct oob_data {
         struct list_head list;
         bdaddr_t bdaddr;
+        u8 bdaddr_type;
         u8 hash192[16];
-        u8 randomizer192[16];
+        u8 rand192[16];
         u8 hash256[16];
-        u8 randomizer256[16];
+        u8 rand256[16];
 };
 
 #define HCI_MAX_SHORT_NAME_LENGTH       10
@@ -303,6 +311,7 @@ struct hci_dev {
         __u32                   req_result;
 
         void                    *smp_data;
+        void                    *smp_bredr_data;
 
         struct discovery_state  discovery;
         struct hci_conn_hash    conn_hash;
@@ -398,6 +407,8 @@ struct hci_conn {
         __u16           le_conn_interval;
         __u16           le_conn_latency;
         __u16           le_supv_timeout;
+        __u8            le_adv_data[HCI_MAX_AD_LENGTH];
+        __u8            le_adv_data_len;
         __s8            rssi;
         __s8            tx_power;
         __s8            max_tx_power;
@@ -496,6 +507,17 @@ static inline void discovery_init(struct hci_dev *hdev)
         INIT_LIST_HEAD(&hdev->discovery.all);
         INIT_LIST_HEAD(&hdev->discovery.unknown);
         INIT_LIST_HEAD(&hdev->discovery.resolve);
+        hdev->discovery.report_invalid_rssi = true;
+        hdev->discovery.rssi = HCI_RSSI_INVALID;
+}
+
+static inline void hci_discovery_filter_clear(struct hci_dev *hdev)
+{
+        hdev->discovery.report_invalid_rssi = true;
+        hdev->discovery.rssi = HCI_RSSI_INVALID;
+        hdev->discovery.uuid_count = 0;
+        kfree(hdev->discovery.uuids);
+        hdev->discovery.uuids = NULL;
 }
 
 bool hci_discovery_active(struct hci_dev *hdev);
@@ -553,6 +575,8 @@ enum {
         HCI_CONN_STK_ENCRYPT,
         HCI_CONN_AUTH_INITIATOR,
         HCI_CONN_DROP,
+        HCI_CONN_PARAM_REMOVAL_PEND,
+        HCI_CONN_NEW_LINK_KEY,
 };
 
 static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
@@ -643,6 +667,26 @@ static inline unsigned int hci_conn_count(struct hci_dev *hdev)
         return c->acl_num + c->amp_num + c->sco_num + c->le_num;
 }
 
+static inline __u8 hci_conn_lookup_type(struct hci_dev *hdev, __u16 handle)
+{
+        struct hci_conn_hash *h = &hdev->conn_hash;
+        struct hci_conn *c;
+        __u8 type = INVALID_LINK;
+
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(c, &h->list, list) {
+                if (c->handle == handle) {
+                        type = c->type;
+                        break;
+                }
+        }
+
+        rcu_read_unlock();
+
+        return type;
+}
+
 static inline struct hci_conn *hci_conn_hash_lookup_handle(struct hci_dev *hdev,
                                                                 __u16 handle)
 {
@@ -853,6 +897,7 @@ int hci_register_dev(struct hci_dev *hdev);
 void hci_unregister_dev(struct hci_dev *hdev);
 int hci_suspend_dev(struct hci_dev *hdev);
 int hci_resume_dev(struct hci_dev *hdev);
+int hci_reset_dev(struct hci_dev *hdev);
 int hci_dev_open(__u16 dev);
 int hci_dev_close(__u16 dev);
 int hci_dev_reset(__u16 dev);
@@ -894,13 +939,11 @@ struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
                                   bdaddr_t *bdaddr, u8 *val, u8 type,
                                   u8 pin_len, bool *persistent);
-struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, __le64 rand,
-                             u8 role);
 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
                             u8 addr_type, u8 type, u8 authenticated,
                             u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand);
-struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                     u8 addr_type, u8 role);
+struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                             u8 addr_type, u8 role);
 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type);
 void hci_smp_ltks_clear(struct hci_dev *hdev);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
@@ -915,13 +958,12 @@ void hci_smp_irks_clear(struct hci_dev *hdev);
 
 void hci_remote_oob_data_clear(struct hci_dev *hdev);
 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
-                                          bdaddr_t *bdaddr);
+                                          bdaddr_t *bdaddr, u8 bdaddr_type);
 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                            u8 *hash, u8 *randomizer);
-int hci_add_remote_oob_ext_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                u8 *hash192, u8 *randomizer192,
-                                u8 *hash256, u8 *randomizer256);
-int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
+                            u8 bdaddr_type, u8 *hash192, u8 *rand192,
+                            u8 *hash256, u8 *rand256);
+int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                               u8 bdaddr_type);
 
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
 
@@ -972,6 +1014,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 
 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
+#define bredr_sc_enabled(dev) ((lmp_sc_capable(dev) || \
+                                test_bit(HCI_FORCE_SC, &(dev)->dbg_flags)) && \
+                               test_bit(HCI_SC_ENABLED, &(dev)->dev_flags))
 
 /* ----- HCI protocols ----- */
 #define HCI_PROTO_DEFER             0x01
@@ -1310,9 +1355,8 @@ int mgmt_update_adv_data(struct hci_dev *hdev);
 void mgmt_discoverable_timeout(struct hci_dev *hdev);
 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
                        bool persistent);
-void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
-                           u8 *dev_class);
+void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
+                           u32 flags, u8 *name, u8 name_len);
 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
                               u8 link_type, u8 addr_type, u8 reason,
                               bool mgmt_connected);
@@ -1349,8 +1393,8 @@ void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
                                     u8 status);
 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status);
 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
-                                       u8 *randomizer192, u8 *hash256,
-                                       u8 *randomizer256, u8 status);
+                                       u8 *rand192, u8 *hash256, u8 *rand256,
+                                       u8 status);
 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index ead99f032f7a..d1bb342d083f 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -28,6 +28,7 @@
 #define __L2CAP_H
 
 #include <asm/unaligned.h>
+#include <linux/atomic.h>
 
 /* L2CAP defaults */
 #define L2CAP_DEFAULT_MTU               672
@@ -140,6 +141,7 @@ struct l2cap_conninfo {
 #define L2CAP_FC_ATT            0x10
 #define L2CAP_FC_SIG_LE         0x20
 #define L2CAP_FC_SMP_LE         0x40
+#define L2CAP_FC_SMP_BREDR      0x80
 
 /* L2CAP Control Field bit masks */
 #define L2CAP_CTRL_SAR                  0xC000
@@ -254,6 +256,7 @@ struct l2cap_conn_rsp {
 #define L2CAP_CID_ATT           0x0004
 #define L2CAP_CID_LE_SIGNALING  0x0005
 #define L2CAP_CID_SMP           0x0006
+#define L2CAP_CID_SMP_BREDR     0x0007
 #define L2CAP_CID_DYN_START     0x0040
 #define L2CAP_CID_DYN_END       0xffff
 #define L2CAP_CID_LE_DYN_END    0x007f
@@ -481,6 +484,7 @@ struct l2cap_chan {
         struct hci_conn         *hs_hcon;
         struct hci_chan         *hs_hchan;
         struct kref     kref;
+        atomic_t        nesting;
 
         __u8            state;
 
@@ -604,10 +608,6 @@ struct l2cap_ops {
         struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
                                                unsigned long hdr_len,
                                                unsigned long len, int nb);
-        int                     (*memcpy_fromiovec) (struct l2cap_chan *chan,
-                                                     unsigned char *kdata,
-                                                     struct iovec *iov,
-                                                     int len);
 };
 
 struct l2cap_conn {
@@ -617,8 +617,8 @@ struct l2cap_conn {
         unsigned int            mtu;
 
         __u32                   feat_mask;
-        __u8                    fixed_chan_mask;
-        bool                    hs_enabled;
+        __u8                    remote_fixed_chan;
+        __u8                    local_fixed_chan;
 
         __u8                    info_state;
         __u8                    info_ident;
@@ -713,6 +713,17 @@ enum {
         FLAG_HOLD_HCI_CONN,
 };
 
+/* Lock nesting levels for L2CAP channels. We need these because lockdep
+ * otherwise considers all channels equal and will e.g. complain about a
+ * connection oriented channel triggering SMP procedures or a listening
+ * channel creating and locking a child channel.
+ */
+enum {
+        L2CAP_NESTING_SMP,
+        L2CAP_NESTING_NORMAL,
+        L2CAP_NESTING_PARENT,
+};
+
 enum {
         L2CAP_TX_STATE_XMIT,
         L2CAP_TX_STATE_WAIT_F,
@@ -778,7 +789,7 @@ void l2cap_chan_put(struct l2cap_chan *c);
 
 static inline void l2cap_chan_lock(struct l2cap_chan *chan)
 {
-        mutex_lock(&chan->lock);
+        mutex_lock_nested(&chan->lock, atomic_read(&chan->nesting));
 }
 
 static inline void l2cap_chan_unlock(struct l2cap_chan *chan)
@@ -890,31 +901,6 @@ static inline long l2cap_chan_no_get_sndtimeo(struct l2cap_chan *chan)
         return 0;
 }
 
-static inline int l2cap_chan_no_memcpy_fromiovec(struct l2cap_chan *chan,
-                                                 unsigned char *kdata,
-                                                 struct iovec *iov,
-                                                 int len)
-{
-        /* Following is safe since for compiler definitions of kvec and
-         * iovec are identical, yielding the same in-core layout and alignment
-         */
-        struct kvec *vec = (struct kvec *)iov;
-
-        while (len > 0) {
-                if (vec->iov_len) {
-                        int copy = min_t(unsigned int, len, vec->iov_len);
-                        memcpy(kdata, vec->iov_base, copy);
-                        len -= copy;
-                        kdata += copy;
-                        vec->iov_base += copy;
-                        vec->iov_len -= copy;
-                }
-                vec++;
-        }
-
-        return 0;
-}
-
 extern bool disable_ertm;
 
 int l2cap_init_sockets(void);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 414cd2f9a437..95c34d5180fa 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -184,6 +184,9 @@ struct mgmt_cp_load_link_keys {
 
 #define MGMT_LTK_UNAUTHENTICATED        0x00
 #define MGMT_LTK_AUTHENTICATED          0x01
+#define MGMT_LTK_P256_UNAUTH            0x02
+#define MGMT_LTK_P256_AUTH              0x03
+#define MGMT_LTK_P256_DEBUG             0x04
 
 struct mgmt_ltk_info {
         struct mgmt_addr_info addr;
@@ -299,28 +302,28 @@ struct mgmt_cp_user_passkey_neg_reply {
 #define MGMT_READ_LOCAL_OOB_DATA_SIZE   0
 struct mgmt_rp_read_local_oob_data {
         __u8    hash[16];
-        __u8    randomizer[16];
+        __u8    rand[16];
 } __packed;
 struct mgmt_rp_read_local_oob_ext_data {
         __u8    hash192[16];
-        __u8    randomizer192[16];
+        __u8    rand192[16];
         __u8    hash256[16];
-        __u8    randomizer256[16];
+        __u8    rand256[16];
 } __packed;
 
 #define MGMT_OP_ADD_REMOTE_OOB_DATA     0x0021
 struct mgmt_cp_add_remote_oob_data {
         struct mgmt_addr_info addr;
         __u8    hash[16];
-        __u8    randomizer[16];
+        __u8    rand[16];
 } __packed;
 #define MGMT_ADD_REMOTE_OOB_DATA_SIZE   (MGMT_ADDR_INFO_SIZE + 32)
 struct mgmt_cp_add_remote_oob_ext_data {
         struct mgmt_addr_info addr;
         __u8    hash192[16];
-        __u8    randomizer192[16];
+        __u8    rand192[16];
         __u8    hash256[16];
-        __u8    randomizer256[16];
+        __u8    rand256[16];
 } __packed;
 #define MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE (MGMT_ADDR_INFO_SIZE + 64)
 
@@ -495,6 +498,15 @@ struct mgmt_cp_set_public_address {
 } __packed;
 #define MGMT_SET_PUBLIC_ADDRESS_SIZE    6
 
+#define MGMT_OP_START_SERVICE_DISCOVERY 0x003A
+struct mgmt_cp_start_service_discovery {
+        __u8 type;
+        __s8 rssi;
+        __le16 uuid_count;
+        __u8 uuids[0][16];
+} __packed;
+#define MGMT_START_SERVICE_DISCOVERY_SIZE 4
+
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
         __le16  opcode;
diff --git a/include/net/bond_3ad.h b/include/net/bond_3ad.h
new file mode 100644
index 000000000000..e01d903633ef
--- /dev/null
+++ b/include/net/bond_3ad.h
@@ -0,0 +1,283 @@
+/*
+ * Copyright(c) 1999 - 2004 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59
+ * Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ */
+
+#ifndef _NET_BOND_3AD_H
+#define _NET_BOND_3AD_H
+
+#include <asm/byteorder.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/if_ether.h>
+
+/* General definitions */
+#define PKT_TYPE_LACPDU         cpu_to_be16(ETH_P_SLOW)
+#define AD_TIMER_INTERVAL       100 /*msec*/
+
+#define MULTICAST_LACPDU_ADDR    {0x01, 0x80, 0xC2, 0x00, 0x00, 0x02}
+
+#define AD_LACP_SLOW 0
+#define AD_LACP_FAST 1
+
+typedef struct mac_addr {
+        u8 mac_addr_value[ETH_ALEN];
+} __packed mac_addr_t;
+
+enum {
+        BOND_AD_STABLE = 0,
+        BOND_AD_BANDWIDTH = 1,
+        BOND_AD_COUNT = 2,
+};
+
+/* rx machine states(43.4.11 in the 802.3ad standard) */
+typedef enum {
+        AD_RX_DUMMY,
+        AD_RX_INITIALIZE,       /* rx Machine */
+        AD_RX_PORT_DISABLED,    /* rx Machine */
+        AD_RX_LACP_DISABLED,    /* rx Machine */
+        AD_RX_EXPIRED,          /* rx Machine */
+        AD_RX_DEFAULTED,        /* rx Machine */
+        AD_RX_CURRENT           /* rx Machine */
+} rx_states_t;
+
+/* periodic machine states(43.4.12 in the 802.3ad standard) */
+typedef enum {
+        AD_PERIODIC_DUMMY,
+        AD_NO_PERIODIC,         /* periodic machine */
+        AD_FAST_PERIODIC,       /* periodic machine */
+        AD_SLOW_PERIODIC,       /* periodic machine */
+        AD_PERIODIC_TX          /* periodic machine */
+} periodic_states_t;
+
+/* mux machine states(43.4.13 in the 802.3ad standard) */
+typedef enum {
+        AD_MUX_DUMMY,
+        AD_MUX_DETACHED,        /* mux machine */
+        AD_MUX_WAITING,         /* mux machine */
+        AD_MUX_ATTACHED,        /* mux machine */
+        AD_MUX_COLLECTING_DISTRIBUTING  /* mux machine */
+} mux_states_t;
+
+/* tx machine states(43.4.15 in the 802.3ad standard) */
+typedef enum {
+        AD_TX_DUMMY,
+        AD_TRANSMIT             /* tx Machine */
+} tx_states_t;
+
+/* rx indication types */
+typedef enum {
+        AD_TYPE_LACPDU = 1,     /* type lacpdu */
+        AD_TYPE_MARKER          /* type marker */
+} pdu_type_t;
+
+/* rx marker indication types */
+typedef enum {
+        AD_MARKER_INFORMATION_SUBTYPE = 1,      /* marker imformation subtype */
+        AD_MARKER_RESPONSE_SUBTYPE              /* marker response subtype */
+} bond_marker_subtype_t;
+
+/* timers types(43.4.9 in the 802.3ad standard) */
+typedef enum {
+        AD_CURRENT_WHILE_TIMER,
+        AD_ACTOR_CHURN_TIMER,
+        AD_PERIODIC_TIMER,
+        AD_PARTNER_CHURN_TIMER,
+        AD_WAIT_WHILE_TIMER
+} ad_timers_t;
+
+#pragma pack(1)
+
+/* Link Aggregation Control Protocol(LACP) data unit structure(43.4.2.2 in the 802.3ad standard) */
+typedef struct lacpdu {
+        u8 subtype;             /* = LACP(= 0x01) */
+        u8 version_number;
+        u8 tlv_type_actor_info; /* = actor information(type/length/value) */
+        u8 actor_information_length;    /* = 20 */
+        __be16 actor_system_priority;
+        struct mac_addr actor_system;
+        __be16 actor_key;
+        __be16 actor_port_priority;
+        __be16 actor_port;
+        u8 actor_state;
+        u8 reserved_3_1[3];             /* = 0 */
+        u8 tlv_type_partner_info;       /* = partner information */
+        u8 partner_information_length;  /* = 20 */
+        __be16 partner_system_priority;
+        struct mac_addr partner_system;
+        __be16 partner_key;
+        __be16 partner_port_priority;
+        __be16 partner_port;
+        u8 partner_state;
+        u8 reserved_3_2[3];             /* = 0 */
+        u8 tlv_type_collector_info;     /* = collector information */
+        u8 collector_information_length;/* = 16 */
+        __be16 collector_max_delay;
+        u8 reserved_12[12];
+        u8 tlv_type_terminator;         /* = terminator */
+        u8 terminator_length;           /* = 0 */
+        u8 reserved_50[50];             /* = 0 */
+} __packed lacpdu_t;
+
+typedef struct lacpdu_header {
+        struct ethhdr hdr;
+        struct lacpdu lacpdu;
+} __packed lacpdu_header_t;
+
+/* Marker Protocol Data Unit(PDU) structure(43.5.3.2 in the 802.3ad standard) */
+typedef struct bond_marker {
+        u8 subtype;             /* = 0x02  (marker PDU) */
+        u8 version_number;      /* = 0x01 */
+        u8 tlv_type;            /* = 0x01  (marker information) */
+        /* = 0x02  (marker response information) */
+        u8 marker_length;       /* = 0x16 */
+        u16 requester_port;     /* The number assigned to the port by the requester */
+        struct mac_addr requester_system;       /* The requester's system id */
+        u32 requester_transaction_id;           /* The transaction id allocated by the requester, */
+        u16 pad;                /* = 0 */
+        u8 tlv_type_terminator; /* = 0x00 */
+        u8 terminator_length;   /* = 0x00 */
+        u8 reserved_90[90];     /* = 0 */
+} __packed bond_marker_t;
+
+typedef struct bond_marker_header {
+        struct ethhdr hdr;
+        struct bond_marker marker;
+} __packed bond_marker_header_t;
+
+#pragma pack()
+
+struct slave;
+struct bonding;
+struct ad_info;
+struct port;
+
+#ifdef __ia64__
+#pragma pack(8)
+#endif
+
+/* aggregator structure(43.4.5 in the 802.3ad standard) */
+typedef struct aggregator {
+        struct mac_addr aggregator_mac_address;
+        u16 aggregator_identifier;
+        bool is_individual;
+        u16 actor_admin_aggregator_key;
+        u16 actor_oper_aggregator_key;
+        struct mac_addr partner_system;
+        u16 partner_system_priority;
+        u16 partner_oper_aggregator_key;
+        u16 receive_state;      /* BOOLEAN */
+        u16 transmit_state;     /* BOOLEAN */
+        struct port *lag_ports;
+        /* ****** PRIVATE PARAMETERS ****** */
+        struct slave *slave;    /* pointer to the bond slave that this aggregator belongs to */
+        u16 is_active;          /* BOOLEAN. Indicates if this aggregator is active */
+        u16 num_of_ports;
+} aggregator_t;
+
+struct port_params {
+        struct mac_addr system;
+        u16 system_priority;
+        u16 key;
+        u16 port_number;
+        u16 port_priority;
+        u16 port_state;
+};
+
+/* port structure(43.4.6 in the 802.3ad standard) */
+typedef struct port {
+        u16 actor_port_number;
+        u16 actor_port_priority;
+        struct mac_addr actor_system;   /* This parameter is added here although it is not specified in the standard, just for simplification */
+        u16 actor_system_priority;      /* This parameter is added here although it is not specified in the standard, just for simplification */
+        u16 actor_port_aggregator_identifier;
+        bool ntt;
+        u16 actor_admin_port_key;
+        u16 actor_oper_port_key;
+        u8 actor_admin_port_state;
+        u8 actor_oper_port_state;
+
+        struct port_params partner_admin;
+        struct port_params partner_oper;
+
+        bool is_enabled;
+
+        /* ****** PRIVATE PARAMETERS ****** */
+        u16 sm_vars;            /* all state machines variables for this port */
+        rx_states_t sm_rx_state;        /* state machine rx state */
+        u16 sm_rx_timer_counter;        /* state machine rx timer counter */
+        periodic_states_t sm_periodic_state;    /* state machine periodic state */
+        u16 sm_periodic_timer_counter;  /* state machine periodic timer counter */
+        mux_states_t sm_mux_state;      /* state machine mux state */
+        u16 sm_mux_timer_counter;       /* state machine mux timer counter */
+        tx_states_t sm_tx_state;        /* state machine tx state */
+        u16 sm_tx_timer_counter;        /* state machine tx timer counter(allways on - enter to transmit state 3 time per second) */
+        struct slave *slave;            /* pointer to the bond slave that this port belongs to */
+        struct aggregator *aggregator;  /* pointer to an aggregator that this port related to */
+        struct port *next_port_in_aggregator;   /* Next port on the linked list of the parent aggregator */
+        u32 transaction_id;             /* continuous number for identification of Marker PDU's; */
+        struct lacpdu lacpdu;           /* the lacpdu that will be sent for this port */
+} port_t;
+
+/* system structure */
+struct ad_system {
+        u16 sys_priority;
+        struct mac_addr sys_mac_addr;
+};
+
+#ifdef __ia64__
+#pragma pack()
+#endif
+
+/* ========== AD Exported structures to the main bonding code ========== */
+#define BOND_AD_INFO(bond)   ((bond)->ad_info)
+#define SLAVE_AD_INFO(slave) ((slave)->ad_info)
+
+struct ad_bond_info {
+        struct ad_system system;        /* 802.3ad system structure */
+        u32 agg_select_timer;           /* Timer to select aggregator after all adapter's hand shakes */
+        u16 aggregator_identifier;
+};
+
+struct ad_slave_info {
+        struct aggregator aggregator;   /* 802.3ad aggregator structure */
+        struct port port;               /* 802.3ad port structure */
+        u16 id;
+};
+
+/* ========== AD Exported functions to the main bonding code ========== */
+void bond_3ad_initialize(struct bonding *bond, u16 tick_resolution);
+void bond_3ad_bind_slave(struct slave *slave);
+void bond_3ad_unbind_slave(struct slave *slave);
+void bond_3ad_state_machine_handler(struct work_struct *);
+void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout);
+void bond_3ad_adapter_speed_changed(struct slave *slave);
+void bond_3ad_adapter_duplex_changed(struct slave *slave);
+void bond_3ad_handle_link_change(struct slave *slave, char link);
+int  bond_3ad_get_active_agg_info(struct bonding *bond, struct ad_info *ad_info);
+int  __bond_3ad_get_active_agg_info(struct bonding *bond,
+                                    struct ad_info *ad_info);
+int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev);
+int bond_3ad_lacpdu_recv(const struct sk_buff *skb, struct bonding *bond,
+                         struct slave *slave);
+int bond_3ad_set_carrier(struct bonding *bond);
+void bond_3ad_update_lacp_rate(struct bonding *bond);
+#endif /* _NET_BOND_3AD_H */
+
diff --git a/include/net/bond_alb.h b/include/net/bond_alb.h
new file mode 100644
index 000000000000..313a8d3b3069
--- /dev/null
+++ b/include/net/bond_alb.h
@@ -0,0 +1,181 @@
+/*
+ * Copyright(c) 1999 - 2004 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ */
+
+#ifndef _NET_BOND_ALB_H
+#define _NET_BOND_ALB_H
+
+#include <linux/if_ether.h>
+
+struct bonding;
+struct slave;
+
+#define BOND_ALB_INFO(bond)   ((bond)->alb_info)
+#define SLAVE_TLB_INFO(slave) ((slave)->tlb_info)
+
+#define ALB_TIMER_TICKS_PER_SEC     10  /* should be a divisor of HZ */
+#define BOND_TLB_REBALANCE_INTERVAL 10  /* In seconds, periodic re-balancing.
+                                         * Used for division - never set
+                                         * to zero !!!
+                                         */
+#define BOND_ALB_DEFAULT_LP_INTERVAL 1
+#define BOND_ALB_LP_INTERVAL(bond) (bond->params.lp_interval)   /* In seconds, periodic send of
+                                                                 * learning packets to the switch
+                                                                 */
+
+#define BOND_TLB_REBALANCE_TICKS (BOND_TLB_REBALANCE_INTERVAL \
+                                  * ALB_TIMER_TICKS_PER_SEC)
+
+#define BOND_ALB_LP_TICKS(bond) (BOND_ALB_LP_INTERVAL(bond) \
+                           * ALB_TIMER_TICKS_PER_SEC)
+
+#define TLB_HASH_TABLE_SIZE 256 /* The size of the clients hash table.
+                                 * Note that this value MUST NOT be smaller
+                                 * because the key hash table is BYTE wide !
+                                 */
+
+
+#define TLB_NULL_INDEX          0xffffffff
+
+/* rlb defs */
+#define RLB_HASH_TABLE_SIZE     256
+#define RLB_NULL_INDEX          0xffffffff
+#define RLB_UPDATE_DELAY        (2*ALB_TIMER_TICKS_PER_SEC) /* 2 seconds */
+#define RLB_ARP_BURST_SIZE      2
+#define RLB_UPDATE_RETRY        3 /* 3-ticks - must be smaller than the rlb
+                                   * rebalance interval (5 min).
+                                   */
+/* RLB_PROMISC_TIMEOUT = 10 sec equals the time that the current slave is
+ * promiscuous after failover
+ */
+#define RLB_PROMISC_TIMEOUT     (10*ALB_TIMER_TICKS_PER_SEC)
+
+
+struct tlb_client_info {
+        struct slave *tx_slave; /* A pointer to slave used for transmiting
+                                 * packets to a Client that the Hash function
+                                 * gave this entry index.
+                                 */
+        u32 tx_bytes;           /* Each Client accumulates the BytesTx that
+                                 * were transmitted to it, and after each
+                                 * CallBack the LoadHistory is divided
+                                 * by the balance interval
+                                 */
+        u32 load_history;       /* This field contains the amount of Bytes
+                                 * that were transmitted to this client by
+                                 * the server on the previous balance
+                                 * interval in Bps.
+                                 */
+        u32 next;               /* The next Hash table entry index, assigned
+                                 * to use the same adapter for transmit.
+                                 */
+        u32 prev;               /* The previous Hash table entry index,
+                                 * assigned to use the same
+                                 */
+};
+
+/* -------------------------------------------------------------------------
+ * struct rlb_client_info contains all info related to a specific rx client
+ * connection. This is the Clients Hash Table entry struct.
+ * Note that this is not a proper hash table; if a new client's IP address
+ * hash collides with an existing client entry, the old entry is replaced.
+ *
+ * There is a linked list (linked by the used_next and used_prev members)
+ * linking all the used entries of the hash table. This allows updating
+ * all the clients without walking over all the unused elements of the table.
+ *
+ * There are also linked lists of entries with identical hash(ip_src). These
+ * allow cleaning up the table from ip_src<->mac_src associations that have
+ * become outdated and would cause sending out invalid ARP updates to the
+ * network. These are linked by the (src_next and src_prev members).
+ * -------------------------------------------------------------------------
+ */
+struct rlb_client_info {
+        __be32 ip_src;          /* the server IP address */
+        __be32 ip_dst;          /* the client IP address */
+        u8  mac_src[ETH_ALEN];  /* the server MAC address */
+        u8  mac_dst[ETH_ALEN];  /* the client MAC address */
+
+        /* list of used hash table entries, starting at rx_hashtbl_used_head */
+        u32 used_next;
+        u32 used_prev;
+
+        /* ip_src based hashing */
+        u32 src_next;   /* next entry with same hash(ip_src) */
+        u32 src_prev;   /* prev entry with same hash(ip_src) */
+        u32 src_first;  /* first entry with hash(ip_src) == this entry's index */
+
+        u8  assigned;           /* checking whether this entry is assigned */
+        u8  ntt;                /* flag - need to transmit client info */
+        struct slave *slave;    /* the slave assigned to this client */
+        unsigned short vlan_id; /* VLAN tag associated with IP address */
+};
+
+struct tlb_slave_info {
+        u32 head;       /* Index to the head of the bi-directional clients
+                         * hash table entries list. The entries in the list
+                         * are the entries that were assigned to use this
+                         * slave for transmit.
+                         */
+        u32 load;       /* Each slave sums the loadHistory of all clients
+                         * assigned to it
+                         */
+};
+
+struct alb_bond_info {
+        struct tlb_client_info  *tx_hashtbl; /* Dynamically allocated */
+        u32                     unbalanced_load;
+        int                     tx_rebalance_counter;
+        int                     lp_counter;
+        /* -------- rlb parameters -------- */
+        int rlb_enabled;
+        struct rlb_client_info  *rx_hashtbl;    /* Receive hash table */
+        u32                     rx_hashtbl_used_head;
+        u8                      rx_ntt; /* flag - need to transmit
+                                         * to all rx clients
+                                         */
+        struct slave            *rx_slave;/* last slave to xmit from */
+        u8                      primary_is_promisc;        /* boolean */
+        u32                     rlb_promisc_timeout_counter;/* counts primary
+                                                             * promiscuity time
+                                                             */
+        u32                     rlb_update_delay_counter;
+        u32                     rlb_update_retry_counter;/* counter of retries
+                                                          * of client update
+                                                          */
+        u8                      rlb_rebalance;  /* flag - indicates that the
+                                                 * rx traffic should be
+                                                 * rebalanced
+                                                 */
+};
+
+int bond_alb_initialize(struct bonding *bond, int rlb_enabled);
+void bond_alb_deinitialize(struct bonding *bond);
+int bond_alb_init_slave(struct bonding *bond, struct slave *slave);
+void bond_alb_deinit_slave(struct bonding *bond, struct slave *slave);
+void bond_alb_handle_link_change(struct bonding *bond, struct slave *slave, char link);
+void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave);
+int bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev);
+int bond_tlb_xmit(struct sk_buff *skb, struct net_device *bond_dev);
+void bond_alb_monitor(struct work_struct *);
+int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr);
+void bond_alb_clear_vlan(struct bonding *bond, unsigned short vlan_id);
+#endif /* _NET_BOND_ALB_H */
+
diff --git a/include/net/bond_options.h b/include/net/bond_options.h
new file mode 100644
index 000000000000..ea6546d2c946
--- /dev/null
+++ b/include/net/bond_options.h
@@ -0,0 +1,130 @@
+/*
+ * drivers/net/bond/bond_options.h - bonding options
+ * Copyright (c) 2013 Nikolay Aleksandrov <nikolay@redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef _NET_BOND_OPTIONS_H
+#define _NET_BOND_OPTIONS_H
+
+#define BOND_OPT_MAX_NAMELEN 32
+#define BOND_OPT_VALID(opt) ((opt) < BOND_OPT_LAST)
+#define BOND_MODE_ALL_EX(x) (~(x))
+
+/* Option flags:
+ * BOND_OPTFLAG_NOSLAVES - check if the bond device is empty before setting
+ * BOND_OPTFLAG_IFDOWN - check if the bond device is down before setting
+ * BOND_OPTFLAG_RAWVAL - the option parses the value itself
+ */
+enum {
+        BOND_OPTFLAG_NOSLAVES   = BIT(0),
+        BOND_OPTFLAG_IFDOWN     = BIT(1),
+        BOND_OPTFLAG_RAWVAL     = BIT(2)
+};
+
+/* Value type flags:
+ * BOND_VALFLAG_DEFAULT - mark the value as default
+ * BOND_VALFLAG_(MIN|MAX) - mark the value as min/max
+ */
+enum {
+        BOND_VALFLAG_DEFAULT    = BIT(0),
+        BOND_VALFLAG_MIN        = BIT(1),
+        BOND_VALFLAG_MAX        = BIT(2)
+};
+
+/* Option IDs, their bit positions correspond to their IDs */
+enum {
+        BOND_OPT_MODE,
+        BOND_OPT_PACKETS_PER_SLAVE,
+        BOND_OPT_XMIT_HASH,
+        BOND_OPT_ARP_VALIDATE,
+        BOND_OPT_ARP_ALL_TARGETS,
+        BOND_OPT_FAIL_OVER_MAC,
+        BOND_OPT_ARP_INTERVAL,
+        BOND_OPT_ARP_TARGETS,
+        BOND_OPT_DOWNDELAY,
+        BOND_OPT_UPDELAY,
+        BOND_OPT_LACP_RATE,
+        BOND_OPT_MINLINKS,
+        BOND_OPT_AD_SELECT,
+        BOND_OPT_NUM_PEER_NOTIF,
+        BOND_OPT_MIIMON,
+        BOND_OPT_PRIMARY,
+        BOND_OPT_PRIMARY_RESELECT,
+        BOND_OPT_USE_CARRIER,
+        BOND_OPT_ACTIVE_SLAVE,
+        BOND_OPT_QUEUE_ID,
+        BOND_OPT_ALL_SLAVES_ACTIVE,
+        BOND_OPT_RESEND_IGMP,
+        BOND_OPT_LP_INTERVAL,
+        BOND_OPT_SLAVES,
+        BOND_OPT_TLB_DYNAMIC_LB,
+        BOND_OPT_LAST
+};
+
+/* This structure is used for storing option values and for passing option
+ * values when changing an option. The logic when used as an arg is as follows:
+ * - if string != NULL -> parse it, if the opt is RAW type then return it, else
+ *   return the parse result
+ * - if string == NULL -> parse value
+ */
+struct bond_opt_value {
+        char *string;
+        u64 value;
+        u32 flags;
+};
+
+struct bonding;
+
+struct bond_option {
+        int id;
+        const char *name;
+        const char *desc;
+        u32 flags;
+
+        /* unsuppmodes is used to denote modes in which the option isn't
+         * supported.
+         */
+        unsigned long unsuppmodes;
+        /* supported values which this option can have, can be a subset of
+         * BOND_OPTVAL_RANGE's value range
+         */
+        const struct bond_opt_value *values;
+
+        int (*set)(struct bonding *bond, const struct bond_opt_value *val);
+};
+
+int __bond_opt_set(struct bonding *bond, unsigned int option,
+                   struct bond_opt_value *val);
+int bond_opt_tryset_rtnl(struct bonding *bond, unsigned int option, char *buf);
+
+const struct bond_opt_value *bond_opt_parse(const struct bond_option *opt,
+                                            struct bond_opt_value *val);
+const struct bond_option *bond_opt_get(unsigned int option);
+const struct bond_option *bond_opt_get_by_name(const char *name);
+const struct bond_opt_value *bond_opt_get_val(unsigned int option, u64 val);
+
+/* This helper is used to initialize a bond_opt_value structure for parameter
+ * passing. There should be either a valid string or value, but not both.
+ * When value is ULLONG_MAX then string will be used.
+ */
+static inline void __bond_opt_init(struct bond_opt_value *optval,
+                                   char *string, u64 value)
+{
+        memset(optval, 0, sizeof(*optval));
+        optval->value = ULLONG_MAX;
+        if (value == ULLONG_MAX)
+                optval->string = string;
+        else
+                optval->value = value;
+}
+#define bond_opt_initval(optval, value) __bond_opt_init(optval, NULL, value)
+#define bond_opt_initstr(optval, str) __bond_opt_init(optval, str, ULLONG_MAX)
+
+void bond_option_arp_ip_targets_clear(struct bonding *bond);
+
+#endif /* _NET_BOND_OPTIONS_H */
diff --git a/include/net/bonding.h b/include/net/bonding.h
new file mode 100644
index 000000000000..983a94b86b95
--- /dev/null
+++ b/include/net/bonding.h
@@ -0,0 +1,654 @@
+/*
+ * Bond several ethernet interfaces into a Cisco, running 'Etherchannel'.
+ *
+ * Portions are (c) Copyright 1995 Simon "Guru Aleph-Null" Janes
+ * NCM: Network and Communications Management, Inc.
+ *
+ * BUT, I'm the one who modified it for ethernet, so:
+ * (c) Copyright 1999, Thomas Davis, tadavis@lbl.gov
+ *
+ *      This software may be used and distributed according to the terms
+ *      of the GNU Public License, incorporated herein by reference.
+ *
+ */
+
+#ifndef _NET_BONDING_H
+#define _NET_BONDING_H
+
+#include <linux/timer.h>
+#include <linux/proc_fs.h>
+#include <linux/if_bonding.h>
+#include <linux/cpumask.h>
+#include <linux/in6.h>
+#include <linux/netpoll.h>
+#include <linux/inetdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/reciprocal_div.h>
+#include <linux/if_link.h>
+
+#include <net/bond_3ad.h>
+#include <net/bond_alb.h>
+#include <net/bond_options.h>
+
+#define DRV_VERSION     "3.7.1"
+#define DRV_RELDATE     "April 27, 2011"
+#define DRV_NAME        "bonding"
+#define DRV_DESCRIPTION "Ethernet Channel Bonding Driver"
+
+#define bond_version DRV_DESCRIPTION ": v" DRV_VERSION " (" DRV_RELDATE ")\n"
+
+#define BOND_MAX_ARP_TARGETS    16
+
+#define BOND_DEFAULT_MIIMON     100
+
+/*
+ * Less bad way to call ioctl from within the kernel; this needs to be
+ * done some other way to get the call out of interrupt context.
+ * Needs "ioctl" variable to be supplied by calling context.
+ */
+#define IOCTL(dev, arg, cmd) ({         \
+        int res = 0;                    \
+        mm_segment_t fs = get_fs();     \
+        set_fs(get_ds());               \
+        res = ioctl(dev, arg, cmd);     \
+        set_fs(fs);                     \
+        res; })
+
+#define BOND_MODE(bond) ((bond)->params.mode)
+
+/* slave list primitives */
+#define bond_slave_list(bond) (&(bond)->dev->adj_list.lower)
+
+#define bond_has_slaves(bond) !list_empty(bond_slave_list(bond))
+
+/* IMPORTANT: bond_first/last_slave can return NULL in case of an empty list */
+#define bond_first_slave(bond) \
+        (bond_has_slaves(bond) ? \
+                netdev_adjacent_get_private(bond_slave_list(bond)->next) : \
+                NULL)
+#define bond_last_slave(bond) \
+        (bond_has_slaves(bond) ? \
+                netdev_adjacent_get_private(bond_slave_list(bond)->prev) : \
+                NULL)
+
+/* Caller must have rcu_read_lock */
+#define bond_first_slave_rcu(bond) \
+        netdev_lower_get_first_private_rcu(bond->dev)
+
+#define bond_is_first_slave(bond, pos) (pos == bond_first_slave(bond))
+#define bond_is_last_slave(bond, pos) (pos == bond_last_slave(bond))
+
+/**
+ * bond_for_each_slave - iterate over all slaves
+ * @bond:       the bond holding this list
+ * @pos:        current slave
+ * @iter:       list_head * iterator
+ *
+ * Caller must hold RTNL
+ */
+#define bond_for_each_slave(bond, pos, iter) \
+        netdev_for_each_lower_private((bond)->dev, pos, iter)
+
+/* Caller must have rcu_read_lock */
+#define bond_for_each_slave_rcu(bond, pos, iter) \
+        netdev_for_each_lower_private_rcu((bond)->dev, pos, iter)
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+extern atomic_t netpoll_block_tx;
+
+static inline void block_netpoll_tx(void)
+{
+        atomic_inc(&netpoll_block_tx);
+}
+
+static inline void unblock_netpoll_tx(void)
+{
+        atomic_dec(&netpoll_block_tx);
+}
+
+static inline int is_netpoll_tx_blocked(struct net_device *dev)
+{
+        if (unlikely(netpoll_tx_running(dev)))
+                return atomic_read(&netpoll_block_tx);
+        return 0;
+}
+#else
+#define block_netpoll_tx()
+#define unblock_netpoll_tx()
+#define is_netpoll_tx_blocked(dev) (0)
+#endif
+
+struct bond_params {
+        int mode;
+        int xmit_policy;
+        int miimon;
+        u8 num_peer_notif;
+        int arp_interval;
+        int arp_validate;
+        int arp_all_targets;
+        int use_carrier;
+        int fail_over_mac;
+        int updelay;
+        int downdelay;
+        int lacp_fast;
+        unsigned int min_links;
+        int ad_select;
+        char primary[IFNAMSIZ];
+        int primary_reselect;
+        __be32 arp_targets[BOND_MAX_ARP_TARGETS];
+        int tx_queues;
+        int all_slaves_active;
+        int resend_igmp;
+        int lp_interval;
+        int packets_per_slave;
+        int tlb_dynamic_lb;
+        struct reciprocal_value reciprocal_packets_per_slave;
+};
+
+struct bond_parm_tbl {
+        char *modename;
+        int mode;
+};
+
+struct slave {
+        struct net_device *dev; /* first - useful for panic debug */
+        struct bonding *bond; /* our master */
+        int    delay;
+        /* all three in jiffies */
+        unsigned long last_link_up;
+        unsigned long last_rx;
+        unsigned long target_last_arp_rx[BOND_MAX_ARP_TARGETS];
+        s8     link;    /* one of BOND_LINK_XXXX */
+        s8     new_link;
+        u8     backup:1,   /* indicates backup slave. Value corresponds with
+                              BOND_STATE_ACTIVE and BOND_STATE_BACKUP */
+               inactive:1, /* indicates inactive slave */
+               should_notify:1; /* indicateds whether the state changed */
+        u8     duplex;
+        u32    original_mtu;
+        u32    link_failure_count;
+        u32    speed;
+        u16    queue_id;
+        u8     perm_hwaddr[ETH_ALEN];
+        struct ad_slave_info *ad_info;
+        struct tlb_slave_info tlb_info;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        struct netpoll *np;
+#endif
+        struct kobject kobj;
+        struct rtnl_link_stats64 slave_stats;
+};
+
+struct bond_up_slave {
+        unsigned int    count;
+        struct rcu_head rcu;
+        struct slave    *arr[0];
+};
+
+/*
+ * Link pseudo-state only used internally by monitors
+ */
+#define BOND_LINK_NOCHANGE -1
+
+/*
+ * Here are the locking policies for the two bonding locks:
+ * Get rcu_read_lock when reading or RTNL when writing slave list.
+ */
+struct bonding {
+        struct   net_device *dev; /* first - useful for panic debug */
+        struct   slave __rcu *curr_active_slave;
+        struct   slave __rcu *current_arp_slave;
+        struct   slave __rcu *primary_slave;
+        struct   bond_up_slave __rcu *slave_arr; /* Array of usable slaves */
+        bool     force_primary;
+        s32      slave_cnt; /* never change this value outside the attach/detach wrappers */
+        int     (*recv_probe)(const struct sk_buff *, struct bonding *,
+                              struct slave *);
+        /* mode_lock is used for mode-specific locking needs, currently used by:
+         * 3ad mode (4) - protect against running bond_3ad_unbind_slave() and
+         *                bond_3ad_state_machine_handler() concurrently and also
+         *                the access to the state machine shared variables.
+         * TLB mode (5) - to sync the use and modifications of its hash table
+         * ALB mode (6) - to sync the use and modifications of its hash table
+         */
+        spinlock_t mode_lock;
+        u8       send_peer_notif;
+        u8       igmp_retrans;
+#ifdef CONFIG_PROC_FS
+        struct   proc_dir_entry *proc_entry;
+        char     proc_file_name[IFNAMSIZ];
+#endif /* CONFIG_PROC_FS */
+        struct   list_head bond_list;
+        u32      rr_tx_counter;
+        struct   ad_bond_info ad_info;
+        struct   alb_bond_info alb_info;
+        struct   bond_params params;
+        struct   workqueue_struct *wq;
+        struct   delayed_work mii_work;
+        struct   delayed_work arp_work;
+        struct   delayed_work alb_work;
+        struct   delayed_work ad_work;
+        struct   delayed_work mcast_work;
+        struct   delayed_work slave_arr_work;
+#ifdef CONFIG_DEBUG_FS
+        /* debugging support via debugfs */
+        struct   dentry *debug_dir;
+#endif /* CONFIG_DEBUG_FS */
+        struct rtnl_link_stats64 bond_stats;
+};
+
+#define bond_slave_get_rcu(dev) \
+        ((struct slave *) rcu_dereference(dev->rx_handler_data))
+
+#define bond_slave_get_rtnl(dev) \
+        ((struct slave *) rtnl_dereference(dev->rx_handler_data))
+
+struct bond_vlan_tag {
+        __be16          vlan_proto;
+        unsigned short  vlan_id;
+};
+
+/**
+ * Returns NULL if the net_device does not belong to any of the bond's slaves
+ *
+ * Caller must hold bond lock for read
+ */
+static inline struct slave *bond_get_slave_by_dev(struct bonding *bond,
+                                                  struct net_device *slave_dev)
+{
+        return netdev_lower_dev_get_private(bond->dev, slave_dev);
+}
+
+static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
+{
+        return slave->bond;
+}
+
+static inline bool bond_should_override_tx_queue(struct bonding *bond)
+{
+        return BOND_MODE(bond) == BOND_MODE_ACTIVEBACKUP ||
+               BOND_MODE(bond) == BOND_MODE_ROUNDROBIN;
+}
+
+static inline bool bond_is_lb(const struct bonding *bond)
+{
+        return BOND_MODE(bond) == BOND_MODE_TLB ||
+               BOND_MODE(bond) == BOND_MODE_ALB;
+}
+
+static inline bool bond_is_nondyn_tlb(const struct bonding *bond)
+{
+        return (BOND_MODE(bond) == BOND_MODE_TLB)  &&
+               (bond->params.tlb_dynamic_lb == 0);
+}
+
+static inline bool bond_mode_uses_xmit_hash(const struct bonding *bond)
+{
+        return (BOND_MODE(bond) == BOND_MODE_8023AD ||
+                BOND_MODE(bond) == BOND_MODE_XOR ||
+                bond_is_nondyn_tlb(bond));
+}
+
+static inline bool bond_mode_uses_arp(int mode)
+{
+        return mode != BOND_MODE_8023AD && mode != BOND_MODE_TLB &&
+               mode != BOND_MODE_ALB;
+}
+
+static inline bool bond_mode_uses_primary(int mode)
+{
+        return mode == BOND_MODE_ACTIVEBACKUP || mode == BOND_MODE_TLB ||
+               mode == BOND_MODE_ALB;
+}
+
+static inline bool bond_uses_primary(struct bonding *bond)
+{
+        return bond_mode_uses_primary(BOND_MODE(bond));
+}
+
+static inline bool bond_slave_is_up(struct slave *slave)
+{
+        return netif_running(slave->dev) && netif_carrier_ok(slave->dev);
+}
+
+static inline void bond_set_active_slave(struct slave *slave)
+{
+        if (slave->backup) {
+                slave->backup = 0;
+                rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
+        }
+}
+
+static inline void bond_set_backup_slave(struct slave *slave)
+{
+        if (!slave->backup) {
+                slave->backup = 1;
+                rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
+        }
+}
+
+static inline void bond_set_slave_state(struct slave *slave,
+                                        int slave_state, bool notify)
+{
+        if (slave->backup == slave_state)
+                return;
+
+        slave->backup = slave_state;
+        if (notify) {
+                rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
+                slave->should_notify = 0;
+        } else {
+                if (slave->should_notify)
+                        slave->should_notify = 0;
+                else
+                        slave->should_notify = 1;
+        }
+}
+
+static inline void bond_slave_state_change(struct bonding *bond)
+{
+        struct list_head *iter;
+        struct slave *tmp;
+
+        bond_for_each_slave(bond, tmp, iter) {
+                if (tmp->link == BOND_LINK_UP)
+                        bond_set_active_slave(tmp);
+                else if (tmp->link == BOND_LINK_DOWN)
+                        bond_set_backup_slave(tmp);
+        }
+}
+
+static inline void bond_slave_state_notify(struct bonding *bond)
+{
+        struct list_head *iter;
+        struct slave *tmp;
+
+        bond_for_each_slave(bond, tmp, iter) {
+                if (tmp->should_notify) {
+                        rtmsg_ifinfo(RTM_NEWLINK, tmp->dev, 0, GFP_ATOMIC);
+                        tmp->should_notify = 0;
+                }
+        }
+}
+
+static inline int bond_slave_state(struct slave *slave)
+{
+        return slave->backup;
+}
+
+static inline bool bond_is_active_slave(struct slave *slave)
+{
+        return !bond_slave_state(slave);
+}
+
+static inline bool bond_slave_can_tx(struct slave *slave)
+{
+        return bond_slave_is_up(slave) && slave->link == BOND_LINK_UP &&
+               bond_is_active_slave(slave);
+}
+
+#define BOND_PRI_RESELECT_ALWAYS        0
+#define BOND_PRI_RESELECT_BETTER        1
+#define BOND_PRI_RESELECT_FAILURE       2
+
+#define BOND_FOM_NONE                   0
+#define BOND_FOM_ACTIVE                 1
+#define BOND_FOM_FOLLOW                 2
+
+#define BOND_ARP_TARGETS_ANY            0
+#define BOND_ARP_TARGETS_ALL            1
+
+#define BOND_ARP_VALIDATE_NONE          0
+#define BOND_ARP_VALIDATE_ACTIVE        (1 << BOND_STATE_ACTIVE)
+#define BOND_ARP_VALIDATE_BACKUP        (1 << BOND_STATE_BACKUP)
+#define BOND_ARP_VALIDATE_ALL           (BOND_ARP_VALIDATE_ACTIVE | \
+                                         BOND_ARP_VALIDATE_BACKUP)
+#define BOND_ARP_FILTER                 (BOND_ARP_VALIDATE_ALL + 1)
+#define BOND_ARP_FILTER_ACTIVE          (BOND_ARP_VALIDATE_ACTIVE | \
+                                         BOND_ARP_FILTER)
+#define BOND_ARP_FILTER_BACKUP          (BOND_ARP_VALIDATE_BACKUP | \
+                                         BOND_ARP_FILTER)
+
+#define BOND_SLAVE_NOTIFY_NOW           true
+#define BOND_SLAVE_NOTIFY_LATER         false
+
+static inline int slave_do_arp_validate(struct bonding *bond,
+                                        struct slave *slave)
+{
+        return bond->params.arp_validate & (1 << bond_slave_state(slave));
+}
+
+static inline int slave_do_arp_validate_only(struct bonding *bond)
+{
+        return bond->params.arp_validate & BOND_ARP_FILTER;
+}
+
+static inline int bond_is_ip_target_ok(__be32 addr)
+{
+        return !ipv4_is_lbcast(addr) && !ipv4_is_zeronet(addr);
+}
+
+/* Get the oldest arp which we've received on this slave for bond's
+ * arp_targets.
+ */
+static inline unsigned long slave_oldest_target_arp_rx(struct bonding *bond,
+                                                       struct slave *slave)
+{
+        int i = 1;
+        unsigned long ret = slave->target_last_arp_rx[0];
+
+        for (; (i < BOND_MAX_ARP_TARGETS) && bond->params.arp_targets[i]; i++)
+                if (time_before(slave->target_last_arp_rx[i], ret))
+                        ret = slave->target_last_arp_rx[i];
+
+        return ret;
+}
+
+static inline unsigned long slave_last_rx(struct bonding *bond,
+                                        struct slave *slave)
+{
+        if (bond->params.arp_all_targets == BOND_ARP_TARGETS_ALL)
+                return slave_oldest_target_arp_rx(bond, slave);
+
+        return slave->last_rx;
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static inline void bond_netpoll_send_skb(const struct slave *slave,
+                                         struct sk_buff *skb)
+{
+        struct netpoll *np = slave->np;
+
+        if (np)
+                netpoll_send_skb(np, skb);
+}
+#else
+static inline void bond_netpoll_send_skb(const struct slave *slave,
+                                         struct sk_buff *skb)
+{
+}
+#endif
+
+static inline void bond_set_slave_inactive_flags(struct slave *slave,
+                                                 bool notify)
+{
+        if (!bond_is_lb(slave->bond))
+                bond_set_slave_state(slave, BOND_STATE_BACKUP, notify);
+        if (!slave->bond->params.all_slaves_active)
+                slave->inactive = 1;
+}
+
+static inline void bond_set_slave_active_flags(struct slave *slave,
+                                               bool notify)
+{
+        bond_set_slave_state(slave, BOND_STATE_ACTIVE, notify);
+        slave->inactive = 0;
+}
+
+static inline bool bond_is_slave_inactive(struct slave *slave)
+{
+        return slave->inactive;
+}
+
+static inline __be32 bond_confirm_addr(struct net_device *dev, __be32 dst, __be32 local)
+{
+        struct in_device *in_dev;
+        __be32 addr = 0;
+
+        rcu_read_lock();
+        in_dev = __in_dev_get_rcu(dev);
+
+        if (in_dev)
+                addr = inet_confirm_addr(dev_net(dev), in_dev, dst, local,
+                                         RT_SCOPE_HOST);
+        rcu_read_unlock();
+        return addr;
+}
+
+struct bond_net {
+        struct net              *net;   /* Associated network namespace */
+        struct list_head        dev_list;
+#ifdef CONFIG_PROC_FS
+        struct proc_dir_entry   *proc_dir;
+#endif
+        struct class_attribute  class_attr_bonding_masters;
+};
+
+int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond, struct slave *slave);
+void bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb, struct net_device *slave_dev);
+int bond_create(struct net *net, const char *name);
+int bond_create_sysfs(struct bond_net *net);
+void bond_destroy_sysfs(struct bond_net *net);
+void bond_prepare_sysfs_group(struct bonding *bond);
+int bond_sysfs_slave_add(struct slave *slave);
+void bond_sysfs_slave_del(struct slave *slave);
+int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev);
+int bond_release(struct net_device *bond_dev, struct net_device *slave_dev);
+u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb);
+void bond_select_active_slave(struct bonding *bond);
+void bond_change_active_slave(struct bonding *bond, struct slave *new_active);
+void bond_create_debugfs(void);
+void bond_destroy_debugfs(void);
+void bond_debug_register(struct bonding *bond);
+void bond_debug_unregister(struct bonding *bond);
+void bond_debug_reregister(struct bonding *bond);
+const char *bond_mode_name(int mode);
+void bond_setup(struct net_device *bond_dev);
+unsigned int bond_get_num_tx_queues(void);
+int bond_netlink_init(void);
+void bond_netlink_fini(void);
+struct net_device *bond_option_active_slave_get_rcu(struct bonding *bond);
+const char *bond_slave_link_status(s8 link);
+struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
+                                              struct net_device *end_dev,
+                                              int level);
+int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave);
+void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay);
+
+#ifdef CONFIG_PROC_FS
+void bond_create_proc_entry(struct bonding *bond);
+void bond_remove_proc_entry(struct bonding *bond);
+void bond_create_proc_dir(struct bond_net *bn);
+void bond_destroy_proc_dir(struct bond_net *bn);
+#else
+static inline void bond_create_proc_entry(struct bonding *bond)
+{
+}
+
+static inline void bond_remove_proc_entry(struct bonding *bond)
+{
+}
+
+static inline void bond_create_proc_dir(struct bond_net *bn)
+{
+}
+
+static inline void bond_destroy_proc_dir(struct bond_net *bn)
+{
+}
+#endif
+
+static inline struct slave *bond_slave_has_mac(struct bonding *bond,
+                                               const u8 *mac)
+{
+        struct list_head *iter;
+        struct slave *tmp;
+
+        bond_for_each_slave(bond, tmp, iter)
+                if (ether_addr_equal_64bits(mac, tmp->dev->dev_addr))
+                        return tmp;
+
+        return NULL;
+}
+
+/* Caller must hold rcu_read_lock() for read */
+static inline struct slave *bond_slave_has_mac_rcu(struct bonding *bond,
+                                               const u8 *mac)
+{
+        struct list_head *iter;
+        struct slave *tmp;
+
+        bond_for_each_slave_rcu(bond, tmp, iter)
+                if (ether_addr_equal_64bits(mac, tmp->dev->dev_addr))
+                        return tmp;
+
+        return NULL;
+}
+
+/* Caller must hold rcu_read_lock() for read */
+static inline bool bond_slave_has_mac_rx(struct bonding *bond, const u8 *mac)
+{
+        struct list_head *iter;
+        struct slave *tmp;
+        struct netdev_hw_addr *ha;
+
+        bond_for_each_slave_rcu(bond, tmp, iter)
+                if (ether_addr_equal_64bits(mac, tmp->dev->dev_addr))
+                        return true;
+
+        if (netdev_uc_empty(bond->dev))
+                return false;
+
+        netdev_for_each_uc_addr(ha, bond->dev)
+                if (ether_addr_equal_64bits(mac, ha->addr))
+                        return true;
+
+        return false;
+}
+
+/* Check if the ip is present in arp ip list, or first free slot if ip == 0
+ * Returns -1 if not found, index if found
+ */
+static inline int bond_get_targets_ip(__be32 *targets, __be32 ip)
+{
+        int i;
+
+        for (i = 0; i < BOND_MAX_ARP_TARGETS; i++)
+                if (targets[i] == ip)
+                        return i;
+                else if (targets[i] == 0)
+                        break;
+
+        return -1;
+}
+
+/* exported from bond_main.c */
+extern int bond_net_id;
+extern const struct bond_parm_tbl bond_lacp_tbl[];
+extern const struct bond_parm_tbl xmit_hashtype_tbl[];
+extern const struct bond_parm_tbl arp_validate_tbl[];
+extern const struct bond_parm_tbl arp_all_targets_tbl[];
+extern const struct bond_parm_tbl fail_over_mac_tbl[];
+extern const struct bond_parm_tbl pri_reselect_tbl[];
+extern struct bond_parm_tbl ad_select_tbl[];
+
+/* exported from bond_netlink.c */
+extern struct rtnl_link_ops bond_link_ops;
+
+static inline void bond_tx_drop(struct net_device *dev, struct sk_buff *skb)
+{
+        atomic_long_inc(&dev->tx_dropped);
+        dev_kfree_skb_any(skb);
+}
+
+#endif /* _NET_BONDING_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index a2ddcf2398fd..4ebb816241fa 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -319,9 +319,12 @@ struct ieee80211_supported_band {
 /**
  * struct vif_params - describes virtual interface parameters
  * @use_4addr: use 4-address frames
- * @macaddr: address to use for this virtual interface. This will only
- *      be used for non-netdevice interfaces. If this parameter is set
- *      to zero address the driver may determine the address as needed.
+ * @macaddr: address to use for this virtual interface.
+ *      If this parameter is set to zero address the driver may
+ *      determine the address as needed.
+ *      This feature is only fully supported by drivers that enable the
+ *      %NL80211_FEATURE_MAC_ON_CREATE flag.  Others may support creating
+ **     only p2p devices with specified MAC.
  */
 struct vif_params {
        int use_4addr;
@@ -799,6 +802,22 @@ struct station_parameters {
 };
 
 /**
+ * struct station_del_parameters - station deletion parameters
+ *
+ * Used to delete a station entry (or all stations).
+ *
+ * @mac: MAC address of the station to remove or NULL to remove all stations
+ * @subtype: Management frame subtype to use for indicating removal
+ *      (10 = Disassociation, 12 = Deauthentication)
+ * @reason_code: Reason code for the Disassociation/Deauthentication frame
+ */
+struct station_del_parameters {
+        const u8 *mac;
+        u8 subtype;
+        u16 reason_code;
+};
+
+/**
  * enum cfg80211_station_type - the type of station being modified
  * @CFG80211_STA_AP_CLIENT: client of an AP interface
  * @CFG80211_STA_AP_MLME_CLIENT: client of an AP interface that has
@@ -1340,6 +1359,16 @@ struct mesh_setup {
 };
 
 /**
+ * struct ocb_setup - 802.11p OCB mode setup configuration
+ * @chandef: defines the channel to use
+ *
+ * These parameters are fixed when connecting to the network
+ */
+struct ocb_setup {
+        struct cfg80211_chan_def chandef;
+};
+
+/**
  * struct ieee80211_txq_params - TX queue parameters
  * @ac: AC identifier
  * @txop: Maximum burst time in units of 32 usecs, 0 meaning disabled
@@ -1408,6 +1437,10 @@ struct cfg80211_ssid {
  * @aborted: (internal) scan request was notified as aborted
  * @notified: (internal) scan request was notified as done or aborted
  * @no_cck: used to send probe requests at non CCK rate in 2GHz band
+ * @mac_addr: MAC address used with randomisation
+ * @mac_addr_mask: MAC address mask used with randomisation, bits that
+ *      are 0 in the mask should be randomised, bits that are 1 should
+ *      be taken from the @mac_addr
  */
 struct cfg80211_scan_request {
         struct cfg80211_ssid *ssids;
@@ -1422,6 +1455,9 @@ struct cfg80211_scan_request {
 
         struct wireless_dev *wdev;
 
+        u8 mac_addr[ETH_ALEN] __aligned(2);
+        u8 mac_addr_mask[ETH_ALEN] __aligned(2);
+
         /* internal */
         struct wiphy *wiphy;
         unsigned long scan_start;
@@ -1432,6 +1468,17 @@ struct cfg80211_scan_request {
         struct ieee80211_channel *channels[0];
 };
 
+static inline void get_random_mask_addr(u8 *buf, const u8 *addr, const u8 *mask)
+{
+        int i;
+
+        get_random_bytes(buf, ETH_ALEN);
+        for (i = 0; i < ETH_ALEN; i++) {
+                buf[i] &= ~mask[i];
+                buf[i] |= addr[i] & mask[i];
+        }
+}
+
 /**
  * struct cfg80211_match_set - sets of attributes to match
  *
@@ -1465,6 +1512,10 @@ struct cfg80211_match_set {
  * @channels: channels to scan
  * @min_rssi_thold: for drivers only supporting a single threshold, this
  *      contains the minimum over all matchsets
+ * @mac_addr: MAC address used with randomisation
+ * @mac_addr_mask: MAC address mask used with randomisation, bits that
+ *      are 0 in the mask should be randomised, bits that are 1 should
+ *      be taken from the @mac_addr
  */
 struct cfg80211_sched_scan_request {
         struct cfg80211_ssid *ssids;
@@ -1479,6 +1530,9 @@ struct cfg80211_sched_scan_request {
         int n_match_sets;
         s32 min_rssi_thold;
 
+        u8 mac_addr[ETH_ALEN] __aligned(2);
+        u8 mac_addr_mask[ETH_ALEN] __aligned(2);
+
         /* internal */
         struct wiphy *wiphy;
         struct net_device *dev;
@@ -1911,6 +1965,7 @@ struct cfg80211_wowlan_tcp {
  * @rfkill_release: wake up when rfkill is released
  * @tcp: TCP connection establishment/wakeup parameters, see nl80211.h.
  *      NULL if not configured.
+ * @nd_config: configuration for the scan to be used for net detect wake.
  */
 struct cfg80211_wowlan {
         bool any, disconnect, magic_pkt, gtk_rekey_failure,
@@ -1919,6 +1974,7 @@ struct cfg80211_wowlan {
         struct cfg80211_pkt_pattern *patterns;
         struct cfg80211_wowlan_tcp *tcp;
         int n_patterns;
+        struct cfg80211_sched_scan_request *nd_config;
 };
 
 /**
@@ -1951,6 +2007,35 @@ struct cfg80211_coalesce {
 };
 
 /**
+ * struct cfg80211_wowlan_nd_match - information about the match
+ *
+ * @ssid: SSID of the match that triggered the wake up
+ * @n_channels: Number of channels where the match occurred.  This
+ *      value may be zero if the driver can't report the channels.
+ * @channels: center frequencies of the channels where a match
+ *      occurred (in MHz)
+ */
+struct cfg80211_wowlan_nd_match {
+        struct cfg80211_ssid ssid;
+        int n_channels;
+        u32 channels[];
+};
+
+/**
+ * struct cfg80211_wowlan_nd_info - net detect wake up information
+ *
+ * @n_matches: Number of match information instances provided in
+ *      @matches.  This value may be zero if the driver can't provide
+ *      match information.
+ * @matches: Array of pointers to matches containing information about
+ *      the matches that triggered the wake up.
+ */
+struct cfg80211_wowlan_nd_info {
+        int n_matches;
+        struct cfg80211_wowlan_nd_match *matches[];
+};
+
+/**
  * struct cfg80211_wowlan_wakeup - wakeup report
  * @disconnect: woke up by getting disconnected
  * @magic_pkt: woke up by receiving magic packet
@@ -1969,6 +2054,7 @@ struct cfg80211_coalesce {
  * @tcp_match: TCP wakeup packet received
  * @tcp_connlost: TCP connection lost or failed to establish
  * @tcp_nomoretokens: TCP data ran out of tokens
+ * @net_detect: if not %NULL, woke up because of net detect
  */
 struct cfg80211_wowlan_wakeup {
         bool disconnect, magic_pkt, gtk_rekey_failure,
@@ -1978,6 +2064,7 @@ struct cfg80211_wowlan_wakeup {
         s32 pattern_idx;
         u32 packet_present_len, packet_len;
         const void *packet;
+        struct cfg80211_wowlan_nd_info *net_detect;
 };
 
 /**
@@ -2132,7 +2219,7 @@ struct cfg80211_qos_map {
  * @stop_ap: Stop being an AP, including stopping beaconing.
  *
  * @add_station: Add a new station.
- * @del_station: Remove a station; @mac may be NULL to remove all stations.
+ * @del_station: Remove a station
  * @change_station: Modify a given station. Note that flags changes are not much
  *      validated in cfg80211, in particular the auth/assoc/authorized flags
  *      might come to the driver in invalid combinations -- make sure to check
@@ -2146,6 +2233,8 @@ struct cfg80211_qos_map {
  * @change_mpath: change a given mesh path
  * @get_mpath: get a mesh path for the given parameters
  * @dump_mpath: dump mesh path callback -- resume dump at index @idx
+ * @get_mpp: get a mesh proxy path for the given parameters
+ * @dump_mpp: dump mesh proxy path callback -- resume dump at index @idx
  * @join_mesh: join the mesh network with the specified parameters
  *      (invoked with the wireless_dev mutex held)
  * @leave_mesh: leave the current mesh network
@@ -2331,6 +2420,17 @@ struct cfg80211_qos_map {
  *      with the peer followed by immediate teardown when the addition is later
  *      rejected)
  * @del_tx_ts: remove an existing TX TS
+ *
+ * @join_ocb: join the OCB network with the specified parameters
+ *      (invoked with the wireless_dev mutex held)
+ * @leave_ocb: leave the current OCB network
+ *      (invoked with the wireless_dev mutex held)
+ *
+ * @tdls_channel_switch: Start channel-switching with a TDLS peer. The driver
+ *      is responsible for continually initiating channel-switching operations
+ *      and returning to the base channel for communication with the AP.
+ * @tdls_cancel_channel_switch: Stop channel-switching with a TDLS peer. Both
+ *      peers must be on the base channel when the call completes.
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -2376,7 +2476,7 @@ struct cfg80211_ops {
                                const u8 *mac,
                                struct station_parameters *params);
         int     (*del_station)(struct wiphy *wiphy, struct net_device *dev,
-                               const u8 *mac);
+                               struct station_del_parameters *params);
         int     (*change_station)(struct wiphy *wiphy, struct net_device *dev,
                                   const u8 *mac,
                                   struct station_parameters *params);
@@ -2396,6 +2496,11 @@ struct cfg80211_ops {
         int     (*dump_mpath)(struct wiphy *wiphy, struct net_device *dev,
                               int idx, u8 *dst, u8 *next_hop,
                               struct mpath_info *pinfo);
+        int     (*get_mpp)(struct wiphy *wiphy, struct net_device *dev,
+                           u8 *dst, u8 *mpp, struct mpath_info *pinfo);
+        int     (*dump_mpp)(struct wiphy *wiphy, struct net_device *dev,
+                            int idx, u8 *dst, u8 *mpp,
+                            struct mpath_info *pinfo);
         int     (*get_mesh_config)(struct wiphy *wiphy,
                                 struct net_device *dev,
                                 struct mesh_config *conf);
@@ -2407,6 +2512,10 @@ struct cfg80211_ops {
                              const struct mesh_setup *setup);
         int     (*leave_mesh)(struct wiphy *wiphy, struct net_device *dev);
 
+        int     (*join_ocb)(struct wiphy *wiphy, struct net_device *dev,
+                            struct ocb_setup *setup);
+        int     (*leave_ocb)(struct wiphy *wiphy, struct net_device *dev);
+
         int     (*change_bss)(struct wiphy *wiphy, struct net_device *dev,
                               struct bss_parameters *params);
 
@@ -2577,6 +2686,14 @@ struct cfg80211_ops {
                              u16 admitted_time);
         int     (*del_tx_ts)(struct wiphy *wiphy, struct net_device *dev,
                              u8 tsid, const u8 *peer);
+
+        int     (*tdls_channel_switch)(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       const u8 *addr, u8 oper_class,
+                                       struct cfg80211_chan_def *chandef);
+        void    (*tdls_cancel_channel_switch)(struct wiphy *wiphy,
+                                              struct net_device *dev,
+                                              const u8 *addr);
 };
 
 /*
@@ -2623,13 +2740,9 @@ struct cfg80211_ops {
  * @WIPHY_FLAG_SUPPORTS_5_10_MHZ: Device supports 5 MHz and 10 MHz channels.
  * @WIPHY_FLAG_HAS_CHANNEL_SWITCH: Device supports channel switch in
  *      beaconing mode (AP, IBSS, Mesh, ...).
- * @WIPHY_FLAG_SUPPORTS_WMM_ADMISSION: the device supports setting up WMM
- *      TSPEC sessions (TID aka TSID 0-7) with the NL80211_CMD_ADD_TX_TS
- *      command. Standard IEEE 802.11 TSPEC setup is not yet supported, it
- *      needs to be able to handle Block-Ack agreements and other things.
  */
 enum wiphy_flags {
-        WIPHY_FLAG_SUPPORTS_WMM_ADMISSION       = BIT(0),
+        /* use hole at 0 */
         /* use hole at 1 */
         /* use hole at 2 */
         WIPHY_FLAG_NETNS_OK                     = BIT(3),
@@ -2755,6 +2868,7 @@ struct ieee80211_txrx_stypes {
  * @WIPHY_WOWLAN_EAP_IDENTITY_REQ: supports wakeup on EAP identity request
  * @WIPHY_WOWLAN_4WAY_HANDSHAKE: supports wakeup on 4-way handshake failure
  * @WIPHY_WOWLAN_RFKILL_RELEASE: supports wakeup on RF-kill release
+ * @WIPHY_WOWLAN_NET_DETECT: supports wakeup on network detection
  */
 enum wiphy_wowlan_support_flags {
         WIPHY_WOWLAN_ANY                = BIT(0),
@@ -2765,6 +2879,7 @@ enum wiphy_wowlan_support_flags {
         WIPHY_WOWLAN_EAP_IDENTITY_REQ   = BIT(5),
         WIPHY_WOWLAN_4WAY_HANDSHAKE     = BIT(6),
         WIPHY_WOWLAN_RFKILL_RELEASE     = BIT(7),
+        WIPHY_WOWLAN_NET_DETECT         = BIT(8),
 };
 
 struct wiphy_wowlan_tcp_support {
@@ -2783,6 +2898,11 @@ struct wiphy_wowlan_tcp_support {
  * @pattern_max_len: maximum length of each pattern
  * @pattern_min_len: minimum length of each pattern
  * @max_pkt_offset: maximum Rx packet offset
+ * @max_nd_match_sets: maximum number of matchsets for net-detect,
+ *      similar, but not necessarily identical, to max_match_sets for
+ *      scheduled scans.
+ *      See &struct cfg80211_sched_scan_request.@match_sets for more
+ *      details.
  * @tcp: TCP wakeup support information
  */
 struct wiphy_wowlan_support {
@@ -2791,6 +2911,7 @@ struct wiphy_wowlan_support {
         int pattern_max_len;
         int pattern_min_len;
         int max_pkt_offset;
+        int max_nd_match_sets;
         const struct wiphy_wowlan_tcp_support *tcp;
 };
 
@@ -3166,6 +3287,23 @@ static inline const char *wiphy_name(const struct wiphy *wiphy)
 }
 
 /**
+ * wiphy_new_nm - create a new wiphy for use with cfg80211
+ *
+ * @ops: The configuration operations for this device
+ * @sizeof_priv: The size of the private area to allocate
+ * @requested_name: Request a particular name.
+ *      NULL is valid value, and means use the default phy%d naming.
+ *
+ * Create a new wiphy and associate the given operations with it.
+ * @sizeof_priv bytes are allocated for private use.
+ *
+ * Return: A pointer to the new wiphy. This pointer must be
+ * assigned to each netdev's ieee80211_ptr for proper operation.
+ */
+struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
+                           const char *requested_name);
+
+/**
  * wiphy_new - create a new wiphy for use with cfg80211
  *
  * @ops: The configuration operations for this device
@@ -3177,7 +3315,11 @@ static inline const char *wiphy_name(const struct wiphy *wiphy)
  * Return: A pointer to the new wiphy. This pointer must be
  * assigned to each netdev's ieee80211_ptr for proper operation.
  */
-struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv);
+static inline struct wiphy *wiphy_new(const struct cfg80211_ops *ops,
+                                      int sizeof_priv)
+{
+        return wiphy_new_nm(ops, sizeof_priv, NULL);
+}
 
 /**
  * wiphy_register - register a wiphy with cfg80211
@@ -4501,33 +4643,6 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
                               gfp_t gfp);
 
 /**
- * cfg80211_radar_event - radar detection event
- * @wiphy: the wiphy
- * @chandef: chandef for the current channel
- * @gfp: context flags
- *
- * This function is called when a radar is detected on the current chanenl.
- */
-void cfg80211_radar_event(struct wiphy *wiphy,
-                          struct cfg80211_chan_def *chandef, gfp_t gfp);
-
-/**
- * cfg80211_cac_event - Channel availability check (CAC) event
- * @netdev: network device
- * @chandef: chandef for the current channel
- * @event: type of event
- * @gfp: context flags
- *
- * This function is called when a Channel availability check (CAC) is finished
- * or aborted. This must be called to notify the completion of a CAC process,
- * also by full-MAC drivers.
- */
-void cfg80211_cac_event(struct net_device *netdev,
-                        const struct cfg80211_chan_def *chandef,
-                        enum nl80211_radar_event event, gfp_t gfp);
-
-
-/**
  * cfg80211_cqm_pktloss_notify - notify userspace about packetloss to peer
  * @dev: network device
  * @peer: peer's MAC address
@@ -4555,6 +4670,42 @@ void cfg80211_cqm_txe_notify(struct net_device *dev, const u8 *peer,
                              u32 num_packets, u32 rate, u32 intvl, gfp_t gfp);
 
 /**
+ * cfg80211_cqm_beacon_loss_notify - beacon loss event
+ * @dev: network device
+ * @gfp: context flags
+ *
+ * Notify userspace about beacon loss from the connected AP.
+ */
+void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp);
+
+/**
+ * cfg80211_radar_event - radar detection event
+ * @wiphy: the wiphy
+ * @chandef: chandef for the current channel
+ * @gfp: context flags
+ *
+ * This function is called when a radar is detected on the current chanenl.
+ */
+void cfg80211_radar_event(struct wiphy *wiphy,
+                          struct cfg80211_chan_def *chandef, gfp_t gfp);
+
+/**
+ * cfg80211_cac_event - Channel availability check (CAC) event
+ * @netdev: network device
+ * @chandef: chandef for the current channel
+ * @event: type of event
+ * @gfp: context flags
+ *
+ * This function is called when a Channel availability check (CAC) is finished
+ * or aborted. This must be called to notify the completion of a CAC process,
+ * also by full-MAC drivers.
+ */
+void cfg80211_cac_event(struct net_device *netdev,
+                        const struct cfg80211_chan_def *chandef,
+                        enum nl80211_radar_event event, gfp_t gfp);
+
+
+/**
  * cfg80211_gtk_rekey_notify - notify userspace about driver rekeying
  * @dev: network device
  * @bssid: BSSID of AP (to avoid races)
@@ -4657,6 +4808,20 @@ bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
 void cfg80211_ch_switch_notify(struct net_device *dev,
                                struct cfg80211_chan_def *chandef);
 
+/*
+ * cfg80211_ch_switch_started_notify - notify channel switch start
+ * @dev: the device on which the channel switch started
+ * @chandef: the future channel definition
+ * @count: the number of TBTTs until the channel switch happens
+ *
+ * Inform the userspace about the channel switch that has just
+ * started, so that it can take appropriate actions (eg. starting
+ * channel switch on other vifs), if necessary.
+ */
+void cfg80211_ch_switch_started_notify(struct net_device *dev,
+                                       struct cfg80211_chan_def *chandef,
+                                       u8 count);
+
 /**
  * ieee80211_operating_class_to_band - convert operating class to band
  *
diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h
new file mode 100644
index 000000000000..7f713acfa106
--- /dev/null
+++ b/include/net/cfg802154.h
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ */
+
+#ifndef __NET_CFG802154_H
+#define __NET_CFG802154_H
+
+#include <linux/ieee802154.h>
+#include <linux/netdevice.h>
+#include <linux/mutex.h>
+#include <linux/bug.h>
+
+#include <net/nl802154.h>
+
+struct wpan_phy;
+
+struct cfg802154_ops {
+        struct net_device * (*add_virtual_intf_deprecated)(struct wpan_phy *wpan_phy,
+                                                           const char *name,
+                                                           int type);
+        void    (*del_virtual_intf_deprecated)(struct wpan_phy *wpan_phy,
+                                               struct net_device *dev);
+        int     (*add_virtual_intf)(struct wpan_phy *wpan_phy,
+                                    const char *name,
+                                    enum nl802154_iftype type,
+                                    __le64 extended_addr);
+        int     (*del_virtual_intf)(struct wpan_phy *wpan_phy,
+                                    struct wpan_dev *wpan_dev);
+        int     (*set_channel)(struct wpan_phy *wpan_phy, u8 page, u8 channel);
+        int     (*set_pan_id)(struct wpan_phy *wpan_phy,
+                              struct wpan_dev *wpan_dev, __le16 pan_id);
+        int     (*set_short_addr)(struct wpan_phy *wpan_phy,
+                                  struct wpan_dev *wpan_dev, __le16 short_addr);
+        int     (*set_backoff_exponent)(struct wpan_phy *wpan_phy,
+                                        struct wpan_dev *wpan_dev, u8 min_be,
+                                        u8 max_be);
+        int     (*set_max_csma_backoffs)(struct wpan_phy *wpan_phy,
+                                         struct wpan_dev *wpan_dev,
+                                         u8 max_csma_backoffs);
+        int     (*set_max_frame_retries)(struct wpan_phy *wpan_phy,
+                                         struct wpan_dev *wpan_dev,
+                                         s8 max_frame_retries);
+        int     (*set_lbt_mode)(struct wpan_phy *wpan_phy,
+                                struct wpan_dev *wpan_dev, bool mode);
+};
+
+struct wpan_phy {
+        struct mutex pib_lock;
+
+        /* If multiple wpan_phys are registered and you're handed e.g.
+         * a regular netdev with assigned ieee802154_ptr, you won't
+         * know whether it points to a wpan_phy your driver has registered
+         * or not. Assign this to something global to your driver to
+         * help determine whether you own this wpan_phy or not.
+         */
+        const void *privid;
+
+        /*
+         * This is a PIB according to 802.15.4-2011.
+         * We do not provide timing-related variables, as they
+         * aren't used outside of driver
+         */
+        u8 current_channel;
+        u8 current_page;
+        u32 channels_supported[IEEE802154_MAX_PAGE + 1];
+        s8 transmit_power;
+        u8 cca_mode;
+
+        __le64 perm_extended_addr;
+
+        s32 cca_ed_level;
+
+        /* PHY depended MAC PIB values */
+
+        /* 802.15.4 acronym: Tdsym in usec */
+        u8 symbol_duration;
+        /* lifs and sifs periods timing */
+        u16 lifs_period;
+        u16 sifs_period;
+
+        struct device dev;
+
+        char priv[0] __aligned(NETDEV_ALIGN);
+};
+
+struct wpan_dev {
+        struct wpan_phy *wpan_phy;
+        int iftype;
+
+        /* the remainder of this struct should be private to cfg802154 */
+        struct list_head list;
+        struct net_device *netdev;
+
+        u32 identifier;
+
+        /* MAC PIB */
+        __le16 pan_id;
+        __le16 short_addr;
+        __le64 extended_addr;
+
+        /* MAC BSN field */
+        u8 bsn;
+        /* MAC DSN field */
+        u8 dsn;
+
+        u8 min_be;
+        u8 max_be;
+        u8 csma_retries;
+        s8 frame_retries;
+
+        bool lbt;
+
+        bool promiscuous_mode;
+};
+
+#define to_phy(_dev)    container_of(_dev, struct wpan_phy, dev)
+
+struct wpan_phy *
+wpan_phy_new(const struct cfg802154_ops *ops, size_t priv_size);
+static inline void wpan_phy_set_dev(struct wpan_phy *phy, struct device *dev)
+{
+        phy->dev.parent = dev;
+}
+
+int wpan_phy_register(struct wpan_phy *phy);
+void wpan_phy_unregister(struct wpan_phy *phy);
+void wpan_phy_free(struct wpan_phy *phy);
+/* Same semantics as for class_for_each_device */
+int wpan_phy_for_each(int (*fn)(struct wpan_phy *phy, void *data), void *data);
+
+static inline void *wpan_phy_priv(struct wpan_phy *phy)
+{
+        BUG_ON(!phy);
+        return &phy->priv;
+}
+
+struct wpan_phy *wpan_phy_find(const char *str);
+
+static inline void wpan_phy_put(struct wpan_phy *phy)
+{
+        put_device(&phy->dev);
+}
+
+static inline const char *wpan_phy_name(struct wpan_phy *phy)
+{
+        return dev_name(&phy->dev);
+}
+
+#endif /* __NET_CFG802154_H */
diff --git a/include/net/checksum.h b/include/net/checksum.h
index 6465bae80a4f..e339a9513e29 100644
--- a/include/net/checksum.h
+++ b/include/net/checksum.h
@@ -151,4 +151,20 @@ static inline void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb,
                                  (__force __be32)to, pseudohdr);
 }
 
+static inline __wsum remcsum_adjust(void *ptr, __wsum csum,
+                                    int start, int offset)
+{
+        __sum16 *psum = (__sum16 *)(ptr + offset);
+        __wsum delta;
+
+        /* Subtract out checksum up to start */
+        csum = csum_sub(csum, csum_partial(ptr, start, 0));
+
+        /* Set derived checksum in packet */
+        delta = csum_sub(csum_fold(csum), *psum);
+        *psum = csum_fold(csum);
+
+        return delta;
+}
+
 #endif
diff --git a/include/net/compat.h b/include/net/compat.h
index 3b603b199c01..42a9c8431177 100644
--- a/include/net/compat.h
+++ b/include/net/compat.h
@@ -40,9 +40,8 @@ int compat_sock_get_timestampns(struct sock *, struct timespec __user *);
 #define compat_mmsghdr  mmsghdr
 #endif /* defined(CONFIG_COMPAT) */
 
-int get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *);
-int verify_compat_iovec(struct msghdr *, struct iovec *,
-                        struct sockaddr_storage *, int);
+ssize_t get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *,
+                      struct sockaddr __user **, struct iovec **);
 asmlinkage long compat_sys_sendmsg(int, struct compat_msghdr __user *,
                                    unsigned int);
 asmlinkage long compat_sys_sendmmsg(int, struct compat_mmsghdr __user *,
diff --git a/include/net/dsa.h b/include/net/dsa.h
index b76559293535..ed3c34bbb67a 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -38,6 +38,9 @@ struct dsa_chip_data {
         struct device   *host_dev;
         int             sw_addr;
 
+        /* set to size of eeprom if supported by the switch */
+        int             eeprom_len;
+
         /* Device tree node pointer for this specific switch chip
          * used during switch setup in case additional properties
          * and resources needs to be used
@@ -139,6 +142,14 @@ struct dsa_switch {
          */
         struct device           *master_dev;
 
+#ifdef CONFIG_NET_DSA_HWMON
+        /*
+         * Hardware monitoring information
+         */
+        char                    hwmon_name[IFNAMSIZ + 8];
+        struct device           *hwmon_dev;
+#endif
+
         /*
          * Slave mii_bus and devices for the individual ports.
          */
@@ -242,6 +253,28 @@ struct dsa_switch_driver {
                            struct ethtool_eee *e);
         int     (*get_eee)(struct dsa_switch *ds, int port,
                            struct ethtool_eee *e);
+
+#ifdef CONFIG_NET_DSA_HWMON
+        /* Hardware monitoring */
+        int     (*get_temp)(struct dsa_switch *ds, int *temp);
+        int     (*get_temp_limit)(struct dsa_switch *ds, int *temp);
+        int     (*set_temp_limit)(struct dsa_switch *ds, int temp);
+        int     (*get_temp_alarm)(struct dsa_switch *ds, bool *alarm);
+#endif
+
+        /* EEPROM access */
+        int     (*get_eeprom_len)(struct dsa_switch *ds);
+        int     (*get_eeprom)(struct dsa_switch *ds,
+                              struct ethtool_eeprom *eeprom, u8 *data);
+        int     (*set_eeprom)(struct dsa_switch *ds,
+                              struct ethtool_eeprom *eeprom, u8 *data);
+
+        /*
+         * Register access.
+         */
+        int     (*get_regs_len)(struct dsa_switch *ds, int port);
+        void    (*get_regs)(struct dsa_switch *ds, int port,
+                            struct ethtool_regs *regs, void *p);
 };
 
 void register_switch_driver(struct dsa_switch_driver *type);
diff --git a/include/net/fou.h b/include/net/fou.h
new file mode 100644
index 000000000000..19b8a0c62a98
--- /dev/null
+++ b/include/net/fou.h
@@ -0,0 +1,19 @@
+#ifndef __NET_FOU_H
+#define __NET_FOU_H
+
+#include <linux/skbuff.h>
+
+#include <net/flow.h>
+#include <net/gue.h>
+#include <net/ip_tunnels.h>
+#include <net/udp.h>
+
+size_t fou_encap_hlen(struct ip_tunnel_encap *e);
+static size_t gue_encap_hlen(struct ip_tunnel_encap *e);
+
+int fou_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,
+                     u8 *protocol, struct flowi4 *fl4);
+int gue_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,
+                     u8 *protocol, struct flowi4 *fl4);
+
+#endif
diff --git a/include/net/gue.h b/include/net/gue.h
index b6c332788084..3f28ec7f1c7f 100644
--- a/include/net/gue.h
+++ b/include/net/gue.h
@@ -1,23 +1,116 @@
 #ifndef __NET_GUE_H
 #define __NET_GUE_H
 
+/* Definitions for the GUE header, standard and private flags, lengths
+ * of optional fields are below.
+ *
+ * Diagram of GUE header:
+ *
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |Ver|C|  Hlen   | Proto/ctype   |        Standard flags       |P|
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                                                               |
+ * ~                      Fields (optional)                        ~
+ * |                                                               |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |            Private flags (optional, P bit is set)             |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                                                               |
+ * ~                   Private fields (optional)                   ~
+ * |                                                               |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ * C bit indicates contol message when set, data message when unset.
+ * For a control message, proto/ctype is interpreted as a type of
+ * control message. For data messages, proto/ctype is the IP protocol
+ * of the next header.
+ *
+ * P bit indicates private flags field is present. The private flags
+ * may refer to options placed after this field.
+ */
+
 struct guehdr {
         union {
                 struct {
 #if defined(__LITTLE_ENDIAN_BITFIELD)
-                        __u8    hlen:4,
-                        version:4;
+                        __u8    hlen:5,
+                                control:1,
+                                version:2;
 #elif defined (__BIG_ENDIAN_BITFIELD)
-                        __u8    version:4,
-                                hlen:4;
+                        __u8    version:2,
+                                control:1,
+                                hlen:5;
 #else
 #error  "Please fix <asm/byteorder.h>"
 #endif
-                        __u8    next_hdr;
+                        __u8    proto_ctype;
                         __u16   flags;
                 };
                 __u32 word;
         };
 };
 
+/* Standard flags in GUE header */
+
+#define GUE_FLAG_PRIV   htons(1<<0)     /* Private flags are in options */
+#define GUE_LEN_PRIV    4
+
+#define GUE_FLAGS_ALL   (GUE_FLAG_PRIV)
+
+/* Private flags in the private option extension */
+
+#define GUE_PFLAG_REMCSUM       htonl(1 << 31)
+#define GUE_PLEN_REMCSUM        4
+
+#define GUE_PFLAGS_ALL  (GUE_PFLAG_REMCSUM)
+
+/* Functions to compute options length corresponding to flags.
+ * If we ever have a lot of flags this can be potentially be
+ * converted to a more optimized algorithm (table lookup
+ * for instance).
+ */
+static inline size_t guehdr_flags_len(__be16 flags)
+{
+        return ((flags & GUE_FLAG_PRIV) ? GUE_LEN_PRIV : 0);
+}
+
+static inline size_t guehdr_priv_flags_len(__be32 flags)
+{
+        return 0;
+}
+
+/* Validate standard and private flags. Returns non-zero (meaning invalid)
+ * if there is an unknown standard or private flags, or the options length for
+ * the flags exceeds the options length specific in hlen of the GUE header.
+ */
+static inline int validate_gue_flags(struct guehdr *guehdr,
+                                     size_t optlen)
+{
+        size_t len;
+        __be32 flags = guehdr->flags;
+
+        if (flags & ~GUE_FLAGS_ALL)
+                return 1;
+
+        len = guehdr_flags_len(flags);
+        if (len > optlen)
+                return 1;
+
+        if (flags & GUE_FLAG_PRIV) {
+                /* Private flags are last four bytes accounted in
+                 * guehdr_flags_len
+                 */
+                flags = *(__be32 *)((void *)&guehdr[1] + len - GUE_LEN_PRIV);
+
+                if (flags & ~GUE_PFLAGS_ALL)
+                        return 1;
+
+                len += guehdr_priv_flags_len(flags);
+                if (len > optlen)
+                        return 1;
+        }
+
+        return 0;
+}
+
 #endif
diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
index 3b53c8e405e4..83bb8a73d23c 100644
--- a/include/net/ieee802154_netdev.h
+++ b/include/net/ieee802154_netdev.h
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
  * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
@@ -27,10 +23,10 @@
 #ifndef IEEE802154_NETDEVICE_H
 #define IEEE802154_NETDEVICE_H
 
-#include <net/ieee802154.h>
 #include <net/af_ieee802154.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/ieee802154.h>
 
 struct ieee802154_sechdr {
 #if defined(__LITTLE_ENDIAN_BITFIELD)
@@ -427,8 +423,6 @@ struct ieee802154_mlme_ops {
 
         /* The fields below are required. */
 
-        struct wpan_phy *(*get_phy)(const struct net_device *dev);
-
         /*
          * FIXME: these should become the part of PIB/MIB interface.
          * However we still don't have IB interface of any kind
@@ -438,16 +432,6 @@ struct ieee802154_mlme_ops {
         u8 (*get_dsn)(const struct net_device *dev);
 };
 
-/* The IEEE 802.15.4 standard defines 2 type of the devices:
- * - FFD - full functionality device
- * - RFD - reduce functionality device
- *
- * So 2 sets of mlme operations are needed
- */
-struct ieee802154_reduced_mlme_ops {
-        struct wpan_phy *(*get_phy)(const struct net_device *dev);
-};
-
 static inline struct ieee802154_mlme_ops *
 ieee802154_mlme_ops(const struct net_device *dev)
 {
diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h
index d1d272843b3b..9201afe083fa 100644
--- a/include/net/inet6_hashtables.h
+++ b/include/net/inet6_hashtables.h
@@ -99,4 +99,14 @@ struct sock *inet6_lookup(struct net *net, struct inet_hashinfo *hashinfo,
                           const struct in6_addr *daddr, const __be16 dport,
                           const int dif);
 #endif /* IS_ENABLED(CONFIG_IPV6) */
+
+#define INET6_MATCH(__sk, __net, __saddr, __daddr, __ports, __dif)      \
+        (((__sk)->sk_portpair == (__ports))                     &&      \
+         ((__sk)->sk_family == AF_INET6)                        &&      \
+         ipv6_addr_equal(&(__sk)->sk_v6_daddr, (__saddr))               &&      \
+         ipv6_addr_equal(&(__sk)->sk_v6_rcv_saddr, (__daddr))   &&      \
+         (!(__sk)->sk_bound_dev_if      ||                              \
+           ((__sk)->sk_bound_dev_if == (__dif)))                &&      \
+         net_eq(sock_net(__sk), (__net)))
+
 #endif /* _INET6_HASHTABLES_H */
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index a5593dab6af7..9326c41c2d7f 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -65,7 +65,8 @@ void ip6_tnl_dst_reset(struct ip6_tnl *t);
 void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst);
 int ip6_tnl_rcv_ctl(struct ip6_tnl *t, const struct in6_addr *laddr,
                 const struct in6_addr *raddr);
-int ip6_tnl_xmit_ctl(struct ip6_tnl *t);
+int ip6_tnl_xmit_ctl(struct ip6_tnl *t, const struct in6_addr *laddr,
+                     const struct in6_addr *raddr);
 __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw);
 __u32 ip6_tnl_get_cap(struct ip6_tnl *t, const struct in6_addr *laddr,
                              const struct in6_addr *raddr);
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index dc9d2a27c315..09a819ee2151 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -201,8 +201,8 @@ void fib_free_table(struct fib_table *tb);
 
 #ifndef CONFIG_IP_MULTIPLE_TABLES
 
-#define TABLE_LOCAL_INDEX       0
-#define TABLE_MAIN_INDEX        1
+#define TABLE_LOCAL_INDEX       (RT_TABLE_LOCAL & (FIB_TABLE_HASHSZ - 1))
+#define TABLE_MAIN_INDEX        (RT_TABLE_MAIN  & (FIB_TABLE_HASHSZ - 1))
 
 static inline struct fib_table *fib_get_table(struct net *net, u32 id)
 {
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 5bc6edeb7143..25a59eb388a6 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -117,6 +117,22 @@ struct ip_tunnel_net {
         struct hlist_head tunnels[IP_TNL_HASH_SIZE];
 };
 
+struct ip_tunnel_encap_ops {
+        size_t (*encap_hlen)(struct ip_tunnel_encap *e);
+        int (*build_header)(struct sk_buff *skb, struct ip_tunnel_encap *e,
+                            u8 *protocol, struct flowi4 *fl4);
+};
+
+#define MAX_IPTUN_ENCAP_OPS 8
+
+extern const struct ip_tunnel_encap_ops __rcu *
+                iptun_encaps[MAX_IPTUN_ENCAP_OPS];
+
+int ip_tunnel_encap_add_ops(const struct ip_tunnel_encap_ops *op,
+                            unsigned int num);
+int ip_tunnel_encap_del_ops(const struct ip_tunnel_encap_ops *op,
+                            unsigned int num);
+
 #ifdef CONFIG_INET
 
 int ip_tunnel_init(struct net_device *dev);
diff --git a/include/net/ipx.h b/include/net/ipx.h
index 0143180fecc9..e5cff6811b30 100644
--- a/include/net/ipx.h
+++ b/include/net/ipx.h
@@ -42,6 +42,9 @@ struct ipxhdr {
         struct ipx_address      ipx_source __packed;
 };
 
+/* From af_ipx.c */
+extern int sysctl_ipx_pprop_broadcasting;
+
 static __inline__ struct ipxhdr *ipx_hdr(struct sk_buff *skb)
 {
         return (struct ipxhdr *)skb_transport_header(skb);
@@ -147,7 +150,7 @@ int ipxrtr_add_route(__be32 network, struct ipx_interface *intrfc,
                      unsigned char *node);
 void ipxrtr_del_routes(struct ipx_interface *intrfc);
 int ipxrtr_route_packet(struct sock *sk, struct sockaddr_ipx *usipx,
-                        struct iovec *iov, size_t len, int noblock);
+                        struct msghdr *msg, size_t len, int noblock);
 int ipxrtr_route_skb(struct sk_buff *skb);
 struct ipx_route *ipxrtr_lookup(__be32 net);
 int ipxrtr_ioctl(unsigned int cmd, void __user *arg);
diff --git a/include/net/irda/irda.h b/include/net/irda/irda.h
index a059465101ff..92c8fb575213 100644
--- a/include/net/irda/irda.h
+++ b/include/net/irda/irda.h
@@ -55,16 +55,6 @@ typedef __u32 magic_t;
 #endif
 
 #ifdef CONFIG_IRDA_DEBUG
-
-extern unsigned int irda_debug;
-
-/* use 0 for production, 1 for verification, >2 for debug */
-#define IRDA_DEBUG_LEVEL 0
-
-#define IRDA_DEBUG(n, args...) \
-do {    if (irda_debug >= (n)) \
-                printk(KERN_DEBUG args); \
-} while (0)
 #define IRDA_ASSERT(expr, func) \
 do { if(!(expr)) { \
         printk( "Assertion failed! %s:%s:%d %s\n", \
@@ -72,15 +62,10 @@ do { if(!(expr)) { \
         func } } while (0)
 #define IRDA_ASSERT_LABEL(label)        label
 #else
-#define IRDA_DEBUG(n, args...) do { } while (0)
 #define IRDA_ASSERT(expr, func) do { (void)(expr); } while (0)
 #define IRDA_ASSERT_LABEL(label)
 #endif /* CONFIG_IRDA_DEBUG */
 
-#define IRDA_WARNING(args...) do { if (net_ratelimit()) printk(KERN_WARNING args); } while (0)
-#define IRDA_MESSAGE(args...) do { if (net_ratelimit()) printk(KERN_INFO args); } while (0)
-#define IRDA_ERROR(args...)   do { if (net_ratelimit()) printk(KERN_ERR args); } while (0)
-
 /*
  *  Magic numbers used by Linux-IrDA. Random numbers which must be unique to 
  *  give the best protection
diff --git a/include/net/irda/irlap.h b/include/net/irda/irlap.h
index fb4b76d5d7f1..6f23e820618c 100644
--- a/include/net/irda/irlap.h
+++ b/include/net/irda/irlap.h
@@ -303,7 +303,7 @@ static inline void irlap_next_state(struct irlap_cb *self, IRLAP_STATE state)
         if (!self || self->magic != LAP_MAGIC)
                 return;
 
-        IRDA_DEBUG(4, "next LAP state = %s\n", irlap_state[state]);
+                pr_debug("next LAP state = %s\n", irlap_state[state]);
         */
         self->state = state;
 }
diff --git a/include/net/irda/parameters.h b/include/net/irda/parameters.h
index 42713c931d1f..2d9cd0007cba 100644
--- a/include/net/irda/parameters.h
+++ b/include/net/irda/parameters.h
@@ -71,17 +71,17 @@ typedef int (*PV_HANDLER)(void *self, __u8 *buf, int len, __u8 pi,
                           PV_TYPE type, PI_HANDLER func);
 
 typedef struct {
-        PI_HANDLER func;  /* Handler for this parameter identifier */
+        const PI_HANDLER func;  /* Handler for this parameter identifier */
         PV_TYPE    type;  /* Data type for this parameter */
 } pi_minor_info_t;
 
 typedef struct {
-        pi_minor_info_t *pi_minor_call_table;
+        const pi_minor_info_t *pi_minor_call_table;
         int len;
 } pi_major_info_t;
 
 typedef struct {
-        pi_major_info_t *tables;
+        const pi_major_info_t *tables;
         int              len;
         __u8             pi_mask;
         int              pi_major_offset;
diff --git a/include/net/llc_c_st.h b/include/net/llc_c_st.h
index 0e79cfba4b3b..48f3f891b2f9 100644
--- a/include/net/llc_c_st.h
+++ b/include/net/llc_c_st.h
@@ -35,8 +35,8 @@
 struct llc_conn_state_trans {
         llc_conn_ev_t      ev;
         u8                 next_state;
-        llc_conn_ev_qfyr_t *ev_qualifiers;
-        llc_conn_action_t  *ev_actions;
+        const llc_conn_ev_qfyr_t *ev_qualifiers;
+        const llc_conn_action_t  *ev_actions;
 };
 
 struct llc_conn_state {
diff --git a/include/net/llc_s_st.h b/include/net/llc_s_st.h
index 567c681f1f3e..c4359e203013 100644
--- a/include/net/llc_s_st.h
+++ b/include/net/llc_s_st.h
@@ -19,7 +19,7 @@
 struct llc_sap_state_trans {
         llc_sap_ev_t      ev;
         u8                next_state;
-        llc_sap_action_t *ev_actions;
+        const llc_sap_action_t *ev_actions;
 };
 
 struct llc_sap_state {
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 0ad1f47d2dc7..58d719ddaa60 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -263,6 +263,7 @@ struct ieee80211_vif_chanctx_switch {
  * @BSS_CHANGED_BANDWIDTH: The bandwidth used by this interface changed,
  *      note that this is only called when it changes after the channel
  *      context had been assigned.
+ * @BSS_CHANGED_OCB: OCB join status changed
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
@@ -287,6 +288,7 @@ enum ieee80211_bss_change {
         BSS_CHANGED_P2P_PS              = 1<<19,
         BSS_CHANGED_BEACON_INFO         = 1<<20,
         BSS_CHANGED_BANDWIDTH           = 1<<21,
+        BSS_CHANGED_OCB                 = 1<<22,
 
         /* when adding here, make sure to change ieee80211_reconfig */
 };
@@ -739,7 +741,8 @@ struct ieee80211_tx_info {
                         u8 ampdu_ack_len;
                         u8 ampdu_len;
                         u8 antenna;
-                        void *status_driver_data[21 / sizeof(void *)];
+                        u16 tx_time;
+                        void *status_driver_data[19 / sizeof(void *)];
                 } status;
                 struct {
                         struct ieee80211_tx_rate driver_rates[
@@ -879,6 +882,9 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  *      subframes share the same sequence number. Reported subframes can be
  *      either regular MSDU or singly A-MSDUs. Subframes must not be
  *      interleaved with other frames.
+ * @RX_FLAG_RADIOTAP_VENDOR_DATA: This frame contains vendor-specific
+ *      radiotap data in the skb->data (before the frame) as described by
+ *      the &struct ieee80211_vendor_radiotap.
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR              = BIT(0),
@@ -908,6 +914,7 @@ enum mac80211_rx_flags {
         RX_FLAG_10MHZ                   = BIT(28),
         RX_FLAG_5MHZ                    = BIT(29),
         RX_FLAG_AMSDU_MORE              = BIT(30),
+        RX_FLAG_RADIOTAP_VENDOR_DATA    = BIT(31),
 };
 
 #define RX_FLAG_STBC_SHIFT              26
@@ -979,6 +986,39 @@ struct ieee80211_rx_status {
 };
 
 /**
+ * struct ieee80211_vendor_radiotap - vendor radiotap data information
+ * @present: presence bitmap for this vendor namespace
+ *      (this could be extended in the future if any vendor needs more
+ *       bits, the radiotap spec does allow for that)
+ * @align: radiotap vendor namespace alignment. This defines the needed
+ *      alignment for the @data field below, not for the vendor namespace
+ *      description itself (which has a fixed 2-byte alignment)
+ *      Must be a power of two, and be set to at least 1!
+ * @oui: radiotap vendor namespace OUI
+ * @subns: radiotap vendor sub namespace
+ * @len: radiotap vendor sub namespace skip length, if alignment is done
+ *      then that's added to this, i.e. this is only the length of the
+ *      @data field.
+ * @pad: number of bytes of padding after the @data, this exists so that
+ *      the skb data alignment can be preserved even if the data has odd
+ *      length
+ * @data: the actual vendor namespace data
+ *
+ * This struct, including the vendor data, goes into the skb->data before
+ * the 802.11 header. It's split up in mac80211 using the align/oui/subns
+ * data.
+ */
+struct ieee80211_vendor_radiotap {
+        u32 present;
+        u8 align;
+        u8 oui[3];
+        u8 subns;
+        u8 pad;
+        u16 len;
+        u8 data[];
+} __packed;
+
+/**
  * enum ieee80211_conf_flags - configuration flags
  *
  * Flags to define PHY configuration options
@@ -1117,6 +1157,8 @@ struct ieee80211_conf {
  *      Function (TSF) timer when the frame containing the channel switch
  *      announcement was received. This is simply the rx.mactime parameter
  *      the driver passed into mac80211.
+ * @device_timestamp: arbitrary timestamp for the device, this is the
+ *      rx.device_timestamp parameter the driver passed to mac80211.
  * @block_tx: Indicates whether transmission must be blocked before the
  *      scheduled channel switch, as indicated by the AP.
  * @chandef: the new channel to switch to
@@ -1124,6 +1166,7 @@ struct ieee80211_conf {
  */
 struct ieee80211_channel_switch {
         u64 timestamp;
+        u32 device_timestamp;
         bool block_tx;
         struct cfg80211_chan_def chandef;
         u8 count;
@@ -1423,6 +1466,8 @@ struct ieee80211_sta_rates {
  * @smps_mode: current SMPS mode (off, static or dynamic)
  * @rates: rate control selection table
  * @tdls: indicates whether the STA is a TDLS peer
+ * @tdls_initiator: indicates the STA is an initiator of the TDLS link. Only
+ *      valid if the STA is a TDLS peer in the first place.
  */
 struct ieee80211_sta {
         u32 supp_rates[IEEE80211_NUM_BANDS];
@@ -1438,6 +1483,7 @@ struct ieee80211_sta {
         enum ieee80211_smps_mode smps_mode;
         struct ieee80211_sta_rates __rcu *rates;
         bool tdls;
+        bool tdls_initiator;
 
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
@@ -1576,6 +1622,10 @@ struct ieee80211_tx_control {
  *      a virtual monitor interface when monitor interfaces are the only
  *      active interfaces.
  *
+ * @IEEE80211_HW_NO_AUTO_VIF: The driver would like for no wlanX to
+ *      be created.  It is expected user-space will create vifs as
+ *      desired (and thus have them named as desired).
+ *
  * @IEEE80211_HW_QUEUE_CONTROL: The driver wants to control per-interface
  *      queue mapping in order to use different queues (not just one per AC)
  *      for different virtual interfaces. See the doc section on HW queue
@@ -1622,7 +1672,8 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_SUPPORTS_DYNAMIC_PS                = 1<<12,
         IEEE80211_HW_MFP_CAPABLE                        = 1<<13,
         IEEE80211_HW_WANT_MONITOR_VIF                   = 1<<14,
-        /* free slots */
+        IEEE80211_HW_NO_AUTO_VIF                        = 1<<15,
+        /* free slot */
         IEEE80211_HW_SUPPORTS_UAPSD                     = 1<<17,
         IEEE80211_HW_REPORTS_TX_ACK_STATUS              = 1<<18,
         IEEE80211_HW_CONNECTION_MONITOR                 = 1<<19,
@@ -1776,6 +1827,31 @@ struct ieee80211_scan_request {
 };
 
 /**
+ * struct ieee80211_tdls_ch_sw_params - TDLS channel switch parameters
+ *
+ * @sta: peer this TDLS channel-switch request/response came from
+ * @chandef: channel referenced in a TDLS channel-switch request
+ * @action_code: see &enum ieee80211_tdls_actioncode
+ * @status: channel-switch response status
+ * @timestamp: time at which the frame was received
+ * @switch_time: switch-timing parameter received in the frame
+ * @switch_timeout: switch-timing parameter received in the frame
+ * @tmpl_skb: TDLS switch-channel response template
+ * @ch_sw_tm_ie: offset of the channel-switch timing IE inside @tmpl_skb
+ */
+struct ieee80211_tdls_ch_sw_params {
+        struct ieee80211_sta *sta;
+        struct cfg80211_chan_def *chandef;
+        u8 action_code;
+        u32 status;
+        u32 timestamp;
+        u16 switch_time;
+        u16 switch_timeout;
+        struct sk_buff *tmpl_skb;
+        u32 ch_sw_tm_ie;
+};
+
+/**
  * wiphy_to_ieee80211_hw - return a mac80211 driver hw struct from a wiphy
  *
  * @wiphy: the &struct wiphy which we want to query
@@ -2375,6 +2451,22 @@ enum ieee80211_roc_type {
 };
 
 /**
+ * enum ieee80211_reconfig_complete_type - reconfig type
+ *
+ * This enum is used by the reconfig_complete() callback to indicate what
+ * reconfiguration type was completed.
+ *
+ * @IEEE80211_RECONFIG_TYPE_RESTART: hw restart type
+ *      (also due to resume() callback returning 1)
+ * @IEEE80211_RECONFIG_TYPE_SUSPEND: suspend type (regardless
+ *      of wowlan configuration)
+ */
+enum ieee80211_reconfig_type {
+        IEEE80211_RECONFIG_TYPE_RESTART,
+        IEEE80211_RECONFIG_TYPE_SUSPEND,
+};
+
+/**
  * struct ieee80211_ops - callbacks from mac80211 to the driver
  *
  * This structure contains various callbacks that the driver may
@@ -2530,7 +2622,9 @@ enum ieee80211_roc_type {
  *
  * @sw_scan_start: Notifier function that is called just before a software scan
  *      is started. Can be NULL, if the driver doesn't need this notification.
- *      The callback can sleep.
+ *      The mac_addr parameter allows supporting NL80211_SCAN_FLAG_RANDOM_ADDR,
+ *      the driver may set the NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR flag if it
+ *      can use this parameter. The callback can sleep.
  *
  * @sw_scan_complete: Notifier function that is called just after a
  *      software scan finished. Can be NULL, if the driver doesn't need
@@ -2601,6 +2695,9 @@ enum ieee80211_roc_type {
  *      uses hardware rate control (%IEEE80211_HW_HAS_RATE_CONTROL) since
  *      otherwise the rate control algorithm is notified directly.
  *      Must be atomic.
+ * @sta_rate_tbl_update: Notifies the driver that the rate table changed. This
+ *      is only used if the configured rate control algorithm actually uses
+ *      the new rate table API, and is therefore optional. Must be atomic.
  *
  * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
  *      bursting) for a hardware TX queue.
@@ -2809,11 +2906,11 @@ enum ieee80211_roc_type {
  *      disabled/enabled via @bss_info_changed.
  * @stop_ap: Stop operation on the AP interface.
  *
- * @restart_complete: Called after a call to ieee80211_restart_hw(), when the
- *      reconfiguration has completed. This can help the driver implement the
- *      reconfiguration step. Also called when reconfiguring because the
- *      driver's resume function returned 1, as this is just like an "inline"
- *      hardware restart. This callback may sleep.
+ * @reconfig_complete: Called after a call to ieee80211_restart_hw() and
+ *      during resume, when the reconfiguration has completed.
+ *      This can help the driver implement the reconfiguration step (and
+ *      indicate mac80211 is ready to receive frames).
+ *      This callback may sleep.
  *
  * @ipv6_addr_change: IPv6 address assignment on the given interface changed.
  *      Currently, this is only called for managed or P2P client interfaces.
@@ -2829,6 +2926,13 @@ enum ieee80211_roc_type {
  *      transmitted and then call ieee80211_csa_finish().
  *      If the CSA count starts as zero or 1, this function will not be called,
  *      since there won't be any time to beacon before the switch anyway.
+ * @pre_channel_switch: This is an optional callback that is called
+ *      before a channel switch procedure is started (ie. when a STA
+ *      gets a CSA or an userspace initiated channel-switch), allowing
+ *      the driver to prepare for the channel switch.
+ * @post_channel_switch: This is an optional callback that is called
+ *      after a channel switch procedure is completed, allowing the
+ *      driver to go back to a normal configuration.
  *
  * @join_ibss: Join an IBSS (on an IBSS interface); this is called after all
  *      information in bss_conf is set up and the beacon can be retrieved. A
@@ -2838,6 +2942,26 @@ enum ieee80211_roc_type {
  * @get_expected_throughput: extract the expected throughput towards the
  *      specified station. The returned value is expressed in Kbps. It returns 0
  *      if the RC algorithm does not have proper data to provide.
+ *
+ * @get_txpower: get current maximum tx power (in dBm) based on configuration
+ *      and hardware limits.
+ *
+ * @tdls_channel_switch: Start channel-switching with a TDLS peer. The driver
+ *      is responsible for continually initiating channel-switching operations
+ *      and returning to the base channel for communication with the AP. The
+ *      driver receives a channel-switch request template and the location of
+ *      the switch-timing IE within the template as part of the invocation.
+ *      The template is valid only within the call, and the driver can
+ *      optionally copy the skb for further re-use.
+ * @tdls_cancel_channel_switch: Stop channel-switching with a TDLS peer. Both
+ *      peers must be on the base channel when the call completes.
+ * @tdls_recv_channel_switch: a TDLS channel-switch related frame (request or
+ *      response) has been received from a remote peer. The driver gets
+ *      parameters parsed from the incoming frame and may use them to continue
+ *      an ongoing channel-switch operation. In addition, a channel-switch
+ *      response template is provided, together with the location of the
+ *      switch-timing IE within the template. The skb can only be used within
+ *      the function call.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw,
@@ -2897,8 +3021,11 @@ struct ieee80211_ops {
                                 struct ieee80211_scan_ies *ies);
         int (*sched_scan_stop)(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif);
-        void (*sw_scan_start)(struct ieee80211_hw *hw);
-        void (*sw_scan_complete)(struct ieee80211_hw *hw);
+        void (*sw_scan_start)(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              const u8 *mac_addr);
+        void (*sw_scan_complete)(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif);
         int (*get_stats)(struct ieee80211_hw *hw,
                          struct ieee80211_low_level_stats *stats);
         void (*get_tkip_seq)(struct ieee80211_hw *hw, u8 hw_key_idx,
@@ -2932,6 +3059,9 @@ struct ieee80211_ops {
                               struct ieee80211_vif *vif,
                               struct ieee80211_sta *sta,
                               u32 changed);
+        void (*sta_rate_tbl_update)(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    struct ieee80211_sta *sta);
         int (*conf_tx)(struct ieee80211_hw *hw,
                        struct ieee80211_vif *vif, u16 ac,
                        const struct ieee80211_tx_queue_params *params);
@@ -2959,6 +3089,7 @@ struct ieee80211_ops {
         void (*flush)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                       u32 queues, bool drop);
         void (*channel_switch)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
                                struct ieee80211_channel_switch *ch_switch);
         int (*set_antenna)(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant);
         int (*get_antenna)(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant);
@@ -3025,7 +3156,8 @@ struct ieee80211_ops {
                                   int n_vifs,
                                   enum ieee80211_chanctx_switch_mode mode);
 
-        void (*restart_complete)(struct ieee80211_hw *hw);
+        void (*reconfig_complete)(struct ieee80211_hw *hw,
+                                  enum ieee80211_reconfig_type reconfig_type);
 
 #if IS_ENABLED(CONFIG_IPV6)
         void (*ipv6_addr_change)(struct ieee80211_hw *hw,
@@ -3035,14 +3167,54 @@ struct ieee80211_ops {
         void (*channel_switch_beacon)(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif,
                                       struct cfg80211_chan_def *chandef);
+        int (*pre_channel_switch)(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_channel_switch *ch_switch);
+
+        int (*post_channel_switch)(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif);
 
         int (*join_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
         void (*leave_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
         u32 (*get_expected_throughput)(struct ieee80211_sta *sta);
+        int (*get_txpower)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                           int *dbm);
+
+        int (*tdls_channel_switch)(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   struct ieee80211_sta *sta, u8 oper_class,
+                                   struct cfg80211_chan_def *chandef,
+                                   struct sk_buff *tmpl_skb, u32 ch_sw_tm_ie);
+        void (*tdls_cancel_channel_switch)(struct ieee80211_hw *hw,
+                                           struct ieee80211_vif *vif,
+                                           struct ieee80211_sta *sta);
+        void (*tdls_recv_channel_switch)(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif,
+                                         struct ieee80211_tdls_ch_sw_params *params);
 };
 
 /**
- * ieee80211_alloc_hw -  Allocate a new hardware device
+ * ieee80211_alloc_hw_nm - Allocate a new hardware device
+ *
+ * This must be called once for each hardware device. The returned pointer
+ * must be used to refer to this device when calling other functions.
+ * mac80211 allocates a private data area for the driver pointed to by
+ * @priv in &struct ieee80211_hw, the size of this area is given as
+ * @priv_data_len.
+ *
+ * @priv_data_len: length of private data
+ * @ops: callbacks for this device
+ * @requested_name: Requested name for this device.
+ *      NULL is valid value, and means use the default naming (phy%d)
+ *
+ * Return: A pointer to the new hardware device, or %NULL on error.
+ */
+struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+                                           const struct ieee80211_ops *ops,
+                                           const char *requested_name);
+
+/**
+ * ieee80211_alloc_hw - Allocate a new hardware device
  *
  * This must be called once for each hardware device. The returned pointer
  * must be used to refer to this device when calling other functions.
@@ -3055,8 +3227,12 @@ struct ieee80211_ops {
  *
  * Return: A pointer to the new hardware device, or %NULL on error.
  */
+static inline
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
-                                        const struct ieee80211_ops *ops);
+                                        const struct ieee80211_ops *ops)
+{
+        return ieee80211_alloc_hw_nm(priv_data_len, ops, NULL);
+}
 
 /**
  * ieee80211_register_hw - Register hardware device
@@ -3443,6 +3619,26 @@ void ieee80211_tx_status(struct ieee80211_hw *hw,
                          struct sk_buff *skb);
 
 /**
+ * ieee80211_tx_status_noskb - transmit status callback without skb
+ *
+ * This function can be used as a replacement for ieee80211_tx_status
+ * in drivers that cannot reliably map tx status information back to
+ * specific skbs.
+ *
+ * Calls to this function for a single hardware must be synchronized
+ * against each other. Calls to this function, ieee80211_tx_status_ni()
+ * and ieee80211_tx_status_irqsafe() may not be mixed for a single hardware.
+ *
+ * @hw: the hardware the frame was transmitted by
+ * @sta: the receiver station to which this packet is sent
+ *      (NULL for multicast packets)
+ * @info: tx status information
+ */
+void ieee80211_tx_status_noskb(struct ieee80211_hw *hw,
+                               struct ieee80211_sta *sta,
+                               struct ieee80211_tx_info *info);
+
+/**
  * ieee80211_tx_status_ni - transmit status callback (in process context)
  *
  * Like ieee80211_tx_status() but can be called in process context.
@@ -3655,7 +3851,7 @@ struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
 /**
  * ieee80211_probereq_get - retrieve a Probe Request template
  * @hw: pointer obtained from ieee80211_alloc_hw().
- * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @src_addr: source MAC address
  * @ssid: SSID buffer
  * @ssid_len: length of SSID
  * @tailroom: tailroom to reserve at end of SKB for IEs
@@ -3666,7 +3862,7 @@ struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
  * Return: The Probe Request template. %NULL on error.
  */
 struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
-                                       struct ieee80211_vif *vif,
+                                       const u8 *src_addr,
                                        const u8 *ssid, size_t ssid_len,
                                        size_t tailroom);
 
@@ -4172,6 +4368,22 @@ void ieee80211_iterate_active_interfaces_rtnl(struct ieee80211_hw *hw,
                                               void *data);
 
 /**
+ * ieee80211_iterate_stations_atomic - iterate stations
+ *
+ * This function iterates over all stations associated with a given
+ * hardware that are currently uploaded to the driver and calls the callback
+ * function for them.
+ * This function requires the iterator callback function to be atomic,
+ *
+ * @hw: the hardware struct of which the interfaces should be iterated over
+ * @iterator: the iterator function to call, cannot sleep
+ * @data: first argument of the iterator function
+ */
+void ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
+                                       void (*iterator)(void *data,
+                                                struct ieee80211_sta *sta),
+                                       void *data);
+/**
  * ieee80211_queue_work - add work onto the mac80211 workqueue
  *
  * Drivers and mac80211 use this to add work onto the mac80211 workqueue.
@@ -4480,6 +4692,14 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
                                gfp_t gfp);
 
 /**
+ * ieee80211_cqm_beacon_loss_notify - inform CQM of beacon loss
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @gfp: context flags
+ */
+void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp);
+
+/**
  * ieee80211_radar_detected - inform that a radar was detected
  *
  * @hw: pointer as obtained from ieee80211_alloc_hw()
@@ -4637,6 +4857,10 @@ struct rate_control_ops {
         void (*free_sta)(void *priv, struct ieee80211_sta *sta,
                          void *priv_sta);
 
+        void (*tx_status_noskb)(void *priv,
+                                struct ieee80211_supported_band *sband,
+                                struct ieee80211_sta *sta, void *priv_sta,
+                                struct ieee80211_tx_info *info);
         void (*tx_status)(void *priv, struct ieee80211_supported_band *sband,
                           struct ieee80211_sta *sta, void *priv_sta,
                           struct sk_buff *skb);
@@ -4888,4 +5112,69 @@ void ieee80211_update_p2p_noa(struct ieee80211_noa_data *data, u32 tsf);
 void ieee80211_tdls_oper_request(struct ieee80211_vif *vif, const u8 *peer,
                                  enum nl80211_tdls_operation oper,
                                  u16 reason_code, gfp_t gfp);
+
+/**
+ * ieee80211_reserve_tid - request to reserve a specific TID
+ *
+ * There is sometimes a need (such as in TDLS) for blocking the driver from
+ * using a specific TID so that the FW can use it for certain operations such
+ * as sending PTI requests. To make sure that the driver doesn't use that TID,
+ * this function must be called as it flushes out packets on this TID and marks
+ * it as blocked, so that any transmit for the station on this TID will be
+ * redirected to the alternative TID in the same AC.
+ *
+ * Note that this function blocks and may call back into the driver, so it
+ * should be called without driver locks held. Also note this function should
+ * only be called from the driver's @sta_state callback.
+ *
+ * @sta: the station to reserve the TID for
+ * @tid: the TID to reserve
+ *
+ * Returns: 0 on success, else on failure
+ */
+int ieee80211_reserve_tid(struct ieee80211_sta *sta, u8 tid);
+
+/**
+ * ieee80211_unreserve_tid - request to unreserve a specific TID
+ *
+ * Once there is no longer any need for reserving a certain TID, this function
+ * should be called, and no longer will packets have their TID modified for
+ * preventing use of this TID in the driver.
+ *
+ * Note that this function blocks and acquires a lock, so it should be called
+ * without driver locks held. Also note this function should only be called
+ * from the driver's @sta_state callback.
+ *
+ * @sta: the station
+ * @tid: the TID to unreserve
+ */
+void ieee80211_unreserve_tid(struct ieee80211_sta *sta, u8 tid);
+
+/**
+ * ieee80211_ie_split - split an IE buffer according to ordering
+ *
+ * @ies: the IE buffer
+ * @ielen: the length of the IE buffer
+ * @ids: an array with element IDs that are allowed before
+ *      the split
+ * @n_ids: the size of the element ID array
+ * @offset: offset where to start splitting in the buffer
+ *
+ * This function splits an IE buffer by updating the @offset
+ * variable to point to the location where the buffer should be
+ * split.
+ *
+ * It assumes that the given IE buffer is well-formed, this
+ * has to be guaranteed by the caller!
+ *
+ * It also assumes that the IEs in the buffer are ordered
+ * correctly, if not the result of using this function will not
+ * be ordered correctly either, i.e. it does no reordering.
+ *
+ * The function returns the offset where the next part of the
+ * buffer starts, which may be @ielen if the entire (remainder)
+ * of the buffer should be used.
+ */
+size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
+                          const u8 *ids, int n_ids, size_t offset);
 #endif /* MAC80211_H */
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index 2e67cdd19cdc..c823d910b46c 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -12,14 +12,12 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 #ifndef NET_MAC802154_H
 #define NET_MAC802154_H
 
 #include <net/af_ieee802154.h>
+#include <linux/ieee802154.h>
 #include <linux/skbuff.h>
 
 /* General MAC frame format:
@@ -35,13 +33,13 @@
  */
 
 /* indicates that the Short Address changed */
-#define IEEE802515_AFILT_SADDR_CHANGED          0x00000001
+#define IEEE802154_AFILT_SADDR_CHANGED          0x00000001
 /* indicates that the IEEE Address changed */
-#define IEEE802515_AFILT_IEEEADDR_CHANGED       0x00000002
+#define IEEE802154_AFILT_IEEEADDR_CHANGED       0x00000002
 /* indicates that the PAN ID changed */
-#define IEEE802515_AFILT_PANID_CHANGED          0x00000004
+#define IEEE802154_AFILT_PANID_CHANGED          0x00000004
 /* indicates that PAN Coordinator status changed */
-#define IEEE802515_AFILT_PANC_CHANGED           0x00000008
+#define IEEE802154_AFILT_PANC_CHANGED           0x00000008
 
 struct ieee802154_hw_addr_filt {
         __le16  pan_id;         /* Each independent PAN selects a unique
@@ -55,7 +53,14 @@ struct ieee802154_hw_addr_filt {
         u8      pan_coord;
 };
 
-struct ieee802154_dev {
+struct ieee802154_vif {
+        int type;
+
+        /* must be last */
+        u8 drv_priv[0] __aligned(sizeof(void *));
+};
+
+struct ieee802154_hw {
         /* filled by the driver */
         int     extra_tx_headroom;
         u32     flags;
@@ -65,6 +70,7 @@ struct ieee802154_dev {
         struct  ieee802154_hw_addr_filt hw_filt;
         void    *priv;
         struct  wpan_phy *phy;
+        size_t vif_data_size;
 };
 
 /* Checksum is in hardware and is omitted from a packet
@@ -76,28 +82,43 @@ struct ieee802154_dev {
  * however, so you are advised to review these flags carefully.
  */
 
-/* Indicates that receiver omits FCS and xmitter will add FCS on it's own. */
-#define IEEE802154_HW_OMIT_CKSUM        0x00000001
+/* Indicates that xmitter will add FCS on it's own. */
+#define IEEE802154_HW_TX_OMIT_CKSUM     0x00000001
 /* Indicates that receiver will autorespond with ACK frames. */
-#define IEEE802154_HW_AACK              0x00000002
+#define IEEE802154_HW_AACK              0x00000002
 /* Indicates that transceiver will support transmit power setting. */
-#define IEEE802154_HW_TXPOWER           0x00000004
+#define IEEE802154_HW_TXPOWER           0x00000004
 /* Indicates that transceiver will support listen before transmit. */
-#define IEEE802154_HW_LBT               0x00000008
+#define IEEE802154_HW_LBT               0x00000008
 /* Indicates that transceiver will support cca mode setting. */
-#define IEEE802154_HW_CCA_MODE          0x00000010
+#define IEEE802154_HW_CCA_MODE          0x00000010
 /* Indicates that transceiver will support cca ed level setting. */
-#define IEEE802154_HW_CCA_ED_LEVEL      0x00000020
+#define IEEE802154_HW_CCA_ED_LEVEL      0x00000020
 /* Indicates that transceiver will support csma (max_be, min_be, csma retries)
  * settings. */
-#define IEEE802154_HW_CSMA_PARAMS       0x00000040
+#define IEEE802154_HW_CSMA_PARAMS       0x00000040
 /* Indicates that transceiver will support ARET frame retries setting. */
-#define IEEE802154_HW_FRAME_RETRIES     0x00000080
+#define IEEE802154_HW_FRAME_RETRIES     0x00000080
+/* Indicates that transceiver will support hardware address filter setting. */
+#define IEEE802154_HW_AFILT             0x00000100
+/* Indicates that transceiver will support promiscuous mode setting. */
+#define IEEE802154_HW_PROMISCUOUS       0x00000200
+/* Indicates that receiver omits FCS. */
+#define IEEE802154_HW_RX_OMIT_CKSUM     0x00000400
+/* Indicates that receiver will not filter frames with bad checksum. */
+#define IEEE802154_HW_RX_DROP_BAD_CKSUM 0x00000800
+
+/* Indicates that receiver omits FCS and xmitter will add FCS on it's own. */
+#define IEEE802154_HW_OMIT_CKSUM        (IEEE802154_HW_TX_OMIT_CKSUM | \
+                                         IEEE802154_HW_RX_OMIT_CKSUM)
 
 /* This groups the most common CSMA support fields into one. */
 #define IEEE802154_HW_CSMA              (IEEE802154_HW_CCA_MODE | \
                                          IEEE802154_HW_CCA_ED_LEVEL | \
-                                         IEEE802154_HW_CSMA_PARAMS | \
+                                         IEEE802154_HW_CSMA_PARAMS)
+
+/* This groups the most common ARET support fields into one. */
+#define IEEE802154_HW_ARET              (IEEE802154_HW_CSMA | \
                                          IEEE802154_HW_FRAME_RETRIES)
 
 /* struct ieee802154_ops - callbacks from mac802154 to the driver
@@ -112,12 +133,24 @@ struct ieee802154_dev {
  * stop:  Handler that 802.15.4 module calls for device cleanup.
  *        This function is called after the last interface is removed.
  *
- * xmit:  Handler that 802.15.4 module calls for each transmitted frame.
+ * xmit_sync:
+ *        Handler that 802.15.4 module calls for each transmitted frame.
+ *        skb cntains the buffer starting from the IEEE 802.15.4 header.
+ *        The low-level driver should send the frame based on available
+ *        configuration. This is called by a workqueue and useful for
+ *        synchronous 802.15.4 drivers.
+ *        This function should return zero or negative errno.
+ *
+ *        WARNING:
+ *        This will be deprecated soon. We don't accept synced xmit callbacks
+ *        drivers anymore.
+ *
+ * xmit_async:
+ *        Handler that 802.15.4 module calls for each transmitted frame.
  *        skb cntains the buffer starting from the IEEE 802.15.4 header.
  *        The low-level driver should send the frame based on available
  *        configuration.
- *        This function should return zero or negative errno. Called with
- *        pib_lock held.
+ *        This function should return zero or negative errno.
  *
  * ed:    Handler that 802.15.4 module calls for Energy Detection.
  *        This function should place the value for detected energy
@@ -159,40 +192,75 @@ struct ieee802154_dev {
  * set_frame_retries
  *        Sets the retransmission attempt limit. Called with pib_lock held.
  *        Returns either zero, or negative errno.
+ *
+ * set_promiscuous_mode
+ *        Enables or disable promiscuous mode.
  */
 struct ieee802154_ops {
         struct module   *owner;
-        int             (*start)(struct ieee802154_dev *dev);
-        void            (*stop)(struct ieee802154_dev *dev);
-        int             (*xmit)(struct ieee802154_dev *dev,
-                                struct sk_buff *skb);
-        int             (*ed)(struct ieee802154_dev *dev, u8 *level);
-        int             (*set_channel)(struct ieee802154_dev *dev,
-                                       int page,
-                                       int channel);
-        int             (*set_hw_addr_filt)(struct ieee802154_dev *dev,
-                                          struct ieee802154_hw_addr_filt *filt,
+        int             (*start)(struct ieee802154_hw *hw);
+        void            (*stop)(struct ieee802154_hw *hw);
+        int             (*xmit_sync)(struct ieee802154_hw *hw,
+                                     struct sk_buff *skb);
+        int             (*xmit_async)(struct ieee802154_hw *hw,
+                                      struct sk_buff *skb);
+        int             (*ed)(struct ieee802154_hw *hw, u8 *level);
+        int             (*set_channel)(struct ieee802154_hw *hw, u8 page,
+                                       u8 channel);
+        int             (*set_hw_addr_filt)(struct ieee802154_hw *hw,
+                                            struct ieee802154_hw_addr_filt *filt,
                                             unsigned long changed);
-        int             (*ieee_addr)(struct ieee802154_dev *dev, __le64 addr);
-        int             (*set_txpower)(struct ieee802154_dev *dev, int db);
-        int             (*set_lbt)(struct ieee802154_dev *dev, bool on);
-        int             (*set_cca_mode)(struct ieee802154_dev *dev, u8 mode);
-        int             (*set_cca_ed_level)(struct ieee802154_dev *dev,
+        int             (*set_txpower)(struct ieee802154_hw *hw, int db);
+        int             (*set_lbt)(struct ieee802154_hw *hw, bool on);
+        int             (*set_cca_mode)(struct ieee802154_hw *hw, u8 mode);
+        int             (*set_cca_ed_level)(struct ieee802154_hw *hw,
                                             s32 level);
-        int             (*set_csma_params)(struct ieee802154_dev *dev,
+        int             (*set_csma_params)(struct ieee802154_hw *hw,
                                            u8 min_be, u8 max_be, u8 retries);
-        int             (*set_frame_retries)(struct ieee802154_dev *dev,
+        int             (*set_frame_retries)(struct ieee802154_hw *hw,
                                              s8 retries);
+        int             (*set_promiscuous_mode)(struct ieee802154_hw *hw,
+                                                const bool on);
 };
 
-/* Basic interface to register ieee802154 device */
-struct ieee802154_dev *
-ieee802154_alloc_device(size_t priv_data_len, struct ieee802154_ops *ops);
-void ieee802154_free_device(struct ieee802154_dev *dev);
-int ieee802154_register_device(struct ieee802154_dev *dev);
-void ieee802154_unregister_device(struct ieee802154_dev *dev);
+/**
+ * ieee802154_be64_to_le64 - copies and convert be64 to le64
+ * @le64_dst: le64 destination pointer
+ * @be64_src: be64 source pointer
+ */
+static inline void ieee802154_be64_to_le64(void *le64_dst, const void *be64_src)
+{
+        __le64 tmp = (__force __le64)swab64p(be64_src);
+
+        memcpy(le64_dst, &tmp, IEEE802154_EXTENDED_ADDR_LEN);
+}
 
-void ieee802154_rx_irqsafe(struct ieee802154_dev *dev, struct sk_buff *skb,
+/**
+ * ieee802154_le64_to_be64 - copies and convert le64 to be64
+ * @be64_dst: be64 destination pointer
+ * @le64_src: le64 source pointer
+ */
+static inline void ieee802154_le64_to_be64(void *be64_dst, const void *le64_src)
+{
+        __be64 tmp = (__force __be64)swab64p(le64_src);
+
+        memcpy(be64_dst, &tmp, IEEE802154_EXTENDED_ADDR_LEN);
+}
+
+/* Basic interface to register ieee802154 hwice */
+struct ieee802154_hw *
+ieee802154_alloc_hw(size_t priv_data_len, const struct ieee802154_ops *ops);
+void ieee802154_free_hw(struct ieee802154_hw *hw);
+int ieee802154_register_hw(struct ieee802154_hw *hw);
+void ieee802154_unregister_hw(struct ieee802154_hw *hw);
+
+void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb);
+void ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb,
                            u8 lqi);
 
+void ieee802154_wake_queue(struct ieee802154_hw *hw);
+void ieee802154_stop_queue(struct ieee802154_hw *hw);
+void ieee802154_xmit_complete(struct ieee802154_hw *hw, struct sk_buff *skb,
+                              bool ifs_handling);
+
 #endif /* NET_MAC802154_H */
diff --git a/include/net/mpls.h b/include/net/mpls.h
new file mode 100644
index 000000000000..5b3b5addfb08
--- /dev/null
+++ b/include/net/mpls.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2014 Nicira, Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ */
+
+#ifndef _NET_MPLS_H
+#define _NET_MPLS_H 1
+
+#include <linux/if_ether.h>
+#include <linux/netdevice.h>
+
+#define MPLS_HLEN 4
+
+static inline bool eth_p_mpls(__be16 eth_type)
+{
+        return eth_type == htons(ETH_P_MPLS_UC) ||
+                eth_type == htons(ETH_P_MPLS_MC);
+}
+
+/*
+ * For non-MPLS skbs this will correspond to the network header.
+ * For MPLS skbs it will be before the network_header as the MPLS
+ * label stack lies between the end of the mac header and the network
+ * header. That is, for MPLS skbs the end of the mac header
+ * is the top of the MPLS label stack.
+ */
+static inline unsigned char *skb_mpls_header(struct sk_buff *skb)
+{
+        return skb_mac_header(skb) + skb->mac_len;
+}
+#endif
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index f60558d0254c..eb070b3674a1 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -69,7 +69,7 @@ struct neigh_parms {
         struct net *net;
 #endif
         struct net_device *dev;
-        struct neigh_parms *next;
+        struct list_head list;
         int     (*neigh_setup)(struct neighbour *);
         void    (*neigh_cleanup)(struct neighbour *);
         struct neigh_table *tbl;
@@ -203,6 +203,7 @@ struct neigh_table {
         void                    (*proxy_redo)(struct sk_buff *skb);
         char                    *id;
         struct neigh_parms      parms;
+        struct list_head        parms_list;
         int                     gc_interval;
         int                     gc_thresh1;
         int                     gc_thresh2;
@@ -219,6 +220,13 @@ struct neigh_table {
         struct pneigh_entry     **phash_buckets;
 };
 
+enum {
+        NEIGH_ARP_TABLE = 0,
+        NEIGH_ND_TABLE = 1,
+        NEIGH_DN_TABLE = 2,
+        NEIGH_NR_TABLES,
+};
+
 static inline int neigh_parms_family(struct neigh_parms *p)
 {
         return p->tbl->family;
@@ -239,8 +247,8 @@ static inline void *neighbour_priv(const struct neighbour *n)
 #define NEIGH_UPDATE_F_ISROUTER                 0x40000000
 #define NEIGH_UPDATE_F_ADMIN                    0x80000000
 
-void neigh_table_init(struct neigh_table *tbl);
-int neigh_table_clear(struct neigh_table *tbl);
+void neigh_table_init(int index, struct neigh_table *tbl);
+int neigh_table_clear(int index, struct neigh_table *tbl);
 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
                                struct net_device *dev);
 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index c8a7db605e03..f0daed2b54d1 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -92,12 +92,18 @@ struct nf_conn {
         /* Have we seen traffic both ways yet? (bitset) */
         unsigned long status;
 
-        /* If we were expected by an expectation, this will be it */
-        struct nf_conn *master;
-
         /* Timer function; drops refcnt when it goes off. */
         struct timer_list timeout;
 
+#ifdef CONFIG_NET_NS
+        struct net *ct_net;
+#endif
+        /* all members below initialized via memset */
+        u8 __nfct_init_offset[0];
+
+        /* If we were expected by an expectation, this will be it */
+        struct nf_conn *master;
+
 #if defined(CONFIG_NF_CONNTRACK_MARK)
         u_int32_t mark;
 #endif
@@ -108,9 +114,6 @@ struct nf_conn {
 
         /* Extensions */
         struct nf_ct_ext *ext;
-#ifdef CONFIG_NET_NS
-        struct net *ct_net;
-#endif
 
         /* Storage reserved for other modules, must be the last member */
         union nf_conntrack_proto proto;
diff --git a/include/net/netfilter/nf_nat_redirect.h b/include/net/netfilter/nf_nat_redirect.h
new file mode 100644
index 000000000000..73b729543309
--- /dev/null
+++ b/include/net/netfilter/nf_nat_redirect.h
@@ -0,0 +1,12 @@
+#ifndef _NF_NAT_REDIRECT_H_
+#define _NF_NAT_REDIRECT_H_
+
+unsigned int
+nf_nat_redirect_ipv4(struct sk_buff *skb,
+                     const struct nf_nat_ipv4_multi_range_compat *mr,
+                     unsigned int hooknum);
+unsigned int
+nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
+                     unsigned int hooknum);
+
+#endif /* _NF_NAT_REDIRECT_H_ */
diff --git a/include/net/netfilter/nf_tables_bridge.h b/include/net/netfilter/nf_tables_bridge.h
new file mode 100644
index 000000000000..511fb79f6dad
--- /dev/null
+++ b/include/net/netfilter/nf_tables_bridge.h
@@ -0,0 +1,7 @@
+#ifndef _NET_NF_TABLES_BRIDGE_H
+#define _NET_NF_TABLES_BRIDGE_H
+
+int nft_bridge_iphdr_validate(struct sk_buff *skb);
+int nft_bridge_ip6hdr_validate(struct sk_buff *skb);
+
+#endif /* _NET_NF_TABLES_BRIDGE_H */
diff --git a/include/net/netfilter/nft_redir.h b/include/net/netfilter/nft_redir.h
new file mode 100644
index 000000000000..a2d67546afab
--- /dev/null
+++ b/include/net/netfilter/nft_redir.h
@@ -0,0 +1,21 @@
+#ifndef _NFT_REDIR_H_
+#define _NFT_REDIR_H_
+
+struct nft_redir {
+        enum nft_registers      sreg_proto_min:8;
+        enum nft_registers      sreg_proto_max:8;
+        u16                     flags;
+};
+
+extern const struct nla_policy nft_redir_policy[];
+
+int nft_redir_init(const struct nft_ctx *ctx,
+                   const struct nft_expr *expr,
+                   const struct nlattr * const tb[]);
+
+int nft_redir_dump(struct sk_buff *skb, const struct nft_expr *expr);
+
+int nft_redir_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
+                       const struct nft_data **data);
+
+#endif /* _NFT_REDIR_H_ */
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 7b903e1bdbbb..64158353ecb2 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -1185,4 +1185,14 @@ static inline int nla_validate_nested(const struct nlattr *start, int maxtype,
 #define nla_for_each_nested(pos, nla, rem) \
         nla_for_each_attr(pos, nla_data(nla), nla_len(nla), rem)
 
+/**
+ * nla_is_last - Test if attribute is last in stream
+ * @nla: attribute to test
+ * @rem: bytes remaining in stream
+ */
+static inline bool nla_is_last(const struct nlattr *nla, int rem)
+{
+        return nla->nla_len == rem;
+}
+
 #endif
diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
index 9da798256f0e..730d82ad6ee5 100644
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -50,8 +50,8 @@ struct netns_xfrm {
         struct list_head        policy_all;
         struct hlist_head       *policy_byidx;
         unsigned int            policy_idx_hmask;
-        struct hlist_head       policy_inexact[XFRM_POLICY_MAX * 2];
-        struct xfrm_policy_hash policy_bydst[XFRM_POLICY_MAX * 2];
+        struct hlist_head       policy_inexact[XFRM_POLICY_MAX];
+        struct xfrm_policy_hash policy_bydst[XFRM_POLICY_MAX];
         unsigned int            policy_count[XFRM_POLICY_MAX * 2];
         struct work_struct      policy_hash_work;
         struct xfrm_policy_hthresh policy_hthresh;
diff --git a/include/net/nfc/digital.h b/include/net/nfc/digital.h
index d9a5cf7ac1c4..0ae101eef0f4 100644
--- a/include/net/nfc/digital.h
+++ b/include/net/nfc/digital.h
@@ -225,6 +225,19 @@ struct nfc_digital_dev {
         u8 curr_protocol;
         u8 curr_rf_tech;
         u8 curr_nfc_dep_pni;
+        u8 did;
+
+        u8 local_payload_max;
+        u8 remote_payload_max;
+
+        struct sk_buff *chaining_skb;
+        struct digital_data_exch *data_exch;
+
+        int atn_count;
+        int nack_count;
+
+        struct sk_buff *saved_skb;
+        unsigned int saved_skb_len;
 
         u16 target_fsc;
 
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 7ee8f4cc610b..14bd0e1c47fa 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -57,10 +57,14 @@ struct nfc_hci_ops {
         int (*discover_se)(struct nfc_hci_dev *dev);
         int (*enable_se)(struct nfc_hci_dev *dev, u32 se_idx);
         int (*disable_se)(struct nfc_hci_dev *dev, u32 se_idx);
+        int (*se_io)(struct nfc_hci_dev *dev, u32 se_idx,
+                      u8 *apdu, size_t apdu_length,
+                      se_io_cb_t cb, void *cb_context);
 };
 
 /* Pipes */
 #define NFC_HCI_INVALID_PIPE    0x80
+#define NFC_HCI_DO_NOT_CREATE_PIPE      0x81
 #define NFC_HCI_LINK_MGMT_PIPE  0x00
 #define NFC_HCI_ADMIN_PIPE      0x01
 
diff --git a/include/net/nfc/nci.h b/include/net/nfc/nci.h
index 9eca9ae2280c..e7257a4653b4 100644
--- a/include/net/nfc/nci.h
+++ b/include/net/nfc/nci.h
@@ -28,6 +28,8 @@
 #ifndef __NCI_H
 #define __NCI_H
 
+#include <net/nfc/nfc.h>
+
 /* NCI constants */
 #define NCI_MAX_NUM_MAPPING_CONFIGS                             10
 #define NCI_MAX_NUM_RF_CONFIGS                                  10
@@ -73,6 +75,8 @@
 #define NCI_NFC_A_ACTIVE_LISTEN_MODE                            0x83
 #define NCI_NFC_F_ACTIVE_LISTEN_MODE                            0x85
 
+#define NCI_RF_TECH_MODE_LISTEN_MASK                            0x80
+
 /* NCI RF Technologies */
 #define NCI_NFC_RF_TECHNOLOGY_A                                 0x00
 #define NCI_NFC_RF_TECHNOLOGY_B                                 0x01
@@ -106,6 +110,17 @@
 
 /* NCI Configuration Parameter Tags */
 #define NCI_PN_ATR_REQ_GEN_BYTES                                0x29
+#define NCI_LN_ATR_RES_GEN_BYTES                                0x61
+#define NCI_LA_SEL_INFO                                         0x32
+#define NCI_LF_PROTOCOL_TYPE                                    0x50
+#define NCI_LF_CON_BITR_F                                       0x54
+
+/* NCI Configuration Parameters masks */
+#define NCI_LA_SEL_INFO_ISO_DEP_MASK                            0x20
+#define NCI_LA_SEL_INFO_NFC_DEP_MASK                            0x40
+#define NCI_LF_PROTOCOL_TYPE_NFC_DEP_MASK                       0x02
+#define NCI_LF_CON_BITR_F_212                                   0x02
+#define NCI_LF_CON_BITR_F_424                                   0x04
 
 /* NCI Reset types */
 #define NCI_RESET_TYPE_KEEP_CONFIG                              0x00
@@ -314,26 +329,31 @@ struct nci_core_intf_error_ntf {
 struct rf_tech_specific_params_nfca_poll {
         __u16   sens_res;
         __u8    nfcid1_len;     /* 0, 4, 7, or 10 Bytes */
-        __u8    nfcid1[10];
+        __u8    nfcid1[NFC_NFCID1_MAXSIZE];
         __u8    sel_res_len;    /* 0 or 1 Bytes */
         __u8    sel_res;
 } __packed;
 
 struct rf_tech_specific_params_nfcb_poll {
         __u8    sensb_res_len;
-        __u8    sensb_res[12];  /* 11 or 12 Bytes */
+        __u8    sensb_res[NFC_SENSB_RES_MAXSIZE];       /* 11 or 12 Bytes */
 } __packed;
 
 struct rf_tech_specific_params_nfcf_poll {
         __u8    bit_rate;
         __u8    sensf_res_len;
-        __u8    sensf_res[18];  /* 16 or 18 Bytes */
+        __u8    sensf_res[NFC_SENSF_RES_MAXSIZE];       /* 16 or 18 Bytes */
 } __packed;
 
 struct rf_tech_specific_params_nfcv_poll {
         __u8    res_flags;
         __u8    dsfid;
-        __u8    uid[8]; /* 8 Bytes */
+        __u8    uid[NFC_ISO15693_UID_MAXSIZE];  /* 8 Bytes */
+} __packed;
+
+struct rf_tech_specific_params_nfcf_listen {
+        __u8    local_nfcid2_len;
+        __u8    local_nfcid2[NFC_NFCID2_MAXSIZE];       /* 0 or 8 Bytes */
 } __packed;
 
 struct nci_rf_discover_ntf {
@@ -365,7 +385,12 @@ struct activation_params_nfcb_poll_iso_dep {
 
 struct activation_params_poll_nfc_dep {
         __u8    atr_res_len;
-        __u8    atr_res[63];
+        __u8    atr_res[NFC_ATR_RES_MAXSIZE - 2]; /* ATR_RES from byte 3 */
+};
+
+struct activation_params_listen_nfc_dep {
+        __u8    atr_req_len;
+        __u8    atr_req[NFC_ATR_REQ_MAXSIZE - 2]; /* ATR_REQ from byte 3 */
 };
 
 struct nci_rf_intf_activated_ntf {
@@ -382,6 +407,7 @@ struct nci_rf_intf_activated_ntf {
                 struct rf_tech_specific_params_nfcb_poll nfcb_poll;
                 struct rf_tech_specific_params_nfcf_poll nfcf_poll;
                 struct rf_tech_specific_params_nfcv_poll nfcv_poll;
+                struct rf_tech_specific_params_nfcf_listen nfcf_listen;
         } rf_tech_specific_params;
 
         __u8    data_exch_rf_tech_and_mode;
@@ -393,6 +419,7 @@ struct nci_rf_intf_activated_ntf {
                 struct activation_params_nfca_poll_iso_dep nfca_poll_iso_dep;
                 struct activation_params_nfcb_poll_iso_dep nfcb_poll_iso_dep;
                 struct activation_params_poll_nfc_dep poll_nfc_dep;
+                struct activation_params_listen_nfc_dep listen_nfc_dep;
         } activation_params;
 
 } __packed;
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 75d10e625c49..9e51bb4d841e 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -4,6 +4,7 @@
  *
  *  Copyright (C) 2011 Texas Instruments, Inc.
  *  Copyright (C) 2013 Intel Corporation. All rights reserved.
+ *  Copyright (C) 2014 Marvell International Ltd.
  *
  *  Written by Ilan Elias <ilane@ti.com>
  *
@@ -49,6 +50,8 @@ enum nci_state {
         NCI_W4_ALL_DISCOVERIES,
         NCI_W4_HOST_SELECT,
         NCI_POLL_ACTIVE,
+        NCI_LISTEN_ACTIVE,
+        NCI_LISTEN_SLEEP,
 };
 
 /* NCI timeouts */
@@ -69,6 +72,12 @@ struct nci_ops {
         int   (*send)(struct nci_dev *ndev, struct sk_buff *skb);
         int   (*setup)(struct nci_dev *ndev);
         __u32 (*get_rfprotocol)(struct nci_dev *ndev, __u8 rf_protocol);
+        int   (*discover_se)(struct nci_dev *ndev);
+        int   (*disable_se)(struct nci_dev *ndev, u32 se_idx);
+        int   (*enable_se)(struct nci_dev *ndev, u32 se_idx);
+        int   (*se_io)(struct nci_dev *ndev, u32 se_idx,
+                                u8 *apdu, size_t apdu_length,
+                                se_io_cb_t cb, void *cb_context);
 };
 
 #define NCI_MAX_SUPPORTED_RF_INTERFACES         4
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 6c583e244de2..12adb817c27a 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2011 Instituto Nokia de Tecnologia
+ * Copyright (C) 2014 Marvell International Ltd.
  *
  * Authors:
  *    Lauro Ramos Venancio <lauro.venancio@openbossa.org>
@@ -87,6 +88,7 @@ struct nfc_ops {
 #define NFC_TARGET_IDX_ANY -1
 #define NFC_MAX_GT_LEN 48
 #define NFC_ATR_RES_GT_OFFSET 15
+#define NFC_ATR_REQ_GT_OFFSET 14
 
 /**
  * struct nfc_target - NFC target descriptiom
diff --git a/include/net/nl802154.h b/include/net/nl802154.h
index b23548e04098..6dbd406ca41b 100644
--- a/include/net/nl802154.h
+++ b/include/net/nl802154.h
@@ -1,126 +1,122 @@
+#ifndef __NL802154_H
+#define __NL802154_H
 /*
- * nl802154.h
+ * 802.15.4 netlink interface public header
  *
- * Copyright (C) 2007, 2008, 2009 Siemens AG
+ * Copyright 2014 Alexander Aring <aar@pengutronix.de>
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation.
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
  *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
  */
 
-#ifndef IEEE802154_NL_H
-#define IEEE802154_NL_H
+#define NL802154_GENL_NAME "nl802154"
 
-struct net_device;
-struct ieee802154_addr;
+enum nl802154_commands {
+/* don't change the order or add anything between, this is ABI! */
+/* currently we don't shipping this file via uapi, ignore the above one */
+        NL802154_CMD_UNSPEC,
 
-/**
- * ieee802154_nl_assoc_indic - Notify userland of an association request.
- * @dev: The network device on which this association request was
- *       received.
- * @addr: The address of the device requesting association.
- * @cap: The capability information field from the device.
- *
- * This informs a userland coordinator of a device requesting to
- * associate with the PAN controlled by the coordinator.
- *
- * Note: This is in section 7.3.1 of the IEEE 802.15.4-2006 document.
- */
-int ieee802154_nl_assoc_indic(struct net_device *dev,
-                struct ieee802154_addr *addr, u8 cap);
-
-/**
- * ieee802154_nl_assoc_confirm - Notify userland of association.
- * @dev: The device which has completed association.
- * @short_addr: The short address assigned to the device.
- * @status: The status of the association.
- *
- * Inform userland of the result of an association request. If the
- * association request included asking the coordinator to allocate
- * a short address then it is returned in @short_addr.
- *
- * Note: This is in section 7.3.2 of the IEEE 802.15.4 document.
- */
-int ieee802154_nl_assoc_confirm(struct net_device *dev,
-                __le16 short_addr, u8 status);
-
-/**
- * ieee802154_nl_disassoc_indic - Notify userland of disassociation.
- * @dev: The device on which disassociation was indicated.
- * @addr: The device which is disassociating.
- * @reason: The reason for the disassociation.
- *
- * Inform userland that a device has disassociated from the network.
- *
- * Note: This is in section 7.3.3 of the IEEE 802.15.4 document.
- */
-int ieee802154_nl_disassoc_indic(struct net_device *dev,
-                struct ieee802154_addr *addr, u8 reason);
-
-/**
- * ieee802154_nl_disassoc_confirm - Notify userland of disassociation
- * completion.
- * @dev: The device on which disassociation was ordered.
- * @status: The result of the disassociation.
- *
- * Inform userland of the result of requesting that a device
- * disassociate, or the result of requesting that we disassociate from
- * a PAN managed by another coordinator.
- *
- * Note: This is in section 7.1.4.3 of the IEEE 802.15.4 document.
- */
-int ieee802154_nl_disassoc_confirm(struct net_device *dev,
-                u8 status);
-
-/**
- * ieee802154_nl_scan_confirm - Notify userland of completion of scan.
- * @dev: The device which was instructed to scan.
- * @status: The status of the scan operation.
- * @scan_type: What type of scan was performed.
- * @unscanned: Any channels that the device was unable to scan.
- * @edl: The energy levels (if a passive scan).
- *
- *
- * Note: This is in section 7.1.11 of the IEEE 802.15.4 document.
- * Note: This API does not permit the return of an active scan result.
- */
-int ieee802154_nl_scan_confirm(struct net_device *dev,
-                u8 status, u8 scan_type, u32 unscanned, u8 page,
-                u8 *edl/*, struct list_head *pan_desc_list */);
-
-/**
- * ieee802154_nl_beacon_indic - Notify userland of a received beacon.
- * @dev: The device on which a beacon was received.
- * @panid: The PAN of the coordinator.
- * @coord_addr: The short address of the coordinator on that PAN.
- *
- * Note: This is in section 7.1.5 of the IEEE 802.15.4 document.
- * Note: This API does not provide extended information such as what
- * channel the PAN is on or what the LQI of the beacon frame was on
- * receipt.
- * Note: This API cannot indicate a beacon frame for a coordinator
- *       operating in long addressing mode.
- */
-int ieee802154_nl_beacon_indic(struct net_device *dev, __le16 panid,
-                __le16 coord_addr);
+        NL802154_CMD_GET_WPAN_PHY,              /* can dump */
+        NL802154_CMD_SET_WPAN_PHY,
+        NL802154_CMD_NEW_WPAN_PHY,
+        NL802154_CMD_DEL_WPAN_PHY,
 
-/**
- * ieee802154_nl_start_confirm - Notify userland of completion of start.
- * @dev: The device which was instructed to scan.
- * @status: The status of the scan operation.
- *
- * Note: This is in section 7.1.14 of the IEEE 802.15.4 document.
- */
-int ieee802154_nl_start_confirm(struct net_device *dev, u8 status);
+        NL802154_CMD_GET_INTERFACE,             /* can dump */
+        NL802154_CMD_SET_INTERFACE,
+        NL802154_CMD_NEW_INTERFACE,
+        NL802154_CMD_DEL_INTERFACE,
+
+        NL802154_CMD_SET_CHANNEL,
+
+        NL802154_CMD_SET_PAN_ID,
+        NL802154_CMD_SET_SHORT_ADDR,
+
+        NL802154_CMD_SET_TX_POWER,
+        NL802154_CMD_SET_CCA_MODE,
+        NL802154_CMD_SET_CCA_ED_LEVEL,
+
+        NL802154_CMD_SET_MAX_FRAME_RETRIES,
+
+        NL802154_CMD_SET_BACKOFF_EXPONENT,
+        NL802154_CMD_SET_MAX_CSMA_BACKOFFS,
+
+        NL802154_CMD_SET_LBT_MODE,
+
+        /* add new commands above here */
+
+        /* used to define NL802154_CMD_MAX below */
+        __NL802154_CMD_AFTER_LAST,
+        NL802154_CMD_MAX = __NL802154_CMD_AFTER_LAST - 1
+};
+
+enum nl802154_attrs {
+/* don't change the order or add anything between, this is ABI! */
+/* currently we don't shipping this file via uapi, ignore the above one */
+        NL802154_ATTR_UNSPEC,
+
+        NL802154_ATTR_WPAN_PHY,
+        NL802154_ATTR_WPAN_PHY_NAME,
+
+        NL802154_ATTR_IFINDEX,
+        NL802154_ATTR_IFNAME,
+        NL802154_ATTR_IFTYPE,
+
+        NL802154_ATTR_WPAN_DEV,
+
+        NL802154_ATTR_PAGE,
+        NL802154_ATTR_CHANNEL,
+
+        NL802154_ATTR_PAN_ID,
+        NL802154_ATTR_SHORT_ADDR,
+
+        NL802154_ATTR_TX_POWER,
+
+        NL802154_ATTR_CCA_MODE,
+        NL802154_ATTR_CCA_MODE3_AND,
+        NL802154_ATTR_CCA_ED_LEVEL,
+
+        NL802154_ATTR_MAX_FRAME_RETRIES,
+
+        NL802154_ATTR_MAX_BE,
+        NL802154_ATTR_MIN_BE,
+        NL802154_ATTR_MAX_CSMA_BACKOFFS,
+
+        NL802154_ATTR_LBT_MODE,
+
+        NL802154_ATTR_GENERATION,
+
+        NL802154_ATTR_CHANNELS_SUPPORTED,
+        NL802154_ATTR_SUPPORTED_CHANNEL,
+
+        NL802154_ATTR_EXTENDED_ADDR,
+
+        /* add attributes here, update the policy in nl802154.c */
+
+        __NL802154_ATTR_AFTER_LAST,
+        NL802154_ATTR_MAX = __NL802154_ATTR_AFTER_LAST - 1
+};
+
+enum nl802154_iftype {
+        /* for backwards compatibility TODO */
+        NL802154_IFTYPE_UNSPEC = -1,
+
+        NL802154_IFTYPE_NODE,
+        NL802154_IFTYPE_MONITOR,
+        NL802154_IFTYPE_COORD,
+
+        /* keep last */
+        NUM_NL802154_IFTYPES,
+        NL802154_IFTYPE_MAX = NUM_NL802154_IFTYPES - 1
+};
 
-#endif
+#endif /* __NL802154_H */
diff --git a/include/net/ping.h b/include/net/ping.h
index 026479b61a2d..f074060bc5de 100644
--- a/include/net/ping.h
+++ b/include/net/ping.h
@@ -82,7 +82,7 @@ int  ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
 int  ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                      size_t len);
 int  ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
-void ping_rcv(struct sk_buff *skb);
+bool ping_rcv(struct sk_buff *skb);
 
 #ifdef CONFIG_PROC_FS
 struct ping_seq_afinfo {
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index dad7ab20a8cb..b776d72d84be 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -136,6 +136,17 @@ struct regulatory_request {
  *      otherwise initiating radiation is not allowed. This will enable the
  *      relaxations enabled under the CFG80211_REG_RELAX_NO_IR configuration
  *      option
+ * @REGULATORY_IGNORE_STALE_KICKOFF: the regulatory core will _not_ make sure
+ *      all interfaces on this wiphy reside on allowed channels. If this flag
+ *      is not set, upon a regdomain change, the interfaces are given a grace
+ *      period (currently 60 seconds) to disconnect or move to an allowed
+ *      channel. Interfaces on forbidden channels are forcibly disconnected.
+ *      Currently these types of interfaces are supported for enforcement:
+ *      NL80211_IFTYPE_ADHOC, NL80211_IFTYPE_STATION, NL80211_IFTYPE_AP,
+ *      NL80211_IFTYPE_AP_VLAN, NL80211_IFTYPE_MONITOR,
+ *      NL80211_IFTYPE_P2P_CLIENT, NL80211_IFTYPE_P2P_GO,
+ *      NL80211_IFTYPE_P2P_DEVICE. The flag will be set by default if a device
+ *      includes any modes unsupported for enforcement checking.
  */
 enum ieee80211_regulatory_flags {
         REGULATORY_CUSTOM_REG                   = BIT(0),
@@ -144,6 +155,7 @@ enum ieee80211_regulatory_flags {
         REGULATORY_COUNTRY_IE_FOLLOW_POWER      = BIT(3),
         REGULATORY_COUNTRY_IE_IGNORE            = BIT(4),
         REGULATORY_ENABLE_RELAX_NO_IR           = BIT(5),
+        REGULATORY_IGNORE_STALE_KICKOFF         = BIT(6),
 };
 
 struct ieee80211_freq_range {
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index d17ed6fb2f70..3d282cbb66bf 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -219,7 +219,6 @@ struct tcf_proto_ops {
         void                    (*destroy)(struct tcf_proto*);
 
         unsigned long           (*get)(struct tcf_proto*, u32 handle);
-        void                    (*put)(struct tcf_proto*, unsigned long);
         int                     (*change)(struct net *net, struct sk_buff *,
                                         struct tcf_proto*, unsigned long,
                                         u32 handle, struct nlattr **,
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 72a31db47ded..487ef34bbd63 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -219,7 +219,7 @@ struct sctp_chunk *sctp_make_abort_no_data(const struct sctp_association *,
                                       const struct sctp_chunk *,
                                       __u32 tsn);
 struct sctp_chunk *sctp_make_abort_user(const struct sctp_association *,
-                                        const struct msghdr *, size_t msg_len);
+                                        struct msghdr *, size_t msg_len);
 struct sctp_chunk *sctp_make_abort_violation(const struct sctp_association *,
                                    const struct sctp_chunk *,
                                    const __u8 *,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 4ff3f67be62c..2bb2fcf5b11f 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -531,7 +531,7 @@ struct sctp_datamsg {
 
 struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *,
                                             struct sctp_sndrcvinfo *,
-                                            struct msghdr *, int len);
+                                            struct iov_iter *);
 void sctp_datamsg_free(struct sctp_datamsg *);
 void sctp_datamsg_put(struct sctp_datamsg *);
 void sctp_chunk_fail(struct sctp_chunk *, int error);
@@ -647,8 +647,8 @@ struct sctp_chunk {
 
 void sctp_chunk_hold(struct sctp_chunk *);
 void sctp_chunk_put(struct sctp_chunk *);
-int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
-                          struct iovec *data);
+int sctp_user_addto_chunk(struct sctp_chunk *chunk, int len,
+                          struct iov_iter *from);
 void sctp_chunk_free(struct sctp_chunk *);
 void  *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data);
 struct sctp_chunk *sctp_chunkify(struct sk_buff *,
@@ -1116,7 +1116,6 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw, int len,
 sctp_scope_t sctp_scope(const union sctp_addr *);
 int sctp_in_scope(struct net *net, const union sctp_addr *addr, const sctp_scope_t scope);
 int sctp_is_any(struct sock *sk, const union sctp_addr *addr);
-int sctp_addr_is_valid(const union sctp_addr *addr);
 int sctp_is_ep_boundall(struct sock *sk);
 
 
diff --git a/include/net/sock.h b/include/net/sock.h
index 7ff44e062a38..c3e83c9a8ab8 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -273,6 +273,7 @@ struct cg_proto;
   *     @sk_rcvtimeo: %SO_RCVTIMEO setting
   *     @sk_sndtimeo: %SO_SNDTIMEO setting
   *     @sk_rxhash: flow hash received from netif layer
+  *     @sk_incoming_cpu: record cpu processing incoming packets
   *     @sk_txhash: computed flow hash for use on transmit
   *     @sk_filter: socket filtering instructions
   *     @sk_protinfo: private area, net family specific, when not using slab
@@ -350,6 +351,12 @@ struct sock {
 #ifdef CONFIG_RPS
         __u32                   sk_rxhash;
 #endif
+        u16                     sk_incoming_cpu;
+        /* 16bit hole
+         * Warned : sk_incoming_cpu can be set from softirq,
+         * Do not use this hole without fully understanding possible issues.
+         */
+
         __u32                   sk_txhash;
 #ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned int            sk_napi_id;
@@ -833,6 +840,11 @@ static inline int sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
         return sk->sk_backlog_rcv(sk, skb);
 }
 
+static inline void sk_incoming_cpu_update(struct sock *sk)
+{
+        sk->sk_incoming_cpu = raw_smp_processor_id();
+}
+
 static inline void sock_rps_record_flow_hash(__u32 hash)
 {
 #ifdef CONFIG_RPS
@@ -1865,29 +1877,6 @@ static inline int skb_copy_to_page_nocache(struct sock *sk, char __user *from,
         return 0;
 }
 
-static inline int skb_copy_to_page(struct sock *sk, char __user *from,
-                                   struct sk_buff *skb, struct page *page,
-                                   int off, int copy)
-{
-        if (skb->ip_summed == CHECKSUM_NONE) {
-                int err = 0;
-                __wsum csum = csum_and_copy_from_user(from,
-                                                     page_address(page) + off,
-                                                            copy, 0, &err);
-                if (err)
-                        return err;
-                skb->csum = csum_block_add(skb->csum, csum, skb->len);
-        } else if (copy_from_user(page_address(page) + off, from, copy))
-                return -EFAULT;
-
-        skb->len             += copy;
-        skb->data_len        += copy;
-        skb->truesize        += copy;
-        sk->sk_wmem_queued   += copy;
-        sk_mem_charge(sk, copy);
-        return 0;
-}
-
 /**
  * sk_wmem_alloc_get - returns write allocations
  * @sk: socket
@@ -2269,16 +2258,6 @@ bool sk_ns_capable(const struct sock *sk,
 bool sk_capable(const struct sock *sk, int cap);
 bool sk_net_capable(const struct sock *sk, int cap);
 
-/*
- *      Enable debug/info messages
- */
-extern int net_msg_warn;
-#define NETDEBUG(fmt, args...) \
-        do { if (net_msg_warn) printk(fmt,##args); } while (0)
-
-#define LIMIT_NETDEBUG(fmt, args...) \
-        do { if (net_msg_warn && net_ratelimit()) printk(fmt,##args); } while(0)
-
 extern __u32 sysctl_wmem_max;
 extern __u32 sysctl_rmem_max;
 
diff --git a/include/net/switchdev.h b/include/net/switchdev.h
new file mode 100644
index 000000000000..8a6d1641fd9b
--- /dev/null
+++ b/include/net/switchdev.h
@@ -0,0 +1,37 @@
+/*
+ * include/net/switchdev.h - Switch device API
+ * Copyright (c) 2014 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#ifndef _LINUX_SWITCHDEV_H_
+#define _LINUX_SWITCHDEV_H_
+
+#include <linux/netdevice.h>
+
+#ifdef CONFIG_NET_SWITCHDEV
+
+int netdev_switch_parent_id_get(struct net_device *dev,
+                                struct netdev_phys_item_id *psid);
+int netdev_switch_port_stp_update(struct net_device *dev, u8 state);
+
+#else
+
+static inline int netdev_switch_parent_id_get(struct net_device *dev,
+                                              struct netdev_phys_item_id *psid)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int netdev_switch_port_stp_update(struct net_device *dev,
+                                                u8 state)
+{
+        return -EOPNOTSUPP;
+}
+
+#endif
+
+#endif /* _LINUX_SWITCHDEV_H_ */
diff --git a/include/net/tc_act/tc_vlan.h b/include/net/tc_act/tc_vlan.h
new file mode 100644
index 000000000000..93b70ade1ff3
--- /dev/null
+++ b/include/net/tc_act/tc_vlan.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2014 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __NET_TC_VLAN_H
+#define __NET_TC_VLAN_H
+
+#include <net/act_api.h>
+
+#define VLAN_F_POP              0x1
+#define VLAN_F_PUSH             0x2
+
+struct tcf_vlan {
+        struct tcf_common       common;
+        int                     tcfv_action;
+        u16                     tcfv_push_vid;
+        __be16                  tcfv_push_proto;
+};
+#define to_vlan(a) \
+        container_of(a->priv, struct tcf_vlan, common)
+
+#endif /* __NET_TC_VLAN_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 4062b4f0d121..f50f29faf76f 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -55,9 +55,9 @@ void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define MAX_TCP_HEADER  (128 + MAX_HEADER)
 #define MAX_TCP_OPTION_SPACE 40
 
-/* 
+/*
  * Never offer a window over 32767 without using window scaling. Some
- * poor stacks do signed 16bit maths! 
+ * poor stacks do signed 16bit maths!
  */
 #define MAX_TCP_WINDOW          32767U
 
@@ -70,9 +70,6 @@ void tcp_time_wait(struct sock *sk, int state, int timeo);
 /* After receiving this amount of duplicate ACKs fast retransmit starts. */
 #define TCP_FASTRETRANS_THRESH 3
 
-/* Maximal reordering. */
-#define TCP_MAX_REORDERING      127
-
 /* Maximal number of ACKs sent quickly to accelerate slow-start. */
 #define TCP_MAX_QUICKACKS       16U
 
@@ -167,7 +164,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo);
 /*
  *      TCP option
  */
- 
+
 #define TCPOPT_NOP              1       /* Padding */
 #define TCPOPT_EOL              0       /* End of options */
 #define TCPOPT_MSS              2       /* Segment size negotiating */
@@ -252,6 +249,7 @@ extern int sysctl_tcp_abort_on_overflow;
 extern int sysctl_tcp_max_orphans;
 extern int sysctl_tcp_fack;
 extern int sysctl_tcp_reordering;
+extern int sysctl_tcp_max_reordering;
 extern int sysctl_tcp_dsack;
 extern long sysctl_tcp_mem[3];
 extern int sysctl_tcp_wmem[3];
@@ -492,17 +490,16 @@ u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
                               u16 *mssp);
 __u32 cookie_v4_init_sequence(struct sock *sk, const struct sk_buff *skb,
                               __u16 *mss);
-#endif
-
 __u32 cookie_init_timestamp(struct request_sock *req);
-bool cookie_check_timestamp(struct tcp_options_received *opt, struct net *net,
-                            bool *ecn_ok);
+bool cookie_timestamp_decode(struct tcp_options_received *opt);
+bool cookie_ecn_ok(const struct tcp_options_received *opt,
+                   const struct net *net, const struct dst_entry *dst);
 
 /* From net/ipv6/syncookies.c */
 int __cookie_v6_check(const struct ipv6hdr *iph, const struct tcphdr *th,
                       u32 cookie);
 struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb);
-#ifdef CONFIG_SYN_COOKIES
+
 u32 __cookie_v6_init_sequence(const struct ipv6hdr *iph,
                               const struct tcphdr *th, u16 *mssp);
 __u32 cookie_v6_init_sequence(struct sock *sk, const struct sk_buff *skb,
@@ -1104,16 +1101,16 @@ static inline int tcp_win_from_space(int space)
                 space - (space>>sysctl_tcp_adv_win_scale);
 }
 
-/* Note: caller must be prepared to deal with negative returns */ 
+/* Note: caller must be prepared to deal with negative returns */
 static inline int tcp_space(const struct sock *sk)
 {
         return tcp_win_from_space(sk->sk_rcvbuf -
                                   atomic_read(&sk->sk_rmem_alloc));
-} 
+}
 
 static inline int tcp_full_space(const struct sock *sk)
 {
-        return tcp_win_from_space(sk->sk_rcvbuf); 
+        return tcp_win_from_space(sk->sk_rcvbuf);
 }
 
 static inline void tcp_openreq_init(struct request_sock *req,
diff --git a/include/net/udplite.h b/include/net/udplite.h
index 2caadabcd07b..ae7c8d1fbcad 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -19,7 +19,9 @@ extern struct udp_table		udplite_table;
 static __inline__ int udplite_getfrag(void *from, char *to, int  offset,
                                       int len, int odd, struct sk_buff *skb)
 {
-        return memcpy_fromiovecend(to, (struct iovec *) from, offset, len);
+        struct msghdr *msg = from;
+        /* XXX: stripping const */
+        return memcpy_fromiovecend(to, (struct iovec *)msg->msg_iter.iov, offset, len);
 }
 
 /* Designate sk as UDP-Lite socket */
@@ -40,7 +42,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
          * checksum. UDP-Lite (like IPv6) mandates checksums, hence packets
          * with a zero checksum field are illegal.                            */
         if (uh->check == 0) {
-                LIMIT_NETDEBUG(KERN_DEBUG "UDPLite: zeroed checksum field\n");
+                net_dbg_ratelimited("UDPLite: zeroed checksum field\n");
                 return 1;
         }
 
@@ -52,8 +54,8 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
                 /*
                  * Coverage length violates RFC 3828: log and discard silently.
                  */
-                LIMIT_NETDEBUG(KERN_DEBUG "UDPLite: bad csum coverage %d/%d\n",
-                               cscov, skb->len);
+                net_dbg_ratelimited("UDPLite: bad csum coverage %d/%d\n",
+                                    cscov, skb->len);
                 return 1;
 
         } else if (cscov < skb->len) {
diff --git a/include/net/wpan-phy.h b/include/net/wpan-phy.h
deleted file mode 100644
index 10ab0fc6d4f7..000000000000
--- a/include/net/wpan-phy.h
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright (C) 2007, 2008, 2009 Siemens AG
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- * Written by:
- * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
- */
-
-#ifndef WPAN_PHY_H
-#define WPAN_PHY_H
-
-#include <linux/netdevice.h>
-#include <linux/mutex.h>
-#include <linux/bug.h>
-
-/* According to the IEEE 802.15.4 stadard the upper most significant bits of
- * the 32-bit channel bitmaps shall be used as an integer value to specify 32
- * possible channel pages. The lower 27 bits of the channel bit map shall be
- * used as a bit mask to specify channel numbers within a channel page.
- */
-#define WPAN_NUM_CHANNELS       27
-#define WPAN_NUM_PAGES          32
-
-struct wpan_phy {
-        struct mutex pib_lock;
-
-        /*
-         * This is a PIB according to 802.15.4-2011.
-         * We do not provide timing-related variables, as they
-         * aren't used outside of driver
-         */
-        u8 current_channel;
-        u8 current_page;
-        u32 channels_supported[32];
-        s8 transmit_power;
-        u8 cca_mode;
-        u8 min_be;
-        u8 max_be;
-        u8 csma_retries;
-        s8 frame_retries;
-
-        bool lbt;
-        s32 cca_ed_level;
-
-        struct device dev;
-        int idx;
-
-        struct net_device *(*add_iface)(struct wpan_phy *phy,
-                                        const char *name, int type);
-        void (*del_iface)(struct wpan_phy *phy, struct net_device *dev);
-
-        int (*set_txpower)(struct wpan_phy *phy, int db);
-        int (*set_lbt)(struct wpan_phy *phy, bool on);
-        int (*set_cca_mode)(struct wpan_phy *phy, u8 cca_mode);
-        int (*set_cca_ed_level)(struct wpan_phy *phy, int level);
-        int (*set_csma_params)(struct wpan_phy *phy, u8 min_be, u8 max_be,
-                               u8 retries);
-        int (*set_frame_retries)(struct wpan_phy *phy, s8 retries);
-
-        char priv[0] __attribute__((__aligned__(NETDEV_ALIGN)));
-};
-
-#define to_phy(_dev)    container_of(_dev, struct wpan_phy, dev)
-
-struct wpan_phy *wpan_phy_alloc(size_t priv_size);
-static inline void wpan_phy_set_dev(struct wpan_phy *phy, struct device *dev)
-{
-        phy->dev.parent = dev;
-}
-int wpan_phy_register(struct wpan_phy *phy);
-void wpan_phy_unregister(struct wpan_phy *phy);
-void wpan_phy_free(struct wpan_phy *phy);
-/* Same semantics as for class_for_each_device */
-int wpan_phy_for_each(int (*fn)(struct wpan_phy *phy, void *data), void *data);
-
-static inline void *wpan_phy_priv(struct wpan_phy *phy)
-{
-        BUG_ON(!phy);
-        return &phy->priv;
-}
-
-struct wpan_phy *wpan_phy_find(const char *str);
-
-static inline void wpan_phy_put(struct wpan_phy *phy)
-{
-        put_device(&phy->dev);
-}
-
-static inline const char *wpan_phy_name(struct wpan_phy *phy)
-{
-        return dev_name(&phy->dev);
-}
-#endif
diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index ea0796bdcf88..5c15c2a5c123 100644
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h
@@ -82,4 +82,9 @@
 
 #define SO_BPF_EXTENSIONS       48
 
+#define SO_INCOMING_CPU         49
+
+#define SO_ATTACH_BPF           50
+#define SO_DETACH_BPF           SO_DETACH_FILTER
+
 #endif /* __ASM_GENERIC_SOCKET_H */
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index c54fcb5993c3..d8e1716707ba 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -37,27 +37,27 @@ header-y += aio_abi.h
 header-y += apm_bios.h
 header-y += arcfb.h
 header-y += atalk.h
-header-y += atm.h
-header-y += atm_eni.h
-header-y += atm_he.h
-header-y += atm_idt77105.h
-header-y += atm_nicstar.h
-header-y += atm_tcp.h
-header-y += atm_zatm.h
 header-y += atmapi.h
 header-y += atmarp.h
 header-y += atmbr2684.h
 header-y += atmclip.h
 header-y += atmdev.h
+header-y += atm_eni.h
+header-y += atm.h
+header-y += atm_he.h
+header-y += atm_idt77105.h
 header-y += atmioc.h
 header-y += atmlec.h
 header-y += atmmpc.h
+header-y += atm_nicstar.h
 header-y += atmppp.h
 header-y += atmsap.h
 header-y += atmsvc.h
+header-y += atm_tcp.h
+header-y += atm_zatm.h
 header-y += audit.h
-header-y += auto_fs.h
 header-y += auto_fs4.h
+header-y += auto_fs.h
 header-y += auxvec.h
 header-y += ax25.h
 header-y += b1lli.h
@@ -67,8 +67,8 @@ header-y += bfs_fs.h
 header-y += binfmts.h
 header-y += blkpg.h
 header-y += blktrace_api.h
-header-y += bpf.h
 header-y += bpf_common.h
+header-y += bpf.h
 header-y += bpqether.h
 header-y += bsg.h
 header-y += btrfs.h
@@ -93,21 +93,21 @@ header-y += cyclades.h
 header-y += cycx_cfm.h
 header-y += dcbnl.h
 header-y += dccp.h
-header-y += dlm.h
+header-y += dlmconstants.h
 header-y += dlm_device.h
+header-y += dlm.h
 header-y += dlm_netlink.h
 header-y += dlm_plock.h
-header-y += dlmconstants.h
 header-y += dm-ioctl.h
 header-y += dm-log-userspace.h
 header-y += dn.h
 header-y += dqblk_xfs.h
 header-y += edd.h
 header-y += efs_fs_sb.h
+header-y += elfcore.h
 header-y += elf-em.h
 header-y += elf-fdpic.h
 header-y += elf.h
-header-y += elfcore.h
 header-y += errno.h
 header-y += errqueue.h
 header-y += ethtool.h
@@ -131,15 +131,15 @@ header-y += fsl_hypervisor.h
 header-y += fuse.h
 header-y += futex.h
 header-y += gameport.h
-header-y += gen_stats.h
 header-y += genetlink.h
+header-y += gen_stats.h
 header-y += gfs2_ondisk.h
 header-y += gigaset_dev.h
-header-y += hdlc.h
 header-y += hdlcdrv.h
+header-y += hdlc.h
 header-y += hdreg.h
-header-y += hid.h
 header-y += hiddev.h
+header-y += hid.h
 header-y += hidraw.h
 header-y += hpet.h
 header-y += hsr_netlink.h
@@ -151,7 +151,6 @@ header-y += i2o-dev.h
 header-y += i8k.h
 header-y += icmp.h
 header-y += icmpv6.h
-header-y += if.h
 header-y += if_addr.h
 header-y += if_addrlabel.h
 header-y += if_alg.h
@@ -165,6 +164,7 @@ header-y += if_ether.h
 header-y += if_fc.h
 header-y += if_fddi.h
 header-y += if_frad.h
+header-y += if.h
 header-y += if_hippi.h
 header-y += if_infiniband.h
 header-y += if_link.h
@@ -182,40 +182,40 @@ header-y += if_tunnel.h
 header-y += if_vlan.h
 header-y += if_x25.h
 header-y += igmp.h
-header-y += in.h
 header-y += in6.h
-header-y += in_route.h
 header-y += inet_diag.h
+header-y += in.h
 header-y += inotify.h
 header-y += input.h
+header-y += in_route.h
 header-y += ioctl.h
-header-y += ip.h
 header-y += ip6_tunnel.h
-header-y += ip_vs.h
 header-y += ipc.h
+header-y += ip.h
 header-y += ipmi.h
 header-y += ipmi_msgdefs.h
 header-y += ipsec.h
 header-y += ipv6.h
 header-y += ipv6_route.h
+header-y += ip_vs.h
 header-y += ipx.h
 header-y += irda.h
 header-y += irqnr.h
-header-y += isdn.h
 header-y += isdn_divertif.h
-header-y += isdn_ppp.h
+header-y += isdn.h
 header-y += isdnif.h
+header-y += isdn_ppp.h
 header-y += iso_fs.h
-header-y += ivtv.h
 header-y += ivtvfb.h
+header-y += ivtv.h
 header-y += ixjuser.h
 header-y += jffs2.h
 header-y += joystick.h
-header-y += kd.h
 header-y += kdev_t.h
-header-y += kernel-page-flags.h
-header-y += kernel.h
+header-y += kd.h
 header-y += kernelcapi.h
+header-y += kernel.h
+header-y += kernel-page-flags.h
 header-y += kexec.h
 header-y += keyboard.h
 header-y += keyctl.h
@@ -231,6 +231,7 @@ ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/include/uapi/asm/kvm_para.h \
 header-y += kvm_para.h
 endif
 
+header-y += hw_breakpoint.h
 header-y += l2tp.h
 header-y += libc-compat.h
 header-y += limits.h
@@ -256,43 +257,43 @@ header-y += mman.h
 header-y += mmtimer.h
 header-y += mpls.h
 header-y += mqueue.h
-header-y += mroute.h
 header-y += mroute6.h
+header-y += mroute.h
 header-y += msdos_fs.h
 header-y += msg.h
 header-y += mtio.h
-header-y += n_r3964.h
 header-y += nbd.h
-header-y += ncp.h
 header-y += ncp_fs.h
+header-y += ncp.h
 header-y += ncp_mount.h
 header-y += ncp_no.h
 header-y += neighbour.h
-header-y += net.h
-header-y += net_dropmon.h
-header-y += net_tstamp.h
 header-y += netconf.h
 header-y += netdevice.h
-header-y += netlink_diag.h
-header-y += netfilter.h
+header-y += net_dropmon.h
 header-y += netfilter_arp.h
 header-y += netfilter_bridge.h
 header-y += netfilter_decnet.h
+header-y += netfilter.h
 header-y += netfilter_ipv4.h
 header-y += netfilter_ipv6.h
+header-y += net.h
+header-y += netlink_diag.h
 header-y += netlink.h
 header-y += netrom.h
+header-y += net_tstamp.h
 header-y += nfc.h
-header-y += nfs.h
 header-y += nfs2.h
 header-y += nfs3.h
 header-y += nfs4.h
 header-y += nfs4_mount.h
+header-y += nfsacl.h
 header-y += nfs_fs.h
+header-y += nfs.h
 header-y += nfs_idmap.h
 header-y += nfs_mount.h
-header-y += nfsacl.h
 header-y += nl80211.h
+header-y += n_r3964.h
 header-y += nubus.h
 header-y += nvme.h
 header-y += nvram.h
@@ -312,16 +313,16 @@ header-y += pfkeyv2.h
 header-y += pg.h
 header-y += phantom.h
 header-y += phonet.h
+header-y += pktcdvd.h
 header-y += pkt_cls.h
 header-y += pkt_sched.h
-header-y += pktcdvd.h
 header-y += pmu.h
 header-y += poll.h
 header-y += posix_types.h
 header-y += ppdev.h
 header-y += ppp-comp.h
-header-y += ppp-ioctl.h
 header-y += ppp_defs.h
+header-y += ppp-ioctl.h
 header-y += pps.h
 header-y += prctl.h
 header-y += psci.h
@@ -353,13 +354,13 @@ header-y += seccomp.h
 header-y += securebits.h
 header-y += selinux_netlink.h
 header-y += sem.h
-header-y += serial.h
 header-y += serial_core.h
+header-y += serial.h
 header-y += serial_reg.h
 header-y += serio.h
 header-y += shm.h
-header-y += signal.h
 header-y += signalfd.h
+header-y += signal.h
 header-y += smiapp.h
 header-y += snmp.h
 header-y += sock_diag.h
@@ -368,8 +369,8 @@ header-y += sockios.h
 header-y += som.h
 header-y += sonet.h
 header-y += sonypi.h
-header-y += sound.h
 header-y += soundcard.h
+header-y += sound.h
 header-y += stat.h
 header-y += stddef.h
 header-y += string.h
@@ -388,11 +389,12 @@ header-y += time.h
 header-y += times.h
 header-y += timex.h
 header-y += tiocl.h
-header-y += tipc.h
 header-y += tipc_config.h
+header-y += tipc_netlink.h
+header-y += tipc.h
 header-y += toshiba.h
-header-y += tty.h
 header-y += tty_flags.h
+header-y += tty.h
 header-y += types.h
 header-y += udf_fs_i.h
 header-y += udp.h
@@ -424,12 +426,12 @@ header-y += virtio_blk.h
 header-y += virtio_config.h
 header-y += virtio_console.h
 header-y += virtio_ids.h
-header-y += virtio_types.h
 header-y += virtio_net.h
 header-y += virtio_pci.h
 header-y += virtio_ring.h
 header-y += virtio_rng.h
 header-y += virtio_scsi.h
+header-y += virtio_types.h
 header-y += vm_sockets.h
 header-y += vt.h
 header-y += wait.h
@@ -440,6 +442,5 @@ header-y += wireless.h
 header-y += x25.h
 header-y += xattr.h
 header-y += xfrm.h
-header-y += hw_breakpoint.h
 header-y += zorro.h
 header-y += zorro_ids.h
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index d18316f9e9c4..45da7ec7d274 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -82,7 +82,7 @@ enum bpf_cmd {
 
         /* create or update key/value pair in a given map
          * err = bpf(BPF_MAP_UPDATE_ELEM, union bpf_attr *attr, u32 size)
-         * Using attr->map_fd, attr->key, attr->value
+         * Using attr->map_fd, attr->key, attr->value, attr->flags
          * returns zero or negative error
          */
         BPF_MAP_UPDATE_ELEM,
@@ -111,12 +111,20 @@ enum bpf_cmd {
 
 enum bpf_map_type {
         BPF_MAP_TYPE_UNSPEC,
+        BPF_MAP_TYPE_HASH,
+        BPF_MAP_TYPE_ARRAY,
 };
 
 enum bpf_prog_type {
         BPF_PROG_TYPE_UNSPEC,
+        BPF_PROG_TYPE_SOCKET_FILTER,
 };
 
+/* flags for BPF_MAP_UPDATE_ELEM command */
+#define BPF_ANY         0 /* create new element or update existing */
+#define BPF_NOEXIST     1 /* create new element if it didn't exist */
+#define BPF_EXIST       2 /* update existing element */
+
 union bpf_attr {
         struct { /* anonymous struct used by BPF_MAP_CREATE command */
                 __u32   map_type;       /* one of enum bpf_map_type */
@@ -132,6 +140,7 @@ union bpf_attr {
                         __aligned_u64 value;
                         __aligned_u64 next_key;
                 };
+                __u64           flags;
         };
 
         struct { /* anonymous struct used by BPF_PROG_LOAD command */
@@ -150,6 +159,9 @@ union bpf_attr {
  */
 enum bpf_func_id {
         BPF_FUNC_unspec,
+        BPF_FUNC_map_lookup_elem, /* void *map_lookup_elem(&map, &key) */
+        BPF_FUNC_map_update_elem, /* int map_update_elem(&map, &key, &value, flags) */
+        BPF_FUNC_map_delete_elem, /* int map_delete_elem(&map, &key) */
         __BPF_FUNC_MAX_ID,
 };
 
diff --git a/include/uapi/linux/can/error.h b/include/uapi/linux/can/error.h
index c247446ab25a..1c508be9687f 100644
--- a/include/uapi/linux/can/error.h
+++ b/include/uapi/linux/can/error.h
@@ -71,6 +71,7 @@
 #define CAN_ERR_CRTL_TX_PASSIVE  0x20 /* reached error passive status TX */
                                       /* (at least one error counter exceeds */
                                       /* the protocol-defined level of 127)  */
+#define CAN_ERR_CRTL_ACTIVE      0x40 /* recovered to error active state */
 
 /* error in CAN protocol (type) / data[2] */
 #define CAN_ERR_PROT_UNSPEC      0x00 /* unspecified */
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 99b43056a6fe..5f66d9c2889d 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -534,6 +534,7 @@ struct ethtool_pauseparam {
  * @ETH_SS_NTUPLE_FILTERS: Previously used with %ETHTOOL_GRXNTUPLE;
  *      now deprecated
  * @ETH_SS_FEATURES: Device feature names
+ * @ETH_SS_RSS_HASH_FUNCS: RSS hush function names
  */
 enum ethtool_stringset {
         ETH_SS_TEST             = 0,
@@ -541,6 +542,7 @@ enum ethtool_stringset {
         ETH_SS_PRIV_FLAGS,
         ETH_SS_NTUPLE_FILTERS,
         ETH_SS_FEATURES,
+        ETH_SS_RSS_HASH_FUNCS,
 };
 
 /**
@@ -884,6 +886,8 @@ struct ethtool_rxfh_indir {
  * @key_size: On entry, the array size of the user buffer for the hash key,
  *      which may be zero.  On return from %ETHTOOL_GRSSH, the size of the
  *      hardware hash key.
+ * @hfunc: Defines the current RSS hash function used by HW (or to be set to).
+ *      Valid values are one of the %ETH_RSS_HASH_*.
  * @rsvd:       Reserved for future extensions.
  * @rss_config: RX ring/queue index for each hash value i.e., indirection table
  *      of @indir_size __u32 elements, followed by hash key of @key_size
@@ -893,14 +897,16 @@ struct ethtool_rxfh_indir {
  * size should be returned.  For %ETHTOOL_SRSSH, an @indir_size of
  * %ETH_RXFH_INDIR_NO_CHANGE means that indir table setting is not requested
  * and a @indir_size of zero means the indir table should be reset to default
- * values.
+ * values. An hfunc of zero means that hash function setting is not requested.
  */
 struct ethtool_rxfh {
         __u32   cmd;
         __u32   rss_context;
         __u32   indir_size;
         __u32   key_size;
-        __u32   rsvd[2];
+        __u8    hfunc;
+        __u8    rsvd8[3];
+        __u32   rsvd32;
         __u32   rss_config[0];
 };
 #define ETH_RXFH_INDIR_NO_CHANGE        0xffffffff
@@ -1213,6 +1219,10 @@ enum ethtool_sfeatures_retval_bits {
 #define SUPPORTED_40000baseCR4_Full     (1 << 24)
 #define SUPPORTED_40000baseSR4_Full     (1 << 25)
 #define SUPPORTED_40000baseLR4_Full     (1 << 26)
+#define SUPPORTED_56000baseKR4_Full     (1 << 27)
+#define SUPPORTED_56000baseCR4_Full     (1 << 28)
+#define SUPPORTED_56000baseSR4_Full     (1 << 29)
+#define SUPPORTED_56000baseLR4_Full     (1 << 30)
 
 #define ADVERTISED_10baseT_Half         (1 << 0)
 #define ADVERTISED_10baseT_Full         (1 << 1)
@@ -1241,6 +1251,10 @@ enum ethtool_sfeatures_retval_bits {
 #define ADVERTISED_40000baseCR4_Full    (1 << 24)
 #define ADVERTISED_40000baseSR4_Full    (1 << 25)
 #define ADVERTISED_40000baseLR4_Full    (1 << 26)
+#define ADVERTISED_56000baseKR4_Full    (1 << 27)
+#define ADVERTISED_56000baseCR4_Full    (1 << 28)
+#define ADVERTISED_56000baseSR4_Full    (1 << 29)
+#define ADVERTISED_56000baseLR4_Full    (1 << 30)
 
 /* The following are all involved in forcing a particular link
  * mode for the device for setting things.  When getting the
@@ -1248,12 +1262,16 @@ enum ethtool_sfeatures_retval_bits {
  * it was forced up into this mode or autonegotiated.
  */
 
-/* The forced speed, 10Mb, 100Mb, gigabit, 2.5Gb, 10GbE. */
+/* The forced speed, 10Mb, 100Mb, gigabit, [2.5|10|20|40|56]GbE. */
 #define SPEED_10                10
 #define SPEED_100               100
 #define SPEED_1000              1000
 #define SPEED_2500              2500
 #define SPEED_10000             10000
+#define SPEED_20000             20000
+#define SPEED_40000             40000
+#define SPEED_56000             56000
+
 #define SPEED_UNKNOWN           -1
 
 /* Duplex, half or full. */
@@ -1343,6 +1361,10 @@ enum ethtool_sfeatures_retval_bits {
 #define ETH_MODULE_SFF_8079_LEN         256
 #define ETH_MODULE_SFF_8472             0x2
 #define ETH_MODULE_SFF_8472_LEN         512
+#define ETH_MODULE_SFF_8636             0x3
+#define ETH_MODULE_SFF_8636_LEN         256
+#define ETH_MODULE_SFF_8436             0x4
+#define ETH_MODULE_SFF_8436_LEN         256
 
 /* Reset flags */
 /* The reset() operation must clear the flags for the components which
diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
index da17e456908d..b03ee8f62d3c 100644
--- a/include/uapi/linux/if_bridge.h
+++ b/include/uapi/linux/if_bridge.h
@@ -105,6 +105,7 @@ struct __fdb_entry {
 
 #define BRIDGE_MODE_VEB         0       /* Default loopback mode */
 #define BRIDGE_MODE_VEPA        1       /* 802.1Qbg defined VEPA mode */
+#define BRIDGE_MODE_UNDEF       0xFFFF  /* mode undefined */
 
 /* Bridge management nested attributes
  * [IFLA_AF_SPEC] = {
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 0bdb77e16875..f7d0d2d7173a 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -145,6 +145,7 @@ enum {
         IFLA_CARRIER,
         IFLA_PHYS_PORT_ID,
         IFLA_CARRIER_CHANGES,
+        IFLA_PHYS_SWITCH_ID,
         __IFLA_MAX
 };
 
@@ -243,6 +244,8 @@ enum {
         IFLA_BRPORT_FAST_LEAVE, /* multicast fast leave    */
         IFLA_BRPORT_LEARNING,   /* mac learning */
         IFLA_BRPORT_UNICAST_FLOOD, /* flood unicast traffic */
+        IFLA_BRPORT_PROXYARP,   /* proxy ARP */
+        IFLA_BRPORT_LEARNING_SYNC, /* mac learning sync from device */
         __IFLA_BRPORT_MAX
 };
 #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
@@ -329,6 +332,21 @@ enum macvlan_macaddr_mode {
 
 #define MACVLAN_FLAG_NOPROMISC  1
 
+/* IPVLAN section */
+enum {
+        IFLA_IPVLAN_UNSPEC,
+        IFLA_IPVLAN_MODE,
+        __IFLA_IPVLAN_MAX
+};
+
+#define IFLA_IPVLAN_MAX (__IFLA_IPVLAN_MAX - 1)
+
+enum ipvlan_mode {
+        IPVLAN_MODE_L2 = 0,
+        IPVLAN_MODE_L3,
+        IPVLAN_MODE_MAX
+};
+
 /* VXLAN section */
 enum {
         IFLA_VXLAN_UNSPEC,
diff --git a/include/uapi/linux/if_tunnel.h b/include/uapi/linux/if_tunnel.h
index 280d9e092283..bd3cc11a431f 100644
--- a/include/uapi/linux/if_tunnel.h
+++ b/include/uapi/linux/if_tunnel.h
@@ -69,6 +69,7 @@ enum tunnel_encap_types {
 
 #define TUNNEL_ENCAP_FLAG_CSUM          (1<<0)
 #define TUNNEL_ENCAP_FLAG_CSUM6         (1<<1)
+#define TUNNEL_ENCAP_FLAG_REMCSUM       (1<<2)
 
 /* SIT-mode i_flags */
 #define SIT_ISATAP      0x0001
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index efa2666f4b8a..e863d088b9a5 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -164,6 +164,7 @@ enum {
         DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL,
         DEVCONF_SUPPRESS_FRAG_NDISC,
         DEVCONF_ACCEPT_RA_FROM_LOCAL,
+        DEVCONF_USE_OPTIMISTIC,
         DEVCONF_MAX
 };
 
diff --git a/include/uapi/linux/neighbour.h b/include/uapi/linux/neighbour.h
index 4a1d7e96dfe3..f3d77f9f1e0b 100644
--- a/include/uapi/linux/neighbour.h
+++ b/include/uapi/linux/neighbour.h
@@ -35,11 +35,11 @@ enum {
  */
 
 #define NTF_USE         0x01
-#define NTF_PROXY       0x08    /* == ATF_PUBL */
-#define NTF_ROUTER      0x80
-
 #define NTF_SELF        0x02
 #define NTF_MASTER      0x04
+#define NTF_PROXY       0x08    /* == ATF_PUBL */
+#define NTF_EXT_LEARNED 0x10
+#define NTF_ROUTER      0x80
 
 /*
  *      Neighbor Cache Entry States.
diff --git a/include/uapi/linux/net_tstamp.h b/include/uapi/linux/net_tstamp.h
index ff354021bb69..edbc888ceb51 100644
--- a/include/uapi/linux/net_tstamp.h
+++ b/include/uapi/linux/net_tstamp.h
@@ -23,8 +23,9 @@ enum {
         SOF_TIMESTAMPING_OPT_ID = (1<<7),
         SOF_TIMESTAMPING_TX_SCHED = (1<<8),
         SOF_TIMESTAMPING_TX_ACK = (1<<9),
+        SOF_TIMESTAMPING_OPT_CMSG = (1<<10),
 
-        SOF_TIMESTAMPING_LAST = SOF_TIMESTAMPING_TX_ACK,
+        SOF_TIMESTAMPING_LAST = SOF_TIMESTAMPING_OPT_CMSG,
         SOF_TIMESTAMPING_MASK = (SOF_TIMESTAMPING_LAST - 1) |
                                  SOF_TIMESTAMPING_LAST
 };
diff --git a/include/uapi/linux/netfilter/ipset/ip_set.h b/include/uapi/linux/netfilter/ipset/ip_set.h
index ca03119111a2..5ab4e60894cf 100644
--- a/include/uapi/linux/netfilter/ipset/ip_set.h
+++ b/include/uapi/linux/netfilter/ipset/ip_set.h
@@ -256,11 +256,17 @@ enum {
         IPSET_COUNTER_GT,
 };
 
-struct ip_set_counter_match {
+/* Backward compatibility for set match v3 */
+struct ip_set_counter_match0 {
         __u8 op;
         __u64 value;
 };
 
+struct ip_set_counter_match {
+        __aligned_u64 value;
+        __u8 op;
+};
+
 /* Interface to iptables/ip6tables */
 
 #define SO_IP_SET               83
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index f31fe7b660a5..832bc46db78b 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -579,6 +579,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_CPU: cpu id through smp_processor_id()
  * @NFT_META_IIFGROUP: packet input interface group
  * @NFT_META_OIFGROUP: packet output interface group
+ * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
  */
 enum nft_meta_keys {
         NFT_META_LEN,
@@ -604,6 +605,7 @@ enum nft_meta_keys {
         NFT_META_CPU,
         NFT_META_IIFGROUP,
         NFT_META_OIFGROUP,
+        NFT_META_CGROUP,
 };
 
 /**
@@ -838,6 +840,22 @@ enum nft_masq_attributes {
 #define NFTA_MASQ_MAX           (__NFTA_MASQ_MAX - 1)
 
 /**
+ * enum nft_redir_attributes - nf_tables redirect expression netlink attributes
+ *
+ * @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
+ * @NFTA_REDIR_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
+ * @NFTA_REDIR_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
+ */
+enum nft_redir_attributes {
+        NFTA_REDIR_UNSPEC,
+        NFTA_REDIR_REG_PROTO_MIN,
+        NFTA_REDIR_REG_PROTO_MAX,
+        NFTA_REDIR_FLAGS,
+        __NFTA_REDIR_MAX
+};
+#define NFTA_REDIR_MAX          (__NFTA_REDIR_MAX - 1)
+
+/**
  * enum nft_gen_attributes - nf_tables ruleset generation attributes
  *
  * @NFTA_GEN_ID: Ruleset generation ID (NLA_U32)
diff --git a/include/uapi/linux/netfilter/xt_set.h b/include/uapi/linux/netfilter/xt_set.h
index d6a1df1f2947..d4e02348384c 100644
--- a/include/uapi/linux/netfilter/xt_set.h
+++ b/include/uapi/linux/netfilter/xt_set.h
@@ -66,8 +66,8 @@ struct xt_set_info_target_v2 {
 
 struct xt_set_info_match_v3 {
         struct xt_set_info match_set;
-        struct ip_set_counter_match packets;
-        struct ip_set_counter_match bytes;
+        struct ip_set_counter_match0 packets;
+        struct ip_set_counter_match0 bytes;
         __u32 flags;
 };
 
@@ -81,4 +81,13 @@ struct xt_set_info_target_v3 {
         __u32 timeout;
 };
 
+/* Revision 4 match */
+
+struct xt_set_info_match_v4 {
+        struct xt_set_info match_set;
+        struct ip_set_counter_match packets;
+        struct ip_set_counter_match bytes;
+        __u32 flags;
+};
+
 #endif /*_XT_SET_H*/
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 9b19b4461928..8119255feae4 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -116,6 +116,7 @@ enum nfc_commands {
         NFC_EVENT_SE_TRANSACTION,
         NFC_CMD_GET_SE,
         NFC_CMD_SE_IO,
+        NFC_CMD_ACTIVATE_TARGET,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -196,15 +197,19 @@ enum nfc_sdp_attr {
 };
 #define NFC_SDP_ATTR_MAX (__NFC_SDP_ATTR_AFTER_LAST - 1)
 
-#define NFC_DEVICE_NAME_MAXSIZE 8
-#define NFC_NFCID1_MAXSIZE 10
-#define NFC_NFCID2_MAXSIZE 8
-#define NFC_NFCID3_MAXSIZE 10
-#define NFC_SENSB_RES_MAXSIZE 12
-#define NFC_SENSF_RES_MAXSIZE 18
-#define NFC_GB_MAXSIZE        48
-#define NFC_FIRMWARE_NAME_MAXSIZE 32
-#define NFC_ISO15693_UID_MAXSIZE 8
+#define NFC_DEVICE_NAME_MAXSIZE         8
+#define NFC_NFCID1_MAXSIZE              10
+#define NFC_NFCID2_MAXSIZE              8
+#define NFC_NFCID3_MAXSIZE              10
+#define NFC_SENSB_RES_MAXSIZE           12
+#define NFC_SENSF_RES_MAXSIZE           18
+#define NFC_ATR_REQ_MAXSIZE             64
+#define NFC_ATR_RES_MAXSIZE             64
+#define NFC_ATR_REQ_GB_MAXSIZE          48
+#define NFC_ATR_RES_GB_MAXSIZE          47
+#define NFC_GB_MAXSIZE                  48
+#define NFC_FIRMWARE_NAME_MAXSIZE       32
+#define NFC_ISO15693_UID_MAXSIZE        8
 
 /* NFC protocols */
 #define NFC_PROTO_JEWEL         1
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 4b28dc07bcb1..b37bd5a1cb82 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -227,7 +227,11 @@
  *      the interface identified by %NL80211_ATTR_IFINDEX.
  * @NL80211_CMD_DEL_STATION: Remove a station identified by %NL80211_ATTR_MAC
  *      or, if no MAC address given, all stations, on the interface identified
- *      by %NL80211_ATTR_IFINDEX.
+ *      by %NL80211_ATTR_IFINDEX. %NL80211_ATTR_MGMT_SUBTYPE and
+ *      %NL80211_ATTR_REASON_CODE can optionally be used to specify which type
+ *      of disconnection indication should be sent to the station
+ *      (Deauthentication or Disassociation frame and reason code for that
+ *      frame).
  *
  * @NL80211_CMD_GET_MPATH: Get mesh path attributes for mesh path to
  *      destination %NL80211_ATTR_MAC on the interface identified by
@@ -639,7 +643,18 @@
  * @NL80211_CMD_CH_SWITCH_NOTIFY: An AP or GO may decide to switch channels
  *      independently of the userspace SME, send this event indicating
  *      %NL80211_ATTR_IFINDEX is now on %NL80211_ATTR_WIPHY_FREQ and the
- *      attributes determining channel width.
+ *      attributes determining channel width.  This indication may also be
+ *      sent when a remotely-initiated switch (e.g., when a STA receives a CSA
+ *      from the remote AP) is completed;
+ *
+ * @NL80211_CMD_CH_SWITCH_STARTED_NOTIFY: Notify that a channel switch
+ *      has been started on an interface, regardless of the initiator
+ *      (ie. whether it was requested from a remote device or
+ *      initiated on our own).  It indicates that
+ *      %NL80211_ATTR_IFINDEX will be on %NL80211_ATTR_WIPHY_FREQ
+ *      after %NL80211_ATTR_CH_SWITCH_COUNT TBTT's.  The userspace may
+ *      decide to react to this indication by requesting other
+ *      interfaces to change channel as well.
  *
  * @NL80211_CMD_START_P2P_DEVICE: Start the given P2P Device, identified by
  *      its %NL80211_ATTR_WDEV identifier. It must have been created with
@@ -738,6 +753,27 @@
  *      before removing a station entry entirely, or before disassociating
  *      or similar, cleanup will happen in the driver/device in this case.
  *
+ * @NL80211_CMD_GET_MPP: Get mesh path attributes for mesh proxy path to
+ *      destination %NL80211_ATTR_MAC on the interface identified by
+ *      %NL80211_ATTR_IFINDEX.
+ *
+ * @NL80211_CMD_JOIN_OCB: Join the OCB network. The center frequency and
+ *      bandwidth of a channel must be given.
+ * @NL80211_CMD_LEAVE_OCB: Leave the OCB network -- no special arguments, the
+ *      network is determined by the network interface.
+ *
+ * @NL80211_CMD_TDLS_CHANNEL_SWITCH: Start channel-switching with a TDLS peer,
+ *      identified by the %NL80211_ATTR_MAC parameter. A target channel is
+ *      provided via %NL80211_ATTR_WIPHY_FREQ and other attributes determining
+ *      channel width/type. The target operating class is given via
+ *      %NL80211_ATTR_OPER_CLASS.
+ *      The driver is responsible for continually initiating channel-switching
+ *      operations and returning to the base channel for communication with the
+ *      AP.
+ * @NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH: Stop channel-switching with a TDLS
+ *      peer given by %NL80211_ATTR_MAC. Both peers must be on the base channel
+ *      when this command completes.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -912,6 +948,16 @@ enum nl80211_commands {
         NL80211_CMD_ADD_TX_TS,
         NL80211_CMD_DEL_TX_TS,
 
+        NL80211_CMD_GET_MPP,
+
+        NL80211_CMD_JOIN_OCB,
+        NL80211_CMD_LEAVE_OCB,
+
+        NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
+
+        NL80211_CMD_TDLS_CHANNEL_SWITCH,
+        NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -1606,9 +1652,9 @@ enum nl80211_commands {
  * @NL80211_ATTR_TDLS_PEER_CAPABILITY: flags for TDLS peer capabilities, u32.
  *      As specified in the &enum nl80211_tdls_peer_capability.
  *
- * @NL80211_ATTR_IFACE_SOCKET_OWNER: flag attribute, if set during interface
+ * @NL80211_ATTR_SOCKET_OWNER: Flag attribute, if set during interface
  *      creation then the new interface will be owned by the netlink socket
- *      that created it and will be destroyed when the socket is closed
+ *      that created it and will be destroyed when the socket is closed.
  *
  * @NL80211_ATTR_TDLS_INITIATOR: flag attribute indicating the current end is
  *      the TDLS link initiator.
@@ -1638,6 +1684,11 @@ enum nl80211_commands {
  * @NL80211_ATTR_SMPS_MODE: SMPS mode to use (ap mode). see
  *      &enum nl80211_smps_mode.
  *
+ * @NL80211_ATTR_OPER_CLASS: operating class
+ *
+ * @NL80211_ATTR_MAC_MASK: MAC address mask
+ *
+ * @NUM_NL80211_ATTR: total number of nl80211_attrs available
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1973,7 +2024,7 @@ enum nl80211_attrs {
 
         NL80211_ATTR_TDLS_PEER_CAPABILITY,
 
-        NL80211_ATTR_IFACE_SOCKET_OWNER,
+        NL80211_ATTR_SOCKET_OWNER,
 
         NL80211_ATTR_CSA_C_OFFSETS_TX,
         NL80211_ATTR_MAX_CSA_COUNTERS,
@@ -1990,15 +2041,21 @@ enum nl80211_attrs {
 
         NL80211_ATTR_SMPS_MODE,
 
+        NL80211_ATTR_OPER_CLASS,
+
+        NL80211_ATTR_MAC_MASK,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
+        NUM_NL80211_ATTR = __NL80211_ATTR_AFTER_LAST,
         NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
 };
 
 /* source-level API compatibility */
 #define NL80211_ATTR_SCAN_GENERATION NL80211_ATTR_GENERATION
 #define NL80211_ATTR_MESH_PARAMS NL80211_ATTR_MESH_CONFIG
+#define NL80211_ATTR_IFACE_SOCKET_OWNER NL80211_ATTR_SOCKET_OWNER
 
 /*
  * Allow user space programs to use #ifdef on new attributes by defining them
@@ -2064,6 +2121,8 @@ enum nl80211_attrs {
  *      and therefore can't be created in the normal ways, use the
  *      %NL80211_CMD_START_P2P_DEVICE and %NL80211_CMD_STOP_P2P_DEVICE
  *      commands to create and destroy one
+ * @NL80211_IF_TYPE_OCB: Outside Context of a BSS
+ *      This mode corresponds to the MIB variable dot11OCBActivated=true
  * @NL80211_IFTYPE_MAX: highest interface type number currently defined
  * @NUM_NL80211_IFTYPES: number of defined interface types
  *
@@ -2083,6 +2142,7 @@ enum nl80211_iftype {
         NL80211_IFTYPE_P2P_CLIENT,
         NL80211_IFTYPE_P2P_GO,
         NL80211_IFTYPE_P2P_DEVICE,
+        NL80211_IFTYPE_OCB,
 
         /* keep last */
         NUM_NL80211_IFTYPES,
@@ -2631,6 +2691,11 @@ enum nl80211_sched_scan_match_attr {
  * @NL80211_RRF_AUTO_BW: maximum available bandwidth should be calculated
  *      base on contiguous rules and wider channels will be allowed to cross
  *      multiple contiguous/overlapping frequency ranges.
+ * @NL80211_RRF_GO_CONCURRENT: See &NL80211_FREQUENCY_ATTR_GO_CONCURRENT
+ * @NL80211_RRF_NO_HT40MINUS: channels can't be used in HT40- operation
+ * @NL80211_RRF_NO_HT40PLUS: channels can't be used in HT40+ operation
+ * @NL80211_RRF_NO_80MHZ: 80MHz operation not allowed
+ * @NL80211_RRF_NO_160MHZ: 160MHz operation not allowed
  */
 enum nl80211_reg_rule_flags {
         NL80211_RRF_NO_OFDM             = 1<<0,
@@ -2643,11 +2708,18 @@ enum nl80211_reg_rule_flags {
         NL80211_RRF_NO_IR               = 1<<7,
         __NL80211_RRF_NO_IBSS           = 1<<8,
         NL80211_RRF_AUTO_BW             = 1<<11,
+        NL80211_RRF_GO_CONCURRENT       = 1<<12,
+        NL80211_RRF_NO_HT40MINUS        = 1<<13,
+        NL80211_RRF_NO_HT40PLUS         = 1<<14,
+        NL80211_RRF_NO_80MHZ            = 1<<15,
+        NL80211_RRF_NO_160MHZ           = 1<<16,
 };
 
 #define NL80211_RRF_PASSIVE_SCAN        NL80211_RRF_NO_IR
 #define NL80211_RRF_NO_IBSS             NL80211_RRF_NO_IR
 #define NL80211_RRF_NO_IR               NL80211_RRF_NO_IR
+#define NL80211_RRF_NO_HT40             (NL80211_RRF_NO_HT40MINUS |\
+                                         NL80211_RRF_NO_HT40PLUS)
 
 /* For backport compatibility with older userspace */
 #define NL80211_RRF_NO_IR_ALL           (NL80211_RRF_NO_IR | __NL80211_RRF_NO_IBSS)
@@ -3379,6 +3451,8 @@ enum nl80211_ps_state {
  *      interval in which %NL80211_ATTR_CQM_TXE_PKTS and
  *      %NL80211_ATTR_CQM_TXE_RATE must be satisfied before generating an
  *      %NL80211_CMD_NOTIFY_CQM. Set to 0 to turn off TX error reporting.
+ * @NL80211_ATTR_CQM_BEACON_LOSS_EVENT: flag attribute that's set in a beacon
+ *      loss event
  * @__NL80211_ATTR_CQM_AFTER_LAST: internal
  * @NL80211_ATTR_CQM_MAX: highest key attribute
  */
@@ -3391,6 +3465,7 @@ enum nl80211_attr_cqm {
         NL80211_ATTR_CQM_TXE_RATE,
         NL80211_ATTR_CQM_TXE_PKTS,
         NL80211_ATTR_CQM_TXE_INTVL,
+        NL80211_ATTR_CQM_BEACON_LOSS_EVENT,
 
         /* keep last */
         __NL80211_ATTR_CQM_AFTER_LAST,
@@ -3403,9 +3478,7 @@ enum nl80211_attr_cqm {
  *      configured threshold
  * @NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH: The RSSI is higher than the
  *      configured threshold
- * @NL80211_CQM_RSSI_BEACON_LOSS_EVENT: The device experienced beacon loss.
- *      (Note that deauth/disassoc will still follow if the AP is not
- *      available. This event might get used as roaming event, etc.)
+ * @NL80211_CQM_RSSI_BEACON_LOSS_EVENT: (reserved, never sent)
  */
 enum nl80211_cqm_rssi_threshold_event {
         NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
@@ -3545,6 +3618,25 @@ struct nl80211_pattern_support {
  * @NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS: For wakeup reporting only,
  *      the TCP connection ran out of tokens to use for data to send to the
  *      service
+ * @NL80211_WOWLAN_TRIG_NET_DETECT: wake up when a configured network
+ *      is detected.  This is a nested attribute that contains the
+ *      same attributes used with @NL80211_CMD_START_SCHED_SCAN.  It
+ *      specifies how the scan is performed (e.g. the interval and the
+ *      channels to scan) as well as the scan results that will
+ *      trigger a wake (i.e. the matchsets).
+ * @NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS: nested attribute
+ *      containing an array with information about what triggered the
+ *      wake up.  If no elements are present in the array, it means
+ *      that the information is not available.  If more than one
+ *      element is present, it means that more than one match
+ *      occurred.
+ *      Each element in the array is a nested attribute that contains
+ *      one optional %NL80211_ATTR_SSID attribute and one optional
+ *      %NL80211_ATTR_SCAN_FREQUENCIES attribute.  At least one of
+ *      these attributes must be present.  If
+ *      %NL80211_ATTR_SCAN_FREQUENCIES contains more than one
+ *      frequency, it means that the match occurred in more than one
+ *      channel.
  * @NUM_NL80211_WOWLAN_TRIG: number of wake on wireless triggers
  * @MAX_NL80211_WOWLAN_TRIG: highest wowlan trigger attribute number
  *
@@ -3570,6 +3662,8 @@ enum nl80211_wowlan_triggers {
         NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH,
         NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST,
         NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS,
+        NL80211_WOWLAN_TRIG_NET_DETECT,
+        NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS,
 
         /* keep last */
         NUM_NL80211_WOWLAN_TRIG,
@@ -4042,6 +4136,27 @@ enum nl80211_ap_sme_features {
  *      multiplexing powersave, ie. can turn off all but one chain
  *      and then wake the rest up as required after, for example,
  *      rts/cts handshake.
+ * @NL80211_FEATURE_SUPPORTS_WMM_ADMISSION: the device supports setting up WMM
+ *      TSPEC sessions (TID aka TSID 0-7) with the %NL80211_CMD_ADD_TX_TS
+ *      command. Standard IEEE 802.11 TSPEC setup is not yet supported, it
+ *      needs to be able to handle Block-Ack agreements and other things.
+ * @NL80211_FEATURE_MAC_ON_CREATE: Device supports configuring
+ *      the vif's MAC address upon creation.
+ *      See 'macaddr' field in the vif_params (cfg80211.h).
+ * @NL80211_FEATURE_TDLS_CHANNEL_SWITCH: Driver supports channel switching when
+ *      operating as a TDLS peer.
+ * @NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR: This device/driver supports using a
+ *      random MAC address during scan (if the device is unassociated); the
+ *      %NL80211_SCAN_FLAG_RANDOM_ADDR flag may be set for scans and the MAC
+ *      address mask/value will be used.
+ * @NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR: This device/driver supports
+ *      using a random MAC address for every scan iteration during scheduled
+ *      scan (while not associated), the %NL80211_SCAN_FLAG_RANDOM_ADDR may
+ *      be set for scheduled scan and the MAC address mask/value will be used.
+ * @NL80211_FEATURE_ND_RANDOM_MAC_ADDR: This device/driver supports using a
+ *      random MAC address for every scan iteration during "net detect", i.e.
+ *      scan in unassociated WoWLAN, the %NL80211_SCAN_FLAG_RANDOM_ADDR may
+ *      be set for scheduled scan and the MAC address mask/value will be used.
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -4070,6 +4185,12 @@ enum nl80211_feature_flags {
         NL80211_FEATURE_ACKTO_ESTIMATION                = 1 << 23,
         NL80211_FEATURE_STATIC_SMPS                     = 1 << 24,
         NL80211_FEATURE_DYNAMIC_SMPS                    = 1 << 25,
+        NL80211_FEATURE_SUPPORTS_WMM_ADMISSION          = 1 << 26,
+        NL80211_FEATURE_MAC_ON_CREATE                   = 1 << 27,
+        NL80211_FEATURE_TDLS_CHANNEL_SWITCH             = 1 << 28,
+        NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR            = 1 << 29,
+        NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR      = 1 << 30,
+        NL80211_FEATURE_ND_RANDOM_MAC_ADDR              = 1 << 31,
 };
 
 /**
@@ -4118,11 +4239,21 @@ enum nl80211_connect_failed_reason {
  *      dangerous because will destroy stations performance as a lot of frames
  *      will be lost while scanning off-channel, therefore it must be used only
  *      when really needed
+ * @NL80211_SCAN_FLAG_RANDOM_ADDR: use a random MAC address for this scan (or
+ *      for scheduled scan: a different one for every scan iteration). When the
+ *      flag is set, depending on device capabilities the @NL80211_ATTR_MAC and
+ *      @NL80211_ATTR_MAC_MASK attributes may also be given in which case only
+ *      the masked bits will be preserved from the MAC address and the remainder
+ *      randomised. If the attributes are not given full randomisation (46 bits,
+ *      locally administered 1, multicast 0) is assumed.
+ *      This flag must not be requested when the feature isn't supported, check
+ *      the nl80211 feature flags for the device.
  */
 enum nl80211_scan_flags {
         NL80211_SCAN_FLAG_LOW_PRIORITY                  = 1<<0,
         NL80211_SCAN_FLAG_FLUSH                         = 1<<1,
         NL80211_SCAN_FLAG_AP                            = 1<<2,
+        NL80211_SCAN_FLAG_RANDOM_ADDR                   = 1<<3,
 };
 
 /**
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 435eabc5ffaa..3a6dcaa359b7 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -157,6 +157,11 @@ enum ovs_packet_cmd {
  * notification if the %OVS_ACTION_ATTR_USERSPACE action specified an
  * %OVS_USERSPACE_ATTR_USERDATA attribute, with the same length and content
  * specified there.
+ * @OVS_PACKET_ATTR_EGRESS_TUN_KEY: Present for an %OVS_PACKET_CMD_ACTION
+ * notification if the %OVS_ACTION_ATTR_USERSPACE action specified an
+ * %OVS_USERSPACE_ATTR_EGRESS_TUN_PORT attribute, which is sent only if the
+ * output port is actually a tunnel port. Contains the output tunnel key
+ * extracted from the packet as nested %OVS_TUNNEL_KEY_ATTR_* attributes.
  *
  * These attributes follow the &struct ovs_header within the Generic Netlink
  * payload for %OVS_PACKET_* commands.
@@ -167,6 +172,8 @@ enum ovs_packet_attr {
         OVS_PACKET_ATTR_KEY,         /* Nested OVS_KEY_ATTR_* attributes. */
         OVS_PACKET_ATTR_ACTIONS,     /* Nested OVS_ACTION_ATTR_* attributes. */
         OVS_PACKET_ATTR_USERDATA,    /* OVS_ACTION_ATTR_USERSPACE arg. */
+        OVS_PACKET_ATTR_EGRESS_TUN_KEY,  /* Nested OVS_TUNNEL_KEY_ATTR_*
+                                            attributes. */
         __OVS_PACKET_ATTR_MAX
 };
 
@@ -293,6 +300,9 @@ enum ovs_key_attr {
         OVS_KEY_ATTR_DP_HASH,      /* u32 hash value. Value 0 indicates the hash
                                    is not computed by the datapath. */
         OVS_KEY_ATTR_RECIRC_ID, /* u32 recirc id */
+        OVS_KEY_ATTR_MPLS,      /* array of struct ovs_key_mpls.
+                                 * The implementation may restrict
+                                 * the accepted length of the array. */
 
 #ifdef __KERNEL__
         OVS_KEY_ATTR_TUNNEL_INFO,  /* struct ovs_tunnel_info */
@@ -312,6 +322,8 @@ enum ovs_tunnel_key_attr {
         OVS_TUNNEL_KEY_ATTR_CSUM,               /* No argument. CSUM packet. */
         OVS_TUNNEL_KEY_ATTR_OAM,                /* No argument. OAM frame.  */
         OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS,        /* Array of Geneve options. */
+        OVS_TUNNEL_KEY_ATTR_TP_SRC,             /* be16 src Transport Port. */
+        OVS_TUNNEL_KEY_ATTR_TP_DST,             /* be16 dst Transport Port. */
         __OVS_TUNNEL_KEY_ATTR_MAX
 };
 
@@ -340,6 +352,10 @@ struct ovs_key_ethernet {
         __u8     eth_dst[ETH_ALEN];
 };
 
+struct ovs_key_mpls {
+        __be32 mpls_lse;
+};
+
 struct ovs_key_ipv4 {
         __be32 ipv4_src;
         __be32 ipv4_dst;
@@ -393,9 +409,9 @@ struct ovs_key_arp {
 };
 
 struct ovs_key_nd {
-        __u32 nd_target[4];
-        __u8  nd_sll[ETH_ALEN];
-        __u8  nd_tll[ETH_ALEN];
+        __be32  nd_target[4];
+        __u8    nd_sll[ETH_ALEN];
+        __u8    nd_tll[ETH_ALEN];
 };
 
 /**
@@ -441,6 +457,8 @@ enum ovs_flow_attr {
         OVS_FLOW_ATTR_USED,      /* u64 msecs last used in monotonic time. */
         OVS_FLOW_ATTR_CLEAR,     /* Flag to clear stats, tcp_flags, used. */
         OVS_FLOW_ATTR_MASK,      /* Sequence of OVS_KEY_ATTR_* attributes. */
+        OVS_FLOW_ATTR_PROBE,     /* Flow operation is a feature probe, error
+                                  * logging should be suppressed. */
         __OVS_FLOW_ATTR_MAX
 };
 
@@ -473,17 +491,34 @@ enum ovs_sample_attr {
  * message should be sent.  Required.
  * @OVS_USERSPACE_ATTR_USERDATA: If present, its variable-length argument is
  * copied to the %OVS_PACKET_CMD_ACTION message as %OVS_PACKET_ATTR_USERDATA.
+ * @OVS_USERSPACE_ATTR_EGRESS_TUN_PORT: If present, u32 output port to get
+ * tunnel info.
  */
 enum ovs_userspace_attr {
         OVS_USERSPACE_ATTR_UNSPEC,
         OVS_USERSPACE_ATTR_PID,       /* u32 Netlink PID to receive upcalls. */
         OVS_USERSPACE_ATTR_USERDATA,  /* Optional user-specified cookie. */
+        OVS_USERSPACE_ATTR_EGRESS_TUN_PORT,  /* Optional, u32 output port
+                                              * to get tunnel info. */
         __OVS_USERSPACE_ATTR_MAX
 };
 
 #define OVS_USERSPACE_ATTR_MAX (__OVS_USERSPACE_ATTR_MAX - 1)
 
 /**
+ * struct ovs_action_push_mpls - %OVS_ACTION_ATTR_PUSH_MPLS action argument.
+ * @mpls_lse: MPLS label stack entry to push.
+ * @mpls_ethertype: Ethertype to set in the encapsulating ethernet frame.
+ *
+ * The only values @mpls_ethertype should ever be given are %ETH_P_MPLS_UC and
+ * %ETH_P_MPLS_MC, indicating MPLS unicast or multicast. Other are rejected.
+ */
+struct ovs_action_push_mpls {
+        __be32 mpls_lse;
+        __be16 mpls_ethertype; /* Either %ETH_P_MPLS_UC or %ETH_P_MPLS_MC */
+};
+
+/**
  * struct ovs_action_push_vlan - %OVS_ACTION_ATTR_PUSH_VLAN action argument.
  * @vlan_tpid: Tag protocol identifier (TPID) to push.
  * @vlan_tci: Tag control identifier (TCI) to push.  The CFI bit must be set
@@ -534,6 +569,15 @@ struct ovs_action_hash {
  * @OVS_ACTION_ATTR_POP_VLAN: Pop the outermost 802.1Q header off the packet.
  * @OVS_ACTION_ATTR_SAMPLE: Probabilitically executes actions, as specified in
  * the nested %OVS_SAMPLE_ATTR_* attributes.
+ * @OVS_ACTION_ATTR_PUSH_MPLS: Push a new MPLS label stack entry onto the
+ * top of the packets MPLS label stack.  Set the ethertype of the
+ * encapsulating frame to either %ETH_P_MPLS_UC or %ETH_P_MPLS_MC to
+ * indicate the new packet contents.
+ * @OVS_ACTION_ATTR_POP_MPLS: Pop an MPLS label stack entry off of the
+ * packet's MPLS label stack.  Set the encapsulating frame's ethertype to
+ * indicate the new packet contents. This could potentially still be
+ * %ETH_P_MPLS if the resulting MPLS label stack is not empty.  If there
+ * is no MPLS label stack, as determined by ethertype, no action is taken.
  *
  * Only a single header can be set with a single %OVS_ACTION_ATTR_SET.  Not all
  * fields within a header are modifiable, e.g. the IPv4 protocol and fragment
@@ -550,6 +594,9 @@ enum ovs_action_attr {
         OVS_ACTION_ATTR_SAMPLE,       /* Nested OVS_SAMPLE_ATTR_*. */
         OVS_ACTION_ATTR_RECIRC,       /* u32 recirc_id. */
         OVS_ACTION_ATTR_HASH,         /* struct ovs_action_hash. */
+        OVS_ACTION_ATTR_PUSH_MPLS,    /* struct ovs_action_push_mpls. */
+        OVS_ACTION_ATTR_POP_MPLS,     /* __be16 ethertype. */
+
         __OVS_ACTION_ATTR_MAX
 };
 
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index eb0f1a554d7b..9c9b8b4480cd 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -235,6 +235,7 @@ enum {
 #define RTPROT_NTK      15      /* Netsukuku */
 #define RTPROT_DHCP     16      /* DHCP client */
 #define RTPROT_MROUTED  17      /* Multicast daemon */
+#define RTPROT_BABEL    42      /* Babel daemon */
 
 /* rtm_scope
 
diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index df40137f33dd..b22224100011 100644
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -156,6 +156,7 @@ enum
         UDP_MIB_RCVBUFERRORS,                   /* RcvbufErrors */
         UDP_MIB_SNDBUFERRORS,                   /* SndbufErrors */
         UDP_MIB_CSUMERRORS,                     /* InCsumErrors */
+        UDP_MIB_IGNOREDMULTI,                   /* IgnoredMulti */
         __UDP_MIB_MAX
 };
 
@@ -265,6 +266,10 @@ enum
         LINUX_MIB_TCPWANTZEROWINDOWADV,         /* TCPWantZeroWindowAdv */
         LINUX_MIB_TCPSYNRETRANS,                /* TCPSynRetrans */
         LINUX_MIB_TCPORIGDATASENT,              /* TCPOrigDataSent */
+        LINUX_MIB_TCPHYSTARTTRAINDETECT,        /* TCPHystartTrainDetect */
+        LINUX_MIB_TCPHYSTARTTRAINCWND,          /* TCPHystartTrainCwnd */
+        LINUX_MIB_TCPHYSTARTDELAYDETECT,        /* TCPHystartDelayDetect */
+        LINUX_MIB_TCPHYSTARTDELAYCWND,          /* TCPHystartDelayCwnd */
         __LINUX_MIB_MAX
 };
 
diff --git a/include/uapi/linux/tc_act/Kbuild b/include/uapi/linux/tc_act/Kbuild
index 56f121605c99..b057da2b87a4 100644
--- a/include/uapi/linux/tc_act/Kbuild
+++ b/include/uapi/linux/tc_act/Kbuild
@@ -7,3 +7,4 @@ header-y += tc_mirred.h
 header-y += tc_nat.h
 header-y += tc_pedit.h
 header-y += tc_skbedit.h
+header-y += tc_vlan.h
diff --git a/include/uapi/linux/tc_act/tc_vlan.h b/include/uapi/linux/tc_act/tc_vlan.h
new file mode 100644
index 000000000000..f7b8d448b960
--- /dev/null
+++ b/include/uapi/linux/tc_act/tc_vlan.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2014 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __LINUX_TC_VLAN_H
+#define __LINUX_TC_VLAN_H
+
+#include <linux/pkt_cls.h>
+
+#define TCA_ACT_VLAN 12
+
+#define TCA_VLAN_ACT_POP        1
+#define TCA_VLAN_ACT_PUSH       2
+
+struct tc_vlan {
+        tc_gen;
+        int v_action;
+};
+
+enum {
+        TCA_VLAN_UNSPEC,
+        TCA_VLAN_TM,
+        TCA_VLAN_PARMS,
+        TCA_VLAN_PUSH_VLAN_ID,
+        TCA_VLAN_PUSH_VLAN_PROTOCOL,
+        __TCA_VLAN_MAX,
+};
+#define TCA_VLAN_MAX (__TCA_VLAN_MAX - 1)
+
+#endif
diff --git a/include/uapi/linux/tipc_netlink.h b/include/uapi/linux/tipc_netlink.h
new file mode 100644
index 000000000000..8d723824ad69
--- /dev/null
+++ b/include/uapi/linux/tipc_netlink.h
@@ -0,0 +1,244 @@
+/*
+ * Copyright (c) 2014, Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _LINUX_TIPC_NETLINK_H_
+#define _LINUX_TIPC_NETLINK_H_
+
+#define TIPC_GENL_V2_NAME      "TIPCv2"
+#define TIPC_GENL_V2_VERSION   0x1
+
+/* Netlink commands */
+enum {
+        TIPC_NL_UNSPEC,
+        TIPC_NL_LEGACY,
+        TIPC_NL_BEARER_DISABLE,
+        TIPC_NL_BEARER_ENABLE,
+        TIPC_NL_BEARER_GET,
+        TIPC_NL_BEARER_SET,
+        TIPC_NL_SOCK_GET,
+        TIPC_NL_PUBL_GET,
+        TIPC_NL_LINK_GET,
+        TIPC_NL_LINK_SET,
+        TIPC_NL_LINK_RESET_STATS,
+        TIPC_NL_MEDIA_GET,
+        TIPC_NL_MEDIA_SET,
+        TIPC_NL_NODE_GET,
+        TIPC_NL_NET_GET,
+        TIPC_NL_NET_SET,
+        TIPC_NL_NAME_TABLE_GET,
+
+        __TIPC_NL_CMD_MAX,
+        TIPC_NL_CMD_MAX = __TIPC_NL_CMD_MAX - 1
+};
+
+/* Top level netlink attributes */
+enum {
+        TIPC_NLA_UNSPEC,
+        TIPC_NLA_BEARER,                /* nest */
+        TIPC_NLA_SOCK,                  /* nest */
+        TIPC_NLA_PUBL,                  /* nest */
+        TIPC_NLA_LINK,                  /* nest */
+        TIPC_NLA_MEDIA,                 /* nest */
+        TIPC_NLA_NODE,                  /* nest */
+        TIPC_NLA_NET,                   /* nest */
+        TIPC_NLA_NAME_TABLE,            /* nest */
+
+        __TIPC_NLA_MAX,
+        TIPC_NLA_MAX = __TIPC_NLA_MAX - 1
+};
+
+/* Bearer info */
+enum {
+        TIPC_NLA_BEARER_UNSPEC,
+        TIPC_NLA_BEARER_NAME,           /* string */
+        TIPC_NLA_BEARER_PROP,           /* nest */
+        TIPC_NLA_BEARER_DOMAIN,         /* u32 */
+
+        __TIPC_NLA_BEARER_MAX,
+        TIPC_NLA_BEARER_MAX = __TIPC_NLA_BEARER_MAX - 1
+};
+
+/* Socket info */
+enum {
+        TIPC_NLA_SOCK_UNSPEC,
+        TIPC_NLA_SOCK_ADDR,             /* u32 */
+        TIPC_NLA_SOCK_REF,              /* u32 */
+        TIPC_NLA_SOCK_CON,              /* nest */
+        TIPC_NLA_SOCK_HAS_PUBL,         /* flag */
+
+        __TIPC_NLA_SOCK_MAX,
+        TIPC_NLA_SOCK_MAX = __TIPC_NLA_SOCK_MAX - 1
+};
+
+/* Link info */
+enum {
+        TIPC_NLA_LINK_UNSPEC,
+        TIPC_NLA_LINK_NAME,             /* string */
+        TIPC_NLA_LINK_DEST,             /* u32 */
+        TIPC_NLA_LINK_MTU,              /* u32 */
+        TIPC_NLA_LINK_BROADCAST,        /* flag */
+        TIPC_NLA_LINK_UP,               /* flag */
+        TIPC_NLA_LINK_ACTIVE,           /* flag */
+        TIPC_NLA_LINK_PROP,             /* nest */
+        TIPC_NLA_LINK_STATS,            /* nest */
+        TIPC_NLA_LINK_RX,               /* u32 */
+        TIPC_NLA_LINK_TX,               /* u32 */
+
+        __TIPC_NLA_LINK_MAX,
+        TIPC_NLA_LINK_MAX = __TIPC_NLA_LINK_MAX - 1
+};
+
+/* Media info */
+enum {
+        TIPC_NLA_MEDIA_UNSPEC,
+        TIPC_NLA_MEDIA_NAME,            /* string */
+        TIPC_NLA_MEDIA_PROP,            /* nest */
+
+        __TIPC_NLA_MEDIA_MAX,
+        TIPC_NLA_MEDIA_MAX = __TIPC_NLA_MEDIA_MAX - 1
+};
+
+/* Node info */
+enum {
+        TIPC_NLA_NODE_UNSPEC,
+        TIPC_NLA_NODE_ADDR,             /* u32 */
+        TIPC_NLA_NODE_UP,               /* flag */
+
+        __TIPC_NLA_NODE_MAX,
+        TIPC_NLA_NODE_MAX = __TIPC_NLA_NODE_MAX - 1
+};
+
+/* Net info */
+enum {
+        TIPC_NLA_NET_UNSPEC,
+        TIPC_NLA_NET_ID,                /* u32 */
+        TIPC_NLA_NET_ADDR,              /* u32 */
+
+        __TIPC_NLA_NET_MAX,
+        TIPC_NLA_NET_MAX = __TIPC_NLA_NET_MAX - 1
+};
+
+/* Name table info */
+enum {
+        TIPC_NLA_NAME_TABLE_UNSPEC,
+        TIPC_NLA_NAME_TABLE_PUBL,       /* nest */
+
+        __TIPC_NLA_NAME_TABLE_MAX,
+        TIPC_NLA_NAME_TABLE_MAX = __TIPC_NLA_NAME_TABLE_MAX - 1
+};
+
+/* Publication info */
+enum {
+        TIPC_NLA_PUBL_UNSPEC,
+
+        TIPC_NLA_PUBL_TYPE,             /* u32 */
+        TIPC_NLA_PUBL_LOWER,            /* u32 */
+        TIPC_NLA_PUBL_UPPER,            /* u32 */
+        TIPC_NLA_PUBL_SCOPE,            /* u32 */
+        TIPC_NLA_PUBL_NODE,             /* u32 */
+        TIPC_NLA_PUBL_REF,              /* u32 */
+        TIPC_NLA_PUBL_KEY,              /* u32 */
+
+        __TIPC_NLA_PUBL_MAX,
+        TIPC_NLA_PUBL_MAX = __TIPC_NLA_PUBL_MAX - 1
+};
+
+/* Nest, connection info */
+enum {
+        TIPC_NLA_CON_UNSPEC,
+
+        TIPC_NLA_CON_FLAG,              /* flag */
+        TIPC_NLA_CON_NODE,              /* u32 */
+        TIPC_NLA_CON_SOCK,              /* u32 */
+        TIPC_NLA_CON_TYPE,              /* u32 */
+        TIPC_NLA_CON_INST,              /* u32 */
+
+        __TIPC_NLA_CON_MAX,
+        TIPC_NLA_CON_MAX = __TIPC_NLA_CON_MAX - 1
+};
+
+/* Nest, link propreties. Valid for link, media and bearer */
+enum {
+        TIPC_NLA_PROP_UNSPEC,
+
+        TIPC_NLA_PROP_PRIO,             /* u32 */
+        TIPC_NLA_PROP_TOL,              /* u32 */
+        TIPC_NLA_PROP_WIN,              /* u32 */
+
+        __TIPC_NLA_PROP_MAX,
+        TIPC_NLA_PROP_MAX = __TIPC_NLA_PROP_MAX - 1
+};
+
+/* Nest, statistics info */
+enum {
+        TIPC_NLA_STATS_UNSPEC,
+
+        TIPC_NLA_STATS_RX_INFO,         /* u32 */
+        TIPC_NLA_STATS_RX_FRAGMENTS,    /* u32 */
+        TIPC_NLA_STATS_RX_FRAGMENTED,   /* u32 */
+        TIPC_NLA_STATS_RX_BUNDLES,      /* u32 */
+        TIPC_NLA_STATS_RX_BUNDLED,      /* u32 */
+        TIPC_NLA_STATS_TX_INFO,         /* u32 */
+        TIPC_NLA_STATS_TX_FRAGMENTS,    /* u32 */
+        TIPC_NLA_STATS_TX_FRAGMENTED,   /* u32 */
+        TIPC_NLA_STATS_TX_BUNDLES,      /* u32 */
+        TIPC_NLA_STATS_TX_BUNDLED,      /* u32 */
+        TIPC_NLA_STATS_MSG_PROF_TOT,    /* u32 */
+        TIPC_NLA_STATS_MSG_LEN_CNT,     /* u32 */
+        TIPC_NLA_STATS_MSG_LEN_TOT,     /* u32 */
+        TIPC_NLA_STATS_MSG_LEN_P0,      /* u32 */
+        TIPC_NLA_STATS_MSG_LEN_P1,      /* u32 */
+        TIPC_NLA_STATS_MSG_LEN_P2,      /* u32 */
+        TIPC_NLA_STATS_MSG_LEN_P3,      /* u32 */
+        TIPC_NLA_STATS_MSG_LEN_P4,      /* u32 */
+        TIPC_NLA_STATS_MSG_LEN_P5,      /* u32 */
+        TIPC_NLA_STATS_MSG_LEN_P6,      /* u32 */
+        TIPC_NLA_STATS_RX_STATES,       /* u32 */
+        TIPC_NLA_STATS_RX_PROBES,       /* u32 */
+        TIPC_NLA_STATS_RX_NACKS,        /* u32 */
+        TIPC_NLA_STATS_RX_DEFERRED,     /* u32 */
+        TIPC_NLA_STATS_TX_STATES,       /* u32 */
+        TIPC_NLA_STATS_TX_PROBES,       /* u32 */
+        TIPC_NLA_STATS_TX_NACKS,        /* u32 */
+        TIPC_NLA_STATS_TX_ACKS,         /* u32 */
+        TIPC_NLA_STATS_RETRANSMITTED,   /* u32 */
+        TIPC_NLA_STATS_DUPLICATES,      /* u32 */
+        TIPC_NLA_STATS_LINK_CONGS,      /* u32 */
+        TIPC_NLA_STATS_MAX_QUEUE,       /* u32 */
+        TIPC_NLA_STATS_AVG_QUEUE,       /* u32 */
+
+        __TIPC_NLA_STATS_MAX,
+        TIPC_NLA_STATS_MAX = __TIPC_NLA_STATS_MAX - 1
+};
+
+#endif