Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:
 "Highlights (1721 non-merge commits, this has to be a record of some
  sort):

   1) Add 'random' mode to team driver, from Jiri Pirko and Eric
      Dumazet.

   2) Make it so that any driver that supports configuration of multiple
      MAC addresses can provide the forwarding database add and del
      calls by providing a default implementation and hooking that up if
      the driver doesn't have an explicit set of handlers.  From Vlad
      Yasevich.

   3) Support GSO segmentation over tunnels and other encapsulating
      devices such as VXLAN, from Pravin B Shelar.

   4) Support L2 GRE tunnels in the flow dissector, from Michael Dalton.

   5) Implement Tail Loss Probe (TLP) detection in TCP, from Nandita
      Dukkipati.

   6) In the PHY layer, allow supporting wake-on-lan in situations where
      the PHY registers have to be written for it to be configured.

      Use it to support wake-on-lan in mv643xx_eth.

      From Michael Stapelberg.

   7) Significantly improve firewire IPV6 support, from YOSHIFUJI
      Hideaki.

   8) Allow multiple packets to be sent in a single transmission using
      network coding in batman-adv, from Martin Hundebøll.

   9) Add support for T5 cxgb4 chips, from Santosh Rastapur.

  10) Generalize the VXLAN forwarding tables so that there is more
      flexibility in configurating various aspects of the endpoints.
      From David Stevens.

  11) Support RSS and TSO in hardware over GRE tunnels in bxn2x driver,
      from Dmitry Kravkov.

  12) Zero copy support in nfnelink_queue, from Eric Dumazet and Pablo
      Neira Ayuso.

  13) Start adding networking selftests.

  14) In situations of overload on the same AF_PACKET fanout socket, or
      per-cpu packet receive queue, minimize drop by distributing the
      load to other cpus/fanouts.  From Willem de Bruijn and Eric
      Dumazet.

  15) Add support for new payload offset BPF instruction, from Daniel
      Borkmann.

  16) Convert several drivers over to mdoule_platform_driver(), from
      Sachin Kamat.

  17) Provide a minimal BPF JIT image disassembler userspace tool, from
      Daniel Borkmann.

  18) Rewrite F-RTO implementation in TCP to match the final
      specification of it in RFC4138 and RFC5682.  From Yuchung Cheng.

  19) Provide netlink socket diag of netlink sockets ("Yo dawg, I hear
      you like netlink, so I implemented netlink dumping of netlink
      sockets.") From Andrey Vagin.

  20) Remove ugly passing of rtnetlink attributes into rtnl_doit
      functions, from Thomas Graf.

  21) Allow userspace to be able to see if a configuration change occurs
      in the middle of an address or device list dump, from Nicolas
      Dichtel.

  22) Support RFC3168 ECN protection for ipv6 fragments, from Hannes
      Frederic Sowa.

  23) Increase accuracy of packet length used by packet scheduler, from
      Jason Wang.

  24) Beginning set of changes to make ipv4/ipv6 fragment handling more
      scalable and less susceptible to overload and locking contention,
      from Jesper Dangaard Brouer.

  25) Get rid of using non-type-safe NLMSG_* macros and use nlmsg_*()
      instead.  From Hong Zhiguo.

  26) Optimize route usage in IPVS by avoiding reference counting where
      possible, from Julian Anastasov.

  27) Convert IPVS schedulers to RCU, also from Julian Anastasov.

  28) Support cpu fanouts in xt_NFQUEUE netfilter target, from Holger
      Eitzenberger.

  29) Network namespace support for nf_log, ebt_log, xt_LOG, ipt_ULOG,
      nfnetlink_log, and nfnetlink_queue.  From Gao feng.

  30) Implement RFC3168 ECN protection, from Hannes Frederic Sowa.

  31) Support several new r8169 chips, from Hayes Wang.

  32) Support tokenized interface identifiers in ipv6, from Daniel
      Borkmann.

  33) Use usbnet_link_change() helper in USB net driver, from Ming Lei.

  34) Add 802.1ad vlan offload support, from Patrick McHardy.

  35) Support mmap() based netlink communication, also from Patrick
      McHardy.

  36) Support HW timestamping in mlx4 driver, from Amir Vadai.

  37) Rationalize AF_PACKET packet timestamping when transmitting, from
      Willem de Bruijn and Daniel Borkmann.

  38) Bring parity to what's provided by /proc/net/packet socket dumping
      and the info provided by netlink socket dumping of AF_PACKET
      sockets.  From Nicolas Dichtel.

  39) Fix peeking beyond zero sized SKBs in AF_UNIX, from Benjamin
      Poirier"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1722 commits)
  filter: fix va_list build error
  af_unix: fix a fatal race with bit fields
  bnx2x: Prevent memory leak when cnic is absent
  bnx2x: correct reading of speed capabilities
  net: sctp: attribute printl with __printf for gcc fmt checks
  netlink: kconfig: move mmap i/o into netlink kconfig
  netpoll: convert mutex into a semaphore
  netlink: Fix skb ref counting.
  net_sched: act_ipt forward compat with xtables
  mlx4_en: fix a build error on 32bit arches
  Revert "bnx2x: allow nvram test to run when device is down"
  bridge: avoid OOPS if root port not found
  drivers: net: cpsw: fix kernel warn on cpsw irq enable
  sh_eth: use random MAC address if no valid one supplied
  3c509.c: call SET_NETDEV_DEV for all device types (ISA/ISAPnP/EISA)
  tg3: fix to append hardware time stamping flags
  unix/stream: fix peeking with an offset larger than data in queue
  unix/dgram: fix peeking with an offset larger than data in queue
  unix/dgram: peek beyond 0-sized skbs
  openvswitch: Remove unneeded ovs_netdev_get_ifindex()
  ...

131 files changed, 2832 insertions, 2508 deletions

diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index e0ce311011c0..f14a98a79c9d 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -134,6 +134,7 @@ struct bcma_host_ops {
 #define BCMA_CORE_I2S                   0x834
 #define BCMA_CORE_SDR_DDR1_MEM_CTL      0x835   /* SDR/DDR1 memory controller core */
 #define BCMA_CORE_SHIM                  0x837   /* SHIM component in ubus/6362 */
+#define BCMA_CORE_ARM_CR4               0x83e
 #define BCMA_CORE_DEFAULT               0xFFF
 
 #define BCMA_MAX_NR_CORES               16
@@ -173,6 +174,60 @@ struct bcma_host_ops {
 #define BCMA_CHIP_ID_BCM53572   53572
 #define  BCMA_PKG_ID_BCM47188   9
 
+/* Board types (on PCI usually equals to the subsystem dev id) */
+/* BCM4313 */
+#define BCMA_BOARD_TYPE_BCM94313BU      0X050F
+#define BCMA_BOARD_TYPE_BCM94313HM      0X0510
+#define BCMA_BOARD_TYPE_BCM94313EPA     0X0511
+#define BCMA_BOARD_TYPE_BCM94313HMG     0X051C
+/* BCM4716 */
+#define BCMA_BOARD_TYPE_BCM94716NR2     0X04CD
+/* BCM43224 */
+#define BCMA_BOARD_TYPE_BCM943224X21    0X056E
+#define BCMA_BOARD_TYPE_BCM943224X21_FCC        0X00D1
+#define BCMA_BOARD_TYPE_BCM943224X21B   0X00E9
+#define BCMA_BOARD_TYPE_BCM943224M93    0X008B
+#define BCMA_BOARD_TYPE_BCM943224M93A   0X0090
+#define BCMA_BOARD_TYPE_BCM943224X16    0X0093
+#define BCMA_BOARD_TYPE_BCM94322X9      0X008D
+#define BCMA_BOARD_TYPE_BCM94322M35E    0X008E
+/* BCM43228 */
+#define BCMA_BOARD_TYPE_BCM943228BU8    0X0540
+#define BCMA_BOARD_TYPE_BCM943228BU9    0X0541
+#define BCMA_BOARD_TYPE_BCM943228BU     0X0542
+#define BCMA_BOARD_TYPE_BCM943227HM4L   0X0543
+#define BCMA_BOARD_TYPE_BCM943227HMB    0X0544
+#define BCMA_BOARD_TYPE_BCM943228HM4L   0X0545
+#define BCMA_BOARD_TYPE_BCM943228SD     0X0573
+/* BCM4331 */
+#define BCMA_BOARD_TYPE_BCM94331X19     0X00D6
+#define BCMA_BOARD_TYPE_BCM94331X28     0X00E4
+#define BCMA_BOARD_TYPE_BCM94331X28B    0X010E
+#define BCMA_BOARD_TYPE_BCM94331PCIEBT3AX       0X00E4
+#define BCMA_BOARD_TYPE_BCM94331X12_2G  0X00EC
+#define BCMA_BOARD_TYPE_BCM94331X12_5G  0X00ED
+#define BCMA_BOARD_TYPE_BCM94331X29B    0X00EF
+#define BCMA_BOARD_TYPE_BCM94331CSAX    0X00EF
+#define BCMA_BOARD_TYPE_BCM94331X19C    0X00F5
+#define BCMA_BOARD_TYPE_BCM94331X33     0X00F4
+#define BCMA_BOARD_TYPE_BCM94331BU      0X0523
+#define BCMA_BOARD_TYPE_BCM94331S9BU    0X0524
+#define BCMA_BOARD_TYPE_BCM94331MC      0X0525
+#define BCMA_BOARD_TYPE_BCM94331MCI     0X0526
+#define BCMA_BOARD_TYPE_BCM94331PCIEBT4 0X0527
+#define BCMA_BOARD_TYPE_BCM94331HM      0X0574
+#define BCMA_BOARD_TYPE_BCM94331PCIEDUAL        0X059B
+#define BCMA_BOARD_TYPE_BCM94331MCH5    0X05A9
+#define BCMA_BOARD_TYPE_BCM94331CS      0X05C6
+#define BCMA_BOARD_TYPE_BCM94331CD      0X05DA
+/* BCM53572 */
+#define BCMA_BOARD_TYPE_BCM953572BU     0X058D
+#define BCMA_BOARD_TYPE_BCM953572NR2    0X058E
+#define BCMA_BOARD_TYPE_BCM947188NR2    0X058F
+#define BCMA_BOARD_TYPE_BCM953572SDRNR2 0X0590
+/* BCM43142 */
+#define BCMA_BOARD_TYPE_BCM943142HM     0X05E0
+
 struct bcma_device {
         struct bcma_bus *bus;
         struct bcma_device_id id;
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 8390c474f69a..b8b09eac60a4 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -104,6 +104,7 @@
 #define  BCMA_CC_CHIPST_4706_MIPS_BENDIAN       BIT(3) /* 0: little, 1: big endian */
 #define  BCMA_CC_CHIPST_4706_PCIE1_DISABLE      BIT(5) /* PCIE1 enable strap pin */
 #define  BCMA_CC_CHIPST_5357_NAND_BOOT          BIT(4) /* NAND boot, valid for CC rev 38 and/or BCM5357 */
+#define  BCMA_CC_CHIPST_4360_XTAL_40MZ          0x00000001
 #define BCMA_CC_JCMD                    0x0030          /* Rev >= 10 only */
 #define  BCMA_CC_JCMD_START             0x80000000
 #define  BCMA_CC_JCMD_BUSY              0x80000000
@@ -315,6 +316,9 @@
 #define BCMA_CC_PMU_CTL                 0x0600 /* PMU control */
 #define  BCMA_CC_PMU_CTL_ILP_DIV        0xFFFF0000 /* ILP div mask */
 #define  BCMA_CC_PMU_CTL_ILP_DIV_SHIFT  16
+#define  BCMA_CC_PMU_CTL_RES            0x00006000 /* reset control mask */
+#define  BCMA_CC_PMU_CTL_RES_SHIFT      13
+#define  BCMA_CC_PMU_CTL_RES_RELOAD     0x2     /* reload POR values */
 #define  BCMA_CC_PMU_CTL_PLL_UPD        0x00000400
 #define  BCMA_CC_PMU_CTL_NOILPONW       0x00000200 /* No ILP on wait */
 #define  BCMA_CC_PMU_CTL_HTREQEN        0x00000100 /* HT req enable */
@@ -607,6 +611,8 @@ void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
 
 extern u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks);
 
+extern u32 bcma_chipco_get_alp_clock(struct bcma_drv_cc *cc);
+
 void bcma_chipco_irq_mask(struct bcma_drv_cc *cc, u32 mask, u32 value);
 
 u32 bcma_chipco_irq_status(struct bcma_drv_cc *cc, u32 mask);
diff --git a/include/linux/bcma/bcma_regs.h b/include/linux/bcma/bcma_regs.h
index 7e8104bb7a7e..917dcd7965e7 100644
--- a/include/linux/bcma/bcma_regs.h
+++ b/include/linux/bcma/bcma_regs.h
@@ -37,6 +37,7 @@
 #define  BCMA_IOST_BIST_DONE            0x8000
 #define BCMA_RESET_CTL                  0x0800
 #define  BCMA_RESET_CTL_RESET           0x0001
+#define BCMA_RESET_ST                   0x0804
 
 /* BCMA PCI config space registers. */
 #define BCMA_PCI_PMCSR                  0x44
diff --git a/include/linux/cn_proc.h b/include/linux/cn_proc.h
index 2c1bc1ea04ee..1d5b02a96c46 100644
--- a/include/linux/cn_proc.h
+++ b/include/linux/cn_proc.h
@@ -26,6 +26,7 @@ void proc_id_connector(struct task_struct *task, int which_id);
 void proc_sid_connector(struct task_struct *task);
 void proc_ptrace_connector(struct task_struct *task, int which_id);
 void proc_comm_connector(struct task_struct *task);
+void proc_coredump_connector(struct task_struct *task);
 void proc_exit_connector(struct task_struct *task);
 #else
 static inline void proc_fork_connector(struct task_struct *task)
@@ -48,6 +49,9 @@ static inline void proc_ptrace_connector(struct task_struct *task,
                                          int ptrace_id)
 {}
 
+static inline void proc_coredump_connector(struct task_struct *task)
+{}
+
 static inline void proc_exit_connector(struct task_struct *task)
 {}
 #endif  /* CONFIG_PROC_EVENTS */
diff --git a/include/linux/filter.h b/include/linux/filter.h
index c45eabc135e1..c050dcc322a4 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -48,8 +48,22 @@ extern int sk_chk_filter(struct sock_filter *filter, unsigned int flen);
 extern int sk_get_filter(struct sock *sk, struct sock_filter __user *filter, unsigned len);
 
 #ifdef CONFIG_BPF_JIT
+#include <stdarg.h>
+#include <linux/linkage.h>
+#include <linux/printk.h>
+
 extern void bpf_jit_compile(struct sk_filter *fp);
 extern void bpf_jit_free(struct sk_filter *fp);
+
+static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+                                u32 pass, void *image)
+{
+        pr_err("flen=%u proglen=%u pass=%u image=%p\n",
+               flen, proglen, pass, image);
+        if (image)
+                print_hex_dump(KERN_ERR, "JIT code: ", DUMP_PREFIX_ADDRESS,
+                               16, 1, image, proglen, false);
+}
 #define SK_RUN_FILTER(FILTER, SKB) (*FILTER->bpf_func)(SKB, FILTER->insns)
 #else
 static inline void bpf_jit_compile(struct sk_filter *fp)
@@ -126,6 +140,7 @@ enum {
         BPF_S_ANC_SECCOMP_LD_W,
         BPF_S_ANC_VLAN_TAG,
         BPF_S_ANC_VLAN_TAG_PRESENT,
+        BPF_S_ANC_PAY_OFFSET,
 };
 
 #endif /* __LINUX_FILTER_H__ */
diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h
index b4f6c29caced..630f45335c73 100644
--- a/include/linux/icmpv6.h
+++ b/include/linux/icmpv6.h
@@ -11,9 +11,21 @@ static inline struct icmp6hdr *icmp6_hdr(const struct sk_buff *skb)
 
 #include <linux/netdevice.h>
 
-extern void                             icmpv6_send(struct sk_buff *skb,
-                                                    u8 type, u8 code,
-                                                    __u32 info);
+#if IS_ENABLED(CONFIG_IPV6)
+extern void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info);
+
+typedef void ip6_icmp_send_t(struct sk_buff *skb, u8 type, u8 code, __u32 info);
+extern int inet6_register_icmp_sender(ip6_icmp_send_t *fn);
+extern int inet6_unregister_icmp_sender(ip6_icmp_send_t *fn);
+
+#else
+
+static inline void icmpv6_send(struct sk_buff *skb,
+                               u8 type, u8 code, __u32 info)
+{
+
+}
+#endif
 
 extern int                              icmpv6_init(void);
 extern int                              icmpv6_err_convert(u8 type, u8 code,
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 7e24fe0cfbcd..06b0ed0154a4 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -113,6 +113,34 @@
 #define IEEE80211_CTL_EXT_SSW_FBACK     0x9000
 #define IEEE80211_CTL_EXT_SSW_ACK       0xa000
 
+
+#define IEEE80211_SN_MASK               ((IEEE80211_SCTL_SEQ) >> 4)
+#define IEEE80211_MAX_SN                IEEE80211_SN_MASK
+#define IEEE80211_SN_MODULO             (IEEE80211_MAX_SN + 1)
+
+static inline int ieee80211_sn_less(u16 sn1, u16 sn2)
+{
+        return ((sn1 - sn2) & IEEE80211_SN_MASK) > (IEEE80211_SN_MODULO >> 1);
+}
+
+static inline u16 ieee80211_sn_add(u16 sn1, u16 sn2)
+{
+        return (sn1 + sn2) & IEEE80211_SN_MASK;
+}
+
+static inline u16 ieee80211_sn_inc(u16 sn)
+{
+        return ieee80211_sn_add(sn, 1);
+}
+
+static inline u16 ieee80211_sn_sub(u16 sn1, u16 sn2)
+{
+        return (sn1 - sn2) & IEEE80211_SN_MASK;
+}
+
+#define IEEE80211_SEQ_TO_SN(seq)        (((seq) & IEEE80211_SCTL_SEQ) >> 4)
+#define IEEE80211_SN_TO_SEQ(ssn)        (((ssn) << 4) & IEEE80211_SCTL_SEQ)
+
 /* miscellaneous IEEE 802.11 constants */
 #define IEEE80211_MAX_FRAG_THRESHOLD    2352
 #define IEEE80211_MAX_RTS_THRESHOLD     2353
@@ -185,7 +213,7 @@ struct ieee80211_hdr {
         u8 addr3[6];
         __le16 seq_ctrl;
         u8 addr4[6];
-} __packed;
+} __packed __aligned(2);
 
 struct ieee80211_hdr_3addr {
         __le16 frame_control;
@@ -194,7 +222,7 @@ struct ieee80211_hdr_3addr {
         u8 addr2[6];
         u8 addr3[6];
         __le16 seq_ctrl;
-} __packed;
+} __packed __aligned(2);
 
 struct ieee80211_qos_hdr {
         __le16 frame_control;
@@ -204,7 +232,7 @@ struct ieee80211_qos_hdr {
         u8 addr3[6];
         __le16 seq_ctrl;
         __le16 qos_ctrl;
-} __packed;
+} __packed __aligned(2);
 
 /**
  * ieee80211_has_tods - check if IEEE80211_FCTL_TODS is set
@@ -581,7 +609,7 @@ struct ieee80211s_hdr {
         __le32 seqnum;
         u8 eaddr1[6];
         u8 eaddr2[6];
-} __packed;
+} __packed __aligned(2);
 
 /* Mesh flags */
 #define MESH_FLAGS_AE_A4        0x1
@@ -645,6 +673,36 @@ struct ieee80211_channel_sw_ie {
 } __packed;
 
 /**
+ * struct ieee80211_ext_chansw_ie
+ *
+ * This structure represents the "Extended Channel Switch Announcement element"
+ */
+struct ieee80211_ext_chansw_ie {
+        u8 mode;
+        u8 new_operating_class;
+        u8 new_ch_num;
+        u8 count;
+} __packed;
+
+/**
+ * struct ieee80211_sec_chan_offs_ie - secondary channel offset IE
+ * @sec_chan_offs: secondary channel offset, uses IEEE80211_HT_PARAM_CHA_SEC_*
+ *      values here
+ * This structure represents the "Secondary Channel Offset element"
+ */
+struct ieee80211_sec_chan_offs_ie {
+        u8 sec_chan_offs;
+} __packed;
+
+/**
+ * struct ieee80211_wide_bw_chansw_ie - wide bandwidth channel switch IE
+ */
+struct ieee80211_wide_bw_chansw_ie {
+        u8 new_channel_width;
+        u8 new_center_freq_seg0, new_center_freq_seg1;
+} __packed;
+
+/**
  * struct ieee80211_tim
  *
  * This structure refers to "Traffic Indication Map information element"
@@ -812,12 +870,15 @@ struct ieee80211_mgmt {
                                 } __packed wme_action;
                                 struct{
                                         u8 action_code;
-                                        u8 element_id;
-                                        u8 length;
-                                        struct ieee80211_channel_sw_ie sw_elem;
+                                        u8 variable[0];
                                 } __packed chan_switch;
                                 struct{
                                         u8 action_code;
+                                        struct ieee80211_ext_chansw_ie data;
+                                        u8 variable[0];
+                                } __packed ext_chan_switch;
+                                struct{
+                                        u8 action_code;
                                         u8 dialog_token;
                                         u8 element_id;
                                         u8 length;
@@ -875,7 +936,7 @@ struct ieee80211_mgmt {
                         } u;
                 } __packed action;
         } u;
-} __packed;
+} __packed __aligned(2);
 
 /* Supported Rates value encodings in 802.11n-2009 7.3.2.2 */
 #define BSS_MEMBERSHIP_SELECTOR_HT_PHY  127
@@ -906,20 +967,20 @@ struct ieee80211_rts {
         __le16 duration;
         u8 ra[6];
         u8 ta[6];
-} __packed;
+} __packed __aligned(2);
 
 struct ieee80211_cts {
         __le16 frame_control;
         __le16 duration;
         u8 ra[6];
-} __packed;
+} __packed __aligned(2);
 
 struct ieee80211_pspoll {
         __le16 frame_control;
         __le16 aid;
         u8 bssid[6];
         u8 ta[6];
-} __packed;
+} __packed __aligned(2);
 
 /* TDLS */
 
@@ -999,6 +1060,26 @@ enum ieee80211_p2p_attr_id {
         IEEE80211_P2P_ATTR_MAX
 };
 
+/* Notice of Absence attribute - described in P2P spec 4.1.14 */
+/* Typical max value used here */
+#define IEEE80211_P2P_NOA_DESC_MAX      4
+
+struct ieee80211_p2p_noa_desc {
+        u8 count;
+        __le32 duration;
+        __le32 interval;
+        __le32 start_time;
+} __packed;
+
+struct ieee80211_p2p_noa_attr {
+        u8 index;
+        u8 oppps_ctwindow;
+        struct ieee80211_p2p_noa_desc desc[IEEE80211_P2P_NOA_DESC_MAX];
+} __packed;
+
+#define IEEE80211_P2P_OPPPS_ENABLE_BIT          BIT(7)
+#define IEEE80211_P2P_OPPPS_CTWINDOW_MASK       0x7F
+
 /**
  * struct ieee80211_bar - HT Block Ack Request
  *
@@ -1290,11 +1371,6 @@ struct ieee80211_vht_operation {
 } __packed;
 
 
-#define IEEE80211_VHT_MCS_ZERO_TO_SEVEN_SUPPORT 0
-#define IEEE80211_VHT_MCS_ZERO_TO_EIGHT_SUPPORT 1
-#define IEEE80211_VHT_MCS_ZERO_TO_NINE_SUPPORT  2
-#define IEEE80211_VHT_MCS_NOT_SUPPORTED 3
-
 /* 802.11ac VHT Capabilities */
 #define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895                  0x00000000
 #define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991                  0x00000001
@@ -1310,10 +1386,11 @@ struct ieee80211_vht_operation {
 #define IEEE80211_VHT_CAP_RXSTBC_2                              0x00000200
 #define IEEE80211_VHT_CAP_RXSTBC_3                              0x00000300
 #define IEEE80211_VHT_CAP_RXSTBC_4                              0x00000400
+#define IEEE80211_VHT_CAP_RXSTBC_MASK                           0x00000700
 #define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE                 0x00000800
 #define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE                 0x00001000
 #define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX               0x00006000
-#define IEEE80211_VHT_CAP_SOUNDING_DIMENTION_MAX                0x00030000
+#define IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MAX               0x00030000
 #define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE                 0x00080000
 #define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE                 0x00100000
 #define IEEE80211_VHT_CAP_VHT_TXOP_PS                           0x00200000
@@ -1594,6 +1671,7 @@ enum ieee80211_eid {
 
         WLAN_EID_HT_CAPABILITY = 45,
         WLAN_EID_HT_OPERATION = 61,
+        WLAN_EID_SECONDARY_CHANNEL_OFFSET = 62,
 
         WLAN_EID_RSN = 48,
         WLAN_EID_MMIE = 76,
@@ -1628,6 +1706,8 @@ enum ieee80211_eid {
         WLAN_EID_VHT_CAPABILITY = 191,
         WLAN_EID_VHT_OPERATION = 192,
         WLAN_EID_OPMODE_NOTIF = 199,
+        WLAN_EID_WIDE_BW_CHANNEL_SWITCH = 194,
+        WLAN_EID_CHANNEL_SWITCH_WRAPPER = 196,
 
         /* 802.11ad */
         WLAN_EID_NON_TX_BSSID_CAP =  83,
@@ -1751,6 +1831,7 @@ enum ieee80211_key_len {
 
 /* Public action codes */
 enum ieee80211_pub_actioncode {
+        WLAN_PUB_ACTION_EXT_CHANSW_ANN = 4,
         WLAN_PUB_ACTION_TDLS_DISCOVER_RES = 14,
 };
 
@@ -1911,6 +1992,16 @@ enum ieee80211_timeout_interval_type {
         WLAN_TIMEOUT_ASSOC_COMEBACK = 3 /* 802.11w */,
 };
 
+/**
+ * struct ieee80211_timeout_interval_ie - Timeout Interval element
+ * @type: type, see &enum ieee80211_timeout_interval_type
+ * @value: timeout interval value
+ */
+struct ieee80211_timeout_interval_ie {
+        u8 type;
+        __le32 value;
+} __packed;
+
 /* BACK action code */
 enum ieee80211_back_actioncode {
         WLAN_ACTION_ADDBA_REQ = 0,
diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
index 89b4614a4722..f563907ed776 100644
--- a/include/linux/if_arp.h
+++ b/include/linux/if_arp.h
@@ -33,7 +33,15 @@ static inline struct arphdr *arp_hdr(const struct sk_buff *skb)
 
 static inline int arp_hdr_len(struct net_device *dev)
 {
-        /* ARP header, plus 2 device addresses, plus 2 IP addresses. */
-        return sizeof(struct arphdr) + (dev->addr_len + sizeof(u32)) * 2;
+        switch (dev->type) {
+#if IS_ENABLED(CONFIG_FIREWIRE_NET)
+        case ARPHRD_IEEE1394:
+                /* ARP header, device address and 2 IP addresses */
+                return sizeof(struct arphdr) + dev->addr_len + sizeof(u32) * 2;
+#endif
+        default:
+                /* ARP header, plus 2 device addresses, plus 2 IP addresses. */
+                return sizeof(struct arphdr) + (dev->addr_len + sizeof(u32)) * 2;
+        }
 }
 #endif  /* _LINUX_IF_ARP_H */
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index cfd21e3d5506..4474557904f6 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -112,6 +112,10 @@ struct team_mode_ops {
         void (*port_disabled)(struct team *team, struct team_port *port);
 };
 
+extern int team_modeop_port_enter(struct team *team, struct team_port *port);
+extern void team_modeop_port_change_dev_addr(struct team *team,
+                                             struct team_port *port);
+
 enum team_option_type {
         TEAM_OPTION_TYPE_U32,
         TEAM_OPTION_TYPE_STRING,
@@ -236,7 +240,26 @@ static inline struct team_port *team_get_port_by_index_rcu(struct team *team,
         return NULL;
 }
 
-extern int team_port_set_team_dev_addr(struct team_port *port);
+static inline struct team_port *
+team_get_first_port_txable_rcu(struct team *team, struct team_port *port)
+{
+        struct team_port *cur;
+
+        if (likely(team_port_txable(port)))
+                return port;
+        cur = port;
+        list_for_each_entry_continue_rcu(cur, &team->port_list, list)
+                if (team_port_txable(port))
+                        return cur;
+        list_for_each_entry_rcu(cur, &team->port_list, list) {
+                if (cur == port)
+                        break;
+                if (team_port_txable(port))
+                        return cur;
+        }
+        return NULL;
+}
+
 extern int team_options_register(struct team *team,
                                  const struct team_option *option,
                                  size_t option_count);
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 218a3b686d90..52bd03b38962 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -86,15 +86,15 @@ static inline int is_vlan_dev(struct net_device *dev)
 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
 
 extern struct net_device *__vlan_find_dev_deep(struct net_device *real_dev,
-                                               u16 vlan_id);
+                                               __be16 vlan_proto, u16 vlan_id);
 extern struct net_device *vlan_dev_real_dev(const struct net_device *dev);
 extern u16 vlan_dev_vlan_id(const struct net_device *dev);
 
 extern bool vlan_do_receive(struct sk_buff **skb);
 extern struct sk_buff *vlan_untag(struct sk_buff *skb);
 
-extern int vlan_vid_add(struct net_device *dev, unsigned short vid);
-extern void vlan_vid_del(struct net_device *dev, unsigned short vid);
+extern int vlan_vid_add(struct net_device *dev, __be16 proto, u16 vid);
+extern void vlan_vid_del(struct net_device *dev, __be16 proto, u16 vid);
 
 extern int vlan_vids_add_by_dev(struct net_device *dev,
                                 const struct net_device *by_dev);
@@ -104,7 +104,8 @@ extern void vlan_vids_del_by_dev(struct net_device *dev,
 extern bool vlan_uses_dev(const struct net_device *dev);
 #else
 static inline struct net_device *
-__vlan_find_dev_deep(struct net_device *real_dev, u16 vlan_id)
+__vlan_find_dev_deep(struct net_device *real_dev,
+                     __be16 vlan_proto, u16 vlan_id)
 {
         return NULL;
 }
@@ -131,12 +132,12 @@ static inline struct sk_buff *vlan_untag(struct sk_buff *skb)
         return skb;
 }
 
-static inline int vlan_vid_add(struct net_device *dev, unsigned short vid)
+static inline int vlan_vid_add(struct net_device *dev, __be16 proto, u16 vid)
 {
         return 0;
 }
 
-static inline void vlan_vid_del(struct net_device *dev, unsigned short vid)
+static inline void vlan_vid_del(struct net_device *dev, __be16 proto, u16 vid)
 {
 }
 
@@ -157,9 +158,20 @@ static inline bool vlan_uses_dev(const struct net_device *dev)
 }
 #endif
 
+static inline bool vlan_hw_offload_capable(netdev_features_t features,
+                                           __be16 proto)
+{
+        if (proto == htons(ETH_P_8021Q) && features & NETIF_F_HW_VLAN_CTAG_TX)
+                return true;
+        if (proto == htons(ETH_P_8021AD) && features & NETIF_F_HW_VLAN_STAG_TX)
+                return true;
+        return false;
+}
+
 /**
  * vlan_insert_tag - regular VLAN tag inserting
  * @skb: skbuff to tag
+ * @vlan_proto: VLAN encapsulation protocol
  * @vlan_tci: VLAN TCI to insert
  *
  * Inserts the VLAN tag into @skb as part of the payload
@@ -170,7 +182,8 @@ static inline bool vlan_uses_dev(const struct net_device *dev)
  *
  * Does not change skb->protocol so this function can be used during receive.
  */
-static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb, u16 vlan_tci)
+static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb,
+                                              __be16 vlan_proto, u16 vlan_tci)
 {
         struct vlan_ethhdr *veth;
 
@@ -185,7 +198,7 @@ static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb, u16 vlan_tci)
         skb->mac_header -= VLAN_HLEN;
 
         /* first, the ethernet type */
-        veth->h_vlan_proto = htons(ETH_P_8021Q);
+        veth->h_vlan_proto = vlan_proto;
 
         /* now, the TCI */
         veth->h_vlan_TCI = htons(vlan_tci);
@@ -204,24 +217,28 @@ static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb, u16 vlan_tci)
  * Following the skb_unshare() example, in case of error, the calling function
  * doesn't have to worry about freeing the original skb.
  */
-static inline struct sk_buff *__vlan_put_tag(struct sk_buff *skb, u16 vlan_tci)
+static inline struct sk_buff *__vlan_put_tag(struct sk_buff *skb,
+                                             __be16 vlan_proto, u16 vlan_tci)
 {
-        skb = vlan_insert_tag(skb, vlan_tci);
+        skb = vlan_insert_tag(skb, vlan_proto, vlan_tci);
         if (skb)
-                skb->protocol = htons(ETH_P_8021Q);
+                skb->protocol = vlan_proto;
         return skb;
 }
 
 /**
  * __vlan_hwaccel_put_tag - hardware accelerated VLAN inserting
  * @skb: skbuff to tag
+ * @vlan_proto: VLAN encapsulation protocol
  * @vlan_tci: VLAN TCI to insert
  *
  * Puts the VLAN TCI in @skb->vlan_tci and lets the device do the rest
  */
 static inline struct sk_buff *__vlan_hwaccel_put_tag(struct sk_buff *skb,
+                                                     __be16 vlan_proto,
                                                      u16 vlan_tci)
 {
+        skb->vlan_proto = vlan_proto;
         skb->vlan_tci = VLAN_TAG_PRESENT | vlan_tci;
         return skb;
 }
@@ -236,12 +253,13 @@ static inline struct sk_buff *__vlan_hwaccel_put_tag(struct sk_buff *skb,
  * Assumes skb->dev is the target that will xmit this frame.
  * Returns a VLAN tagged skb.
  */
-static inline struct sk_buff *vlan_put_tag(struct sk_buff *skb, u16 vlan_tci)
+static inline struct sk_buff *vlan_put_tag(struct sk_buff *skb,
+                                           __be16 vlan_proto, u16 vlan_tci)
 {
-        if (skb->dev->features & NETIF_F_HW_VLAN_TX) {
-                return __vlan_hwaccel_put_tag(skb, vlan_tci);
+        if (vlan_hw_offload_capable(skb->dev->features, vlan_proto)) {
+                return __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
         } else {
-                return __vlan_put_tag(skb, vlan_tci);
+                return __vlan_put_tag(skb, vlan_proto, vlan_tci);
         }
 }
 
@@ -256,9 +274,9 @@ static inline int __vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)
 {
         struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb->data;
 
-        if (veth->h_vlan_proto != htons(ETH_P_8021Q)) {
+        if (veth->h_vlan_proto != htons(ETH_P_8021Q) &&
+            veth->h_vlan_proto != htons(ETH_P_8021AD))
                 return -EINVAL;
-        }
 
         *vlan_tci = ntohs(veth->h_vlan_TCI);
         return 0;
@@ -294,7 +312,7 @@ static inline int __vlan_hwaccel_get_tag(const struct sk_buff *skb,
  */
 static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)
 {
-        if (skb->dev->features & NETIF_F_HW_VLAN_TX) {
+        if (skb->dev->features & NETIF_F_HW_VLAN_CTAG_TX) {
                 return __vlan_hwaccel_get_tag(skb, vlan_tci);
         } else {
                 return __vlan_get_tag(skb, vlan_tci);
@@ -339,7 +357,7 @@ static inline void vlan_set_encap_proto(struct sk_buff *skb,
          */
 
         proto = vhdr->h_vlan_encapsulated_proto;
-        if (ntohs(proto) >= 1536) {
+        if (ntohs(proto) >= ETH_P_802_3_MIN) {
                 skb->protocol = proto;
                 return;
         }
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index e83512f63df5..bbca12804d12 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -330,6 +330,24 @@ static inline ktime_t ktime_sub_us(const ktime_t kt, const u64 usec)
 
 extern ktime_t ktime_add_safe(const ktime_t lhs, const ktime_t rhs);
 
+/**
+ * ktime_to_timespec_cond - convert a ktime_t variable to timespec
+ *                          format only if the variable contains data
+ * @kt:         the ktime_t variable to convert
+ * @ts:         the timespec variable to store the result in
+ *
+ * Returns true if there was a successful conversion, false if kt was 0.
+ */
+static inline bool ktime_to_timespec_cond(const ktime_t kt, struct timespec *ts)
+{
+        if (kt.tv64) {
+                *ts = ktime_to_timespec(kt);
+                return true;
+        } else {
+                return false;
+        }
+}
+
 /*
  * The resolution of the clocks. The resolution value is returned in
  * the clock_getres() system call to give application programmers an
diff --git a/include/linux/micrel_phy.h b/include/linux/micrel_phy.h
index 9dbb41a4e250..8752dbbc6135 100644
--- a/include/linux/micrel_phy.h
+++ b/include/linux/micrel_phy.h
@@ -19,6 +19,7 @@
 #define PHY_ID_KSZ9021          0x00221610
 #define PHY_ID_KS8737           0x00221720
 #define PHY_ID_KSZ8021          0x00221555
+#define PHY_ID_KSZ8031          0x00221556
 #define PHY_ID_KSZ8041          0x00221510
 #define PHY_ID_KSZ8051          0x00221550
 /* same id: ks8001 Rev. A/B, and ks8721 Rev 3. */
diff --git a/include/linux/mlx4/cmd.h b/include/linux/mlx4/cmd.h
index 260695186256..adf6e0648f20 100644
--- a/include/linux/mlx4/cmd.h
+++ b/include/linux/mlx4/cmd.h
@@ -34,6 +34,7 @@
 #define MLX4_CMD_H
 
 #include <linux/dma-mapping.h>
+#include <linux/if_link.h>
 
 enum {
         /* initialization and general commands */
@@ -232,6 +233,11 @@ struct mlx4_cmd_mailbox *mlx4_alloc_cmd_mailbox(struct mlx4_dev *dev);
 void mlx4_free_cmd_mailbox(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox);
 
 u32 mlx4_comm_get_version(void);
+int mlx4_set_vf_mac(struct mlx4_dev *dev, int port, int vf, u64 mac);
+int mlx4_set_vf_vlan(struct mlx4_dev *dev, int port, int vf, u16 vlan, u8 qos);
+int mlx4_set_vf_spoofchk(struct mlx4_dev *dev, int port, int vf, bool setting);
+int mlx4_get_vf_config(struct mlx4_dev *dev, int port, int vf, struct ifla_vf_info *ivf);
+
 
 #define MLX4_COMM_GET_IF_REV(cmd_chan_ver) (u8)((cmd_chan_ver) >> 8)
 
diff --git a/include/linux/mlx4/cq.h b/include/linux/mlx4/cq.h
index 6f65b2c8bb89..98fa492cf406 100644
--- a/include/linux/mlx4/cq.h
+++ b/include/linux/mlx4/cq.h
@@ -64,6 +64,22 @@ struct mlx4_err_cqe {
         u8                      owner_sr_opcode;
 };
 
+struct mlx4_ts_cqe {
+        __be32                  vlan_my_qpn;
+        __be32                  immed_rss_invalid;
+        __be32                  g_mlpath_rqpn;
+        __be32                  timestamp_hi;
+        __be16                  status;
+        u8                      ipv6_ext_mask;
+        u8                      badfcs_enc;
+        __be32                  byte_cnt;
+        __be16                  wqe_index;
+        __be16                  checksum;
+        u8                      reserved;
+        __be16                  timestamp_lo;
+        u8                      owner_sr_opcode;
+} __packed;
+
 enum {
         MLX4_CQE_VLAN_PRESENT_MASK      = 1 << 29,
         MLX4_CQE_QPN_MASK               = 0xffffff,
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 811f91cf5e8c..53acaf64189f 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -40,6 +40,8 @@
 
 #include <linux/atomic.h>
 
+#include <linux/clocksource.h>
+
 #define MAX_MSIX_P_PORT         17
 #define MAX_MSIX                64
 #define MSIX_LEGACY_SZ          4
@@ -140,6 +142,7 @@ enum {
         MLX4_DEV_CAP_FLAG_VEP_UC_STEER  = 1LL << 41,
         MLX4_DEV_CAP_FLAG_VEP_MC_STEER  = 1LL << 42,
         MLX4_DEV_CAP_FLAG_COUNTERS      = 1LL << 48,
+        MLX4_DEV_CAP_FLAG_SET_ETH_SCHED = 1LL << 53,
         MLX4_DEV_CAP_FLAG_SENSE_SUPPORT = 1LL << 55,
         MLX4_DEV_CAP_FLAG_PORT_MNG_CHG_EV = 1LL << 59,
         MLX4_DEV_CAP_FLAG_64B_EQE       = 1LL << 61,
@@ -151,7 +154,10 @@ enum {
         MLX4_DEV_CAP_FLAG2_RSS_TOP              = 1LL <<  1,
         MLX4_DEV_CAP_FLAG2_RSS_XOR              = 1LL <<  2,
         MLX4_DEV_CAP_FLAG2_FS_EN                = 1LL <<  3,
-        MLX4_DEV_CAP_FLAGS2_REASSIGN_MAC_EN     = 1LL <<  4
+        MLX4_DEV_CAP_FLAGS2_REASSIGN_MAC_EN     = 1LL <<  4,
+        MLX4_DEV_CAP_FLAG2_TS                   = 1LL <<  5,
+        MLX4_DEV_CAP_FLAG2_VLAN_CONTROL         = 1LL <<  6,
+        MLX4_DEV_CAP_FLAG2_FSM                  = 1LL <<  7
 };
 
 enum {
@@ -443,6 +449,7 @@ struct mlx4_caps {
         u8                      eqe_factor;
         u32                     userspace_caps; /* userspace must be aware of these */
         u32                     function_caps;  /* VFs must be aware of these */
+        u16                     hca_core_clock;
 };
 
 struct mlx4_buf_list {
@@ -837,7 +844,7 @@ void mlx4_free_hwq_res(struct mlx4_dev *mdev, struct mlx4_hwq_resources *wqres,
 
 int mlx4_cq_alloc(struct mlx4_dev *dev, int nent, struct mlx4_mtt *mtt,
                   struct mlx4_uar *uar, u64 db_rec, struct mlx4_cq *cq,
-                  unsigned vector, int collapsed);
+                  unsigned vector, int collapsed, int timestamp_en);
 void mlx4_cq_free(struct mlx4_dev *dev, struct mlx4_cq *cq);
 
 int mlx4_qp_reserve_range(struct mlx4_dev *dev, int cnt, int align, int *base);
@@ -1028,4 +1035,6 @@ int set_and_calc_slave_port_state(struct mlx4_dev *dev, int slave, u8 port, int
 void mlx4_put_slave_node_guid(struct mlx4_dev *dev, int slave, __be64 guid);
 __be64 mlx4_get_slave_node_guid(struct mlx4_dev *dev, int slave);
 
+cycle_t mlx4_read_clock(struct mlx4_dev *dev);
+
 #endif /* MLX4_DEVICE_H */
diff --git a/include/linux/mv643xx_eth.h b/include/linux/mv643xx_eth.h
index 49258e0ed1c6..141d395bbb5f 100644
--- a/include/linux/mv643xx_eth.h
+++ b/include/linux/mv643xx_eth.h
@@ -19,7 +19,6 @@
 
 struct mv643xx_eth_shared_platform_data {
         struct mbus_dram_target_info    *dram;
-        struct platform_device  *shared_smi;
         /*
          * Max packet size for Tx IP/Layer 4 checksum, when set to 0, default
          * limit of 9KiB will be used.
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 3dd39340430e..cbaa027ef5a7 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -22,9 +22,12 @@ enum {
         NETIF_F_IPV6_CSUM_BIT,          /* Can checksum TCP/UDP over IPV6 */
         NETIF_F_HIGHDMA_BIT,            /* Can DMA to high memory. */
         NETIF_F_FRAGLIST_BIT,           /* Scatter/gather IO. */
-        NETIF_F_HW_VLAN_TX_BIT,         /* Transmit VLAN hw acceleration */
-        NETIF_F_HW_VLAN_RX_BIT,         /* Receive VLAN hw acceleration */
-        NETIF_F_HW_VLAN_FILTER_BIT,     /* Receive filtering on VLAN */
+        NETIF_F_HW_VLAN_CTAG_TX_BIT,    /* Transmit VLAN CTAG HW acceleration */
+        NETIF_F_HW_VLAN_CTAG_RX_BIT,    /* Receive VLAN CTAG HW acceleration */
+        NETIF_F_HW_VLAN_CTAG_FILTER_BIT,/* Receive filtering on VLAN CTAGs */
+        NETIF_F_HW_VLAN_STAG_TX_BIT,    /* Transmit VLAN STAG HW acceleration */
+        NETIF_F_HW_VLAN_STAG_RX_BIT,    /* Receive VLAN STAG HW acceleration */
+        NETIF_F_HW_VLAN_STAG_FILTER_BIT,/* Receive filtering on VLAN STAGs */
         NETIF_F_VLAN_CHALLENGED_BIT,    /* Device cannot handle VLAN packets */
         NETIF_F_GSO_BIT,                /* Enable software GSO. */
         NETIF_F_LLTX_BIT,               /* LockLess TX - deprecated. Please */
@@ -42,9 +45,9 @@ enum {
         NETIF_F_TSO6_BIT,               /* ... TCPv6 segmentation */
         NETIF_F_FSO_BIT,                /* ... FCoE segmentation */
         NETIF_F_GSO_GRE_BIT,            /* ... GRE with TSO */
-        /**/NETIF_F_GSO_LAST,           /* [can't be last bit, see GSO_MASK] */
-        NETIF_F_GSO_RESERVED2           /* ... free (fill GSO_MASK to 8 bits) */
-                = NETIF_F_GSO_LAST,
+        NETIF_F_GSO_UDP_TUNNEL_BIT,     /* ... UDP TUNNEL with TSO */
+        /**/NETIF_F_GSO_LAST =          /* last bit, see GSO_MASK */
+                NETIF_F_GSO_UDP_TUNNEL_BIT,
 
         NETIF_F_FCOE_CRC_BIT,           /* FCoE CRC32 */
         NETIF_F_SCTP_CSUM_BIT,          /* SCTP checksum offload */
@@ -80,9 +83,12 @@ enum {
 #define NETIF_F_GSO_ROBUST      __NETIF_F(GSO_ROBUST)
 #define NETIF_F_HIGHDMA         __NETIF_F(HIGHDMA)
 #define NETIF_F_HW_CSUM         __NETIF_F(HW_CSUM)
-#define NETIF_F_HW_VLAN_FILTER  __NETIF_F(HW_VLAN_FILTER)
-#define NETIF_F_HW_VLAN_RX      __NETIF_F(HW_VLAN_RX)
-#define NETIF_F_HW_VLAN_TX      __NETIF_F(HW_VLAN_TX)
+#define NETIF_F_HW_VLAN_CTAG_FILTER __NETIF_F(HW_VLAN_CTAG_FILTER)
+#define NETIF_F_HW_VLAN_CTAG_RX __NETIF_F(HW_VLAN_CTAG_RX)
+#define NETIF_F_HW_VLAN_CTAG_TX __NETIF_F(HW_VLAN_CTAG_TX)
+#define NETIF_F_HW_VLAN_STAG_FILTER __NETIF_F(HW_VLAN_STAG_FILTER)
+#define NETIF_F_HW_VLAN_STAG_RX __NETIF_F(HW_VLAN_STAG_RX)
+#define NETIF_F_HW_VLAN_STAG_TX __NETIF_F(HW_VLAN_STAG_TX)
 #define NETIF_F_IP_CSUM         __NETIF_F(IP_CSUM)
 #define NETIF_F_IPV6_CSUM       __NETIF_F(IPV6_CSUM)
 #define NETIF_F_LLTX            __NETIF_F(LLTX)
@@ -102,7 +108,8 @@ enum {
 #define NETIF_F_VLAN_CHALLENGED __NETIF_F(VLAN_CHALLENGED)
 #define NETIF_F_RXFCS           __NETIF_F(RXFCS)
 #define NETIF_F_RXALL           __NETIF_F(RXALL)
-#define NETIF_F_GRE_GSO         __NETIF_F(GSO_GRE)
+#define NETIF_F_GSO_GRE         __NETIF_F(GSO_GRE)
+#define NETIF_F_GSO_UDP_TUNNEL  __NETIF_F(GSO_UDP_TUNNEL)
 
 /* Features valid for ethtool to change */
 /* = all defined minus driver/device-class-related */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 6151e903eef0..f8898a435dc5 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -144,8 +144,6 @@ static inline bool dev_xmit_complete(int rc)
 # else
 #  define LL_MAX_HEADER 96
 # endif
-#elif IS_ENABLED(CONFIG_TR)
-# define LL_MAX_HEADER 48
 #else
 # define LL_MAX_HEADER 32
 #endif
@@ -211,6 +209,7 @@ struct netdev_hw_addr {
 #define NETDEV_HW_ADDR_T_UNICAST        4
 #define NETDEV_HW_ADDR_T_MULTICAST      5
         bool                    global_use;
+        int                     sync_cnt;
         int                     refcount;
         int                     synced;
         struct rcu_head         rcu_head;
@@ -785,13 +784,13 @@ struct netdev_fcoe_hbainfo {
  *      3. Update dev->stats asynchronously and atomically, and define
  *         neither operation.
  *
- * int (*ndo_vlan_rx_add_vid)(struct net_device *dev, unsigned short vid);
- *      If device support VLAN filtering (dev->features & NETIF_F_HW_VLAN_FILTER)
- *      this function is called when a VLAN id is registered.
+ * int (*ndo_vlan_rx_add_vid)(struct net_device *dev, __be16 proto, u16t vid);
+ *      If device support VLAN filtering this function is called when a
+ *      VLAN id is registered.
  *
  * int (*ndo_vlan_rx_kill_vid)(struct net_device *dev, unsigned short vid);
- *      If device support VLAN filtering (dev->features & NETIF_F_HW_VLAN_FILTER)
- *      this function is called when a VLAN id is unregistered.
+ *      If device support VLAN filtering this function is called when a
+ *      VLAN id is unregistered.
  *
  * void (*ndo_poll_controller)(struct net_device *dev);
  *
@@ -935,9 +934,9 @@ struct net_device_ops {
         struct net_device_stats* (*ndo_get_stats)(struct net_device *dev);
 
         int                     (*ndo_vlan_rx_add_vid)(struct net_device *dev,
-                                                       unsigned short vid);
+                                                       __be16 proto, u16 vid);
         int                     (*ndo_vlan_rx_kill_vid)(struct net_device *dev,
-                                                        unsigned short vid);
+                                                        __be16 proto, u16 vid);
 #ifdef CONFIG_NET_POLL_CONTROLLER
         void                    (*ndo_poll_controller)(struct net_device *dev);
         int                     (*ndo_netpoll_setup)(struct net_device *dev,
@@ -1073,6 +1072,8 @@ struct net_device {
         struct list_head        dev_list;
         struct list_head        napi_list;
         struct list_head        unreg_list;
+        struct list_head        upper_dev_list; /* List of upper devices */
+
 
         /* currently active device features */
         netdev_features_t       features;
@@ -1145,6 +1146,13 @@ struct net_device {
         spinlock_t              addr_list_lock;
         struct netdev_hw_addr_list      uc;     /* Unicast mac addresses */
         struct netdev_hw_addr_list      mc;     /* Multicast mac addresses */
+        struct netdev_hw_addr_list      dev_addrs; /* list of device
+                                                    * hw addresses
+                                                    */
+#ifdef CONFIG_SYSFS
+        struct kset             *queues_kset;
+#endif
+
         bool                    uc_promisc;
         unsigned int            promiscuity;
         unsigned int            allmulti;
@@ -1177,21 +1185,11 @@ struct net_device {
                                                  * avoid dirtying this cache line.
                                                  */
 
-        struct list_head        upper_dev_list; /* List of upper devices */
-
         /* Interface address info used in eth_type_trans() */
         unsigned char           *dev_addr;      /* hw address, (before bcast
                                                    because most packets are
                                                    unicast) */
 
-        struct netdev_hw_addr_list      dev_addrs; /* list of device
-                                                      hw addresses */
-
-        unsigned char           broadcast[MAX_ADDR_LEN];        /* hw bcast add */
-
-#ifdef CONFIG_SYSFS
-        struct kset             *queues_kset;
-#endif
 
 #ifdef CONFIG_RPS
         struct netdev_rx_queue  *_rx;
@@ -1202,18 +1200,14 @@ struct net_device {
         /* Number of RX queues currently active in device */
         unsigned int            real_num_rx_queues;
 
-#ifdef CONFIG_RFS_ACCEL
-        /* CPU reverse-mapping for RX completion interrupts, indexed
-         * by RX queue number.  Assigned by driver.  This must only be
-         * set if the ndo_rx_flow_steer operation is defined. */
-        struct cpu_rmap         *rx_cpu_rmap;
-#endif
 #endif
 
         rx_handler_func_t __rcu *rx_handler;
         void __rcu              *rx_handler_data;
 
         struct netdev_queue __rcu *ingress_queue;
+        unsigned char           broadcast[MAX_ADDR_LEN];        /* hw bcast add */
+
 
 /*
  * Cache lines mostly used on transmit path
@@ -1235,6 +1229,12 @@ struct net_device {
 #ifdef CONFIG_XPS
         struct xps_dev_maps __rcu *xps_maps;
 #endif
+#ifdef CONFIG_RFS_ACCEL
+        /* CPU reverse-mapping for RX completion interrupts, indexed
+         * by RX queue number.  Assigned by driver.  This must only be
+         * set if the ndo_rx_flow_steer operation is defined. */
+        struct cpu_rmap         *rx_cpu_rmap;
+#endif
 
         /* These may be needed for future network-power-down code. */
 
@@ -1475,6 +1475,11 @@ static inline void *netdev_priv(const struct net_device *dev)
  */
 #define SET_NETDEV_DEVTYPE(net, devtype)        ((net)->dev.type = (devtype))
 
+/* Default NAPI poll() weight
+ * Device drivers are strongly advised to not use bigger value
+ */
+#define NAPI_POLL_WEIGHT 64
+
 /**
  *      netif_napi_add - initialize a napi context
  *      @dev:  network device
@@ -1612,6 +1617,9 @@ extern seqcount_t	devnet_rename_seq;	/* Device rename seq */
                 list_for_each_entry_continue(d, &(net)->dev_base_head, dev_list)
 #define for_each_netdev_continue_rcu(net, d)            \
         list_for_each_entry_continue_rcu(d, &(net)->dev_base_head, dev_list)
+#define for_each_netdev_in_bond_rcu(bond, slave)        \
+                for_each_netdev_rcu(&init_net, slave)   \
+                        if (netdev_master_upper_dev_get_rcu(slave) == bond)
 #define net_device_entry(lh)    list_entry(lh, struct net_device, dev_list)
 
 static inline struct net_device *next_net_device(struct net_device *dev)
@@ -1684,7 +1692,6 @@ extern int 		netdev_refcnt_read(const struct net_device *dev);
 extern void             free_netdev(struct net_device *dev);
 extern void             synchronize_net(void);
 extern int              init_dummy_netdev(struct net_device *dev);
-extern void             netdev_resync_ops(struct net_device *dev);
 
 extern struct net_device        *dev_get_by_index(struct net *net, int ifindex);
 extern struct net_device        *__dev_get_by_index(struct net *net, int ifindex);
@@ -2621,6 +2628,7 @@ extern int dev_uc_add(struct net_device *dev, const unsigned char *addr);
 extern int dev_uc_add_excl(struct net_device *dev, const unsigned char *addr);
 extern int dev_uc_del(struct net_device *dev, const unsigned char *addr);
 extern int dev_uc_sync(struct net_device *to, struct net_device *from);
+extern int dev_uc_sync_multiple(struct net_device *to, struct net_device *from);
 extern void dev_uc_unsync(struct net_device *to, struct net_device *from);
 extern void dev_uc_flush(struct net_device *dev);
 extern void dev_uc_init(struct net_device *dev);
@@ -2632,6 +2640,7 @@ extern int dev_mc_add_excl(struct net_device *dev, const unsigned char *addr);
 extern int dev_mc_del(struct net_device *dev, const unsigned char *addr);
 extern int dev_mc_del_global(struct net_device *dev, const unsigned char *addr);
 extern int dev_mc_sync(struct net_device *to, struct net_device *from);
+extern int dev_mc_sync_multiple(struct net_device *to, struct net_device *from);
 extern void dev_mc_unsync(struct net_device *to, struct net_device *from);
 extern void dev_mc_flush(struct net_device *dev);
 extern void dev_mc_init(struct net_device *dev);
@@ -2678,6 +2687,19 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, netdev_features_t features)
 {
         return __skb_gso_segment(skb, features, true);
 }
+__be16 skb_network_protocol(struct sk_buff *skb);
+
+static inline bool can_checksum_protocol(netdev_features_t features,
+                                         __be16 protocol)
+{
+        return ((features & NETIF_F_GEN_CSUM) ||
+                ((features & NETIF_F_V4_CSUM) &&
+                 protocol == htons(ETH_P_IP)) ||
+                ((features & NETIF_F_V6_CSUM) &&
+                 protocol == htons(ETH_P_IPV6)) ||
+                ((features & NETIF_F_FCOE_CRC) &&
+                 protocol == htons(ETH_P_FCOE)));
+}
 
 #ifdef CONFIG_BUG
 extern void netdev_rx_csum_fault(struct net_device *dev);
@@ -2756,6 +2778,11 @@ static inline void netif_set_gso_max_size(struct net_device *dev,
         dev->gso_max_size = size;
 }
 
+static inline bool netif_is_bond_master(struct net_device *dev)
+{
+        return dev->flags & IFF_MASTER && dev->priv_flags & IFF_BONDING;
+}
+
 static inline bool netif_is_bond_slave(struct net_device *dev)
 {
         return dev->flags & IFF_SLAVE && dev->priv_flags & IFF_BONDING;
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index ee142846f56a..0060fde3160e 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -289,11 +289,6 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
 #endif
 }
 
-#ifdef CONFIG_PROC_FS
-#include <linux/proc_fs.h>
-extern struct proc_dir_entry *proc_net_netfilter;
-#endif
-
 #else /* !CONFIG_NETFILTER */
 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
 #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index 7958e84a65af..d80e2753847c 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -1,7 +1,7 @@
 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
  *                         Patrick Schaaf <bof@bof.de>
  *                         Martin Josefsson <gandalf@wlug.westbo.se>
- * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ * Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -47,10 +47,36 @@ enum ip_set_feature {
         IPSET_DUMP_LAST = (1 << IPSET_DUMP_LAST_FLAG),
 };
 
+/* Set extensions */
+enum ip_set_extension {
+        IPSET_EXT_NONE = 0,
+        IPSET_EXT_BIT_TIMEOUT = 1,
+        IPSET_EXT_TIMEOUT = (1 << IPSET_EXT_BIT_TIMEOUT),
+        IPSET_EXT_BIT_COUNTER = 2,
+        IPSET_EXT_COUNTER = (1 << IPSET_EXT_BIT_COUNTER),
+};
+
+/* Extension offsets */
+enum ip_set_offset {
+        IPSET_OFFSET_TIMEOUT = 0,
+        IPSET_OFFSET_COUNTER,
+        IPSET_OFFSET_MAX,
+};
+
+#define SET_WITH_TIMEOUT(s)     ((s)->extensions & IPSET_EXT_TIMEOUT)
+#define SET_WITH_COUNTER(s)     ((s)->extensions & IPSET_EXT_COUNTER)
+
+struct ip_set_ext {
+        unsigned long timeout;
+        u64 packets;
+        u64 bytes;
+};
+
 struct ip_set;
 
 typedef int (*ipset_adtfn)(struct ip_set *set, void *value,
-                           u32 timeout, u32 flags);
+                           const struct ip_set_ext *ext,
+                           struct ip_set_ext *mext, u32 cmdflags);
 
 /* Kernel API function options */
 struct ip_set_adt_opt {
@@ -58,7 +84,7 @@ struct ip_set_adt_opt {
         u8 dim;                 /* Dimension of match/target */
         u8 flags;               /* Direction and negation flags */
         u32 cmdflags;           /* Command-like flags */
-        u32 timeout;            /* Timeout value */
+        struct ip_set_ext ext;  /* Extensions */
 };
 
 /* Set type, variant-specific part */
@@ -69,7 +95,7 @@ struct ip_set_type_variant {
          *                      positive for matching element */
         int (*kadt)(struct ip_set *set, const struct sk_buff *skb,
                     const struct xt_action_param *par,
-                    enum ipset_adt adt, const struct ip_set_adt_opt *opt);
+                    enum ipset_adt adt, struct ip_set_adt_opt *opt);
 
         /* Userspace: test/add/del entries
          *              returns negative error code,
@@ -151,10 +177,76 @@ struct ip_set {
         u8 family;
         /* The type revision */
         u8 revision;
+        /* Extensions */
+        u8 extensions;
         /* The type specific data */
         void *data;
 };
 
+struct ip_set_counter {
+        atomic64_t bytes;
+        atomic64_t packets;
+};
+
+static inline void
+ip_set_add_bytes(u64 bytes, struct ip_set_counter *counter)
+{
+        atomic64_add((long long)bytes, &(counter)->bytes);
+}
+
+static inline void
+ip_set_add_packets(u64 packets, struct ip_set_counter *counter)
+{
+        atomic64_add((long long)packets, &(counter)->packets);
+}
+
+static inline u64
+ip_set_get_bytes(const struct ip_set_counter *counter)
+{
+        return (u64)atomic64_read(&(counter)->bytes);
+}
+
+static inline u64
+ip_set_get_packets(const struct ip_set_counter *counter)
+{
+        return (u64)atomic64_read(&(counter)->packets);
+}
+
+static inline void
+ip_set_update_counter(struct ip_set_counter *counter,
+                      const struct ip_set_ext *ext,
+                      struct ip_set_ext *mext, u32 flags)
+{
+        if (ext->packets != ULLONG_MAX &&
+            !(flags & IPSET_FLAG_SKIP_COUNTER_UPDATE)) {
+                ip_set_add_bytes(ext->bytes, counter);
+                ip_set_add_packets(ext->packets, counter);
+        }
+        if (flags & IPSET_FLAG_MATCH_COUNTERS) {
+                mext->packets = ip_set_get_packets(counter);
+                mext->bytes = ip_set_get_bytes(counter);
+        }
+}
+
+static inline bool
+ip_set_put_counter(struct sk_buff *skb, struct ip_set_counter *counter)
+{
+        return nla_put_net64(skb, IPSET_ATTR_BYTES,
+                             cpu_to_be64(ip_set_get_bytes(counter))) ||
+               nla_put_net64(skb, IPSET_ATTR_PACKETS,
+                             cpu_to_be64(ip_set_get_packets(counter)));
+}
+
+static inline void
+ip_set_init_counter(struct ip_set_counter *counter,
+                    const struct ip_set_ext *ext)
+{
+        if (ext->bytes != ULLONG_MAX)
+                atomic64_set(&(counter)->bytes, (long long)(ext->bytes));
+        if (ext->packets != ULLONG_MAX)
+                atomic64_set(&(counter)->packets, (long long)(ext->packets));
+}
+
 /* register and unregister set references */
 extern ip_set_id_t ip_set_get_byname(const char *name, struct ip_set **set);
 extern void ip_set_put_byindex(ip_set_id_t index);
@@ -167,19 +259,21 @@ extern void ip_set_nfnl_put(ip_set_id_t index);
 
 extern int ip_set_add(ip_set_id_t id, const struct sk_buff *skb,
                       const struct xt_action_param *par,
-                      const struct ip_set_adt_opt *opt);
+                      struct ip_set_adt_opt *opt);
 extern int ip_set_del(ip_set_id_t id, const struct sk_buff *skb,
                       const struct xt_action_param *par,
-                      const struct ip_set_adt_opt *opt);
+                      struct ip_set_adt_opt *opt);
 extern int ip_set_test(ip_set_id_t id, const struct sk_buff *skb,
                        const struct xt_action_param *par,
-                       const struct ip_set_adt_opt *opt);
+                       struct ip_set_adt_opt *opt);
 
 /* Utility functions */
 extern void *ip_set_alloc(size_t size);
 extern void ip_set_free(void *members);
 extern int ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr);
 extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr);
+extern int ip_set_get_extensions(struct ip_set *set, struct nlattr *tb[],
+                                 struct ip_set_ext *ext);
 
 static inline int
 ip_set_get_hostipaddr4(struct nlattr *nla, u32 *ipaddr)
@@ -200,6 +294,14 @@ ip_set_eexist(int ret, u32 flags)
         return ret == -IPSET_ERR_EXIST && (flags & IPSET_FLAG_EXIST);
 }
 
+/* Match elements marked with nomatch */
+static inline bool
+ip_set_enomatch(int ret, u32 flags, enum ipset_adt adt)
+{
+        return adt == IPSET_TEST &&
+               ret == -ENOTEMPTY && ((flags >> 16) & IPSET_FLAG_NOMATCH);
+}
+
 /* Check the NLA_F_NET_BYTEORDER flag */
 static inline bool
 ip_set_attr_netorder(struct nlattr *tb[], int type)
@@ -284,4 +386,14 @@ bitmap_bytes(u32 a, u32 b)
         return 4 * ((((b - a + 8) / 8) + 3) / 4);
 }
 
+#include <linux/netfilter/ipset/ip_set_timeout.h>
+
+#define IP_SET_INIT_KEXT(skb, opt, map)                 \
+        { .bytes = (skb)->len, .packets = 1,            \
+          .timeout = ip_set_adt_opt_timeout(opt, map) }
+
+#define IP_SET_INIT_UEXT(map)                           \
+        { .bytes = ULLONG_MAX, .packets = ULLONG_MAX,   \
+          .timeout = (map)->timeout }
+
 #endif /*_IP_SET_H */
diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
deleted file mode 100644
index 0214c4c146fa..000000000000
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ /dev/null
@@ -1,1241 +0,0 @@
-#ifndef _IP_SET_AHASH_H
-#define _IP_SET_AHASH_H
-
-#include <linux/rcupdate.h>
-#include <linux/jhash.h>
-#include <linux/netfilter/ipset/ip_set_timeout.h>
-
-#define CONCAT(a, b, c)         a##b##c
-#define TOKEN(a, b, c)          CONCAT(a, b, c)
-
-#define type_pf_next            TOKEN(TYPE, PF, _elem)
-
-/* Hashing which uses arrays to resolve clashing. The hash table is resized
- * (doubled) when searching becomes too long.
- * Internally jhash is used with the assumption that the size of the
- * stored data is a multiple of sizeof(u32). If storage supports timeout,
- * the timeout field must be the last one in the data structure - that field
- * is ignored when computing the hash key.
- *
- * Readers and resizing
- *
- * Resizing can be triggered by userspace command only, and those
- * are serialized by the nfnl mutex. During resizing the set is
- * read-locked, so the only possible concurrent operations are
- * the kernel side readers. Those must be protected by proper RCU locking.
- */
-
-/* Number of elements to store in an initial array block */
-#define AHASH_INIT_SIZE                 4
-/* Max number of elements to store in an array block */
-#define AHASH_MAX_SIZE                  (3*AHASH_INIT_SIZE)
-
-/* Max number of elements can be tuned */
-#ifdef IP_SET_HASH_WITH_MULTI
-#define AHASH_MAX(h)                    ((h)->ahash_max)
-
-static inline u8
-tune_ahash_max(u8 curr, u32 multi)
-{
-        u32 n;
-
-        if (multi < curr)
-                return curr;
-
-        n = curr + AHASH_INIT_SIZE;
-        /* Currently, at listing one hash bucket must fit into a message.
-         * Therefore we have a hard limit here.
-         */
-        return n > curr && n <= 64 ? n : curr;
-}
-#define TUNE_AHASH_MAX(h, multi)        \
-        ((h)->ahash_max = tune_ahash_max((h)->ahash_max, multi))
-#else
-#define AHASH_MAX(h)                    AHASH_MAX_SIZE
-#define TUNE_AHASH_MAX(h, multi)
-#endif
-
-/* A hash bucket */
-struct hbucket {
-        void *value;            /* the array of the values */
-        u8 size;                /* size of the array */
-        u8 pos;                 /* position of the first free entry */
-};
-
-/* The hash table: the table size stored here in order to make resizing easy */
-struct htable {
-        u8 htable_bits;         /* size of hash table == 2^htable_bits */
-        struct hbucket bucket[0]; /* hashtable buckets */
-};
-
-#define hbucket(h, i)           (&((h)->bucket[i]))
-
-/* Book-keeping of the prefixes added to the set */
-struct ip_set_hash_nets {
-        u8 cidr;                /* the different cidr values in the set */
-        u32 nets;               /* number of elements per cidr */
-};
-
-/* The generic ip_set hash structure */
-struct ip_set_hash {
-        struct htable *table;   /* the hash table */
-        u32 maxelem;            /* max elements in the hash */
-        u32 elements;           /* current element (vs timeout) */
-        u32 initval;            /* random jhash init value */
-        u32 timeout;            /* timeout value, if enabled */
-        struct timer_list gc;   /* garbage collection when timeout enabled */
-        struct type_pf_next next; /* temporary storage for uadd */
-#ifdef IP_SET_HASH_WITH_MULTI
-        u8 ahash_max;           /* max elements in an array block */
-#endif
-#ifdef IP_SET_HASH_WITH_NETMASK
-        u8 netmask;             /* netmask value for subnets to store */
-#endif
-#ifdef IP_SET_HASH_WITH_RBTREE
-        struct rb_root rbtree;
-#endif
-#ifdef IP_SET_HASH_WITH_NETS
-        struct ip_set_hash_nets nets[0]; /* book-keeping of prefixes */
-#endif
-};
-
-static size_t
-htable_size(u8 hbits)
-{
-        size_t hsize;
-
-        /* We must fit both into u32 in jhash and size_t */
-        if (hbits > 31)
-                return 0;
-        hsize = jhash_size(hbits);
-        if ((((size_t)-1) - sizeof(struct htable))/sizeof(struct hbucket)
-            < hsize)
-                return 0;
-
-        return hsize * sizeof(struct hbucket) + sizeof(struct htable);
-}
-
-/* Compute htable_bits from the user input parameter hashsize */
-static u8
-htable_bits(u32 hashsize)
-{
-        /* Assume that hashsize == 2^htable_bits */
-        u8 bits = fls(hashsize - 1);
-        if (jhash_size(bits) != hashsize)
-                /* Round up to the first 2^n value */
-                bits = fls(hashsize);
-
-        return bits;
-}
-
-#ifdef IP_SET_HASH_WITH_NETS
-#ifdef IP_SET_HASH_WITH_NETS_PACKED
-/* When cidr is packed with nomatch, cidr - 1 is stored in the entry */
-#define CIDR(cidr)      (cidr + 1)
-#else
-#define CIDR(cidr)      (cidr)
-#endif
-
-#define SET_HOST_MASK(family)   (family == AF_INET ? 32 : 128)
-#ifdef IP_SET_HASH_WITH_MULTI
-#define NETS_LENGTH(family)     (SET_HOST_MASK(family) + 1)
-#else
-#define NETS_LENGTH(family)     SET_HOST_MASK(family)
-#endif
-
-/* Network cidr size book keeping when the hash stores different
- * sized networks */
-static void
-add_cidr(struct ip_set_hash *h, u8 cidr, u8 nets_length)
-{
-        int i, j;
-
-        /* Add in increasing prefix order, so larger cidr first */
-        for (i = 0, j = -1; i < nets_length && h->nets[i].nets; i++) {
-                if (j != -1)
-                        continue;
-                else if (h->nets[i].cidr < cidr)
-                        j = i;
-                else if (h->nets[i].cidr == cidr) {
-                        h->nets[i].nets++;
-                        return;
-                }
-        }
-        if (j != -1) {
-                for (; i > j; i--) {
-                        h->nets[i].cidr = h->nets[i - 1].cidr;
-                        h->nets[i].nets = h->nets[i - 1].nets;
-                }
-        }
-        h->nets[i].cidr = cidr;
-        h->nets[i].nets = 1;
-}
-
-static void
-del_cidr(struct ip_set_hash *h, u8 cidr, u8 nets_length)
-{
-        u8 i, j;
-
-        for (i = 0; i < nets_length - 1 && h->nets[i].cidr != cidr; i++)
-                ;
-        h->nets[i].nets--;
-
-        if (h->nets[i].nets != 0)
-                return;
-
-        for (j = i; j < nets_length - 1 && h->nets[j].nets; j++) {
-                h->nets[j].cidr = h->nets[j + 1].cidr;
-                h->nets[j].nets = h->nets[j + 1].nets;
-        }
-}
-#else
-#define NETS_LENGTH(family)             0
-#endif
-
-/* Destroy the hashtable part of the set */
-static void
-ahash_destroy(struct htable *t)
-{
-        struct hbucket *n;
-        u32 i;
-
-        for (i = 0; i < jhash_size(t->htable_bits); i++) {
-                n = hbucket(t, i);
-                if (n->size)
-                        /* FIXME: use slab cache */
-                        kfree(n->value);
-        }
-
-        ip_set_free(t);
-}
-
-/* Calculate the actual memory size of the set data */
-static size_t
-ahash_memsize(const struct ip_set_hash *h, size_t dsize, u8 nets_length)
-{
-        u32 i;
-        struct htable *t = h->table;
-        size_t memsize = sizeof(*h)
-                         + sizeof(*t)
-#ifdef IP_SET_HASH_WITH_NETS
-                         + sizeof(struct ip_set_hash_nets) * nets_length
-#endif
-                         + jhash_size(t->htable_bits) * sizeof(struct hbucket);
-
-        for (i = 0; i < jhash_size(t->htable_bits); i++)
-                        memsize += t->bucket[i].size * dsize;
-
-        return memsize;
-}
-
-/* Flush a hash type of set: destroy all elements */
-static void
-ip_set_hash_flush(struct ip_set *set)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t = h->table;
-        struct hbucket *n;
-        u32 i;
-
-        for (i = 0; i < jhash_size(t->htable_bits); i++) {
-                n = hbucket(t, i);
-                if (n->size) {
-                        n->size = n->pos = 0;
-                        /* FIXME: use slab cache */
-                        kfree(n->value);
-                }
-        }
-#ifdef IP_SET_HASH_WITH_NETS
-        memset(h->nets, 0, sizeof(struct ip_set_hash_nets)
-                           * NETS_LENGTH(set->family));
-#endif
-        h->elements = 0;
-}
-
-/* Destroy a hash type of set */
-static void
-ip_set_hash_destroy(struct ip_set *set)
-{
-        struct ip_set_hash *h = set->data;
-
-        if (with_timeout(h->timeout))
-                del_timer_sync(&h->gc);
-
-        ahash_destroy(h->table);
-#ifdef IP_SET_HASH_WITH_RBTREE
-        rbtree_destroy(&h->rbtree);
-#endif
-        kfree(h);
-
-        set->data = NULL;
-}
-
-#endif /* _IP_SET_AHASH_H */
-
-#ifndef HKEY_DATALEN
-#define HKEY_DATALEN    sizeof(struct type_pf_elem)
-#endif
-
-#define HKEY(data, initval, htable_bits)                        \
-(jhash2((u32 *)(data), HKEY_DATALEN/sizeof(u32), initval)       \
-        & jhash_mask(htable_bits))
-
-/* Type/family dependent function prototypes */
-
-#define type_pf_data_equal      TOKEN(TYPE, PF, _data_equal)
-#define type_pf_data_isnull     TOKEN(TYPE, PF, _data_isnull)
-#define type_pf_data_copy       TOKEN(TYPE, PF, _data_copy)
-#define type_pf_data_zero_out   TOKEN(TYPE, PF, _data_zero_out)
-#define type_pf_data_netmask    TOKEN(TYPE, PF, _data_netmask)
-#define type_pf_data_list       TOKEN(TYPE, PF, _data_list)
-#define type_pf_data_tlist      TOKEN(TYPE, PF, _data_tlist)
-#define type_pf_data_next       TOKEN(TYPE, PF, _data_next)
-#define type_pf_data_flags      TOKEN(TYPE, PF, _data_flags)
-#define type_pf_data_reset_flags TOKEN(TYPE, PF, _data_reset_flags)
-#ifdef IP_SET_HASH_WITH_NETS
-#define type_pf_data_match      TOKEN(TYPE, PF, _data_match)
-#else
-#define type_pf_data_match(d)   1
-#endif
-
-#define type_pf_elem            TOKEN(TYPE, PF, _elem)
-#define type_pf_telem           TOKEN(TYPE, PF, _telem)
-#define type_pf_data_timeout    TOKEN(TYPE, PF, _data_timeout)
-#define type_pf_data_expired    TOKEN(TYPE, PF, _data_expired)
-#define type_pf_data_timeout_set TOKEN(TYPE, PF, _data_timeout_set)
-
-#define type_pf_elem_add        TOKEN(TYPE, PF, _elem_add)
-#define type_pf_add             TOKEN(TYPE, PF, _add)
-#define type_pf_del             TOKEN(TYPE, PF, _del)
-#define type_pf_test_cidrs      TOKEN(TYPE, PF, _test_cidrs)
-#define type_pf_test            TOKEN(TYPE, PF, _test)
-
-#define type_pf_elem_tadd       TOKEN(TYPE, PF, _elem_tadd)
-#define type_pf_del_telem       TOKEN(TYPE, PF, _ahash_del_telem)
-#define type_pf_expire          TOKEN(TYPE, PF, _expire)
-#define type_pf_tadd            TOKEN(TYPE, PF, _tadd)
-#define type_pf_tdel            TOKEN(TYPE, PF, _tdel)
-#define type_pf_ttest_cidrs     TOKEN(TYPE, PF, _ahash_ttest_cidrs)
-#define type_pf_ttest           TOKEN(TYPE, PF, _ahash_ttest)
-
-#define type_pf_resize          TOKEN(TYPE, PF, _resize)
-#define type_pf_tresize         TOKEN(TYPE, PF, _tresize)
-#define type_pf_flush           ip_set_hash_flush
-#define type_pf_destroy         ip_set_hash_destroy
-#define type_pf_head            TOKEN(TYPE, PF, _head)
-#define type_pf_list            TOKEN(TYPE, PF, _list)
-#define type_pf_tlist           TOKEN(TYPE, PF, _tlist)
-#define type_pf_same_set        TOKEN(TYPE, PF, _same_set)
-#define type_pf_kadt            TOKEN(TYPE, PF, _kadt)
-#define type_pf_uadt            TOKEN(TYPE, PF, _uadt)
-#define type_pf_gc              TOKEN(TYPE, PF, _gc)
-#define type_pf_gc_init         TOKEN(TYPE, PF, _gc_init)
-#define type_pf_variant         TOKEN(TYPE, PF, _variant)
-#define type_pf_tvariant        TOKEN(TYPE, PF, _tvariant)
-
-/* Flavour without timeout */
-
-/* Get the ith element from the array block n */
-#define ahash_data(n, i)        \
-        ((struct type_pf_elem *)((n)->value) + (i))
-
-/* Add an element to the hash table when resizing the set:
- * we spare the maintenance of the internal counters. */
-static int
-type_pf_elem_add(struct hbucket *n, const struct type_pf_elem *value,
-                 u8 ahash_max, u32 cadt_flags)
-{
-        struct type_pf_elem *data;
-
-        if (n->pos >= n->size) {
-                void *tmp;
-
-                if (n->size >= ahash_max)
-                        /* Trigger rehashing */
-                        return -EAGAIN;
-
-                tmp = kzalloc((n->size + AHASH_INIT_SIZE)
-                              * sizeof(struct type_pf_elem),
-                              GFP_ATOMIC);
-                if (!tmp)
-                        return -ENOMEM;
-                if (n->size) {
-                        memcpy(tmp, n->value,
-                               sizeof(struct type_pf_elem) * n->size);
-                        kfree(n->value);
-                }
-                n->value = tmp;
-                n->size += AHASH_INIT_SIZE;
-        }
-        data = ahash_data(n, n->pos++);
-        type_pf_data_copy(data, value);
-#ifdef IP_SET_HASH_WITH_NETS
-        /* Resizing won't overwrite stored flags */
-        if (cadt_flags)
-                type_pf_data_flags(data, cadt_flags);
-#endif
-        return 0;
-}
-
-/* Resize a hash: create a new hash table with doubling the hashsize
- * and inserting the elements to it. Repeat until we succeed or
- * fail due to memory pressures. */
-static int
-type_pf_resize(struct ip_set *set, bool retried)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t, *orig = h->table;
-        u8 htable_bits = orig->htable_bits;
-        struct type_pf_elem *data;
-        struct hbucket *n, *m;
-        u32 i, j, flags = 0;
-        int ret;
-
-retry:
-        ret = 0;
-        htable_bits++;
-        pr_debug("attempt to resize set %s from %u to %u, t %p\n",
-                 set->name, orig->htable_bits, htable_bits, orig);
-        if (!htable_bits) {
-                /* In case we have plenty of memory :-) */
-                pr_warning("Cannot increase the hashsize of set %s further\n",
-                           set->name);
-                return -IPSET_ERR_HASH_FULL;
-        }
-        t = ip_set_alloc(sizeof(*t)
-                         + jhash_size(htable_bits) * sizeof(struct hbucket));
-        if (!t)
-                return -ENOMEM;
-        t->htable_bits = htable_bits;
-
-        read_lock_bh(&set->lock);
-        for (i = 0; i < jhash_size(orig->htable_bits); i++) {
-                n = hbucket(orig, i);
-                for (j = 0; j < n->pos; j++) {
-                        data = ahash_data(n, j);
-#ifdef IP_SET_HASH_WITH_NETS
-                        flags = 0;
-                        type_pf_data_reset_flags(data, &flags);
-#endif
-                        m = hbucket(t, HKEY(data, h->initval, htable_bits));
-                        ret = type_pf_elem_add(m, data, AHASH_MAX(h), flags);
-                        if (ret < 0) {
-#ifdef IP_SET_HASH_WITH_NETS
-                                type_pf_data_flags(data, flags);
-#endif
-                                read_unlock_bh(&set->lock);
-                                ahash_destroy(t);
-                                if (ret == -EAGAIN)
-                                        goto retry;
-                                return ret;
-                        }
-                }
-        }
-
-        rcu_assign_pointer(h->table, t);
-        read_unlock_bh(&set->lock);
-
-        /* Give time to other readers of the set */
-        synchronize_rcu_bh();
-
-        pr_debug("set %s resized from %u (%p) to %u (%p)\n", set->name,
-                 orig->htable_bits, orig, t->htable_bits, t);
-        ahash_destroy(orig);
-
-        return 0;
-}
-
-static inline void
-type_pf_data_next(struct ip_set_hash *h, const struct type_pf_elem *d);
-
-/* Add an element to a hash and update the internal counters when succeeded,
- * otherwise report the proper error code. */
-static int
-type_pf_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t;
-        const struct type_pf_elem *d = value;
-        struct hbucket *n;
-        int i, ret = 0;
-        u32 key, multi = 0;
-        u32 cadt_flags = flags >> 16;
-
-        if (h->elements >= h->maxelem) {
-                if (net_ratelimit())
-                        pr_warning("Set %s is full, maxelem %u reached\n",
-                                   set->name, h->maxelem);
-                return -IPSET_ERR_HASH_FULL;
-        }
-
-        rcu_read_lock_bh();
-        t = rcu_dereference_bh(h->table);
-        key = HKEY(value, h->initval, t->htable_bits);
-        n = hbucket(t, key);
-        for (i = 0; i < n->pos; i++)
-                if (type_pf_data_equal(ahash_data(n, i), d, &multi)) {
-#ifdef IP_SET_HASH_WITH_NETS
-                        if (flags & IPSET_FLAG_EXIST)
-                                /* Support overwriting just the flags */
-                                type_pf_data_flags(ahash_data(n, i),
-                                                   cadt_flags);
-#endif
-                        ret = -IPSET_ERR_EXIST;
-                        goto out;
-                }
-        TUNE_AHASH_MAX(h, multi);
-        ret = type_pf_elem_add(n, value, AHASH_MAX(h), cadt_flags);
-        if (ret != 0) {
-                if (ret == -EAGAIN)
-                        type_pf_data_next(h, d);
-                goto out;
-        }
-
-#ifdef IP_SET_HASH_WITH_NETS
-        add_cidr(h, CIDR(d->cidr), NETS_LENGTH(set->family));
-#endif
-        h->elements++;
-out:
-        rcu_read_unlock_bh();
-        return ret;
-}
-
-/* Delete an element from the hash: swap it with the last element
- * and free up space if possible.
- */
-static int
-type_pf_del(struct ip_set *set, void *value, u32 timeout, u32 flags)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t = h->table;
-        const struct type_pf_elem *d = value;
-        struct hbucket *n;
-        int i;
-        struct type_pf_elem *data;
-        u32 key, multi = 0;
-
-        key = HKEY(value, h->initval, t->htable_bits);
-        n = hbucket(t, key);
-        for (i = 0; i < n->pos; i++) {
-                data = ahash_data(n, i);
-                if (!type_pf_data_equal(data, d, &multi))
-                        continue;
-                if (i != n->pos - 1)
-                        /* Not last one */
-                        type_pf_data_copy(data, ahash_data(n, n->pos - 1));
-
-                n->pos--;
-                h->elements--;
-#ifdef IP_SET_HASH_WITH_NETS
-                del_cidr(h, CIDR(d->cidr), NETS_LENGTH(set->family));
-#endif
-                if (n->pos + AHASH_INIT_SIZE < n->size) {
-                        void *tmp = kzalloc((n->size - AHASH_INIT_SIZE)
-                                            * sizeof(struct type_pf_elem),
-                                            GFP_ATOMIC);
-                        if (!tmp)
-                                return 0;
-                        n->size -= AHASH_INIT_SIZE;
-                        memcpy(tmp, n->value,
-                               n->size * sizeof(struct type_pf_elem));
-                        kfree(n->value);
-                        n->value = tmp;
-                }
-                return 0;
-        }
-
-        return -IPSET_ERR_EXIST;
-}
-
-#ifdef IP_SET_HASH_WITH_NETS
-
-/* Special test function which takes into account the different network
- * sizes added to the set */
-static int
-type_pf_test_cidrs(struct ip_set *set, struct type_pf_elem *d, u32 timeout)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t = h->table;
-        struct hbucket *n;
-        const struct type_pf_elem *data;
-        int i, j = 0;
-        u32 key, multi = 0;
-        u8 nets_length = NETS_LENGTH(set->family);
-
-        pr_debug("test by nets\n");
-        for (; j < nets_length && h->nets[j].nets && !multi; j++) {
-                type_pf_data_netmask(d, h->nets[j].cidr);
-                key = HKEY(d, h->initval, t->htable_bits);
-                n = hbucket(t, key);
-                for (i = 0; i < n->pos; i++) {
-                        data = ahash_data(n, i);
-                        if (type_pf_data_equal(data, d, &multi))
-                                return type_pf_data_match(data);
-                }
-        }
-        return 0;
-}
-#endif
-
-/* Test whether the element is added to the set */
-static int
-type_pf_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t = h->table;
-        struct type_pf_elem *d = value;
-        struct hbucket *n;
-        const struct type_pf_elem *data;
-        int i;
-        u32 key, multi = 0;
-
-#ifdef IP_SET_HASH_WITH_NETS
-        /* If we test an IP address and not a network address,
-         * try all possible network sizes */
-        if (CIDR(d->cidr) == SET_HOST_MASK(set->family))
-                return type_pf_test_cidrs(set, d, timeout);
-#endif
-
-        key = HKEY(d, h->initval, t->htable_bits);
-        n = hbucket(t, key);
-        for (i = 0; i < n->pos; i++) {
-                data = ahash_data(n, i);
-                if (type_pf_data_equal(data, d, &multi))
-                        return type_pf_data_match(data);
-        }
-        return 0;
-}
-
-/* Reply a HEADER request: fill out the header part of the set */
-static int
-type_pf_head(struct ip_set *set, struct sk_buff *skb)
-{
-        const struct ip_set_hash *h = set->data;
-        struct nlattr *nested;
-        size_t memsize;
-
-        read_lock_bh(&set->lock);
-        memsize = ahash_memsize(h, with_timeout(h->timeout)
-                                        ? sizeof(struct type_pf_telem)
-                                        : sizeof(struct type_pf_elem),
-                                NETS_LENGTH(set->family));
-        read_unlock_bh(&set->lock);
-
-        nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
-        if (!nested)
-                goto nla_put_failure;
-        if (nla_put_net32(skb, IPSET_ATTR_HASHSIZE,
-                          htonl(jhash_size(h->table->htable_bits))) ||
-            nla_put_net32(skb, IPSET_ATTR_MAXELEM, htonl(h->maxelem)))
-                goto nla_put_failure;
-#ifdef IP_SET_HASH_WITH_NETMASK
-        if (h->netmask != HOST_MASK &&
-            nla_put_u8(skb, IPSET_ATTR_NETMASK, h->netmask))
-                goto nla_put_failure;
-#endif
-        if (nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
-            nla_put_net32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize)) ||
-            (with_timeout(h->timeout) &&
-             nla_put_net32(skb, IPSET_ATTR_TIMEOUT, htonl(h->timeout))))
-                goto nla_put_failure;
-        ipset_nest_end(skb, nested);
-
-        return 0;
-nla_put_failure:
-        return -EMSGSIZE;
-}
-
-/* Reply a LIST/SAVE request: dump the elements of the specified set */
-static int
-type_pf_list(const struct ip_set *set,
-             struct sk_buff *skb, struct netlink_callback *cb)
-{
-        const struct ip_set_hash *h = set->data;
-        const struct htable *t = h->table;
-        struct nlattr *atd, *nested;
-        const struct hbucket *n;
-        const struct type_pf_elem *data;
-        u32 first = cb->args[2];
-        /* We assume that one hash bucket fills into one page */
-        void *incomplete;
-        int i;
-
-        atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
-        if (!atd)
-                return -EMSGSIZE;
-        pr_debug("list hash set %s\n", set->name);
-        for (; cb->args[2] < jhash_size(t->htable_bits); cb->args[2]++) {
-                incomplete = skb_tail_pointer(skb);
-                n = hbucket(t, cb->args[2]);
-                pr_debug("cb->args[2]: %lu, t %p n %p\n", cb->args[2], t, n);
-                for (i = 0; i < n->pos; i++) {
-                        data = ahash_data(n, i);
-                        pr_debug("list hash %lu hbucket %p i %u, data %p\n",
-                                 cb->args[2], n, i, data);
-                        nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
-                        if (!nested) {
-                                if (cb->args[2] == first) {
-                                        nla_nest_cancel(skb, atd);
-                                        return -EMSGSIZE;
-                                } else
-                                        goto nla_put_failure;
-                        }
-                        if (type_pf_data_list(skb, data))
-                                goto nla_put_failure;
-                        ipset_nest_end(skb, nested);
-                }
-        }
-        ipset_nest_end(skb, atd);
-        /* Set listing finished */
-        cb->args[2] = 0;
-
-        return 0;
-
-nla_put_failure:
-        nlmsg_trim(skb, incomplete);
-        ipset_nest_end(skb, atd);
-        if (unlikely(first == cb->args[2])) {
-                pr_warning("Can't list set %s: one bucket does not fit into "
-                           "a message. Please report it!\n", set->name);
-                cb->args[2] = 0;
-                return -EMSGSIZE;
-        }
-        return 0;
-}
-
-static int
-type_pf_kadt(struct ip_set *set, const struct sk_buff *skb,
-             const struct xt_action_param *par,
-             enum ipset_adt adt, const struct ip_set_adt_opt *opt);
-static int
-type_pf_uadt(struct ip_set *set, struct nlattr *tb[],
-             enum ipset_adt adt, u32 *lineno, u32 flags, bool retried);
-
-static const struct ip_set_type_variant type_pf_variant = {
-        .kadt   = type_pf_kadt,
-        .uadt   = type_pf_uadt,
-        .adt    = {
-                [IPSET_ADD] = type_pf_add,
-                [IPSET_DEL] = type_pf_del,
-                [IPSET_TEST] = type_pf_test,
-        },
-        .destroy = type_pf_destroy,
-        .flush  = type_pf_flush,
-        .head   = type_pf_head,
-        .list   = type_pf_list,
-        .resize = type_pf_resize,
-        .same_set = type_pf_same_set,
-};
-
-/* Flavour with timeout support */
-
-#define ahash_tdata(n, i) \
-        (struct type_pf_elem *)((struct type_pf_telem *)((n)->value) + (i))
-
-static inline u32
-type_pf_data_timeout(const struct type_pf_elem *data)
-{
-        const struct type_pf_telem *tdata =
-                (const struct type_pf_telem *) data;
-
-        return tdata->timeout;
-}
-
-static inline bool
-type_pf_data_expired(const struct type_pf_elem *data)
-{
-        const struct type_pf_telem *tdata =
-                (const struct type_pf_telem *) data;
-
-        return ip_set_timeout_expired(tdata->timeout);
-}
-
-static inline void
-type_pf_data_timeout_set(struct type_pf_elem *data, u32 timeout)
-{
-        struct type_pf_telem *tdata = (struct type_pf_telem *) data;
-
-        tdata->timeout = ip_set_timeout_set(timeout);
-}
-
-static int
-type_pf_elem_tadd(struct hbucket *n, const struct type_pf_elem *value,
-                  u8 ahash_max, u32 cadt_flags, u32 timeout)
-{
-        struct type_pf_elem *data;
-
-        if (n->pos >= n->size) {
-                void *tmp;
-
-                if (n->size >= ahash_max)
-                        /* Trigger rehashing */
-                        return -EAGAIN;
-
-                tmp = kzalloc((n->size + AHASH_INIT_SIZE)
-                              * sizeof(struct type_pf_telem),
-                              GFP_ATOMIC);
-                if (!tmp)
-                        return -ENOMEM;
-                if (n->size) {
-                        memcpy(tmp, n->value,
-                               sizeof(struct type_pf_telem) * n->size);
-                        kfree(n->value);
-                }
-                n->value = tmp;
-                n->size += AHASH_INIT_SIZE;
-        }
-        data = ahash_tdata(n, n->pos++);
-        type_pf_data_copy(data, value);
-        type_pf_data_timeout_set(data, timeout);
-#ifdef IP_SET_HASH_WITH_NETS
-        /* Resizing won't overwrite stored flags */
-        if (cadt_flags)
-                type_pf_data_flags(data, cadt_flags);
-#endif
-        return 0;
-}
-
-/* Delete expired elements from the hashtable */
-static void
-type_pf_expire(struct ip_set_hash *h, u8 nets_length)
-{
-        struct htable *t = h->table;
-        struct hbucket *n;
-        struct type_pf_elem *data;
-        u32 i;
-        int j;
-
-        for (i = 0; i < jhash_size(t->htable_bits); i++) {
-                n = hbucket(t, i);
-                for (j = 0; j < n->pos; j++) {
-                        data = ahash_tdata(n, j);
-                        if (type_pf_data_expired(data)) {
-                                pr_debug("expired %u/%u\n", i, j);
-#ifdef IP_SET_HASH_WITH_NETS
-                                del_cidr(h, CIDR(data->cidr), nets_length);
-#endif
-                                if (j != n->pos - 1)
-                                        /* Not last one */
-                                        type_pf_data_copy(data,
-                                                ahash_tdata(n, n->pos - 1));
-                                n->pos--;
-                                h->elements--;
-                        }
-                }
-                if (n->pos + AHASH_INIT_SIZE < n->size) {
-                        void *tmp = kzalloc((n->size - AHASH_INIT_SIZE)
-                                            * sizeof(struct type_pf_telem),
-                                            GFP_ATOMIC);
-                        if (!tmp)
-                                /* Still try to delete expired elements */
-                                continue;
-                        n->size -= AHASH_INIT_SIZE;
-                        memcpy(tmp, n->value,
-                               n->size * sizeof(struct type_pf_telem));
-                        kfree(n->value);
-                        n->value = tmp;
-                }
-        }
-}
-
-static int
-type_pf_tresize(struct ip_set *set, bool retried)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t, *orig = h->table;
-        u8 htable_bits = orig->htable_bits;
-        struct type_pf_elem *data;
-        struct hbucket *n, *m;
-        u32 i, j, flags = 0;
-        int ret;
-
-        /* Try to cleanup once */
-        if (!retried) {
-                i = h->elements;
-                write_lock_bh(&set->lock);
-                type_pf_expire(set->data, NETS_LENGTH(set->family));
-                write_unlock_bh(&set->lock);
-                if (h->elements <  i)
-                        return 0;
-        }
-
-retry:
-        ret = 0;
-        htable_bits++;
-        pr_debug("attempt to resize set %s from %u to %u, t %p\n",
-                 set->name, orig->htable_bits, htable_bits, orig);
-        if (!htable_bits) {
-                /* In case we have plenty of memory :-) */
-                pr_warning("Cannot increase the hashsize of set %s further\n",
-                           set->name);
-                return -IPSET_ERR_HASH_FULL;
-        }
-        t = ip_set_alloc(sizeof(*t)
-                         + jhash_size(htable_bits) * sizeof(struct hbucket));
-        if (!t)
-                return -ENOMEM;
-        t->htable_bits = htable_bits;
-
-        read_lock_bh(&set->lock);
-        for (i = 0; i < jhash_size(orig->htable_bits); i++) {
-                n = hbucket(orig, i);
-                for (j = 0; j < n->pos; j++) {
-                        data = ahash_tdata(n, j);
-#ifdef IP_SET_HASH_WITH_NETS
-                        flags = 0;
-                        type_pf_data_reset_flags(data, &flags);
-#endif
-                        m = hbucket(t, HKEY(data, h->initval, htable_bits));
-                        ret = type_pf_elem_tadd(m, data, AHASH_MAX(h), flags,
-                                ip_set_timeout_get(type_pf_data_timeout(data)));
-                        if (ret < 0) {
-#ifdef IP_SET_HASH_WITH_NETS
-                                type_pf_data_flags(data, flags);
-#endif
-                                read_unlock_bh(&set->lock);
-                                ahash_destroy(t);
-                                if (ret == -EAGAIN)
-                                        goto retry;
-                                return ret;
-                        }
-                }
-        }
-
-        rcu_assign_pointer(h->table, t);
-        read_unlock_bh(&set->lock);
-
-        /* Give time to other readers of the set */
-        synchronize_rcu_bh();
-
-        ahash_destroy(orig);
-
-        return 0;
-}
-
-static int
-type_pf_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t = h->table;
-        const struct type_pf_elem *d = value;
-        struct hbucket *n;
-        struct type_pf_elem *data;
-        int ret = 0, i, j = AHASH_MAX(h) + 1;
-        bool flag_exist = flags & IPSET_FLAG_EXIST;
-        u32 key, multi = 0;
-        u32 cadt_flags = flags >> 16;
-
-        if (h->elements >= h->maxelem)
-                /* FIXME: when set is full, we slow down here */
-                type_pf_expire(h, NETS_LENGTH(set->family));
-        if (h->elements >= h->maxelem) {
-                if (net_ratelimit())
-                        pr_warning("Set %s is full, maxelem %u reached\n",
-                                   set->name, h->maxelem);
-                return -IPSET_ERR_HASH_FULL;
-        }
-
-        rcu_read_lock_bh();
-        t = rcu_dereference_bh(h->table);
-        key = HKEY(d, h->initval, t->htable_bits);
-        n = hbucket(t, key);
-        for (i = 0; i < n->pos; i++) {
-                data = ahash_tdata(n, i);
-                if (type_pf_data_equal(data, d, &multi)) {
-                        if (type_pf_data_expired(data) || flag_exist)
-                                /* Just timeout value may be updated */
-                                j = i;
-                        else {
-                                ret = -IPSET_ERR_EXIST;
-                                goto out;
-                        }
-                } else if (j == AHASH_MAX(h) + 1 &&
-                           type_pf_data_expired(data))
-                        j = i;
-        }
-        if (j != AHASH_MAX(h) + 1) {
-                data = ahash_tdata(n, j);
-#ifdef IP_SET_HASH_WITH_NETS
-                del_cidr(h, CIDR(data->cidr), NETS_LENGTH(set->family));
-                add_cidr(h, CIDR(d->cidr), NETS_LENGTH(set->family));
-#endif
-                type_pf_data_copy(data, d);
-                type_pf_data_timeout_set(data, timeout);
-#ifdef IP_SET_HASH_WITH_NETS
-                type_pf_data_flags(data, cadt_flags);
-#endif
-                goto out;
-        }
-        TUNE_AHASH_MAX(h, multi);
-        ret = type_pf_elem_tadd(n, d, AHASH_MAX(h), cadt_flags, timeout);
-        if (ret != 0) {
-                if (ret == -EAGAIN)
-                        type_pf_data_next(h, d);
-                goto out;
-        }
-
-#ifdef IP_SET_HASH_WITH_NETS
-        add_cidr(h, CIDR(d->cidr), NETS_LENGTH(set->family));
-#endif
-        h->elements++;
-out:
-        rcu_read_unlock_bh();
-        return ret;
-}
-
-static int
-type_pf_tdel(struct ip_set *set, void *value, u32 timeout, u32 flags)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t = h->table;
-        const struct type_pf_elem *d = value;
-        struct hbucket *n;
-        int i;
-        struct type_pf_elem *data;
-        u32 key, multi = 0;
-
-        key = HKEY(value, h->initval, t->htable_bits);
-        n = hbucket(t, key);
-        for (i = 0; i < n->pos; i++) {
-                data = ahash_tdata(n, i);
-                if (!type_pf_data_equal(data, d, &multi))
-                        continue;
-                if (type_pf_data_expired(data))
-                        return -IPSET_ERR_EXIST;
-                if (i != n->pos - 1)
-                        /* Not last one */
-                        type_pf_data_copy(data, ahash_tdata(n, n->pos - 1));
-
-                n->pos--;
-                h->elements--;
-#ifdef IP_SET_HASH_WITH_NETS
-                del_cidr(h, CIDR(d->cidr), NETS_LENGTH(set->family));
-#endif
-                if (n->pos + AHASH_INIT_SIZE < n->size) {
-                        void *tmp = kzalloc((n->size - AHASH_INIT_SIZE)
-                                            * sizeof(struct type_pf_telem),
-                                            GFP_ATOMIC);
-                        if (!tmp)
-                                return 0;
-                        n->size -= AHASH_INIT_SIZE;
-                        memcpy(tmp, n->value,
-                               n->size * sizeof(struct type_pf_telem));
-                        kfree(n->value);
-                        n->value = tmp;
-                }
-                return 0;
-        }
-
-        return -IPSET_ERR_EXIST;
-}
-
-#ifdef IP_SET_HASH_WITH_NETS
-static int
-type_pf_ttest_cidrs(struct ip_set *set, struct type_pf_elem *d, u32 timeout)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t = h->table;
-        struct type_pf_elem *data;
-        struct hbucket *n;
-        int i, j = 0;
-        u32 key, multi = 0;
-        u8 nets_length = NETS_LENGTH(set->family);
-
-        for (; j < nets_length && h->nets[j].nets && !multi; j++) {
-                type_pf_data_netmask(d, h->nets[j].cidr);
-                key = HKEY(d, h->initval, t->htable_bits);
-                n = hbucket(t, key);
-                for (i = 0; i < n->pos; i++) {
-                        data = ahash_tdata(n, i);
-#ifdef IP_SET_HASH_WITH_MULTI
-                        if (type_pf_data_equal(data, d, &multi)) {
-                                if (!type_pf_data_expired(data))
-                                        return type_pf_data_match(data);
-                                multi = 0;
-                        }
-#else
-                        if (type_pf_data_equal(data, d, &multi) &&
-                            !type_pf_data_expired(data))
-                                return type_pf_data_match(data);
-#endif
-                }
-        }
-        return 0;
-}
-#endif
-
-static int
-type_pf_ttest(struct ip_set *set, void *value, u32 timeout, u32 flags)
-{
-        struct ip_set_hash *h = set->data;
-        struct htable *t = h->table;
-        struct type_pf_elem *data, *d = value;
-        struct hbucket *n;
-        int i;
-        u32 key, multi = 0;
-
-#ifdef IP_SET_HASH_WITH_NETS
-        if (CIDR(d->cidr) == SET_HOST_MASK(set->family))
-                return type_pf_ttest_cidrs(set, d, timeout);
-#endif
-        key = HKEY(d, h->initval, t->htable_bits);
-        n = hbucket(t, key);
-        for (i = 0; i < n->pos; i++) {
-                data = ahash_tdata(n, i);
-                if (type_pf_data_equal(data, d, &multi) &&
-                    !type_pf_data_expired(data))
-                        return type_pf_data_match(data);
-        }
-        return 0;
-}
-
-static int
-type_pf_tlist(const struct ip_set *set,
-              struct sk_buff *skb, struct netlink_callback *cb)
-{
-        const struct ip_set_hash *h = set->data;
-        const struct htable *t = h->table;
-        struct nlattr *atd, *nested;
-        const struct hbucket *n;
-        const struct type_pf_elem *data;
-        u32 first = cb->args[2];
-        /* We assume that one hash bucket fills into one page */
-        void *incomplete;
-        int i;
-
-        atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
-        if (!atd)
-                return -EMSGSIZE;
-        for (; cb->args[2] < jhash_size(t->htable_bits); cb->args[2]++) {
-                incomplete = skb_tail_pointer(skb);
-                n = hbucket(t, cb->args[2]);
-                for (i = 0; i < n->pos; i++) {
-                        data = ahash_tdata(n, i);
-                        pr_debug("list %p %u\n", n, i);
-                        if (type_pf_data_expired(data))
-                                continue;
-                        pr_debug("do list %p %u\n", n, i);
-                        nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
-                        if (!nested) {
-                                if (cb->args[2] == first) {
-                                        nla_nest_cancel(skb, atd);
-                                        return -EMSGSIZE;
-                                } else
-                                        goto nla_put_failure;
-                        }
-                        if (type_pf_data_tlist(skb, data))
-                                goto nla_put_failure;
-                        ipset_nest_end(skb, nested);
-                }
-        }
-        ipset_nest_end(skb, atd);
-        /* Set listing finished */
-        cb->args[2] = 0;
-
-        return 0;
-
-nla_put_failure:
-        nlmsg_trim(skb, incomplete);
-        ipset_nest_end(skb, atd);
-        if (unlikely(first == cb->args[2])) {
-                pr_warning("Can't list set %s: one bucket does not fit into "
-                           "a message. Please report it!\n", set->name);
-                cb->args[2] = 0;
-                return -EMSGSIZE;
-        }
-        return 0;
-}
-
-static const struct ip_set_type_variant type_pf_tvariant = {
-        .kadt   = type_pf_kadt,
-        .uadt   = type_pf_uadt,
-        .adt    = {
-                [IPSET_ADD] = type_pf_tadd,
-                [IPSET_DEL] = type_pf_tdel,
-                [IPSET_TEST] = type_pf_ttest,
-        },
-        .destroy = type_pf_destroy,
-        .flush  = type_pf_flush,
-        .head   = type_pf_head,
-        .list   = type_pf_tlist,
-        .resize = type_pf_tresize,
-        .same_set = type_pf_same_set,
-};
-
-static void
-type_pf_gc(unsigned long ul_set)
-{
-        struct ip_set *set = (struct ip_set *) ul_set;
-        struct ip_set_hash *h = set->data;
-
-        pr_debug("called\n");
-        write_lock_bh(&set->lock);
-        type_pf_expire(h, NETS_LENGTH(set->family));
-        write_unlock_bh(&set->lock);
-
-        h->gc.expires = jiffies + IPSET_GC_PERIOD(h->timeout) * HZ;
-        add_timer(&h->gc);
-}
-
-static void
-type_pf_gc_init(struct ip_set *set)
-{
-        struct ip_set_hash *h = set->data;
-
-        init_timer(&h->gc);
-        h->gc.data = (unsigned long) set;
-        h->gc.function = type_pf_gc;
-        h->gc.expires = jiffies + IPSET_GC_PERIOD(h->timeout) * HZ;
-        add_timer(&h->gc);
-        pr_debug("gc initialized, run in every %u\n",
-                 IPSET_GC_PERIOD(h->timeout));
-}
-
-#undef HKEY_DATALEN
-#undef HKEY
-#undef type_pf_data_equal
-#undef type_pf_data_isnull
-#undef type_pf_data_copy
-#undef type_pf_data_zero_out
-#undef type_pf_data_netmask
-#undef type_pf_data_list
-#undef type_pf_data_tlist
-#undef type_pf_data_next
-#undef type_pf_data_flags
-#undef type_pf_data_reset_flags
-#undef type_pf_data_match
-
-#undef type_pf_elem
-#undef type_pf_telem
-#undef type_pf_data_timeout
-#undef type_pf_data_expired
-#undef type_pf_data_timeout_set
-
-#undef type_pf_elem_add
-#undef type_pf_add
-#undef type_pf_del
-#undef type_pf_test_cidrs
-#undef type_pf_test
-
-#undef type_pf_elem_tadd
-#undef type_pf_del_telem
-#undef type_pf_expire
-#undef type_pf_tadd
-#undef type_pf_tdel
-#undef type_pf_ttest_cidrs
-#undef type_pf_ttest
-
-#undef type_pf_resize
-#undef type_pf_tresize
-#undef type_pf_flush
-#undef type_pf_destroy
-#undef type_pf_head
-#undef type_pf_list
-#undef type_pf_tlist
-#undef type_pf_same_set
-#undef type_pf_kadt
-#undef type_pf_uadt
-#undef type_pf_gc
-#undef type_pf_gc_init
-#undef type_pf_variant
-#undef type_pf_tvariant
diff --git a/include/linux/netfilter/ipset/ip_set_bitmap.h b/include/linux/netfilter/ipset/ip_set_bitmap.h
index 1a30646d5be8..5e4662a71e01 100644
--- a/include/linux/netfilter/ipset/ip_set_bitmap.h
+++ b/include/linux/netfilter/ipset/ip_set_bitmap.h
@@ -5,6 +5,12 @@
 
 #define IPSET_BITMAP_MAX_RANGE  0x0000FFFF
 
+enum {
+        IPSET_ADD_FAILED = 1,
+        IPSET_ADD_STORE_PLAIN_TIMEOUT,
+        IPSET_ADD_START_STORED_TIMEOUT,
+};
+
 /* Common functions */
 
 static inline u32
diff --git a/include/linux/netfilter/ipset/ip_set_timeout.h b/include/linux/netfilter/ipset/ip_set_timeout.h
index 41d9cfa08167..3aac04167ca7 100644
--- a/include/linux/netfilter/ipset/ip_set_timeout.h
+++ b/include/linux/netfilter/ipset/ip_set_timeout.h
@@ -1,7 +1,7 @@
 #ifndef _IP_SET_TIMEOUT_H
 #define _IP_SET_TIMEOUT_H
 
-/* Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+/* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -17,13 +17,14 @@
 #define IPSET_GC_PERIOD(timeout) \
         ((timeout/3) ? min_t(u32, (timeout)/3, IPSET_GC_TIME) : 1)
 
-/* Set is defined without timeout support: timeout value may be 0 */
-#define IPSET_NO_TIMEOUT        UINT_MAX
+/* Entry is set with no timeout value */
+#define IPSET_ELEM_PERMANENT    0
 
-#define with_timeout(timeout)   ((timeout) != IPSET_NO_TIMEOUT)
+/* Set is defined with timeout support: timeout value may be 0 */
+#define IPSET_NO_TIMEOUT        UINT_MAX
 
-#define opt_timeout(opt, map)   \
-        (with_timeout((opt)->timeout) ? (opt)->timeout : (map)->timeout)
+#define ip_set_adt_opt_timeout(opt, map)        \
+((opt)->ext.timeout != IPSET_NO_TIMEOUT ? (opt)->ext.timeout : (map)->timeout)
 
 static inline unsigned int
 ip_set_timeout_uget(struct nlattr *tb)
@@ -38,61 +39,6 @@ ip_set_timeout_uget(struct nlattr *tb)
         return timeout == IPSET_NO_TIMEOUT ? IPSET_NO_TIMEOUT - 1 : timeout;
 }
 
-#ifdef IP_SET_BITMAP_TIMEOUT
-
-/* Bitmap specific timeout constants and macros for the entries */
-
-/* Bitmap entry is unset */
-#define IPSET_ELEM_UNSET        0
-/* Bitmap entry is set with no timeout value */
-#define IPSET_ELEM_PERMANENT    (UINT_MAX/2)
-
-static inline bool
-ip_set_timeout_test(unsigned long timeout)
-{
-        return timeout != IPSET_ELEM_UNSET &&
-               (timeout == IPSET_ELEM_PERMANENT ||
-                time_is_after_jiffies(timeout));
-}
-
-static inline bool
-ip_set_timeout_expired(unsigned long timeout)
-{
-        return timeout != IPSET_ELEM_UNSET &&
-               timeout != IPSET_ELEM_PERMANENT &&
-               time_is_before_jiffies(timeout);
-}
-
-static inline unsigned long
-ip_set_timeout_set(u32 timeout)
-{
-        unsigned long t;
-
-        if (!timeout)
-                return IPSET_ELEM_PERMANENT;
-
-        t = msecs_to_jiffies(timeout * 1000) + jiffies;
-        if (t == IPSET_ELEM_UNSET || t == IPSET_ELEM_PERMANENT)
-                /* Bingo! */
-                t++;
-
-        return t;
-}
-
-static inline u32
-ip_set_timeout_get(unsigned long timeout)
-{
-        return timeout == IPSET_ELEM_PERMANENT ? 0 :
-                jiffies_to_msecs(timeout - jiffies)/1000;
-}
-
-#else
-
-/* Hash specific timeout constants and macros for the entries */
-
-/* Hash entry is set with no timeout value */
-#define IPSET_ELEM_PERMANENT    0
-
 static inline bool
 ip_set_timeout_test(unsigned long timeout)
 {
@@ -101,36 +47,32 @@ ip_set_timeout_test(unsigned long timeout)
 }
 
 static inline bool
-ip_set_timeout_expired(unsigned long timeout)
+ip_set_timeout_expired(unsigned long *timeout)
 {
-        return timeout != IPSET_ELEM_PERMANENT &&
-               time_is_before_jiffies(timeout);
+        return *timeout != IPSET_ELEM_PERMANENT &&
+               time_is_before_jiffies(*timeout);
 }
 
-static inline unsigned long
-ip_set_timeout_set(u32 timeout)
+static inline void
+ip_set_timeout_set(unsigned long *timeout, u32 t)
 {
-        unsigned long t;
-
-        if (!timeout)
-                return IPSET_ELEM_PERMANENT;
+        if (!t) {
+                *timeout = IPSET_ELEM_PERMANENT;
+                return;
+        }
 
-        t = msecs_to_jiffies(timeout * 1000) + jiffies;
-        if (t == IPSET_ELEM_PERMANENT)
+        *timeout = msecs_to_jiffies(t * 1000) + jiffies;
+        if (*timeout == IPSET_ELEM_PERMANENT)
                 /* Bingo! :-) */
-                t++;
-
-        return t;
+                (*timeout)--;
 }
 
 static inline u32
-ip_set_timeout_get(unsigned long timeout)
+ip_set_timeout_get(unsigned long *timeout)
 {
-        return timeout == IPSET_ELEM_PERMANENT ? 0 :
-                jiffies_to_msecs(timeout - jiffies)/1000;
+        return *timeout == IPSET_ELEM_PERMANENT ? 0 :
+                jiffies_to_msecs(*timeout - jiffies)/1000;
 }
-#endif /* ! IP_SET_BITMAP_TIMEOUT */
 
 #endif  /* __KERNEL__ */
-
 #endif /* _IP_SET_TIMEOUT_H */
diff --git a/include/linux/netfilter/ipset/pfxlen.h b/include/linux/netfilter/ipset/pfxlen.h
index 199fd11fedc0..1afbb94b4b65 100644
--- a/include/linux/netfilter/ipset/pfxlen.h
+++ b/include/linux/netfilter/ipset/pfxlen.h
@@ -41,4 +41,13 @@ do {						\
         to = from | ~ip_set_hostmask(cidr);     \
 } while (0)
 
+static inline void
+ip6_netmask(union nf_inet_addr *ip, u8 prefix)
+{
+        ip->ip6[0] &= ip_set_netmask6(prefix)[0];
+        ip->ip6[1] &= ip_set_netmask6(prefix)[1];
+        ip->ip6[2] &= ip_set_netmask6(prefix)[2];
+        ip->ip6[3] &= ip_set_netmask6(prefix)[3];
+}
+
 #endif /*_PFXLEN_H */
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index ecbb8e495912..cadb7402d7a7 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -29,10 +29,13 @@ extern int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n);
 extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
 
 extern int nfnetlink_has_listeners(struct net *net, unsigned int group);
-extern int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned int group,
-                          int echo, gfp_t flags);
-extern int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);
-extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags);
+extern struct sk_buff *nfnetlink_alloc_skb(struct net *net, unsigned int size,
+                                           u32 dst_portid, gfp_t gfp_mask);
+extern int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid,
+                          unsigned int group, int echo, gfp_t flags);
+extern int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error);
+extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net,
+                             u32 portid, int flags);
 
 extern void nfnl_lock(__u8 subsys_id);
 extern void nfnl_unlock(__u8 subsys_id);
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index e0f746b7b95c..6358da5eeee8 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -15,11 +15,18 @@ static inline struct nlmsghdr *nlmsg_hdr(const struct sk_buff *skb)
         return (struct nlmsghdr *)skb->data;
 }
 
+enum netlink_skb_flags {
+        NETLINK_SKB_MMAPED      = 0x1,          /* Packet data is mmaped */
+        NETLINK_SKB_TX          = 0x2,          /* Packet was sent by userspace */
+        NETLINK_SKB_DELIVERED   = 0x4,          /* Packet was delivered */
+};
+
 struct netlink_skb_parms {
         struct scm_creds        creds;          /* Skb credentials      */
         __u32                   portid;
         __u32                   dst_group;
-        struct sock             *ssk;
+        __u32                   flags;
+        struct sock             *sk;
 };
 
 #define NETLINK_CB(skb)         (*(struct netlink_skb_parms*)&((skb)->cb))
@@ -57,6 +64,8 @@ extern void __netlink_clear_multicast_users(struct sock *sk, unsigned int group)
 extern void netlink_clear_multicast_users(struct sock *sk, unsigned int group);
 extern void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err);
 extern int netlink_has_listeners(struct sock *sk, unsigned int group);
+extern struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
+                                         u32 dst_portid, gfp_t gfp_mask);
 extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, int nonblock);
 extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid,
                              __u32 group, gfp_t allocation);
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index 9d7d8c64f7c8..fa2cb76a7029 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -40,7 +40,7 @@ struct netpoll_info {
 
         unsigned long rx_flags;
         spinlock_t rx_lock;
-        struct mutex dev_lock;
+        struct semaphore dev_lock;
         struct list_head rx_np; /* netpolls that registered an rx_hook */
 
         struct sk_buff_head neigh_tx; /* list of neigh requests to reply to */
diff --git a/include/linux/of_net.h b/include/linux/of_net.h
index f47464188710..61bf53b02779 100644
--- a/include/linux/of_net.h
+++ b/include/linux/of_net.h
@@ -11,6 +11,16 @@
 #include <linux/of.h>
 extern const int of_get_phy_mode(struct device_node *np);
 extern const void *of_get_mac_address(struct device_node *np);
+#else
+static inline const int of_get_phy_mode(struct device_node *np)
+{
+        return -ENODEV;
+}
+
+static inline const void *of_get_mac_address(struct device_node *np)
+{
+        return NULL;
+}
 #endif
 
 #endif /* __LINUX_OF_NET_H */
diff --git a/include/linux/openvswitch.h b/include/linux/openvswitch.h
index d42e174bd0c8..e6b240b6196c 100644
--- a/include/linux/openvswitch.h
+++ b/include/linux/openvswitch.h
@@ -19,435 +19,6 @@
 #ifndef _LINUX_OPENVSWITCH_H
 #define _LINUX_OPENVSWITCH_H 1
 
-#include <linux/types.h>
-
-/**
- * struct ovs_header - header for OVS Generic Netlink messages.
- * @dp_ifindex: ifindex of local port for datapath (0 to make a request not
- * specific to a datapath).
- *
- * Attributes following the header are specific to a particular OVS Generic
- * Netlink family, but all of the OVS families use this header.
- */
-
-struct ovs_header {
-        int dp_ifindex;
-};
-
-/* Datapaths. */
-
-#define OVS_DATAPATH_FAMILY  "ovs_datapath"
-#define OVS_DATAPATH_MCGROUP "ovs_datapath"
-#define OVS_DATAPATH_VERSION 0x1
-
-enum ovs_datapath_cmd {
-        OVS_DP_CMD_UNSPEC,
-        OVS_DP_CMD_NEW,
-        OVS_DP_CMD_DEL,
-        OVS_DP_CMD_GET,
-        OVS_DP_CMD_SET
-};
-
-/**
- * enum ovs_datapath_attr - attributes for %OVS_DP_* commands.
- * @OVS_DP_ATTR_NAME: Name of the network device that serves as the "local
- * port".  This is the name of the network device whose dp_ifindex is given in
- * the &struct ovs_header.  Always present in notifications.  Required in
- * %OVS_DP_NEW requests.  May be used as an alternative to specifying
- * dp_ifindex in other requests (with a dp_ifindex of 0).
- * @OVS_DP_ATTR_UPCALL_PID: The Netlink socket in userspace that is initially
- * set on the datapath port (for OVS_ACTION_ATTR_MISS).  Only valid on
- * %OVS_DP_CMD_NEW requests. A value of zero indicates that upcalls should
- * not be sent.
- * @OVS_DP_ATTR_STATS: Statistics about packets that have passed through the
- * datapath.  Always present in notifications.
- *
- * These attributes follow the &struct ovs_header within the Generic Netlink
- * payload for %OVS_DP_* commands.
- */
-enum ovs_datapath_attr {
-        OVS_DP_ATTR_UNSPEC,
-        OVS_DP_ATTR_NAME,       /* name of dp_ifindex netdev */
-        OVS_DP_ATTR_UPCALL_PID, /* Netlink PID to receive upcalls */
-        OVS_DP_ATTR_STATS,      /* struct ovs_dp_stats */
-        __OVS_DP_ATTR_MAX
-};
-
-#define OVS_DP_ATTR_MAX (__OVS_DP_ATTR_MAX - 1)
-
-struct ovs_dp_stats {
-        __u64 n_hit;             /* Number of flow table matches. */
-        __u64 n_missed;          /* Number of flow table misses. */
-        __u64 n_lost;            /* Number of misses not sent to userspace. */
-        __u64 n_flows;           /* Number of flows present */
-};
-
-struct ovs_vport_stats {
-        __u64   rx_packets;             /* total packets received       */
-        __u64   tx_packets;             /* total packets transmitted    */
-        __u64   rx_bytes;               /* total bytes received         */
-        __u64   tx_bytes;               /* total bytes transmitted      */
-        __u64   rx_errors;              /* bad packets received         */
-        __u64   tx_errors;              /* packet transmit problems     */
-        __u64   rx_dropped;             /* no space in linux buffers    */
-        __u64   tx_dropped;             /* no space available in linux  */
-};
-
-/* Fixed logical ports. */
-#define OVSP_LOCAL      ((__u16)0)
-
-/* Packet transfer. */
-
-#define OVS_PACKET_FAMILY "ovs_packet"
-#define OVS_PACKET_VERSION 0x1
-
-enum ovs_packet_cmd {
-        OVS_PACKET_CMD_UNSPEC,
-
-        /* Kernel-to-user notifications. */
-        OVS_PACKET_CMD_MISS,    /* Flow table miss. */
-        OVS_PACKET_CMD_ACTION,  /* OVS_ACTION_ATTR_USERSPACE action. */
-
-        /* Userspace commands. */
-        OVS_PACKET_CMD_EXECUTE  /* Apply actions to a packet. */
-};
-
-/**
- * enum ovs_packet_attr - attributes for %OVS_PACKET_* commands.
- * @OVS_PACKET_ATTR_PACKET: Present for all notifications.  Contains the entire
- * packet as received, from the start of the Ethernet header onward.  For
- * %OVS_PACKET_CMD_ACTION, %OVS_PACKET_ATTR_PACKET reflects changes made by
- * actions preceding %OVS_ACTION_ATTR_USERSPACE, but %OVS_PACKET_ATTR_KEY is
- * the flow key extracted from the packet as originally received.
- * @OVS_PACKET_ATTR_KEY: Present for all notifications.  Contains the flow key
- * extracted from the packet as nested %OVS_KEY_ATTR_* attributes.  This allows
- * userspace to adapt its flow setup strategy by comparing its notion of the
- * flow key against the kernel's.
- * @OVS_PACKET_ATTR_ACTIONS: Contains actions for the packet.  Used
- * for %OVS_PACKET_CMD_EXECUTE.  It has nested %OVS_ACTION_ATTR_* attributes.
- * @OVS_PACKET_ATTR_USERDATA: Present for an %OVS_PACKET_CMD_ACTION
- * notification if the %OVS_ACTION_ATTR_USERSPACE action specified an
- * %OVS_USERSPACE_ATTR_USERDATA attribute.
- *
- * These attributes follow the &struct ovs_header within the Generic Netlink
- * payload for %OVS_PACKET_* commands.
- */
-enum ovs_packet_attr {
-        OVS_PACKET_ATTR_UNSPEC,
-        OVS_PACKET_ATTR_PACKET,      /* Packet data. */
-        OVS_PACKET_ATTR_KEY,         /* Nested OVS_KEY_ATTR_* attributes. */
-        OVS_PACKET_ATTR_ACTIONS,     /* Nested OVS_ACTION_ATTR_* attributes. */
-        OVS_PACKET_ATTR_USERDATA,    /* u64 OVS_ACTION_ATTR_USERSPACE arg. */
-        __OVS_PACKET_ATTR_MAX
-};
-
-#define OVS_PACKET_ATTR_MAX (__OVS_PACKET_ATTR_MAX - 1)
-
-/* Virtual ports. */
-
-#define OVS_VPORT_FAMILY  "ovs_vport"
-#define OVS_VPORT_MCGROUP "ovs_vport"
-#define OVS_VPORT_VERSION 0x1
-
-enum ovs_vport_cmd {
-        OVS_VPORT_CMD_UNSPEC,
-        OVS_VPORT_CMD_NEW,
-        OVS_VPORT_CMD_DEL,
-        OVS_VPORT_CMD_GET,
-        OVS_VPORT_CMD_SET
-};
-
-enum ovs_vport_type {
-        OVS_VPORT_TYPE_UNSPEC,
-        OVS_VPORT_TYPE_NETDEV,   /* network device */
-        OVS_VPORT_TYPE_INTERNAL, /* network device implemented by datapath */
-        __OVS_VPORT_TYPE_MAX
-};
-
-#define OVS_VPORT_TYPE_MAX (__OVS_VPORT_TYPE_MAX - 1)
-
-/**
- * enum ovs_vport_attr - attributes for %OVS_VPORT_* commands.
- * @OVS_VPORT_ATTR_PORT_NO: 32-bit port number within datapath.
- * @OVS_VPORT_ATTR_TYPE: 32-bit %OVS_VPORT_TYPE_* constant describing the type
- * of vport.
- * @OVS_VPORT_ATTR_NAME: Name of vport.  For a vport based on a network device
- * this is the name of the network device.  Maximum length %IFNAMSIZ-1 bytes
- * plus a null terminator.
- * @OVS_VPORT_ATTR_OPTIONS: Vport-specific configuration information.
- * @OVS_VPORT_ATTR_UPCALL_PID: The Netlink socket in userspace that
- * OVS_PACKET_CMD_MISS upcalls will be directed to for packets received on
- * this port.  A value of zero indicates that upcalls should not be sent.
- * @OVS_VPORT_ATTR_STATS: A &struct ovs_vport_stats giving statistics for
- * packets sent or received through the vport.
- *
- * These attributes follow the &struct ovs_header within the Generic Netlink
- * payload for %OVS_VPORT_* commands.
- *
- * For %OVS_VPORT_CMD_NEW requests, the %OVS_VPORT_ATTR_TYPE and
- * %OVS_VPORT_ATTR_NAME attributes are required.  %OVS_VPORT_ATTR_PORT_NO is
- * optional; if not specified a free port number is automatically selected.
- * Whether %OVS_VPORT_ATTR_OPTIONS is required or optional depends on the type
- * of vport.
- * and other attributes are ignored.
- *
- * For other requests, if %OVS_VPORT_ATTR_NAME is specified then it is used to
- * look up the vport to operate on; otherwise dp_idx from the &struct
- * ovs_header plus %OVS_VPORT_ATTR_PORT_NO determine the vport.
- */
-enum ovs_vport_attr {
-        OVS_VPORT_ATTR_UNSPEC,
-        OVS_VPORT_ATTR_PORT_NO, /* u32 port number within datapath */
-        OVS_VPORT_ATTR_TYPE,    /* u32 OVS_VPORT_TYPE_* constant. */
-        OVS_VPORT_ATTR_NAME,    /* string name, up to IFNAMSIZ bytes long */
-        OVS_VPORT_ATTR_OPTIONS, /* nested attributes, varies by vport type */
-        OVS_VPORT_ATTR_UPCALL_PID, /* u32 Netlink PID to receive upcalls */
-        OVS_VPORT_ATTR_STATS,   /* struct ovs_vport_stats */
-        __OVS_VPORT_ATTR_MAX
-};
-
-#define OVS_VPORT_ATTR_MAX (__OVS_VPORT_ATTR_MAX - 1)
-
-/* Flows. */
-
-#define OVS_FLOW_FAMILY  "ovs_flow"
-#define OVS_FLOW_MCGROUP "ovs_flow"
-#define OVS_FLOW_VERSION 0x1
-
-enum ovs_flow_cmd {
-        OVS_FLOW_CMD_UNSPEC,
-        OVS_FLOW_CMD_NEW,
-        OVS_FLOW_CMD_DEL,
-        OVS_FLOW_CMD_GET,
-        OVS_FLOW_CMD_SET
-};
-
-struct ovs_flow_stats {
-        __u64 n_packets;         /* Number of matched packets. */
-        __u64 n_bytes;           /* Number of matched bytes. */
-};
-
-enum ovs_key_attr {
-        OVS_KEY_ATTR_UNSPEC,
-        OVS_KEY_ATTR_ENCAP,     /* Nested set of encapsulated attributes. */
-        OVS_KEY_ATTR_PRIORITY,  /* u32 skb->priority */
-        OVS_KEY_ATTR_IN_PORT,   /* u32 OVS dp port number */
-        OVS_KEY_ATTR_ETHERNET,  /* struct ovs_key_ethernet */
-        OVS_KEY_ATTR_VLAN,      /* be16 VLAN TCI */
-        OVS_KEY_ATTR_ETHERTYPE, /* be16 Ethernet type */
-        OVS_KEY_ATTR_IPV4,      /* struct ovs_key_ipv4 */
-        OVS_KEY_ATTR_IPV6,      /* struct ovs_key_ipv6 */
-        OVS_KEY_ATTR_TCP,       /* struct ovs_key_tcp */
-        OVS_KEY_ATTR_UDP,       /* struct ovs_key_udp */
-        OVS_KEY_ATTR_ICMP,      /* struct ovs_key_icmp */
-        OVS_KEY_ATTR_ICMPV6,    /* struct ovs_key_icmpv6 */
-        OVS_KEY_ATTR_ARP,       /* struct ovs_key_arp */
-        OVS_KEY_ATTR_ND,        /* struct ovs_key_nd */
-        OVS_KEY_ATTR_SKB_MARK,  /* u32 skb mark */
-        __OVS_KEY_ATTR_MAX
-};
-
-#define OVS_KEY_ATTR_MAX (__OVS_KEY_ATTR_MAX - 1)
-
-/**
- * enum ovs_frag_type - IPv4 and IPv6 fragment type
- * @OVS_FRAG_TYPE_NONE: Packet is not a fragment.
- * @OVS_FRAG_TYPE_FIRST: Packet is a fragment with offset 0.
- * @OVS_FRAG_TYPE_LATER: Packet is a fragment with nonzero offset.
- *
- * Used as the @ipv4_frag in &struct ovs_key_ipv4 and as @ipv6_frag &struct
- * ovs_key_ipv6.
- */
-enum ovs_frag_type {
-        OVS_FRAG_TYPE_NONE,
-        OVS_FRAG_TYPE_FIRST,
-        OVS_FRAG_TYPE_LATER,
-        __OVS_FRAG_TYPE_MAX
-};
-
-#define OVS_FRAG_TYPE_MAX (__OVS_FRAG_TYPE_MAX - 1)
-
-struct ovs_key_ethernet {
-        __u8     eth_src[6];
-        __u8     eth_dst[6];
-};
-
-struct ovs_key_ipv4 {
-        __be32 ipv4_src;
-        __be32 ipv4_dst;
-        __u8   ipv4_proto;
-        __u8   ipv4_tos;
-        __u8   ipv4_ttl;
-        __u8   ipv4_frag;       /* One of OVS_FRAG_TYPE_*. */
-};
-
-struct ovs_key_ipv6 {
-        __be32 ipv6_src[4];
-        __be32 ipv6_dst[4];
-        __be32 ipv6_label;      /* 20-bits in least-significant bits. */
-        __u8   ipv6_proto;
-        __u8   ipv6_tclass;
-        __u8   ipv6_hlimit;
-        __u8   ipv6_frag;       /* One of OVS_FRAG_TYPE_*. */
-};
-
-struct ovs_key_tcp {
-        __be16 tcp_src;
-        __be16 tcp_dst;
-};
-
-struct ovs_key_udp {
-        __be16 udp_src;
-        __be16 udp_dst;
-};
-
-struct ovs_key_icmp {
-        __u8 icmp_type;
-        __u8 icmp_code;
-};
-
-struct ovs_key_icmpv6 {
-        __u8 icmpv6_type;
-        __u8 icmpv6_code;
-};
-
-struct ovs_key_arp {
-        __be32 arp_sip;
-        __be32 arp_tip;
-        __be16 arp_op;
-        __u8   arp_sha[6];
-        __u8   arp_tha[6];
-};
-
-struct ovs_key_nd {
-        __u32 nd_target[4];
-        __u8  nd_sll[6];
-        __u8  nd_tll[6];
-};
-
-/**
- * enum ovs_flow_attr - attributes for %OVS_FLOW_* commands.
- * @OVS_FLOW_ATTR_KEY: Nested %OVS_KEY_ATTR_* attributes specifying the flow
- * key.  Always present in notifications.  Required for all requests (except
- * dumps).
- * @OVS_FLOW_ATTR_ACTIONS: Nested %OVS_ACTION_ATTR_* attributes specifying
- * the actions to take for packets that match the key.  Always present in
- * notifications.  Required for %OVS_FLOW_CMD_NEW requests, optional for
- * %OVS_FLOW_CMD_SET requests.
- * @OVS_FLOW_ATTR_STATS: &struct ovs_flow_stats giving statistics for this
- * flow.  Present in notifications if the stats would be nonzero.  Ignored in
- * requests.
- * @OVS_FLOW_ATTR_TCP_FLAGS: An 8-bit value giving the OR'd value of all of the
- * TCP flags seen on packets in this flow.  Only present in notifications for
- * TCP flows, and only if it would be nonzero.  Ignored in requests.
- * @OVS_FLOW_ATTR_USED: A 64-bit integer giving the time, in milliseconds on
- * the system monotonic clock, at which a packet was last processed for this
- * flow.  Only present in notifications if a packet has been processed for this
- * flow.  Ignored in requests.
- * @OVS_FLOW_ATTR_CLEAR: If present in a %OVS_FLOW_CMD_SET request, clears the
- * last-used time, accumulated TCP flags, and statistics for this flow.
- * Otherwise ignored in requests.  Never present in notifications.
- *
- * These attributes follow the &struct ovs_header within the Generic Netlink
- * payload for %OVS_FLOW_* commands.
- */
-enum ovs_flow_attr {
-        OVS_FLOW_ATTR_UNSPEC,
-        OVS_FLOW_ATTR_KEY,       /* Sequence of OVS_KEY_ATTR_* attributes. */
-        OVS_FLOW_ATTR_ACTIONS,   /* Nested OVS_ACTION_ATTR_* attributes. */
-        OVS_FLOW_ATTR_STATS,     /* struct ovs_flow_stats. */
-        OVS_FLOW_ATTR_TCP_FLAGS, /* 8-bit OR'd TCP flags. */
-        OVS_FLOW_ATTR_USED,      /* u64 msecs last used in monotonic time. */
-        OVS_FLOW_ATTR_CLEAR,     /* Flag to clear stats, tcp_flags, used. */
-        __OVS_FLOW_ATTR_MAX
-};
-
-#define OVS_FLOW_ATTR_MAX (__OVS_FLOW_ATTR_MAX - 1)
-
-/**
- * enum ovs_sample_attr - Attributes for %OVS_ACTION_ATTR_SAMPLE action.
- * @OVS_SAMPLE_ATTR_PROBABILITY: 32-bit fraction of packets to sample with
- * @OVS_ACTION_ATTR_SAMPLE.  A value of 0 samples no packets, a value of
- * %UINT32_MAX samples all packets and intermediate values sample intermediate
- * fractions of packets.
- * @OVS_SAMPLE_ATTR_ACTIONS: Set of actions to execute in sampling event.
- * Actions are passed as nested attributes.
- *
- * Executes the specified actions with the given probability on a per-packet
- * basis.
- */
-enum ovs_sample_attr {
-        OVS_SAMPLE_ATTR_UNSPEC,
-        OVS_SAMPLE_ATTR_PROBABILITY, /* u32 number */
-        OVS_SAMPLE_ATTR_ACTIONS,     /* Nested OVS_ACTION_ATTR_* attributes. */
-        __OVS_SAMPLE_ATTR_MAX,
-};
-
-#define OVS_SAMPLE_ATTR_MAX (__OVS_SAMPLE_ATTR_MAX - 1)
-
-/**
- * enum ovs_userspace_attr - Attributes for %OVS_ACTION_ATTR_USERSPACE action.
- * @OVS_USERSPACE_ATTR_PID: u32 Netlink PID to which the %OVS_PACKET_CMD_ACTION
- * message should be sent.  Required.
- * @OVS_USERSPACE_ATTR_USERDATA: If present, its u64 argument is copied to the
- * %OVS_PACKET_CMD_ACTION message as %OVS_PACKET_ATTR_USERDATA,
- */
-enum ovs_userspace_attr {
-        OVS_USERSPACE_ATTR_UNSPEC,
-        OVS_USERSPACE_ATTR_PID,       /* u32 Netlink PID to receive upcalls. */
-        OVS_USERSPACE_ATTR_USERDATA,  /* u64 optional user-specified cookie. */
-        __OVS_USERSPACE_ATTR_MAX
-};
-
-#define OVS_USERSPACE_ATTR_MAX (__OVS_USERSPACE_ATTR_MAX - 1)
-
-/**
- * struct ovs_action_push_vlan - %OVS_ACTION_ATTR_PUSH_VLAN action argument.
- * @vlan_tpid: Tag protocol identifier (TPID) to push.
- * @vlan_tci: Tag control identifier (TCI) to push.  The CFI bit must be set
- * (but it will not be set in the 802.1Q header that is pushed).
- *
- * The @vlan_tpid value is typically %ETH_P_8021Q.  The only acceptable TPID
- * values are those that the kernel module also parses as 802.1Q headers, to
- * prevent %OVS_ACTION_ATTR_PUSH_VLAN followed by %OVS_ACTION_ATTR_POP_VLAN
- * from having surprising results.
- */
-struct ovs_action_push_vlan {
-        __be16 vlan_tpid;       /* 802.1Q TPID. */
-        __be16 vlan_tci;        /* 802.1Q TCI (VLAN ID and priority). */
-};
-
-/**
- * enum ovs_action_attr - Action types.
- *
- * @OVS_ACTION_ATTR_OUTPUT: Output packet to port.
- * @OVS_ACTION_ATTR_USERSPACE: Send packet to userspace according to nested
- * %OVS_USERSPACE_ATTR_* attributes.
- * @OVS_ACTION_ATTR_SET: Replaces the contents of an existing header.  The
- * single nested %OVS_KEY_ATTR_* attribute specifies a header to modify and its
- * value.
- * @OVS_ACTION_ATTR_PUSH_VLAN: Push a new outermost 802.1Q header onto the
- * packet.
- * @OVS_ACTION_ATTR_POP_VLAN: Pop the outermost 802.1Q header off the packet.
- * @OVS_ACTION_ATTR_SAMPLE: Probabilitically executes actions, as specified in
- * the nested %OVS_SAMPLE_ATTR_* attributes.
- *
- * Only a single header can be set with a single %OVS_ACTION_ATTR_SET.  Not all
- * fields within a header are modifiable, e.g. the IPv4 protocol and fragment
- * type may not be changed.
- */
-
-enum ovs_action_attr {
-        OVS_ACTION_ATTR_UNSPEC,
-        OVS_ACTION_ATTR_OUTPUT,       /* u32 port number. */
-        OVS_ACTION_ATTR_USERSPACE,    /* Nested OVS_USERSPACE_ATTR_*. */
-        OVS_ACTION_ATTR_SET,          /* One nested OVS_KEY_ATTR_*. */
-        OVS_ACTION_ATTR_PUSH_VLAN,    /* struct ovs_action_push_vlan. */
-        OVS_ACTION_ATTR_POP_VLAN,     /* No argument. */
-        OVS_ACTION_ATTR_SAMPLE,       /* Nested OVS_SAMPLE_ATTR_*. */
-        __OVS_ACTION_ATTR_MAX
-};
-
-#define OVS_ACTION_ATTR_MAX (__OVS_ACTION_ATTR_MAX - 1)
+#include <uapi/linux/openvswitch.h>
 
 #endif /* _LINUX_OPENVSWITCH_H */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index e73dfa308b87..3a24e4ff3248 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1661,6 +1661,7 @@ int pci_enable_sriov(struct pci_dev *dev, int nr_virtfn);
 void pci_disable_sriov(struct pci_dev *dev);
 irqreturn_t pci_sriov_migration(struct pci_dev *dev);
 int pci_num_vf(struct pci_dev *dev);
+int pci_vfs_assigned(struct pci_dev *dev);
 int pci_sriov_set_totalvfs(struct pci_dev *dev, u16 numvfs);
 int pci_sriov_get_totalvfs(struct pci_dev *dev);
 #else
@@ -1679,6 +1680,10 @@ static inline int pci_num_vf(struct pci_dev *dev)
 {
         return 0;
 }
+static inline int pci_vfs_assigned(struct pci_dev *dev)
+{
+        return 0;
+}
 static inline int pci_sriov_set_totalvfs(struct pci_dev *dev, u16 numvfs)
 {
         return 0;
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 33999adbf8c8..9e11039dd7a3 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -455,6 +455,14 @@ struct phy_driver {
          */
         void (*txtstamp)(struct phy_device *dev, struct sk_buff *skb, int type);
 
+        /* Some devices (e.g. qnap TS-119P II) require PHY register changes to
+         * enable Wake on LAN, so set_wol is provided to be called in the
+         * ethernet driver's set_wol function. */
+        int (*set_wol)(struct phy_device *dev, struct ethtool_wolinfo *wol);
+
+        /* See set_wol, but for checking whether Wake on LAN is enabled. */
+        void (*get_wol)(struct phy_device *dev, struct ethtool_wolinfo *wol);
+
         struct device_driver driver;
 };
 #define to_phy_driver(d) container_of(d, struct phy_driver, driver)
@@ -560,6 +568,8 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable);
 int phy_get_eee_err(struct phy_device *phydev);
 int phy_ethtool_set_eee(struct phy_device *phydev, struct ethtool_eee *data);
 int phy_ethtool_get_eee(struct phy_device *phydev, struct ethtool_eee *data);
+int phy_ethtool_set_wol(struct phy_device *phydev, struct ethtool_wolinfo *wol);
+void phy_ethtool_get_wol(struct phy_device *phydev, struct ethtool_wolinfo *wol);
 
 int __init mdio_bus_init(void);
 void mdio_bus_exit(void);
diff --git a/include/linux/platform_data/brcmfmac-sdio.h b/include/linux/platform_data/brcmfmac-sdio.h
new file mode 100644
index 000000000000..1ade657d5fc1
--- /dev/null
+++ b/include/linux/platform_data/brcmfmac-sdio.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _LINUX_BRCMFMAC_PLATFORM_H
+#define _LINUX_BRCMFMAC_PLATFORM_H
+
+/*
+ * Platform specific driver functions and data. Through the platform specific
+ * device data functions can be provided to help the brcmfmac driver to
+ * operate with the device in combination with the used platform.
+ *
+ * Use the platform data in the following (similar) way:
+ *
+ *
+#include <brcmfmac_platform.h>
+
+
+static void brcmfmac_power_on(void)
+{
+}
+
+static void brcmfmac_power_off(void)
+{
+}
+
+static void brcmfmac_reset(void)
+{
+}
+
+static struct brcmfmac_sdio_platform_data brcmfmac_sdio_pdata = {
+        .power_on               = brcmfmac_power_on,
+        .power_off              = brcmfmac_power_off,
+        .reset                  = brcmfmac_reset
+};
+
+static struct platform_device brcmfmac_device = {
+        .name                   = BRCMFMAC_SDIO_PDATA_NAME,
+        .id                     = PLATFORM_DEVID_NONE,
+        .dev.platform_data      = &brcmfmac_sdio_pdata
+};
+
+void __init brcmfmac_init_pdata(void)
+{
+        brcmfmac_sdio_pdata.oob_irq_supported = true;
+        brcmfmac_sdio_pdata.oob_irq_nr = gpio_to_irq(GPIO_BRCMF_SDIO_OOB);
+        brcmfmac_sdio_pdata.oob_irq_flags = IORESOURCE_IRQ |
+                                            IORESOURCE_IRQ_HIGHLEVEL;
+        platform_device_register(&brcmfmac_device);
+}
+ *
+ *
+ * Note: the brcmfmac can be loaded as module or be statically built-in into
+ * the kernel. If built-in then do note that it uses module_init (and
+ * module_exit) routines which equal device_initcall. So if you intend to
+ * create a module with the platform specific data for the brcmfmac and have
+ * it built-in to the kernel then use a higher initcall then device_initcall
+ * (see init.h). If this is not done then brcmfmac will load without problems
+ * but will not pickup the platform data.
+ *
+ * When the driver does not "detect" platform driver data then it will continue
+ * without reporting anything and just assume there is no data needed. Which is
+ * probably true for most platforms.
+ *
+ * Explanation of the platform_data fields:
+ *
+ * drive_strength: is the preferred drive_strength to be used for the SDIO
+ * pins. If 0 then a default value will be used. This is the target drive
+ * strength, the exact drive strength which will be used depends on the
+ * capabilities of the device.
+ *
+ * oob_irq_supported: does the board have support for OOB interrupts. SDIO
+ * in-band interrupts are relatively slow and for having less overhead on
+ * interrupt processing an out of band interrupt can be used. If the HW
+ * supports this then enable this by setting this field to true and configure
+ * the oob related fields.
+ *
+ * oob_irq_nr, oob_irq_flags: the OOB interrupt information. The values are
+ * used for registering the irq using request_irq function.
+ *
+ * power_on: This function is called by the brcmfmac when the module gets
+ * loaded. This can be particularly useful for low power devices. The platform
+ * spcific routine may for example decide to power up the complete device.
+ * If there is no use-case for this function then provide NULL.
+ *
+ * power_off: This function is called by the brcmfmac when the module gets
+ * unloaded. At this point the device can be powered down or otherwise be reset.
+ * So if an actual power_off is not supported but reset is then reset the device
+ * when this function gets called. This can be particularly useful for low power
+ * devices. If there is no use-case for this function (either power-down or
+ * reset) then provide NULL.
+ *
+ * reset: This function can get called if the device communication broke down.
+ * This functionality is particularly useful in case of SDIO type devices. It is
+ * possible to reset a dongle via sdio data interface, but it requires that
+ * this is fully functional. This function is chip/module specific and this
+ * function should return only after the complete reset has completed.
+ */
+
+#define BRCMFMAC_SDIO_PDATA_NAME        "brcmfmac_sdio"
+
+struct brcmfmac_sdio_platform_data {
+        unsigned int drive_strength;
+        bool oob_irq_supported;
+        unsigned int oob_irq_nr;
+        unsigned long oob_irq_flags;
+        void (*power_on)(void);
+        void (*power_off)(void);
+        void (*reset)(void);
+};
+
+#endif /* _LINUX_BRCMFMAC_PLATFORM_H */
diff --git a/include/linux/platform_data/cpsw.h b/include/linux/platform_data/cpsw.h
index 798fb80b024b..bb3cd58d71e3 100644
--- a/include/linux/platform_data/cpsw.h
+++ b/include/linux/platform_data/cpsw.h
@@ -30,7 +30,7 @@ struct cpsw_platform_data {
         u32     channels;       /* number of cpdma channels (symmetric) */
         u32     slaves;         /* number of slave cpgmac ports */
         struct cpsw_slave_data  *slave_data;
-        u32     cpts_active_slave; /* time stamping slave */
+        u32     active_slave; /* time stamping, ethtool and SIOCGMIIPHY slave */
         u32     cpts_clock_mult;  /* convert input clock ticks to nanoseconds */
         u32     cpts_clock_shift; /* convert input clock ticks to nanoseconds */
         u32     ale_entries;    /* ale table size */
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 489dd7bb28ec..f28544b2f9af 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -69,6 +69,15 @@ extern int ndo_dflt_fdb_dump(struct sk_buff *skb,
                              struct netlink_callback *cb,
                              struct net_device *dev,
                              int idx);
+extern int ndo_dflt_fdb_add(struct ndmsg *ndm,
+                            struct nlattr *tb[],
+                            struct net_device *dev,
+                            const unsigned char *addr,
+                             u16 flags);
+extern int ndo_dflt_fdb_del(struct ndmsg *ndm,
+                            struct nlattr *tb[],
+                            struct net_device *dev,
+                            const unsigned char *addr);
 
 extern int ndo_dflt_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,
                                    struct net_device *dev, u16 mode);
diff --git a/include/linux/sctp.h b/include/linux/sctp.h
index c11a28706fa4..3bfe8d6ee248 100644
--- a/include/linux/sctp.h
+++ b/include/linux/sctp.h
@@ -53,7 +53,9 @@
 
 #include <linux/in.h>           /* We need in_addr.  */
 #include <linux/in6.h>          /* We need in6_addr.  */
+#include <linux/skbuff.h>
 
+#include <uapi/linux/sctp.h>
 
 /* Section 3.1.  SCTP Common Header Format */
 typedef struct sctphdr {
@@ -63,14 +65,10 @@ typedef struct sctphdr {
         __le32 checksum;
 } __packed sctp_sctphdr_t;
 
-#ifdef __KERNEL__
-#include <linux/skbuff.h>
-
 static inline struct sctphdr *sctp_hdr(const struct sk_buff *skb)
 {
         return (struct sctphdr *)skb_transport_header(skb);
 }
-#endif
 
 /* Section 3.2.  Chunk Field Descriptions. */
 typedef struct sctp_chunkhdr {
diff --git a/include/linux/sh_eth.h b/include/linux/sh_eth.h
index b17d765ded84..fc305713fc6d 100644
--- a/include/linux/sh_eth.h
+++ b/include/linux/sh_eth.h
@@ -6,6 +6,7 @@
 enum {EDMAC_LITTLE_ENDIAN, EDMAC_BIG_ENDIAN};
 enum {
         SH_ETH_REG_GIGABIT,
+        SH_ETH_REG_FAST_RCAR,
         SH_ETH_REG_FAST_SH4,
         SH_ETH_REG_FAST_SH3_SH2
 };
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index b8292d8cc9fa..2e0ced1af3b1 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -32,6 +32,7 @@
 #include <linux/hrtimer.h>
 #include <linux/dma-mapping.h>
 #include <linux/netdev_features.h>
+#include <net/flow_keys.h>
 
 /* Don't change this without changing skb_csum_unnecessary! */
 #define CHECKSUM_NONE 0
@@ -316,6 +317,8 @@ enum {
         SKB_GSO_FCOE = 1 << 5,
 
         SKB_GSO_GRE = 1 << 6,
+
+        SKB_GSO_UDP_TUNNEL = 1 << 7,
 };
 
 #if BITS_PER_LONG > 32
@@ -384,9 +387,11 @@ typedef unsigned char *sk_buff_data_t;
  *      @secmark: security marking
  *      @mark: Generic packet mark
  *      @dropcount: total number of sk_receive_queue overflows
+ *      @vlan_proto: vlan encapsulation protocol
  *      @vlan_tci: vlan tag control information
  *      @inner_transport_header: Inner transport layer header (encapsulation)
  *      @inner_network_header: Network layer header (encapsulation)
+ *      @inner_mac_header: Link layer header (encapsulation)
  *      @transport_header: Transport layer header
  *      @network_header: Network layer header
  *      @mac_header: Link layer header
@@ -461,6 +466,7 @@ struct sk_buff {
 
         __u32                   rxhash;
 
+        __be16                  vlan_proto;
         __u16                   vlan_tci;
 
 #ifdef CONFIG_NET_SCHED
@@ -505,6 +511,7 @@ struct sk_buff {
 
         sk_buff_data_t          inner_transport_header;
         sk_buff_data_t          inner_network_header;
+        sk_buff_data_t          inner_mac_header;
         sk_buff_data_t          transport_header;
         sk_buff_data_t          network_header;
         sk_buff_data_t          mac_header;
@@ -570,7 +577,40 @@ static inline void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)
         skb->_skb_refdst = (unsigned long)dst;
 }
 
-extern void skb_dst_set_noref(struct sk_buff *skb, struct dst_entry *dst);
+extern void __skb_dst_set_noref(struct sk_buff *skb, struct dst_entry *dst,
+                                bool force);
+
+/**
+ * skb_dst_set_noref - sets skb dst, hopefully, without taking reference
+ * @skb: buffer
+ * @dst: dst entry
+ *
+ * Sets skb dst, assuming a reference was not taken on dst.
+ * If dst entry is cached, we do not take reference and dst_release
+ * will be avoided by refdst_drop. If dst entry is not cached, we take
+ * reference, so that last dst_release can destroy the dst immediately.
+ */
+static inline void skb_dst_set_noref(struct sk_buff *skb, struct dst_entry *dst)
+{
+        __skb_dst_set_noref(skb, dst, false);
+}
+
+/**
+ * skb_dst_set_noref_force - sets skb dst, without taking reference
+ * @skb: buffer
+ * @dst: dst entry
+ *
+ * Sets skb dst, assuming a reference was not taken on dst.
+ * No reference is taken and no dst_release will be called. While for
+ * cached dsts deferred reclaim is a basic feature, for entries that are
+ * not cached it is caller's job to guarantee that last dst_release for
+ * provided dst happens when nobody uses it, eg. after a RCU grace period.
+ */
+static inline void skb_dst_set_noref_force(struct sk_buff *skb,
+                                           struct dst_entry *dst)
+{
+        __skb_dst_set_noref(skb, dst, true);
+}
 
 /**
  * skb_dst_is_noref - Test if skb dst isn't refcounted
@@ -611,6 +651,12 @@ static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
         return __alloc_skb(size, priority, SKB_ALLOC_FCLONE, NUMA_NO_NODE);
 }
 
+extern struct sk_buff *__alloc_skb_head(gfp_t priority, int node);
+static inline struct sk_buff *alloc_skb_head(gfp_t priority)
+{
+        return __alloc_skb_head(priority, -1);
+}
+
 extern struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src);
 extern int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask);
 extern struct sk_buff *skb_clone(struct sk_buff *skb,
@@ -1471,6 +1517,7 @@ static inline void skb_reserve(struct sk_buff *skb, int len)
 
 static inline void skb_reset_inner_headers(struct sk_buff *skb)
 {
+        skb->inner_mac_header = skb->mac_header;
         skb->inner_network_header = skb->network_header;
         skb->inner_transport_header = skb->transport_header;
 }
@@ -1516,6 +1563,22 @@ static inline void skb_set_inner_network_header(struct sk_buff *skb,
         skb->inner_network_header += offset;
 }
 
+static inline unsigned char *skb_inner_mac_header(const struct sk_buff *skb)
+{
+        return skb->head + skb->inner_mac_header;
+}
+
+static inline void skb_reset_inner_mac_header(struct sk_buff *skb)
+{
+        skb->inner_mac_header = skb->data - skb->head;
+}
+
+static inline void skb_set_inner_mac_header(struct sk_buff *skb,
+                                            const int offset)
+{
+        skb_reset_inner_mac_header(skb);
+        skb->inner_mac_header += offset;
+}
 static inline bool skb_transport_header_was_set(const struct sk_buff *skb)
 {
         return skb->transport_header != ~0U;
@@ -1609,6 +1672,21 @@ static inline void skb_set_inner_network_header(struct sk_buff *skb,
         skb->inner_network_header = skb->data + offset;
 }
 
+static inline unsigned char *skb_inner_mac_header(const struct sk_buff *skb)
+{
+        return skb->inner_mac_header;
+}
+
+static inline void skb_reset_inner_mac_header(struct sk_buff *skb)
+{
+        skb->inner_mac_header = skb->data;
+}
+
+static inline void skb_set_inner_mac_header(struct sk_buff *skb,
+                                                const int offset)
+{
+        skb->inner_mac_header = skb->data + offset;
+}
 static inline bool skb_transport_header_was_set(const struct sk_buff *skb)
 {
         return skb->transport_header != NULL;
@@ -1666,6 +1744,19 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
 }
 #endif /* NET_SKBUFF_DATA_USES_OFFSET */
 
+static inline void skb_probe_transport_header(struct sk_buff *skb,
+                                              const int offset_hint)
+{
+        struct flow_keys keys;
+
+        if (skb_transport_header_was_set(skb))
+                return;
+        else if (skb_flow_dissect(skb, &keys))
+                skb_set_transport_header(skb, keys.thoff);
+        else
+                skb_set_transport_header(skb, offset_hint);
+}
+
 static inline void skb_mac_header_rebuild(struct sk_buff *skb)
 {
         if (skb_mac_header_was_set(skb)) {
@@ -2811,6 +2902,8 @@ static inline void skb_checksum_none_assert(const struct sk_buff *skb)
 
 bool skb_partial_csum_set(struct sk_buff *skb, u16 start, u16 off);
 
+u32 __skb_get_poff(const struct sk_buff *skb);
+
 /**
  * skb_head_is_locked - Determine if the skb->head is locked down
  * @skb: skb to check
diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
index e8d702e0fd89..54f91d35e5fd 100644
--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -1,6 +1,7 @@
 #ifndef __SOCK_DIAG_H__
 #define __SOCK_DIAG_H__
 
+#include <linux/user_namespace.h>
 #include <uapi/linux/sock_diag.h>
 
 struct sk_buff;
@@ -22,5 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie);
 void sock_diag_save_cookie(void *sk, __u32 *cookie);
 
 int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
+int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
+                             struct sk_buff *skb, int attrtype);
 
 #endif
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 2b9f74b0ffea..428c37a1f95c 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -298,6 +298,7 @@ struct ucred {
 #define SOL_IUCV        277
 #define SOL_CAIF        278
 #define SOL_ALG         279
+#define SOL_NFC         280
 
 /* IPX options */
 #define IPX_TYPE        1
diff --git a/include/linux/spi/at86rf230.h b/include/linux/spi/at86rf230.h
index b2b1afbb3202..aa327a8105ad 100644
--- a/include/linux/spi/at86rf230.h
+++ b/include/linux/spi/at86rf230.h
@@ -26,6 +26,20 @@ struct at86rf230_platform_data {
         int rstn;
         int slp_tr;
         int dig2;
+
+        /* Setting the irq_type will configure the driver to request
+         * the platform irq trigger type according to the given value
+         * and configure the interrupt polarity of the device to the
+         * corresponding polarity.
+         *
+         * Allowed values are: IRQF_TRIGGER_RISING, IRQF_TRIGGER_FALLING,
+         *                     IRQF_TRIGGER_HIGH and IRQF_TRIGGER_LOW
+         *
+         * Setting it to 0, the driver does not touch the trigger type
+         * configuration of the interrupt and sets the interrupt polarity
+         * of the device to high active (the default value).
+         */
+        int irq_type;
 };
 
 #endif
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 22958d68ecfe..c64999fd1660 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -26,9 +26,9 @@ struct ssb_sprom_core_pwr_info {
 
 struct ssb_sprom {
         u8 revision;
-        u8 il0mac[6];           /* MAC address for 802.11b/g */
-        u8 et0mac[6];           /* MAC address for Ethernet */
-        u8 et1mac[6];           /* MAC address for 802.11a */
+        u8 il0mac[6] __aligned(sizeof(u16));    /* MAC address for 802.11b/g */
+        u8 et0mac[6] __aligned(sizeof(u16));    /* MAC address for Ethernet */
+        u8 et1mac[6] __aligned(sizeof(u16));    /* MAC address for 802.11a */
         u8 et0phyaddr;          /* MII address for enet0 */
         u8 et1phyaddr;          /* MII address for enet1 */
         u8 et0mdcport;          /* MDIO for enet0 */
@@ -340,13 +340,61 @@ enum ssb_bustype {
 #define SSB_BOARDVENDOR_DELL    0x1028  /* Dell */
 #define SSB_BOARDVENDOR_HP      0x0E11  /* HP */
 /* board_type */
+#define SSB_BOARD_BCM94301CB    0x0406
+#define SSB_BOARD_BCM94301MP    0x0407
+#define SSB_BOARD_BU4309        0x040A
+#define SSB_BOARD_BCM94309CB    0x040B
+#define SSB_BOARD_BCM4309MP     0x040C
+#define SSB_BOARD_BU4306        0x0416
 #define SSB_BOARD_BCM94306MP    0x0418
 #define SSB_BOARD_BCM4309G      0x0421
 #define SSB_BOARD_BCM4306CB     0x0417
-#define SSB_BOARD_BCM4309MP     0x040C
+#define SSB_BOARD_BCM94306PC    0x0425  /* pcmcia 3.3v 4306 card */
+#define SSB_BOARD_BCM94306CBSG  0x042B  /* with SiGe PA */
+#define SSB_BOARD_PCSG94306     0x042D  /* with SiGe PA */
+#define SSB_BOARD_BU4704SD      0x042E  /* with sdram */
+#define SSB_BOARD_BCM94704AGR   0x042F  /* dual 11a/11g Router */
+#define SSB_BOARD_BCM94308MP    0x0430  /* 11a-only minipci */
+#define SSB_BOARD_BU4318        0x0447
+#define SSB_BOARD_CB4318        0x0448
+#define SSB_BOARD_MPG4318       0x0449
 #define SSB_BOARD_MP4318        0x044A
-#define SSB_BOARD_BU4306        0x0416
-#define SSB_BOARD_BU4309        0x040A
+#define SSB_BOARD_SD4318        0x044B
+#define SSB_BOARD_BCM94306P     0x044C  /* with SiGe */
+#define SSB_BOARD_BCM94303MP    0x044E
+#define SSB_BOARD_BCM94306MPM   0x0450
+#define SSB_BOARD_BCM94306MPL   0x0453
+#define SSB_BOARD_PC4303        0x0454  /* pcmcia */
+#define SSB_BOARD_BCM94306MPLNA 0x0457
+#define SSB_BOARD_BCM94306MPH   0x045B
+#define SSB_BOARD_BCM94306PCIV  0x045C
+#define SSB_BOARD_BCM94318MPGH  0x0463
+#define SSB_BOARD_BU4311        0x0464
+#define SSB_BOARD_BCM94311MC    0x0465
+#define SSB_BOARD_BCM94311MCAG  0x0466
+/* 4321 boards */
+#define SSB_BOARD_BU4321        0x046B
+#define SSB_BOARD_BU4321E       0x047C
+#define SSB_BOARD_MP4321        0x046C
+#define SSB_BOARD_CB2_4321      0x046D
+#define SSB_BOARD_CB2_4321_AG   0x0066
+#define SSB_BOARD_MC4321        0x046E
+/* 4325 boards */
+#define SSB_BOARD_BCM94325DEVBU 0x0490
+#define SSB_BOARD_BCM94325BGABU 0x0491
+#define SSB_BOARD_BCM94325SDGWB 0x0492
+#define SSB_BOARD_BCM94325SDGMDL        0x04AA
+#define SSB_BOARD_BCM94325SDGMDL2       0x04C6
+#define SSB_BOARD_BCM94325SDGMDL3       0x04C9
+#define SSB_BOARD_BCM94325SDABGWBA      0x04E1
+/* 4322 boards */
+#define SSB_BOARD_BCM94322MC    0x04A4
+#define SSB_BOARD_BCM94322USB   0x04A8  /* dualband */
+#define SSB_BOARD_BCM94322HM    0x04B0
+#define SSB_BOARD_BCM94322USB2D 0x04Bf  /* single band discrete front end */
+/* 4312 boards */
+#define SSB_BOARD_BU4312        0x048A
+#define SSB_BOARD_BCM4312MCGSG  0x04B5
 /* chip_package */
 #define SSB_CHIPPACK_BCM4712S   1       /* Small 200pin 4712 */
 #define SSB_CHIPPACK_BCM4712M   2       /* Medium 225pin 4712 */
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index 6ecfa02ddbac..3a7256955b10 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -289,11 +289,11 @@
 #define  SSB_SPROM4_ETHPHY_ET1A_SHIFT   5
 #define  SSB_SPROM4_ETHPHY_ET0M         (1<<14) /* MDIO for enet0 */
 #define  SSB_SPROM4_ETHPHY_ET1M         (1<<15) /* MDIO for enet1 */
-#define SSB_SPROM4_ANTAVAIL             0x005D  /* Antenna available bitfields */
-#define  SSB_SPROM4_ANTAVAIL_A          0x00FF  /* A-PHY bitfield */
-#define  SSB_SPROM4_ANTAVAIL_A_SHIFT    0
-#define  SSB_SPROM4_ANTAVAIL_BG         0xFF00  /* B-PHY and G-PHY bitfield */
-#define  SSB_SPROM4_ANTAVAIL_BG_SHIFT   8
+#define SSB_SPROM4_ANTAVAIL             0x005C  /* Antenna available bitfields */
+#define  SSB_SPROM4_ANTAVAIL_BG         0x00FF  /* B-PHY and G-PHY bitfield */
+#define  SSB_SPROM4_ANTAVAIL_BG_SHIFT   0
+#define  SSB_SPROM4_ANTAVAIL_A          0xFF00  /* A-PHY bitfield */
+#define  SSB_SPROM4_ANTAVAIL_A_SHIFT    8
 #define SSB_SPROM4_AGAIN01              0x005E  /* Antenna Gain (in dBm Q5.2) */
 #define  SSB_SPROM4_AGAIN0              0x00FF  /* Antenna 0 */
 #define  SSB_SPROM4_AGAIN0_SHIFT        0
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index f28408c07dc2..5adbc33d1ab3 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -90,9 +90,6 @@ struct tcp_options_received {
                 sack_ok : 4,    /* SACK seen on SYN packet              */
                 snd_wscale : 4, /* Window scaling received from sender  */
                 rcv_wscale : 4; /* Window scaling to send to receiver   */
-        u8      cookie_plus:6,  /* bytes in authenticator/cookie option */
-                cookie_out_never:1,
-                cookie_in_always:1;
         u8      num_sacks;      /* Number of SACK blocks                */
         u16     user_mss;       /* mss requested by user in ioctl       */
         u16     mss_clamp;      /* Maximal mss, negotiated at connection setup */
@@ -102,7 +99,6 @@ static inline void tcp_clear_options(struct tcp_options_received *rx_opt)
 {
         rx_opt->tstamp_ok = rx_opt->sack_ok = 0;
         rx_opt->wscale_ok = rx_opt->snd_wscale = 0;
-        rx_opt->cookie_plus = 0;
 }
 
 /* This is the max number of SACKS that we'll generate and process. It's safe
@@ -191,20 +187,19 @@ struct tcp_sock {
         u32     window_clamp;   /* Maximal window to advertise          */
         u32     rcv_ssthresh;   /* Current window clamp                 */
 
-        u32     frto_highmark;  /* snd_nxt when RTO occurred */
         u16     advmss;         /* Advertised MSS                       */
-        u8      frto_counter;   /* Number of new acks after RTO */
+        u8      unused;
         u8      nonagle     : 4,/* Disable Nagle algorithm?             */
                 thin_lto    : 1,/* Use linear timeouts for thin streams */
                 thin_dupack : 1,/* Fast retransmit on first dupack      */
                 repair      : 1,
-                unused      : 1;
+                frto        : 1;/* F-RTO (RFC5682) activated in CA_Loss */
         u8      repair_queue;
         u8      do_early_retrans:1,/* Enable RFC5827 early-retransmit  */
-                early_retrans_delayed:1, /* Delayed ER timer installed */
                 syn_data:1,     /* SYN includes data */
                 syn_fastopen:1, /* SYN includes Fast Open option */
                 syn_data_acked:1;/* data in SYN is acked by SYN-ACK */
+        u32     tlp_high_seq;   /* snd_nxt at the time of TLP retransmit. */
 
 /* RTT measurement */
         u32     srtt;           /* smoothed round trip time << 3        */
@@ -320,12 +315,6 @@ struct tcp_sock {
         struct tcp_md5sig_info  __rcu *md5sig_info;
 #endif
 
-        /* When the cookie options are generated and exchanged, then this
-         * object holds a reference to them (cookie_values->kref).  Also
-         * contains related tcp_cookie_transactions fields.
-         */
-        struct tcp_cookie_values  *cookie_values;
-
 /* TCP fastopen related information */
         struct tcp_fastopen_request *fastopen_req;
         /* fastopen_rsk points to request_sock that resulted in this big
@@ -361,10 +350,6 @@ struct tcp_timewait_sock {
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_md5sig_key     *tw_md5_key;
 #endif
-        /* Few sockets in timewait have cookies; in that case, then this
-         * object holds a reference to them (tw_cookie_values->kref).
-         */
-        struct tcp_cookie_values  *tw_cookie_values;
 };
 
 static inline struct tcp_timewait_sock *tcp_twsk(const struct sock *sk)
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 0e5ac93bab10..da46327fca17 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -72,6 +72,7 @@ struct usbnet {
 #               define EVENT_DEVICE_REPORT_IDLE 8
 #               define EVENT_NO_RUNTIME_PM      9
 #               define EVENT_RX_KILL    10
+#               define EVENT_LINK_CHANGE        11
 };
 
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
@@ -245,5 +246,6 @@ extern void usbnet_get_drvinfo(struct net_device *, struct ethtool_drvinfo *);
 extern int usbnet_nway_reset(struct net_device *net);
 
 extern int usbnet_manage_power(struct usbnet *, int);
+extern void usbnet_link_change(struct usbnet *, bool, bool);
 
 #endif /* __LINUX_USB_USBNET_H */
diff --git a/include/linux/virtio.h b/include/linux/virtio.h
index ff6714e6d0f5..2d7a5e045908 100644
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -58,12 +58,6 @@ void *virtqueue_detach_unused_buf(struct virtqueue *vq);
 
 unsigned int virtqueue_get_vring_size(struct virtqueue *vq);
 
-/* FIXME: Obsolete accessor, but required for virtio_net merge. */
-static inline unsigned int virtqueue_get_queue_index(struct virtqueue *vq)
-{
-        return vq->index;
-}
-
 /**
  * virtio_device - representation of a device using virtio
  * @index: unique position on the virtio bus
diff --git a/include/linux/vm_sockets.h b/include/linux/vm_sockets.h
new file mode 100644
index 000000000000..0805eecba8f7
--- /dev/null
+++ b/include/linux/vm_sockets.h
@@ -0,0 +1,23 @@
+/*
+ * VMware vSockets Driver
+ *
+ * Copyright (C) 2007-2013 VMware, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation version 2 and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef _VM_SOCKETS_H
+#define _VM_SOCKETS_H
+
+#include <uapi/linux/vm_sockets.h>
+
+int vm_sockets_get_local_cid(void);
+
+#endif /* _VM_SOCKETS_H */
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 0a996a3517ed..dbdfd2b0f3b3 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -29,7 +29,8 @@ struct unix_address {
 
 struct unix_skb_parms {
         struct pid              *pid;           /* Skb credentials      */
-        const struct cred       *cred;
+        kuid_t                  uid;
+        kgid_t                  gid;
         struct scm_fp_list      *fp;            /* Passed files         */
 #ifdef CONFIG_SECURITY_NETWORK
         u32                     secid;          /* Security ID          */
@@ -56,9 +57,10 @@ struct unix_sock {
         struct list_head        link;
         atomic_long_t           inflight;
         spinlock_t              lock;
-        unsigned int            gc_candidate : 1;
-        unsigned int            gc_maybe_cycle : 1;
         unsigned char           recursion_level;
+        unsigned long           gc_flags;
+#define UNIX_GC_CANDIDATE       0
+#define UNIX_GC_MAYBE_CYCLE     1
         struct socket_wq        peer_wq;
 };
 #define unix_sk(__sk) ((struct unix_sock *)__sk)
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 9531beee09b5..6912ef9a1881 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -193,11 +193,11 @@ static inline bool bdaddr_type_is_le(__u8 type)
 #define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff} })
 
 /* Copy, swap, convert BD Address */
-static inline int bacmp(bdaddr_t *ba1, bdaddr_t *ba2)
+static inline int bacmp(const bdaddr_t *ba1, const bdaddr_t *ba2)
 {
         return memcmp(ba1, ba2, sizeof(bdaddr_t));
 }
-static inline void bacpy(bdaddr_t *dst, bdaddr_t *src)
+static inline void bacpy(bdaddr_t *dst, const bdaddr_t *src)
 {
         memcpy(dst, src, sizeof(bdaddr_t));
 }
@@ -232,7 +232,7 @@ struct bt_sock_list {
 };
 
 int  bt_sock_register(int proto, const struct net_proto_family *ops);
-int  bt_sock_unregister(int proto);
+void bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
 int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
@@ -260,12 +260,23 @@ struct l2cap_ctrl {
         __u8            retries;
 };
 
+struct hci_dev;
+
+typedef void (*hci_req_complete_t)(struct hci_dev *hdev, u8 status);
+
+struct hci_req_ctrl {
+        bool                    start;
+        u8                      event;
+        hci_req_complete_t      complete;
+};
+
 struct bt_skb_cb {
         __u8 pkt_type;
         __u8 incoming;
         __u16 expect;
         __u8 force_active;
         struct l2cap_ctrl control;
+        struct hci_req_ctrl req;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
 
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 7f12c25f1fca..e0512aaef4b8 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -119,10 +119,16 @@ enum {
         HCI_CONNECTABLE,
         HCI_DISCOVERABLE,
         HCI_LINK_SECURITY,
-        HCI_PENDING_CLASS,
         HCI_PERIODIC_INQ,
+        HCI_FAST_CONNECTABLE,
 };
 
+/* A mask for the flags that are supposed to remain when a reset happens
+ * or the HCI device is closed.
+ */
+#define HCI_PERSISTENT_MASK (BIT(HCI_LE_SCAN) | BIT(HCI_PERIODIC_INQ) | \
+                              BIT(HCI_FAST_CONNECTABLE))
+
 /* HCI ioctl defines */
 #define HCIDEVUP        _IOW('H', 201, int)
 #define HCIDEVDOWN      _IOW('H', 202, int)
@@ -881,12 +887,25 @@ struct hci_rp_read_data_block_size {
         __le16   num_blocks;
 } __packed;
 
+#define HCI_OP_READ_PAGE_SCAN_ACTIVITY  0x0c1b
+struct hci_rp_read_page_scan_activity {
+        __u8     status;
+        __le16   interval;
+        __le16   window;
+} __packed;
+
 #define HCI_OP_WRITE_PAGE_SCAN_ACTIVITY 0x0c1c
 struct hci_cp_write_page_scan_activity {
         __le16   interval;
         __le16   window;
 } __packed;
 
+#define HCI_OP_READ_PAGE_SCAN_TYPE      0x0c46
+struct hci_rp_read_page_scan_type {
+        __u8     status;
+        __u8     type;
+} __packed;
+
 #define HCI_OP_WRITE_PAGE_SCAN_TYPE     0x0c47
         #define PAGE_SCAN_TYPE_STANDARD         0x00
         #define PAGE_SCAN_TYPE_INTERLACED       0x01
@@ -965,6 +984,9 @@ struct hci_cp_le_set_adv_data {
 
 #define HCI_OP_LE_SET_ADV_ENABLE        0x200a
 
+#define LE_SCAN_PASSIVE                 0x00
+#define LE_SCAN_ACTIVE                  0x01
+
 #define HCI_OP_LE_SET_SCAN_PARAM        0x200b
 struct hci_cp_le_set_scan_param {
         __u8    type;
@@ -974,8 +996,10 @@ struct hci_cp_le_set_scan_param {
         __u8    filter_policy;
 } __packed;
 
-#define LE_SCANNING_DISABLED            0x00
-#define LE_SCANNING_ENABLED             0x01
+#define LE_SCAN_DISABLE                 0x00
+#define LE_SCAN_ENABLE                  0x01
+#define LE_SCAN_FILTER_DUP_DISABLE      0x00
+#define LE_SCAN_FILTER_DUP_ENABLE       0x01
 
 #define HCI_OP_LE_SET_SCAN_ENABLE       0x200c
 struct hci_cp_le_set_scan_enable {
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 90cf75afcb02..35a57cd1704c 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -134,6 +134,8 @@ struct amp_assoc {
         __u8    data[HCI_MAX_AMP_ASSOC_SIZE];
 };
 
+#define HCI_MAX_PAGES   3
+
 #define NUM_REASSEMBLY 4
 struct hci_dev {
         struct list_head list;
@@ -151,8 +153,8 @@ struct hci_dev {
         __u8            dev_class[3];
         __u8            major_class;
         __u8            minor_class;
-        __u8            features[8];
-        __u8            host_features[8];
+        __u8            max_page;
+        __u8            features[HCI_MAX_PAGES][8];
         __u8            le_features[8];
         __u8            le_white_list_size;
         __u8            le_states[8];
@@ -165,6 +167,10 @@ struct hci_dev {
         __u16           voice_setting;
         __u8            io_capability;
         __s8            inq_tx_power;
+        __u16           page_scan_interval;
+        __u16           page_scan_window;
+        __u8            page_scan_type;
+
         __u16           devid_source;
         __u16           devid_vendor;
         __u16           devid_product;
@@ -240,6 +246,7 @@ struct hci_dev {
         struct sk_buff_head     raw_q;
         struct sk_buff_head     cmd_q;
 
+        struct sk_buff          *recv_evt;
         struct sk_buff          *sent_cmd;
         struct sk_buff          *reassembly[NUM_REASSEMBLY];
 
@@ -248,8 +255,6 @@ struct hci_dev {
         __u32                   req_status;
         __u32                   req_result;
 
-        __u16                   init_last_cmd;
-
         struct list_head        mgmt_pending;
 
         struct discovery_state  discovery;
@@ -266,8 +271,6 @@ struct hci_dev {
 
         struct hci_dev_stats    stat;
 
-        struct sk_buff_head     driver_init;
-
         atomic_t                promisc;
 
         struct dentry           *debugfs;
@@ -290,6 +293,7 @@ struct hci_dev {
         int (*open)(struct hci_dev *hdev);
         int (*close)(struct hci_dev *hdev);
         int (*flush)(struct hci_dev *hdev);
+        int (*setup)(struct hci_dev *hdev);
         int (*send)(struct sk_buff *skb);
         void (*notify)(struct hci_dev *hdev, unsigned int evt);
         int (*ioctl)(struct hci_dev *hdev, unsigned int cmd, unsigned long arg);
@@ -311,7 +315,7 @@ struct hci_conn {
         bool            out;
         __u8            attempt;
         __u8            dev_class[3];
-        __u8            features[8];
+        __u8            features[HCI_MAX_PAGES][8];
         __u16           interval;
         __u16           pkt_type;
         __u16           link_policy;
@@ -343,7 +347,6 @@ struct hci_conn {
         struct timer_list auto_accept_timer;
 
         struct device   dev;
-        atomic_t        devref;
 
         struct hci_dev  *hdev;
         void            *l2cap_data;
@@ -574,7 +577,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_state(struct hci_dev *hdev,
         return NULL;
 }
 
-void hci_acl_disconn(struct hci_conn *conn, __u8 reason);
+void hci_disconnect(struct hci_conn *conn, __u8 reason);
 void hci_setup_sync(struct hci_conn *conn, __u16 handle);
 void hci_sco_setup(struct hci_conn *conn, __u8 status);
 
@@ -582,7 +585,6 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst);
 int hci_conn_del(struct hci_conn *conn);
 void hci_conn_hash_flush(struct hci_dev *hdev);
 void hci_conn_check_pending(struct hci_dev *hdev);
-void hci_conn_accept(struct hci_conn *conn, int mask);
 
 struct hci_chan *hci_chan_create(struct hci_conn *conn);
 void hci_chan_del(struct hci_chan *chan);
@@ -599,8 +601,36 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 
 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
 
-void hci_conn_hold_device(struct hci_conn *conn);
-void hci_conn_put_device(struct hci_conn *conn);
+/*
+ * hci_conn_get() and hci_conn_put() are used to control the life-time of an
+ * "hci_conn" object. They do not guarantee that the hci_conn object is running,
+ * working or anything else. They just guarantee that the object is available
+ * and can be dereferenced. So you can use its locks, local variables and any
+ * other constant data.
+ * Before accessing runtime data, you _must_ lock the object and then check that
+ * it is still running. As soon as you release the locks, the connection might
+ * get dropped, though.
+ *
+ * On the other hand, hci_conn_hold() and hci_conn_drop() are used to control
+ * how long the underlying connection is held. So every channel that runs on the
+ * hci_conn object calls this to prevent the connection from disappearing. As
+ * long as you hold a device, you must also guarantee that you have a valid
+ * reference to the device via hci_conn_get() (or the initial reference from
+ * hci_conn_add()).
+ * The hold()/drop() ref-count is known to drop below 0 sometimes, which doesn't
+ * break because nobody cares for that. But this means, we cannot use
+ * _get()/_drop() in it, but require the caller to have a valid ref (FIXME).
+ */
+
+static inline void hci_conn_get(struct hci_conn *conn)
+{
+        get_device(&conn->dev);
+}
+
+static inline void hci_conn_put(struct hci_conn *conn)
+{
+        put_device(&conn->dev);
+}
 
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
@@ -610,7 +640,7 @@ static inline void hci_conn_hold(struct hci_conn *conn)
         cancel_delayed_work(&conn->disc_work);
 }
 
-static inline void hci_conn_put(struct hci_conn *conn)
+static inline void hci_conn_drop(struct hci_conn *conn)
 {
         BT_DBG("hcon %p orig refcnt %d", conn, atomic_read(&conn->refcnt));
 
@@ -742,8 +772,6 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
                                                                 u8 *randomizer);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
-int hci_update_ad(struct hci_dev *hdev);
-
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
 
 int hci_recv_frame(struct sk_buff *skb);
@@ -760,29 +788,29 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->dev.parent = (pdev))
 
 /* ----- LMP capabilities ----- */
-#define lmp_encrypt_capable(dev)   ((dev)->features[0] & LMP_ENCRYPT)
-#define lmp_rswitch_capable(dev)   ((dev)->features[0] & LMP_RSWITCH)
-#define lmp_hold_capable(dev)      ((dev)->features[0] & LMP_HOLD)
-#define lmp_sniff_capable(dev)     ((dev)->features[0] & LMP_SNIFF)
-#define lmp_park_capable(dev)      ((dev)->features[1] & LMP_PARK)
-#define lmp_inq_rssi_capable(dev)  ((dev)->features[3] & LMP_RSSI_INQ)
-#define lmp_esco_capable(dev)      ((dev)->features[3] & LMP_ESCO)
-#define lmp_bredr_capable(dev)     (!((dev)->features[4] & LMP_NO_BREDR))
-#define lmp_le_capable(dev)        ((dev)->features[4] & LMP_LE)
-#define lmp_sniffsubr_capable(dev) ((dev)->features[5] & LMP_SNIFF_SUBR)
-#define lmp_pause_enc_capable(dev) ((dev)->features[5] & LMP_PAUSE_ENC)
-#define lmp_ext_inq_capable(dev)   ((dev)->features[6] & LMP_EXT_INQ)
-#define lmp_le_br_capable(dev)     !!((dev)->features[6] & LMP_SIMUL_LE_BR)
-#define lmp_ssp_capable(dev)       ((dev)->features[6] & LMP_SIMPLE_PAIR)
-#define lmp_no_flush_capable(dev)  ((dev)->features[6] & LMP_NO_FLUSH)
-#define lmp_lsto_capable(dev)      ((dev)->features[7] & LMP_LSTO)
-#define lmp_inq_tx_pwr_capable(dev) ((dev)->features[7] & LMP_INQ_TX_PWR)
-#define lmp_ext_feat_capable(dev)  ((dev)->features[7] & LMP_EXTFEATURES)
+#define lmp_encrypt_capable(dev)   ((dev)->features[0][0] & LMP_ENCRYPT)
+#define lmp_rswitch_capable(dev)   ((dev)->features[0][0] & LMP_RSWITCH)
+#define lmp_hold_capable(dev)      ((dev)->features[0][0] & LMP_HOLD)
+#define lmp_sniff_capable(dev)     ((dev)->features[0][0] & LMP_SNIFF)
+#define lmp_park_capable(dev)      ((dev)->features[0][1] & LMP_PARK)
+#define lmp_inq_rssi_capable(dev)  ((dev)->features[0][3] & LMP_RSSI_INQ)
+#define lmp_esco_capable(dev)      ((dev)->features[0][3] & LMP_ESCO)
+#define lmp_bredr_capable(dev)     (!((dev)->features[0][4] & LMP_NO_BREDR))
+#define lmp_le_capable(dev)        ((dev)->features[0][4] & LMP_LE)
+#define lmp_sniffsubr_capable(dev) ((dev)->features[0][5] & LMP_SNIFF_SUBR)
+#define lmp_pause_enc_capable(dev) ((dev)->features[0][5] & LMP_PAUSE_ENC)
+#define lmp_ext_inq_capable(dev)   ((dev)->features[0][6] & LMP_EXT_INQ)
+#define lmp_le_br_capable(dev)     (!!((dev)->features[0][6] & LMP_SIMUL_LE_BR))
+#define lmp_ssp_capable(dev)       ((dev)->features[0][6] & LMP_SIMPLE_PAIR)
+#define lmp_no_flush_capable(dev)  ((dev)->features[0][6] & LMP_NO_FLUSH)
+#define lmp_lsto_capable(dev)      ((dev)->features[0][7] & LMP_LSTO)
+#define lmp_inq_tx_pwr_capable(dev) ((dev)->features[0][7] & LMP_INQ_TX_PWR)
+#define lmp_ext_feat_capable(dev)  ((dev)->features[0][7] & LMP_EXTFEATURES)
 
 /* ----- Extended LMP capabilities ----- */
-#define lmp_host_ssp_capable(dev)  ((dev)->host_features[0] & LMP_HOST_SSP)
-#define lmp_host_le_capable(dev)   !!((dev)->host_features[0] & LMP_HOST_LE)
-#define lmp_host_le_br_capable(dev) !!((dev)->host_features[0] & LMP_HOST_LE_BREDR)
+#define lmp_host_ssp_capable(dev)  ((dev)->features[1][0] & LMP_HOST_SSP)
+#define lmp_host_le_capable(dev)   (!!((dev)->features[1][0] & LMP_HOST_LE))
+#define lmp_host_le_br_capable(dev) (!!((dev)->features[1][0] & LMP_HOST_LE_BREDR))
 
 /* returns true if at least one AMP active */
 static inline bool hci_amp_capable(void)
@@ -1041,7 +1069,31 @@ static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
 int hci_register_cb(struct hci_cb *hcb);
 int hci_unregister_cb(struct hci_cb *hcb);
 
-int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param);
+struct hci_request {
+        struct hci_dev          *hdev;
+        struct sk_buff_head     cmd_q;
+
+        /* If something goes wrong when building the HCI request, the error
+         * value is stored in this field.
+         */
+        int                     err;
+};
+
+void hci_req_init(struct hci_request *req, struct hci_dev *hdev);
+int hci_req_run(struct hci_request *req, hci_req_complete_t complete);
+void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
+                 const void *param);
+void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
+                    const void *param, u8 event);
+void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status);
+
+struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
+                               const void *param, u32 timeout);
+struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
+                                  const void *param, u8 event, u32 timeout);
+
+int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
+                 const void *param);
 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags);
 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb);
 
@@ -1153,7 +1205,7 @@ struct hci_sec_filter {
 #define hci_req_lock(d)         mutex_lock(&d->req_lock)
 #define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
 
-void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result);
+void hci_update_ad(struct hci_request *req);
 
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index cdd33021f831..fb94cf13c777 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -583,6 +583,14 @@ struct l2cap_conn {
 
         struct list_head        chan_l;
         struct mutex            chan_lock;
+        struct kref             ref;
+        struct list_head        users;
+};
+
+struct l2cap_user {
+        struct list_head list;
+        int (*probe) (struct l2cap_conn *conn, struct l2cap_user *user);
+        void (*remove) (struct l2cap_conn *conn, struct l2cap_user *user);
 };
 
 #define L2CAP_INFO_CL_MTU_REQ_SENT      0x01
@@ -786,6 +794,7 @@ extern bool disable_ertm;
 
 int l2cap_init_sockets(void);
 void l2cap_cleanup_sockets(void);
+bool l2cap_is_socket(struct socket *sock);
 
 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan);
 int __l2cap_wait_ack(struct sock *sk);
@@ -812,4 +821,10 @@ void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
                        u8 status);
 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result);
 
+void l2cap_conn_get(struct l2cap_conn *conn);
+void l2cap_conn_put(struct l2cap_conn *conn);
+
+int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user);
+void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user);
+
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index e2e3ecad1008..7afd4199d6b6 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -158,7 +158,6 @@ struct rfcomm_session {
         struct timer_list timer;
         unsigned long    state;
         unsigned long    flags;
-        atomic_t         refcnt;
         int              initiator;
 
         /* Default DLC parameters */
@@ -276,11 +275,6 @@ static inline void rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 void   rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src,
                                                                 bdaddr_t *dst);
 
-static inline void rfcomm_session_hold(struct rfcomm_session *s)
-{
-        atomic_inc(&s->refcnt);
-}
-
 /* ---- RFCOMM sockets ---- */
 struct sockaddr_rc {
         sa_family_t     rc_family;
diff --git a/include/net/caif/caif_dev.h b/include/net/caif/caif_dev.h
index ef2dd9438bb1..028b754ae9b1 100644
--- a/include/net/caif/caif_dev.h
+++ b/include/net/caif/caif_dev.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/ sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/caif_device.h b/include/net/caif/caif_device.h
index d02f044adb8a..d6e3c4267c81 100644
--- a/include/net/caif/caif_device.h
+++ b/include/net/caif/caif_device.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/ sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
index bcb9cc3ce98b..4795e817afe5 100644
--- a/include/net/caif/caif_hsi.h
+++ b/include/net/caif/caif_hsi.h
@@ -1,6 +1,5 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Contact: Sjur Brendeland / sjur.brandeland@stericsson.com
  * Author:  Daniel Martensson / daniel.martensson@stericsson.com
  *          Dmitry.Tarnyagin  / dmitry.tarnyagin@stericsson.com
  * License terms: GNU General Public License (GPL) version 2
diff --git a/include/net/caif/caif_layer.h b/include/net/caif/caif_layer.h
index 0f3a39125f90..94e5ed64dc6d 100644
--- a/include/net/caif/caif_layer.h
+++ b/include/net/caif/caif_layer.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland / sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/caif_shm.h b/include/net/caif/caif_shm.h
deleted file mode 100644
index 5bcce55438cf..000000000000
--- a/include/net/caif/caif_shm.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) ST-Ericsson AB 2010
- * Contact: Sjur Brendeland / sjur.brandeland@stericsson.com
- * Author: Amarnath Revanna / amarnath.bangalore.revanna@stericsson.com
- * License terms: GNU General Public License (GPL) version 2
- */
-
-#ifndef CAIF_SHM_H_
-#define CAIF_SHM_H_
-
-struct shmdev_layer {
-        u32 shm_base_addr;
-        u32 shm_total_sz;
-        u32 shm_id;
-        u32 shm_loopback;
-        void *hmbx;
-        int (*pshmdev_mbxsend) (u32 shm_id, u32 mbx_msg);
-        int (*pshmdev_mbxsetup) (void *pshmdrv_cb,
-                                struct shmdev_layer *pshm_dev, void *pshm_drv);
-        struct net_device *pshm_netdev;
-};
-
-extern int caif_shmcore_probe(struct shmdev_layer *pshm_dev);
-extern void caif_shmcore_remove(struct net_device *pshm_netdev);
-
-#endif
diff --git a/include/net/caif/cfcnfg.h b/include/net/caif/cfcnfg.h
index 90b4ff8bad83..70bfd017581f 100644
--- a/include/net/caif/cfcnfg.h
+++ b/include/net/caif/cfcnfg.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
index 9e5425b4a1d7..f2ae33d23baf 100644
--- a/include/net/caif/cfctrl.h
+++ b/include/net/caif/cfctrl.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cffrml.h b/include/net/caif/cffrml.h
index afac1a48cce7..a06e33fbaa8b 100644
--- a/include/net/caif/cffrml.h
+++ b/include/net/caif/cffrml.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cfmuxl.h b/include/net/caif/cfmuxl.h
index 5847a196b8ad..752999572f21 100644
--- a/include/net/caif/cfmuxl.h
+++ b/include/net/caif/cfmuxl.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cfpkt.h b/include/net/caif/cfpkt.h
index 83a89ba3005b..1c1ad46250d5 100644
--- a/include/net/caif/cfpkt.h
+++ b/include/net/caif/cfpkt.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cfserl.h b/include/net/caif/cfserl.h
index f121299a3427..b5b020f3c72e 100644
--- a/include/net/caif/cfserl.h
+++ b/include/net/caif/cfserl.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cfsrvl.h b/include/net/caif/cfsrvl.h
index 0f5905241843..cd47705c2cc3 100644
--- a/include/net/caif/cfsrvl.h
+++ b/include/net/caif/cfsrvl.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index d581c6de5d64..26b5b692c22b 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -611,22 +611,10 @@ struct cfg80211_ap_settings {
 };
 
 /**
- * enum plink_action - actions to perform in mesh peers
- *
- * @PLINK_ACTION_INVALID: action 0 is reserved
- * @PLINK_ACTION_OPEN: start mesh peer link establishment
- * @PLINK_ACTION_BLOCK: block traffic from this mesh peer
- */
-enum plink_actions {
-        PLINK_ACTION_INVALID,
-        PLINK_ACTION_OPEN,
-        PLINK_ACTION_BLOCK,
-};
-
-/**
  * enum station_parameters_apply_mask - station parameter values to apply
  * @STATION_PARAM_APPLY_UAPSD: apply new uAPSD parameters (uapsd_queues, max_sp)
  * @STATION_PARAM_APPLY_CAPABILITY: apply new capability
+ * @STATION_PARAM_APPLY_PLINK_STATE: apply new plink state
  *
  * Not all station parameters have in-band "no change" signalling,
  * for those that don't these flags will are used.
@@ -634,6 +622,7 @@ enum plink_actions {
 enum station_parameters_apply_mask {
         STATION_PARAM_APPLY_UAPSD = BIT(0),
         STATION_PARAM_APPLY_CAPABILITY = BIT(1),
+        STATION_PARAM_APPLY_PLINK_STATE = BIT(2),
 };
 
 /**
@@ -669,7 +658,7 @@ enum station_parameters_apply_mask {
  * @ext_capab_len: number of extended capabilities
  */
 struct station_parameters {
-        u8 *supported_rates;
+        const u8 *supported_rates;
         struct net_device *vlan;
         u32 sta_flags_mask, sta_flags_set;
         u32 sta_modify_mask;
@@ -678,17 +667,60 @@ struct station_parameters {
         u8 supported_rates_len;
         u8 plink_action;
         u8 plink_state;
-        struct ieee80211_ht_cap *ht_capa;
-        struct ieee80211_vht_cap *vht_capa;
+        const struct ieee80211_ht_cap *ht_capa;
+        const struct ieee80211_vht_cap *vht_capa;
         u8 uapsd_queues;
         u8 max_sp;
         enum nl80211_mesh_power_mode local_pm;
         u16 capability;
-        u8 *ext_capab;
+        const u8 *ext_capab;
         u8 ext_capab_len;
 };
 
 /**
+ * enum cfg80211_station_type - the type of station being modified
+ * @CFG80211_STA_AP_CLIENT: client of an AP interface
+ * @CFG80211_STA_AP_MLME_CLIENT: client of an AP interface that has
+ *      the AP MLME in the device
+ * @CFG80211_STA_AP_STA: AP station on managed interface
+ * @CFG80211_STA_IBSS: IBSS station
+ * @CFG80211_STA_TDLS_PEER_SETUP: TDLS peer on managed interface (dummy entry
+ *      while TDLS setup is in progress, it moves out of this state when
+ *      being marked authorized; use this only if TDLS with external setup is
+ *      supported/used)
+ * @CFG80211_STA_TDLS_PEER_ACTIVE: TDLS peer on managed interface (active
+ *      entry that is operating, has been marked authorized by userspace)
+ * @CFG80211_STA_MESH_PEER_KERNEL: peer on mesh interface (kernel managed)
+ * @CFG80211_STA_MESH_PEER_USER: peer on mesh interface (user managed)
+ */
+enum cfg80211_station_type {
+        CFG80211_STA_AP_CLIENT,
+        CFG80211_STA_AP_MLME_CLIENT,
+        CFG80211_STA_AP_STA,
+        CFG80211_STA_IBSS,
+        CFG80211_STA_TDLS_PEER_SETUP,
+        CFG80211_STA_TDLS_PEER_ACTIVE,
+        CFG80211_STA_MESH_PEER_KERNEL,
+        CFG80211_STA_MESH_PEER_USER,
+};
+
+/**
+ * cfg80211_check_station_change - validate parameter changes
+ * @wiphy: the wiphy this operates on
+ * @params: the new parameters for a station
+ * @statype: the type of station being modified
+ *
+ * Utility function for the @change_station driver method. Call this function
+ * with the appropriate station type looking up the station (and checking that
+ * it exists). It will verify whether the station change is acceptable, and if
+ * not will return an error code. Note that it may modify the parameters for
+ * backward compatibility reasons, so don't use them before calling this.
+ */
+int cfg80211_check_station_change(struct wiphy *wiphy,
+                                  struct station_parameters *params,
+                                  enum cfg80211_station_type statype);
+
+/**
  * enum station_info_flags - station information flags
  *
  * Used by the driver to indicate which info in &struct station_info
@@ -1119,6 +1151,7 @@ struct mesh_config {
  * @ie_len: length of vendor information elements
  * @is_authenticated: this mesh requires authentication
  * @is_secure: this mesh uses security
+ * @user_mpm: userspace handles all MPM functions
  * @dtim_period: DTIM period to use
  * @beacon_interval: beacon interval to use
  * @mcast_rate: multicat rate for Mesh Node [6Mbps is the default for 802.11a]
@@ -1136,6 +1169,7 @@ struct mesh_setup {
         u8 ie_len;
         bool is_authenticated;
         bool is_secure;
+        bool user_mpm;
         u8 dtim_period;
         u16 beacon_interval;
         int mcast_rate[IEEE80211_NUM_BANDS];
@@ -1398,9 +1432,11 @@ struct cfg80211_auth_request {
  * enum cfg80211_assoc_req_flags - Over-ride default behaviour in association.
  *
  * @ASSOC_REQ_DISABLE_HT:  Disable HT (802.11n)
+ * @ASSOC_REQ_DISABLE_VHT:  Disable VHT
  */
 enum cfg80211_assoc_req_flags {
         ASSOC_REQ_DISABLE_HT            = BIT(0),
+        ASSOC_REQ_DISABLE_VHT           = BIT(1),
 };
 
 /**
@@ -1422,6 +1458,8 @@ enum cfg80211_assoc_req_flags {
  * @ht_capa:  HT Capabilities over-rides.  Values set in ht_capa_mask
  *   will be used in ht_capa.  Un-supported values will be ignored.
  * @ht_capa_mask:  The bits of ht_capa which are to be used.
+ * @vht_capa: VHT capability override
+ * @vht_capa_mask: VHT capability mask indicating which fields to use
  */
 struct cfg80211_assoc_request {
         struct cfg80211_bss *bss;
@@ -1432,6 +1470,7 @@ struct cfg80211_assoc_request {
         u32 flags;
         struct ieee80211_ht_cap ht_capa;
         struct ieee80211_ht_cap ht_capa_mask;
+        struct ieee80211_vht_cap vht_capa, vht_capa_mask;
 };
 
 /**
@@ -1542,6 +1581,8 @@ struct cfg80211_ibss_params {
  * @ht_capa:  HT Capabilities over-rides.  Values set in ht_capa_mask
  *   will be used in ht_capa.  Un-supported values will be ignored.
  * @ht_capa_mask:  The bits of ht_capa which are to be used.
+ * @vht_capa:  VHT Capability overrides
+ * @vht_capa_mask: The bits of vht_capa which are to be used.
  */
 struct cfg80211_connect_params {
         struct ieee80211_channel *channel;
@@ -1560,6 +1601,8 @@ struct cfg80211_connect_params {
         int bg_scan_period;
         struct ieee80211_ht_cap ht_capa;
         struct ieee80211_ht_cap ht_capa_mask;
+        struct ieee80211_vht_cap vht_capa;
+        struct ieee80211_vht_cap vht_capa_mask;
 };
 
 /**
@@ -1722,6 +1765,21 @@ struct cfg80211_gtk_rekey_data {
 };
 
 /**
+ * struct cfg80211_update_ft_ies_params - FT IE Information
+ *
+ * This structure provides information needed to update the fast transition IE
+ *
+ * @md: The Mobility Domain ID, 2 Octet value
+ * @ie: Fast Transition IEs
+ * @ie_len: Length of ft_ie in octets
+ */
+struct cfg80211_update_ft_ies_params {
+        u16 md;
+        const u8 *ie;
+        size_t ie_len;
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -1781,9 +1839,8 @@ struct cfg80211_gtk_rekey_data {
  * @change_station: Modify a given station. Note that flags changes are not much
  *      validated in cfg80211, in particular the auth/assoc/authorized flags
  *      might come to the driver in invalid combinations -- make sure to check
- *      them, also against the existing state! Also, supported_rates changes are
- *      not checked in station mode -- drivers need to reject (or ignore) them
- *      for anything but TDLS peers.
+ *      them, also against the existing state! Drivers must call
+ *      cfg80211_check_station_change() to validate the information.
  * @get_station: get station information for the station identified by @mac
  * @dump_station: dump station callback -- resume dump at index @idx
  *
@@ -1941,6 +1998,16 @@ struct cfg80211_gtk_rekey_data {
  *      advertise the support for MAC based ACL have to implement this callback.
  *
  * @start_radar_detection: Start radar detection in the driver.
+ *
+ * @update_ft_ies: Provide updated Fast BSS Transition information to the
+ *      driver. If the SME is in the driver/firmware, this information can be
+ *      used in building Authentication and Reassociation Request frames.
+ *
+ * @crit_proto_start: Indicates a critical protocol needs more link reliability
+ *      for a given duration (milliseconds). The protocol is provided so the
+ *      driver can take the most appropriate actions.
+ * @crit_proto_stop: Indicates critical protocol no longer needs increased link
+ *      reliability. This operation can not fail.
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -2168,6 +2235,14 @@ struct cfg80211_ops {
         int     (*start_radar_detection)(struct wiphy *wiphy,
                                          struct net_device *dev,
                                          struct cfg80211_chan_def *chandef);
+        int     (*update_ft_ies)(struct wiphy *wiphy, struct net_device *dev,
+                                 struct cfg80211_update_ft_ies_params *ftie);
+        int     (*crit_proto_start)(struct wiphy *wiphy,
+                                    struct wireless_dev *wdev,
+                                    enum nl80211_crit_proto_id protocol,
+                                    u16 duration);
+        void    (*crit_proto_stop)(struct wiphy *wiphy,
+                                   struct wireless_dev *wdev);
 };
 
 /*
@@ -2485,6 +2560,8 @@ struct wiphy_wowlan_support {
  * @ap_sme_capa: AP SME capabilities, flags from &enum nl80211_ap_sme_features.
  * @ht_capa_mod_mask:  Specify what ht_cap values can be over-ridden.
  *      If null, then none can be over-ridden.
+ * @vht_capa_mod_mask:  Specify what VHT capabilities can be over-ridden.
+ *      If null, then none can be over-ridden.
  *
  * @max_acl_mac_addrs: Maximum number of MAC addresses that the device
  *      supports for ACL.
@@ -2593,6 +2670,7 @@ struct wiphy {
         struct dentry *debugfsdir;
 
         const struct ieee80211_ht_cap *ht_capa_mod_mask;
+        const struct ieee80211_vht_cap *vht_capa_mod_mask;
 
 #ifdef CONFIG_NET_NS
         /* the network namespace this phy lives in currently */
@@ -3958,6 +4036,17 @@ bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
 void cfg80211_ch_switch_notify(struct net_device *dev,
                                struct cfg80211_chan_def *chandef);
 
+/**
+ * ieee80211_operating_class_to_band - convert operating class to band
+ *
+ * @operating_class: the operating class to convert
+ * @band: band pointer to fill
+ *
+ * Returns %true if the conversion was successful, %false otherwise.
+ */
+bool ieee80211_operating_class_to_band(u8 operating_class,
+                                       enum ieee80211_band *band);
+
 /*
  * cfg80211_tdls_oper_request - request userspace to perform TDLS operation
  * @dev: the device on which the operation is requested
@@ -4002,6 +4091,30 @@ u32 cfg80211_calculate_bitrate(struct rate_info *rate);
 void cfg80211_unregister_wdev(struct wireless_dev *wdev);
 
 /**
+ * struct cfg80211_ft_event - FT Information Elements
+ * @ies: FT IEs
+ * @ies_len: length of the FT IE in bytes
+ * @target_ap: target AP's MAC address
+ * @ric_ies: RIC IE
+ * @ric_ies_len: length of the RIC IE in bytes
+ */
+struct cfg80211_ft_event_params {
+        const u8 *ies;
+        size_t ies_len;
+        const u8 *target_ap;
+        const u8 *ric_ies;
+        size_t ric_ies_len;
+};
+
+/**
+ * cfg80211_ft_event - notify userspace about FT IE and RIC IE
+ * @netdev: network device
+ * @ft_event: IE information
+ */
+void cfg80211_ft_event(struct net_device *netdev,
+                       struct cfg80211_ft_event_params *ft_event);
+
+/**
  * cfg80211_get_p2p_attr - find and copy a P2P attribute from IE buffer
  * @ies: the input IE buffer
  * @len: the input length
@@ -4036,6 +4149,17 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                                    struct cfg80211_wowlan_wakeup *wakeup,
                                    gfp_t gfp);
 
+/**
+ * cfg80211_crit_proto_stopped() - indicate critical protocol stopped by driver.
+ *
+ * @wdev: the wireless device for which critical protocol is stopped.
+ *
+ * This function can be called by the driver to indicate it has reverted
+ * operation back to normal. One reason could be that the duration given
+ * by .crit_proto_start() has expired.
+ */
+void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
index 2581638f4a3d..0fee0617fb7d 100644
--- a/include/net/cls_cgroup.h
+++ b/include/net/cls_cgroup.h
@@ -24,7 +24,7 @@ struct cgroup_cls_state
         u32 classid;
 };
 
-extern void sock_update_classid(struct sock *sk, struct task_struct *task);
+extern void sock_update_classid(struct sock *sk);
 
 #if IS_BUILTIN(CONFIG_NET_CLS_CGROUP)
 static inline u32 task_cls_classid(struct task_struct *p)
@@ -61,7 +61,7 @@ static inline u32 task_cls_classid(struct task_struct *p)
 }
 #endif
 #else /* !CGROUP_NET_CLS_CGROUP */
-static inline void sock_update_classid(struct sock *sk, struct task_struct *task)
+static inline void sock_update_classid(struct sock *sk)
 {
 }
 
diff --git a/include/net/dn_fib.h b/include/net/dn_fib.h
index 1ee9d4bda30d..74004af31c48 100644
--- a/include/net/dn_fib.h
+++ b/include/net/dn_fib.h
@@ -1,24 +1,9 @@
 #ifndef _NET_DN_FIB_H
 #define _NET_DN_FIB_H
 
-/* WARNING: The ordering of these elements must match ordering
- *          of RTA_* rtnetlink attribute numbers.
- */
-struct dn_kern_rta {
-        void            *rta_dst;
-        void            *rta_src;
-        int             *rta_iif;
-        int             *rta_oif;
-        void            *rta_gw;
-        u32             *rta_priority;
-        void            *rta_prefsrc;
-        struct rtattr   *rta_mx;
-        struct rtattr   *rta_mp;
-        unsigned char   *rta_protoinfo;
-        u32             *rta_flow;
-        struct rta_cacheinfo *rta_ci;
-        struct rta_session *rta_sess;
-};
+#include <linux/netlink.h>
+
+extern const struct nla_policy rtm_dn_policy[];
 
 struct dn_fib_res {
         struct fib_rule *r;
@@ -93,10 +78,10 @@ struct dn_fib_table {
         u32 n;
 
         int (*insert)(struct dn_fib_table *t, struct rtmsg *r, 
-                        struct dn_kern_rta *rta, struct nlmsghdr *n, 
+                        struct nlattr *attrs[], struct nlmsghdr *n,
                         struct netlink_skb_parms *req);
         int (*delete)(struct dn_fib_table *t, struct rtmsg *r,
-                        struct dn_kern_rta *rta, struct nlmsghdr *n,
+                        struct nlattr *attrs[], struct nlmsghdr *n,
                         struct netlink_skb_parms *req);
         int (*lookup)(struct dn_fib_table *t, const struct flowidn *fld,
                         struct dn_fib_res *res);
@@ -116,13 +101,12 @@ extern void dn_fib_cleanup(void);
 extern int dn_fib_ioctl(struct socket *sock, unsigned int cmd, 
                         unsigned long arg);
 extern struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, 
-                                struct dn_kern_rta *rta, 
+                                struct nlattr *attrs[],
                                 const struct nlmsghdr *nlh, int *errp);
 extern int dn_fib_semantic_match(int type, struct dn_fib_info *fi, 
                         const struct flowidn *fld,
                         struct dn_fib_res *res);
 extern void dn_fib_release_info(struct dn_fib_info *fi);
-extern __le16 dn_fib_get_attr16(struct rtattr *attr, int attrlen, int type);
 extern void dn_fib_flush(void);
 extern void dn_fib_select_multipath(const struct flowidn *fld,
                                         struct dn_fib_res *res);
diff --git a/include/net/firewire.h b/include/net/firewire.h
new file mode 100644
index 000000000000..31bcbfe7a220
--- /dev/null
+++ b/include/net/firewire.h
@@ -0,0 +1,25 @@
+#ifndef _NET_FIREWIRE_H
+#define _NET_FIREWIRE_H
+
+/* Pseudo L2 address */
+#define FWNET_ALEN      16
+union fwnet_hwaddr {
+        u8 u[FWNET_ALEN];
+        /* "Hardware address" defined in RFC2734/RF3146 */
+        struct {
+                __be64 uniq_id;         /* EUI-64                       */
+                u8 max_rec;             /* max packet size              */
+                u8 sspd;                /* max speed                    */
+                __be16 fifo_hi;         /* hi 16bits of FIFO addr       */
+                __be32 fifo_lo;         /* lo 32bits of FIFO addr       */
+        } __packed uc;
+};
+
+/* Pseudo L2 Header */
+#define FWNET_HLEN      18
+struct fwnet_header {
+        u8 h_dest[FWNET_ALEN];  /* destination address */
+        __be16 h_proto;         /* packet type ID field */
+} __packed;
+
+#endif
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index bdfbe68c1c3b..93024a47e0e2 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -50,6 +50,7 @@ struct genl_family {
         unsigned int            version;
         unsigned int            maxattr;
         bool                    netnsok;
+        bool                    parallel_ops;
         int                     (*pre_doit)(struct genl_ops *ops,
                                             struct sk_buff *skb,
                                             struct genl_info *info);
diff --git a/include/net/gre.h b/include/net/gre.h
index 82665474bcb7..9f03a390c826 100644
--- a/include/net/gre.h
+++ b/include/net/gre.h
@@ -2,6 +2,7 @@
 #define __LINUX_GRE_H
 
 #include <linux/skbuff.h>
+#include <net/ip_tunnels.h>
 
 #define GREPROTO_CISCO          0
 #define GREPROTO_PPTP           1
@@ -12,7 +13,57 @@ struct gre_protocol {
         void (*err_handler)(struct sk_buff *skb, u32 info);
 };
 
+struct gre_base_hdr {
+        __be16 flags;
+        __be16 protocol;
+};
+#define GRE_HEADER_SECTION 4
+
 int gre_add_protocol(const struct gre_protocol *proto, u8 version);
 int gre_del_protocol(const struct gre_protocol *proto, u8 version);
 
+static inline __be16 gre_flags_to_tnl_flags(__be16 flags)
+{
+        __be16 tflags = 0;
+
+        if (flags & GRE_CSUM)
+                tflags |= TUNNEL_CSUM;
+        if (flags & GRE_ROUTING)
+                tflags |= TUNNEL_ROUTING;
+        if (flags & GRE_KEY)
+                tflags |= TUNNEL_KEY;
+        if (flags & GRE_SEQ)
+                tflags |= TUNNEL_SEQ;
+        if (flags & GRE_STRICT)
+                tflags |= TUNNEL_STRICT;
+        if (flags & GRE_REC)
+                tflags |= TUNNEL_REC;
+        if (flags & GRE_VERSION)
+                tflags |= TUNNEL_VERSION;
+
+        return tflags;
+}
+
+static inline __be16 tnl_flags_to_gre_flags(__be16 tflags)
+{
+        __be16 flags = 0;
+
+        if (tflags & TUNNEL_CSUM)
+                flags |= GRE_CSUM;
+        if (tflags & TUNNEL_ROUTING)
+                flags |= GRE_ROUTING;
+        if (tflags & TUNNEL_KEY)
+                flags |= GRE_KEY;
+        if (tflags & TUNNEL_SEQ)
+                flags |= GRE_SEQ;
+        if (tflags & TUNNEL_STRICT)
+                flags |= GRE_STRICT;
+        if (tflags & TUNNEL_REC)
+                flags |= GRE_REC;
+        if (tflags & TUNNEL_VERSION)
+                flags |= GRE_VERSION;
+
+        return flags;
+}
+
 #endif
diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
index d104c882fc29..8196d5d40359 100644
--- a/include/net/ieee802154_netdev.h
+++ b/include/net/ieee802154_netdev.h
@@ -85,6 +85,8 @@ struct wpan_phy;
  * Use wpan_wpy_put to put that reference.
  */
 struct ieee802154_mlme_ops {
+        /* The following fields are optional (can be NULL). */
+
         int (*assoc_req)(struct net_device *dev,
                         struct ieee802154_addr *addr,
                         u8 channel, u8 page, u8 cap);
@@ -101,6 +103,8 @@ struct ieee802154_mlme_ops {
         int (*scan_req)(struct net_device *dev,
                         u8 type, u32 channels, u8 page, u8 duration);
 
+        /* The fields below are required. */
+
         struct wpan_phy *(*get_phy)(const struct net_device *dev);
 
         /*
@@ -110,7 +114,6 @@ struct ieee802154_mlme_ops {
         u16 (*get_pan_id)(const struct net_device *dev);
         u16 (*get_short_addr)(const struct net_device *dev);
         u8 (*get_dsn)(const struct net_device *dev);
-        u8 (*get_bsn)(const struct net_device *dev);
 };
 
 /* The IEEE 802.15.4 standard defines 2 type of the devices:
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 93563221d29a..100fb8cec17c 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -71,6 +71,8 @@ struct inet6_ifaddr {
         struct inet6_ifaddr     *ifpub;
         int                     regen_count;
 #endif
+        bool                    tokenized;
+
         struct rcu_head         rcu;
 };
 
@@ -187,6 +189,8 @@ struct inet6_dev {
         struct list_head        tempaddr_list;
 #endif
 
+        struct in6_addr         token;
+
         struct neigh_parms      *nd_parms;
         struct inet6_dev        *next;
         struct ipv6_devconf     cnf;
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 183292722f6e..de2c78529afa 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -133,6 +133,8 @@ struct inet_connection_sock {
 #define ICSK_TIME_RETRANS       1       /* Retransmit timer */
 #define ICSK_TIME_DACK          2       /* Delayed ack timer */
 #define ICSK_TIME_PROBE0        3       /* Zero window probe timer */
+#define ICSK_TIME_EARLY_RETRANS 4       /* Early retransmit timer */
+#define ICSK_TIME_LOSS_PROBE    5       /* Tail loss probe timer */
 
 static inline struct inet_connection_sock *inet_csk(const struct sock *sk)
 {
@@ -222,7 +224,8 @@ static inline void inet_csk_reset_xmit_timer(struct sock *sk, const int what,
                 when = max_when;
         }
 
-        if (what == ICSK_TIME_RETRANS || what == ICSK_TIME_PROBE0) {
+        if (what == ICSK_TIME_RETRANS || what == ICSK_TIME_PROBE0 ||
+            what == ICSK_TIME_EARLY_RETRANS || what ==  ICSK_TIME_LOSS_PROBE) {
                 icsk->icsk_pending = what;
                 icsk->icsk_timeout = jiffies + when;
                 sk_reset_timer(sk, &icsk->icsk_retransmit_timer, icsk->icsk_timeout);
diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
index 0a1dcc2fa2f5..4182c9be8bb5 100644
--- a/include/net/inet_frag.h
+++ b/include/net/inet_frag.h
@@ -41,7 +41,7 @@ struct inet_frag_queue {
         struct netns_frags      *net;
 };
 
-#define INETFRAGS_HASHSZ                64
+#define INETFRAGS_HASHSZ        1024
 
 /* averaged:
  * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ /
@@ -50,10 +50,16 @@ struct inet_frag_queue {
  */
 #define INETFRAGS_MAXDEPTH              128
 
+struct inet_frag_bucket {
+        struct hlist_head       chain;
+        spinlock_t              chain_lock;
+};
+
 struct inet_frags {
-        struct hlist_head       hash[INETFRAGS_HASHSZ];
+        struct inet_frag_bucket hash[INETFRAGS_HASHSZ];
         /* This rwlock is a global lock (seperate per IPv4, IPv6 and
          * netfilter). Important to keep this on a seperate cacheline.
+         * Its primarily a rebuild protection rwlock.
          */
         rwlock_t                lock ____cacheline_aligned_in_smp;
         int                     secret_interval;
@@ -143,6 +149,7 @@ static inline void inet_frag_lru_del(struct inet_frag_queue *q)
 {
         spin_lock(&q->net->lru_lock);
         list_del(&q->lru_list);
+        q->net->nqueues--;
         spin_unlock(&q->net->lru_lock);
 }
 
@@ -151,6 +158,19 @@ static inline void inet_frag_lru_add(struct netns_frags *nf,
 {
         spin_lock(&nf->lru_lock);
         list_add_tail(&q->lru_list, &nf->lru_list);
+        q->net->nqueues++;
         spin_unlock(&nf->lru_lock);
 }
+
+/* RFC 3168 support :
+ * We want to check ECN values of all fragments, do detect invalid combinations.
+ * In ipq->ecn, we store the OR value of each ip4_frag_ecn() fragment value.
+ */
+#define IPFRAG_ECN_NOT_ECT      0x01 /* one frag had ECN_NOT_ECT */
+#define IPFRAG_ECN_ECT_1        0x02 /* one frag had ECN_ECT_1 */
+#define IPFRAG_ECN_ECT_0        0x04 /* one frag had ECN_ECT_0 */
+#define IPFRAG_ECN_CE           0x08 /* one frag had ECN_CE */
+
+extern const u8 ip_frag_ecn_table[16];
+
 #endif
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index e03047f7090b..4da5de10d1d4 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -3,6 +3,7 @@
 
 #include <linux/ipv6.h>
 #include <linux/netdevice.h>
+#include <linux/if_tunnel.h>
 #include <linux/ip6_tunnel.h>
 
 #define IP6TUNNEL_ERR_TIMEO (30*HZ)
@@ -68,4 +69,24 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw);
 __u32 ip6_tnl_get_cap(struct ip6_tnl *t, const struct in6_addr *laddr,
                              const struct in6_addr *raddr);
 
+static inline void ip6tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct net_device_stats *stats = &dev->stats;
+        int pkt_len, err;
+
+        nf_reset(skb);
+        pkt_len = skb->len;
+        err = ip6_local_out(skb);
+
+        if (net_xmit_eval(err) == 0) {
+                struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
+                tstats->tx_bytes += pkt_len;
+                tstats->tx_packets++;
+                u64_stats_update_end(&tstats->syncp);
+        } else {
+                stats->tx_errors++;
+                stats->tx_aborted_errors++;
+        }
+}
 #endif
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
new file mode 100644
index 000000000000..4b6f0b28f41f
--- /dev/null
+++ b/include/net/ip_tunnels.h
@@ -0,0 +1,177 @@
+#ifndef __NET_IP_TUNNELS_H
+#define __NET_IP_TUNNELS_H 1
+
+#include <linux/if_tunnel.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <linux/types.h>
+#include <linux/u64_stats_sync.h>
+#include <net/dsfield.h>
+#include <net/gro_cells.h>
+#include <net/inet_ecn.h>
+#include <net/ip.h>
+#include <net/rtnetlink.h>
+
+#if IS_ENABLED(CONFIG_IPV6)
+#include <net/ipv6.h>
+#include <net/ip6_fib.h>
+#include <net/ip6_route.h>
+#endif
+
+/* Keep error state on tunnel for 30 sec */
+#define IPTUNNEL_ERR_TIMEO      (30*HZ)
+
+/* 6rd prefix/relay information */
+#ifdef CONFIG_IPV6_SIT_6RD
+struct ip_tunnel_6rd_parm {
+        struct in6_addr         prefix;
+        __be32                  relay_prefix;
+        u16                     prefixlen;
+        u16                     relay_prefixlen;
+};
+#endif
+
+struct ip_tunnel_prl_entry {
+        struct ip_tunnel_prl_entry __rcu *next;
+        __be32                          addr;
+        u16                             flags;
+        struct rcu_head                 rcu_head;
+};
+
+struct ip_tunnel {
+        struct ip_tunnel __rcu  *next;
+        struct hlist_node hash_node;
+        struct net_device       *dev;
+
+        int             err_count;      /* Number of arrived ICMP errors */
+        unsigned long   err_time;       /* Time when the last ICMP error
+                                         * arrived */
+
+        /* These four fields used only by GRE */
+        __u32           i_seqno;        /* The last seen seqno  */
+        __u32           o_seqno;        /* The last output seqno */
+        int             hlen;           /* Precalculated header length */
+        int             mlink;
+
+        struct ip_tunnel_parm parms;
+
+        /* for SIT */
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel_6rd_parm ip6rd;
+#endif
+        struct ip_tunnel_prl_entry __rcu *prl;  /* potential router list */
+        unsigned int            prl_count;      /* # of entries in PRL */
+        int                     ip_tnl_net_id;
+        struct gro_cells        gro_cells;
+};
+
+#define TUNNEL_CSUM     __cpu_to_be16(0x01)
+#define TUNNEL_ROUTING  __cpu_to_be16(0x02)
+#define TUNNEL_KEY      __cpu_to_be16(0x04)
+#define TUNNEL_SEQ      __cpu_to_be16(0x08)
+#define TUNNEL_STRICT   __cpu_to_be16(0x10)
+#define TUNNEL_REC      __cpu_to_be16(0x20)
+#define TUNNEL_VERSION  __cpu_to_be16(0x40)
+#define TUNNEL_NO_KEY   __cpu_to_be16(0x80)
+
+struct tnl_ptk_info {
+        __be16 flags;
+        __be16 proto;
+        __be32 key;
+        __be32 seq;
+};
+
+#define PACKET_RCVD     0
+#define PACKET_REJECT   1
+
+#define IP_TNL_HASH_BITS   10
+#define IP_TNL_HASH_SIZE   (1 << IP_TNL_HASH_BITS)
+
+struct ip_tunnel_net {
+        struct hlist_head *tunnels;
+        struct net_device *fb_tunnel_dev;
+};
+
+int ip_tunnel_init(struct net_device *dev);
+void ip_tunnel_uninit(struct net_device *dev);
+void  ip_tunnel_dellink(struct net_device *dev, struct list_head *head);
+int __net_init ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
+                                  struct rtnl_link_ops *ops, char *devname);
+
+void __net_exit ip_tunnel_delete_net(struct ip_tunnel_net *itn);
+
+void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+                    const struct iphdr *tnl_params);
+int ip_tunnel_ioctl(struct net_device *dev, struct ip_tunnel_parm *p, int cmd);
+int ip_tunnel_change_mtu(struct net_device *dev, int new_mtu);
+
+struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
+                                                struct rtnl_link_stats64 *tot);
+struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
+                                   int link, __be16 flags,
+                                   __be32 remote, __be32 local,
+                                   __be32 key);
+
+int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+                  const struct tnl_ptk_info *tpi, bool log_ecn_error);
+int ip_tunnel_changelink(struct net_device *dev, struct nlattr *tb[],
+                         struct ip_tunnel_parm *p);
+int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
+                      struct ip_tunnel_parm *p);
+void ip_tunnel_setup(struct net_device *dev, int net_id);
+
+/* Extract dsfield from inner protocol */
+static inline u8 ip_tunnel_get_dsfield(const struct iphdr *iph,
+                                       const struct sk_buff *skb)
+{
+        if (skb->protocol == htons(ETH_P_IP))
+                return iph->tos;
+        else if (skb->protocol == htons(ETH_P_IPV6))
+                return ipv6_get_dsfield((const struct ipv6hdr *)iph);
+        else
+                return 0;
+}
+
+/* Propogate ECN bits out */
+static inline u8 ip_tunnel_ecn_encap(u8 tos, const struct iphdr *iph,
+                                     const struct sk_buff *skb)
+{
+        u8 inner = ip_tunnel_get_dsfield(iph, skb);
+
+        return INET_ECN_encapsulate(tos, inner);
+}
+
+static inline void tunnel_ip_select_ident(struct sk_buff *skb,
+                                          const struct iphdr  *old_iph,
+                                          struct dst_entry *dst)
+{
+        struct iphdr *iph = ip_hdr(skb);
+
+        /* Use inner packet iph-id if possible. */
+        if (skb->protocol == htons(ETH_P_IP) && old_iph->id)
+                iph->id = old_iph->id;
+        else
+                __ip_select_ident(iph, dst,
+                                  (skb_shinfo(skb)->gso_segs ?: 1) - 1);
+}
+
+static inline void iptunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        int err;
+        int pkt_len = skb->len - skb_transport_offset(skb);
+        struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
+
+        nf_reset(skb);
+
+        err = ip_local_out(skb);
+        if (likely(net_xmit_eval(err) == 0)) {
+                u64_stats_update_begin(&tstats->syncp);
+                tstats->tx_bytes += pkt_len;
+                tstats->tx_packets++;
+                u64_stats_update_end(&tstats->syncp);
+        } else {
+                dev->stats.tx_errors++;
+                dev->stats.tx_aborted_errors++;
+        }
+}
+#endif /* __NET_IP_TUNNELS_H */
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index fce8e6b66d55..4c062ccff9aa 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -233,6 +233,21 @@ static inline void ip_vs_addr_copy(int af, union nf_inet_addr *dst,
         dst->ip = src->ip;
 }
 
+static inline void ip_vs_addr_set(int af, union nf_inet_addr *dst,
+                                  const union nf_inet_addr *src)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6) {
+                dst->in6 = src->in6;
+                return;
+        }
+#endif
+        dst->ip = src->ip;
+        dst->all[1] = 0;
+        dst->all[2] = 0;
+        dst->all[3] = 0;
+}
+
 static inline int ip_vs_addr_equal(int af, const union nf_inet_addr *a,
                                    const union nf_inet_addr *b)
 {
@@ -344,8 +359,6 @@ static inline const char *ip_vs_dbg_addr(int af, char *buf, size_t buf_len,
 #define LeaveFunction(level)   do {} while (0)
 #endif
 
-#define IP_VS_WAIT_WHILE(expr)  while (expr) { cpu_relax(); }
-
 
 /*
  *      The port number of FTP service (in network order).
@@ -459,7 +472,7 @@ struct ip_vs_estimator {
 struct ip_vs_stats {
         struct ip_vs_stats_user ustats;         /* statistics */
         struct ip_vs_estimator  est;            /* estimator */
-        struct ip_vs_cpu_stats  *cpustats;      /* per cpu counters */
+        struct ip_vs_cpu_stats __percpu *cpustats;      /* per cpu counters */
         spinlock_t              lock;           /* spin lock */
         struct ip_vs_stats_user ustats0;        /* reset values */
 };
@@ -566,20 +579,19 @@ struct ip_vs_conn_param {
  */
 struct ip_vs_conn {
         struct hlist_node       c_list;         /* hashed list heads */
-#ifdef CONFIG_NET_NS
-        struct net              *net;           /* Name space */
-#endif
         /* Protocol, addresses and port numbers */
-        u16                     af;             /* address family */
         __be16                  cport;
-        __be16                  vport;
         __be16                  dport;
-        __u32                   fwmark;         /* Fire wall mark from skb */
+        __be16                  vport;
+        u16                     af;             /* address family */
         union nf_inet_addr      caddr;          /* client address */
         union nf_inet_addr      vaddr;          /* virtual address */
         union nf_inet_addr      daddr;          /* destination address */
         volatile __u32          flags;          /* status flags */
         __u16                   protocol;       /* Which protocol (TCP/UDP) */
+#ifdef CONFIG_NET_NS
+        struct net              *net;           /* Name space */
+#endif
 
         /* counter and timer */
         atomic_t                refcnt;         /* reference count */
@@ -593,6 +605,7 @@ struct ip_vs_conn {
                                                  * state transition triggerd
                                                  * synchronization
                                                  */
+        __u32                   fwmark;         /* Fire wall mark from skb */
         unsigned long           sync_endtime;   /* jiffies + sent_retries */
 
         /* Control members */
@@ -620,6 +633,8 @@ struct ip_vs_conn {
         const struct ip_vs_pe   *pe;
         char                    *pe_data;
         __u8                    pe_data_len;
+
+        struct rcu_head         rcu_head;
 };
 
 /*
@@ -663,7 +678,7 @@ struct ip_vs_service_user_kern {
         u16                     af;
         u16                     protocol;
         union nf_inet_addr      addr;           /* virtual ip address */
-        u16                     port;
+        __be16                  port;
         u32                     fwmark;         /* firwall mark of service */
 
         /* virtual service options */
@@ -671,14 +686,14 @@ struct ip_vs_service_user_kern {
         char                    *pe_name;
         unsigned int            flags;          /* virtual service flags */
         unsigned int            timeout;        /* persistent timeout in sec */
-        u32                     netmask;        /* persistent netmask */
+        __be32                  netmask;        /* persistent netmask or plen */
 };
 
 
 struct ip_vs_dest_user_kern {
         /* destination server address */
         union nf_inet_addr      addr;
-        u16                     port;
+        __be16                  port;
 
         /* real server options */
         unsigned int            conn_flags;     /* connection flags */
@@ -695,10 +710,9 @@ struct ip_vs_dest_user_kern {
  *      and the forwarding entries
  */
 struct ip_vs_service {
-        struct list_head        s_list;   /* for normal service table */
-        struct list_head        f_list;   /* for fwmark-based service table */
+        struct hlist_node       s_list;   /* for normal service table */
+        struct hlist_node       f_list;   /* for fwmark-based service table */
         atomic_t                refcnt;   /* reference counter */
-        atomic_t                usecnt;   /* use counter */
 
         u16                     af;       /* address family */
         __u16                   protocol; /* which protocol (TCP/UDP) */
@@ -707,31 +721,41 @@ struct ip_vs_service {
         __u32                   fwmark;   /* firewall mark of the service */
         unsigned int            flags;    /* service status flags */
         unsigned int            timeout;  /* persistent timeout in ticks */
-        __be32                  netmask;  /* grouping granularity */
+        __be32                  netmask;  /* grouping granularity, mask/plen */
         struct net              *net;
 
         struct list_head        destinations;  /* real server d-linked list */
         __u32                   num_dests;     /* number of servers */
         struct ip_vs_stats      stats;         /* statistics for the service */
-        struct ip_vs_app        *inc;     /* bind conns to this app inc */
 
         /* for scheduling */
-        struct ip_vs_scheduler  *scheduler;    /* bound scheduler object */
-        rwlock_t                sched_lock;    /* lock sched_data */
+        struct ip_vs_scheduler __rcu *scheduler; /* bound scheduler object */
+        spinlock_t              sched_lock;    /* lock sched_data */
         void                    *sched_data;   /* scheduler application data */
 
         /* alternate persistence engine */
-        struct ip_vs_pe         *pe;
+        struct ip_vs_pe __rcu   *pe;
+
+        struct rcu_head         rcu_head;
 };
 
+/* Information for cached dst */
+struct ip_vs_dest_dst {
+        struct dst_entry        *dst_cache;     /* destination cache entry */
+        u32                     dst_cookie;
+        union nf_inet_addr      dst_saddr;
+        struct rcu_head         rcu_head;
+};
 
+/* In grace period after removing */
+#define IP_VS_DEST_STATE_REMOVING       0x01
 /*
  *      The real server destination forwarding entry
  *      with ip address, port number, and so on.
  */
 struct ip_vs_dest {
         struct list_head        n_list;   /* for the dests in the service */
-        struct list_head        d_list;   /* for table with all the dests */
+        struct hlist_node       d_list;   /* for table with all the dests */
 
         u16                     af;             /* address family */
         __be16                  port;           /* port number of the server */
@@ -742,6 +766,7 @@ struct ip_vs_dest {
 
         atomic_t                refcnt;         /* reference counter */
         struct ip_vs_stats      stats;          /* statistics */
+        unsigned long           state;          /* state flags */
 
         /* connection counters and thresholds */
         atomic_t                activeconns;    /* active connections */
@@ -752,10 +777,7 @@ struct ip_vs_dest {
 
         /* for destination cache */
         spinlock_t              dst_lock;       /* lock of dst_cache */
-        struct dst_entry        *dst_cache;     /* destination cache entry */
-        u32                     dst_rtos;       /* RT_TOS(tos) for dst */
-        u32                     dst_cookie;
-        union nf_inet_addr      dst_saddr;
+        struct ip_vs_dest_dst __rcu *dest_dst;  /* cached dst info */
 
         /* for virtual service */
         struct ip_vs_service    *svc;           /* service it belongs to */
@@ -763,6 +785,10 @@ struct ip_vs_dest {
         __be16                  vport;          /* virtual port number */
         union nf_inet_addr      vaddr;          /* virtual IP address */
         __u32                   vfwmark;        /* firewall mark of service */
+
+        struct list_head        t_list;         /* in dest_trash */
+        struct rcu_head         rcu_head;
+        unsigned int            in_rs_table:1;  /* we are in rs_table */
 };
 
 
@@ -778,9 +804,13 @@ struct ip_vs_scheduler {
         /* scheduler initializing service */
         int (*init_service)(struct ip_vs_service *svc);
         /* scheduling service finish */
-        int (*done_service)(struct ip_vs_service *svc);
-        /* scheduler updating service */
-        int (*update_service)(struct ip_vs_service *svc);
+        void (*done_service)(struct ip_vs_service *svc);
+        /* dest is linked */
+        int (*add_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest);
+        /* dest is unlinked */
+        int (*del_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest);
+        /* dest is updated */
+        int (*upd_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest);
 
         /* selecting a server from the given service */
         struct ip_vs_dest* (*schedule)(struct ip_vs_service *svc,
@@ -819,6 +849,7 @@ struct ip_vs_app {
         struct ip_vs_app        *app;           /* its real application */
         __be16                  port;           /* port number in net order */
         atomic_t                usecnt;         /* usage counter */
+        struct rcu_head         rcu_head;
 
         /*
          * output hook: Process packet in inout direction, diff set for TCP.
@@ -881,6 +912,9 @@ struct ipvs_master_sync_state {
         struct netns_ipvs       *ipvs;
 };
 
+/* How much time to keep dests in trash */
+#define IP_VS_DEST_TRASH_PERIOD         (120 * HZ)
+
 /* IPVS in network namespace */
 struct netns_ipvs {
         int                     gen;            /* Generation */
@@ -892,7 +926,7 @@ struct netns_ipvs {
         #define IP_VS_RTAB_SIZE (1 << IP_VS_RTAB_BITS)
         #define IP_VS_RTAB_MASK (IP_VS_RTAB_SIZE - 1)
 
-        struct list_head        rs_table[IP_VS_RTAB_SIZE];
+        struct hlist_head       rs_table[IP_VS_RTAB_SIZE];
         /* ip_vs_app */
         struct list_head        app_list;
         /* ip_vs_proto */
@@ -904,7 +938,6 @@ struct netns_ipvs {
         #define TCP_APP_TAB_SIZE        (1 << TCP_APP_TAB_BITS)
         #define TCP_APP_TAB_MASK        (TCP_APP_TAB_SIZE - 1)
         struct list_head        tcp_apps[TCP_APP_TAB_SIZE];
-        spinlock_t              tcp_app_lock;
 #endif
         /* ip_vs_proto_udp */
 #ifdef CONFIG_IP_VS_PROTO_UDP
@@ -912,7 +945,6 @@ struct netns_ipvs {
         #define UDP_APP_TAB_SIZE        (1 << UDP_APP_TAB_BITS)
         #define UDP_APP_TAB_MASK        (UDP_APP_TAB_SIZE - 1)
         struct list_head        udp_apps[UDP_APP_TAB_SIZE];
-        spinlock_t              udp_app_lock;
 #endif
         /* ip_vs_proto_sctp */
 #ifdef CONFIG_IP_VS_PROTO_SCTP
@@ -921,7 +953,6 @@ struct netns_ipvs {
         #define SCTP_APP_TAB_MASK       (SCTP_APP_TAB_SIZE - 1)
         /* Hash table for SCTP application incarnations  */
         struct list_head        sctp_apps[SCTP_APP_TAB_SIZE];
-        spinlock_t              sctp_app_lock;
 #endif
         /* ip_vs_conn */
         atomic_t                conn_count;      /*  connection counter */
@@ -931,9 +962,10 @@ struct netns_ipvs {
 
         int                     num_services;    /* no of virtual services */
 
-        rwlock_t                rs_lock;         /* real services table */
         /* Trash for destinations */
         struct list_head        dest_trash;
+        spinlock_t              dest_trash_lock;
+        struct timer_list       dest_trash_timer; /* expiration timer */
         /* Service counters */
         atomic_t                ftpsvc_counter;
         atomic_t                nullsvc_counter;
@@ -1181,9 +1213,19 @@ struct ip_vs_conn * ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,
                                              const struct ip_vs_iphdr *iph,
                                              int inverse);
 
+/* Get reference to gain full access to conn.
+ * By default, RCU read-side critical sections have access only to
+ * conn fields and its PE data, see ip_vs_conn_rcu_free() for reference.
+ */
+static inline bool __ip_vs_conn_get(struct ip_vs_conn *cp)
+{
+        return atomic_inc_not_zero(&cp->refcnt);
+}
+
 /* put back the conn without restarting its timer */
 static inline void __ip_vs_conn_put(struct ip_vs_conn *cp)
 {
+        smp_mb__before_atomic_dec();
         atomic_dec(&cp->refcnt);
 }
 extern void ip_vs_conn_put(struct ip_vs_conn *cp);
@@ -1298,8 +1340,6 @@ extern void ip_vs_app_inc_put(struct ip_vs_app *inc);
 extern int ip_vs_app_pkt_out(struct ip_vs_conn *, struct sk_buff *skb);
 extern int ip_vs_app_pkt_in(struct ip_vs_conn *, struct sk_buff *skb);
 
-void ip_vs_bind_pe(struct ip_vs_service *svc, struct ip_vs_pe *pe);
-void ip_vs_unbind_pe(struct ip_vs_service *svc);
 int register_ip_vs_pe(struct ip_vs_pe *pe);
 int unregister_ip_vs_pe(struct ip_vs_pe *pe);
 struct ip_vs_pe *ip_vs_pe_getbyname(const char *name);
@@ -1346,7 +1386,8 @@ extern int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler);
 extern int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler);
 extern int ip_vs_bind_scheduler(struct ip_vs_service *svc,
                                 struct ip_vs_scheduler *scheduler);
-extern int ip_vs_unbind_scheduler(struct ip_vs_service *svc);
+extern void ip_vs_unbind_scheduler(struct ip_vs_service *svc,
+                                   struct ip_vs_scheduler *sched);
 extern struct ip_vs_scheduler *ip_vs_scheduler_get(const char *sched_name);
 extern void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler);
 extern struct ip_vs_conn *
@@ -1366,17 +1407,12 @@ extern struct ip_vs_stats ip_vs_stats;
 extern int sysctl_ip_vs_sync_ver;
 
 extern struct ip_vs_service *
-ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
+ip_vs_service_find(struct net *net, int af, __u32 fwmark, __u16 protocol,
                   const union nf_inet_addr *vaddr, __be16 vport);
 
-static inline void ip_vs_service_put(struct ip_vs_service *svc)
-{
-        atomic_dec(&svc->usecnt);
-}
-
-extern struct ip_vs_dest *
-ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
-                          const union nf_inet_addr *daddr, __be16 dport);
+extern bool
+ip_vs_has_real_service(struct net *net, int af, __u16 protocol,
+                       const union nf_inet_addr *daddr, __be16 dport);
 
 extern int ip_vs_use_count_inc(void);
 extern void ip_vs_use_count_dec(void);
@@ -1388,8 +1424,18 @@ extern struct ip_vs_dest *
 ip_vs_find_dest(struct net *net, int af, const union nf_inet_addr *daddr,
                 __be16 dport, const union nf_inet_addr *vaddr, __be16 vport,
                 __u16 protocol, __u32 fwmark, __u32 flags);
-extern struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp);
+extern void ip_vs_try_bind_dest(struct ip_vs_conn *cp);
 
+static inline void ip_vs_dest_hold(struct ip_vs_dest *dest)
+{
+        atomic_inc(&dest->refcnt);
+}
+
+static inline void ip_vs_dest_put(struct ip_vs_dest *dest)
+{
+        smp_mb__before_atomic_dec();
+        atomic_dec(&dest->refcnt);
+}
 
 /*
  *      IPVS sync daemon data and function prototypes
@@ -1428,7 +1474,7 @@ extern int ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 extern int ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                            struct ip_vs_protocol *pp, int offset,
                            unsigned int hooknum, struct ip_vs_iphdr *iph);
-extern void ip_vs_dst_reset(struct ip_vs_dest *dest);
+extern void ip_vs_dest_dst_rcu_free(struct rcu_head *head);
 
 #ifdef CONFIG_IP_VS_IPV6
 extern int ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
diff --git a/include/net/ipip.h b/include/net/ipip.h
deleted file mode 100644
index 982141c15200..000000000000
--- a/include/net/ipip.h
+++ /dev/null
@@ -1,87 +0,0 @@
-#ifndef __NET_IPIP_H
-#define __NET_IPIP_H 1
-
-#include <linux/if_tunnel.h>
-#include <net/gro_cells.h>
-#include <net/ip.h>
-
-/* Keep error state on tunnel for 30 sec */
-#define IPTUNNEL_ERR_TIMEO      (30*HZ)
-
-/* 6rd prefix/relay information */
-struct ip_tunnel_6rd_parm {
-        struct in6_addr         prefix;
-        __be32                  relay_prefix;
-        u16                     prefixlen;
-        u16                     relay_prefixlen;
-};
-
-struct ip_tunnel {
-        struct ip_tunnel __rcu  *next;
-        struct net_device       *dev;
-
-        int                     err_count;      /* Number of arrived ICMP errors */
-        unsigned long           err_time;       /* Time when the last ICMP error arrived */
-
-        /* These four fields used only by GRE */
-        __u32                   i_seqno;        /* The last seen seqno  */
-        __u32                   o_seqno;        /* The last output seqno */
-        int                     hlen;           /* Precalculated GRE header length */
-        int                     mlink;
-
-        struct ip_tunnel_parm   parms;
-
-        /* for SIT */
-#ifdef CONFIG_IPV6_SIT_6RD
-        struct ip_tunnel_6rd_parm       ip6rd;
-#endif
-        struct ip_tunnel_prl_entry __rcu *prl;          /* potential router list */
-        unsigned int                    prl_count;      /* # of entries in PRL */
-
-        struct gro_cells                gro_cells;
-};
-
-struct ip_tunnel_prl_entry {
-        struct ip_tunnel_prl_entry __rcu *next;
-        __be32                          addr;
-        u16                             flags;
-        struct rcu_head                 rcu_head;
-};
-
-static inline void iptunnel_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-        int err;
-        struct iphdr *iph = ip_hdr(skb);
-        int pkt_len = skb->len - skb_transport_offset(skb);
-        struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
-
-        nf_reset(skb);
-        skb->ip_summed = CHECKSUM_NONE;
-        ip_select_ident(iph, skb_dst(skb), NULL);
-
-        err = ip_local_out(skb);
-        if (likely(net_xmit_eval(err) == 0)) {
-                u64_stats_update_begin(&tstats->syncp);
-                tstats->tx_bytes += pkt_len;
-                tstats->tx_packets++;
-                u64_stats_update_end(&tstats->syncp);
-        } else {
-                dev->stats.tx_errors++;
-                dev->stats.tx_aborted_errors++;
-        }
-}
-
-static inline void tunnel_ip_select_ident(struct sk_buff *skb,
-                                          const struct iphdr  *old_iph,
-                                          struct dst_entry *dst)
-{
-        struct iphdr *iph = ip_hdr(skb);
-
-        /* Use inner packet iph-id if possible. */
-        if (skb->protocol == htons(ETH_P_IP) && old_iph->id)
-                iph->id = old_iph->id;
-        else
-                __ip_select_ident(iph, dst,
-                                  (skb_shinfo(skb)->gso_segs ?: 1) - 1);
-}
-#endif
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 64d12e77719a..0810aa57c780 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -217,7 +217,7 @@ struct ipv6_txoptions {
 };
 
 struct ip6_flowlabel {
-        struct ip6_flowlabel    *next;
+        struct ip6_flowlabel __rcu *next;
         __be32                  label;
         atomic_t                users;
         struct in6_addr         dst;
@@ -238,9 +238,9 @@ struct ip6_flowlabel {
 #define IPV6_FLOWLABEL_MASK     cpu_to_be32(0x000FFFFF)
 
 struct ipv6_fl_socklist {
-        struct ipv6_fl_socklist *next;
-        struct ip6_flowlabel    *fl;
-        struct rcu_head         rcu;
+        struct ipv6_fl_socklist __rcu   *next;
+        struct ip6_flowlabel            *fl;
+        struct rcu_head                 rcu;
 };
 
 extern struct ip6_flowlabel     *fl6_sock_lookup(struct sock *sk, __be32 label);
@@ -320,6 +320,18 @@ static inline int ipv6_addr_src_scope(const struct in6_addr *addr)
         return __ipv6_addr_src_scope(__ipv6_addr_type(addr));
 }
 
+static inline bool __ipv6_addr_needs_scope_id(int type)
+{
+        return type & IPV6_ADDR_LINKLOCAL ||
+               (type & IPV6_ADDR_MULTICAST &&
+                (type & (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)));
+}
+
+static inline __u32 ipv6_iface_scope_id(const struct in6_addr *addr, int iface)
+{
+        return __ipv6_addr_needs_scope_id(__ipv6_addr_type(addr)) ? iface : 0;
+}
+
 static inline int ipv6_addr_cmp(const struct in6_addr *a1, const struct in6_addr *a2)
 {
         return memcmp(a1, a2, sizeof(struct in6_addr));
@@ -466,6 +478,7 @@ struct ip6_create_arg {
         u32 user;
         const struct in6_addr *src;
         const struct in6_addr *dst;
+        u8 ecn;
 };
 
 void ip6_frag_init(struct inet_frag_queue *q, void *a);
@@ -485,6 +498,7 @@ struct frag_queue {
         int                     iif;
         unsigned int            csum;
         __u16                   nhoffset;
+        u8                      ecn;
 };
 
 void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq,
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index f7eba1300d82..04c2d4670dc6 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -93,9 +93,11 @@ struct device;
  * enum ieee80211_max_queues - maximum number of queues
  *
  * @IEEE80211_MAX_QUEUES: Maximum number of regular device queues.
+ * @IEEE80211_MAX_QUEUE_MAP: bitmap with maximum queues set
  */
 enum ieee80211_max_queues {
         IEEE80211_MAX_QUEUES =          16,
+        IEEE80211_MAX_QUEUE_MAP =       BIT(IEEE80211_MAX_QUEUES) - 1,
 };
 
 #define IEEE80211_INVAL_HW_QUEUE        0xff
@@ -126,6 +128,7 @@ enum ieee80211_ac_numbers {
  *      2^n-1 in the range 1..32767]
  * @cw_max: maximum contention window [like @cw_min]
  * @txop: maximum burst time in units of 32 usecs, 0 meaning disabled
+ * @acm: is mandatory admission control required for the access category
  * @uapsd: is U-APSD mode enabled for the queue
  */
 struct ieee80211_tx_queue_params {
@@ -133,6 +136,7 @@ struct ieee80211_tx_queue_params {
         u16 cw_min;
         u16 cw_max;
         u8 aifs;
+        bool acm;
         bool uapsd;
 };
 
@@ -207,7 +211,7 @@ struct ieee80211_chanctx_conf {
  * @BSS_CHANGED_QOS: QoS for this association was enabled/disabled. Note
  *      that it is only ever disabled for station mode.
  * @BSS_CHANGED_IDLE: Idle changed for this BSS/interface.
- * @BSS_CHANGED_SSID: SSID changed for this BSS (AP mode)
+ * @BSS_CHANGED_SSID: SSID changed for this BSS (AP and IBSS mode)
  * @BSS_CHANGED_AP_PROBE_RESP: Probe Response changed for this BSS (AP mode)
  * @BSS_CHANGED_PS: PS changed for this BSS (STA mode)
  * @BSS_CHANGED_TXPOWER: TX power setting changed for this interface
@@ -324,12 +328,11 @@ enum ieee80211_rssi_event {
  *      your driver/device needs to do.
  * @ps: power-save mode (STA only). This flag is NOT affected by
  *      offchannel/dynamic_ps operations.
- * @ssid: The SSID of the current vif. Only valid in AP-mode.
+ * @ssid: The SSID of the current vif. Valid in AP and IBSS mode.
  * @ssid_len: Length of SSID given in @ssid.
  * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
  * @txpower: TX power in dBm
- * @p2p_ctwindow: P2P CTWindow, only for P2P client interfaces
- * @p2p_oppps: P2P opportunistic PS is enabled
+ * @p2p_noa_attr: P2P NoA attribute for P2P powersave
  */
 struct ieee80211_bss_conf {
         const u8 *bssid;
@@ -363,8 +366,7 @@ struct ieee80211_bss_conf {
         size_t ssid_len;
         bool hidden_ssid;
         int txpower;
-        u8 p2p_ctwindow;
-        bool p2p_oppps;
+        struct ieee80211_p2p_noa_attr p2p_noa_attr;
 };
 
 /**
@@ -561,6 +563,9 @@ enum mac80211_rate_control_flags {
 /* maximum number of rate stages */
 #define IEEE80211_TX_MAX_RATES  4
 
+/* maximum number of rate table entries */
+#define IEEE80211_TX_RATE_TABLE_SIZE    4
+
 /**
  * struct ieee80211_tx_rate - rate selection/status
  *
@@ -601,8 +606,8 @@ static inline void ieee80211_rate_set_vht(struct ieee80211_tx_rate *rate,
                                           u8 mcs, u8 nss)
 {
         WARN_ON(mcs & ~0xF);
-        WARN_ON(nss & ~0x7);
-        rate->idx = (nss << 4) | mcs;
+        WARN_ON((nss - 1) & ~0x7);
+        rate->idx = ((nss - 1) << 4) | mcs;
 }
 
 static inline u8
@@ -614,7 +619,7 @@ ieee80211_rate_get_vht_mcs(const struct ieee80211_tx_rate *rate)
 static inline u8
 ieee80211_rate_get_vht_nss(const struct ieee80211_tx_rate *rate)
 {
-        return rate->idx >> 4;
+        return (rate->idx >> 4) + 1;
 }
 
 /**
@@ -655,7 +660,11 @@ struct ieee80211_tx_info {
                                         struct ieee80211_tx_rate rates[
                                                 IEEE80211_TX_MAX_RATES];
                                         s8 rts_cts_rate_idx;
-                                        /* 3 bytes free */
+                                        u8 use_rts:1;
+                                        u8 use_cts_prot:1;
+                                        u8 short_preamble:1;
+                                        u8 skip_table:1;
+                                        /* 2 bytes free */
                                 };
                                 /* only needed before rate control */
                                 unsigned long jiffies;
@@ -676,6 +685,8 @@ struct ieee80211_tx_info {
                 struct {
                         struct ieee80211_tx_rate driver_rates[
                                 IEEE80211_TX_MAX_RATES];
+                        u8 pad[4];
+
                         void *rate_driver_data[
                                 IEEE80211_TX_INFO_RATE_DRIVER_DATA_SIZE / sizeof(void *)];
                 };
@@ -974,8 +985,7 @@ enum ieee80211_smps_mode {
  * @power_level: requested transmit power (in dBm), backward compatibility
  *      value only that is set to the minimum of all interfaces
  *
- * @channel: the channel to tune to
- * @channel_type: the channel (HT) type
+ * @chandef: the channel definition to tune to
  * @radar_enabled: whether radar detection is enabled
  *
  * @long_frame_max_tx_count: Maximum number of transmissions for a "long" frame
@@ -1001,8 +1011,7 @@ struct ieee80211_conf {
 
         u8 long_frame_max_tx_count, short_frame_max_tx_count;
 
-        struct ieee80211_channel *channel;
-        enum nl80211_channel_type channel_type;
+        struct cfg80211_chan_def chandef;
         bool radar_enabled;
         enum ieee80211_smps_mode smps_mode;
 };
@@ -1019,13 +1028,13 @@ struct ieee80211_conf {
  *      the driver passed into mac80211.
  * @block_tx: Indicates whether transmission must be blocked before the
  *      scheduled channel switch, as indicated by the AP.
- * @channel: the new channel to switch to
+ * @chandef: the new channel to switch to
  * @count: the number of TBTT's until the channel switch event
  */
 struct ieee80211_channel_switch {
         u64 timestamp;
         bool block_tx;
-        struct ieee80211_channel *channel;
+        struct cfg80211_chan_def chandef;
         u8 count;
 };
 
@@ -1067,6 +1076,9 @@ enum ieee80211_vif_flags {
  *      path needing to access it; even though the netdev carrier will always
  *      be off when it is %NULL there can still be races and packets could be
  *      processed after it switches back to %NULL.
+ * @debugfs_dir: debugfs dentry, can be used by drivers to create own per
+ *      interface debug files. Note that it will be NULL for the virtual
+ *      monitor interface (if that is requested.)
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *).
  */
@@ -1083,6 +1095,10 @@ struct ieee80211_vif {
 
         u32 driver_flags;
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+        struct dentry *debugfs_dir;
+#endif
+
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
 };
@@ -1101,8 +1117,6 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
  * These flags are used for communication about keys between the driver
  * and mac80211, with the @flags parameter of &struct ieee80211_key_conf.
  *
- * @IEEE80211_KEY_FLAG_WMM_STA: Set by mac80211, this flag indicates
- *      that the STA this key will be used with could be using QoS.
  * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
  *      driver to indicate that it requires IV generation for this
  *      particular key.
@@ -1127,7 +1141,6 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
  *      %IEEE80211_KEY_FLAG_SW_MGMT_TX flag to encrypt such frames in SW.
  */
 enum ieee80211_key_flags {
-        IEEE80211_KEY_FLAG_WMM_STA      = 1<<0,
         IEEE80211_KEY_FLAG_GENERATE_IV  = 1<<1,
         IEEE80211_KEY_FLAG_GENERATE_MMIC= 1<<2,
         IEEE80211_KEY_FLAG_PAIRWISE     = 1<<3,
@@ -1219,6 +1232,24 @@ enum ieee80211_sta_rx_bandwidth {
 };
 
 /**
+ * struct ieee80211_sta_rates - station rate selection table
+ *
+ * @rcu_head: RCU head used for freeing the table on update
+ * @rates: transmit rates/flags to be used by default.
+ *      Overriding entries per-packet is possible by using cb tx control.
+ */
+struct ieee80211_sta_rates {
+        struct rcu_head rcu_head;
+        struct {
+                s8 idx;
+                u8 count;
+                u8 count_cts;
+                u8 count_rts;
+                u16 flags;
+        } rate[IEEE80211_TX_RATE_TABLE_SIZE];
+};
+
+/**
  * struct ieee80211_sta - station table entry
  *
  * A station table entry represents a station we are possibly
@@ -1231,9 +1262,8 @@ enum ieee80211_sta_rx_bandwidth {
  * @addr: MAC address
  * @aid: AID we assigned to the station if we're an AP
  * @supp_rates: Bitmap of supported rates (per band)
- * @ht_cap: HT capabilities of this STA; restricted to our own TX capabilities
- * @vht_cap: VHT capabilities of this STA; Not restricting any capabilities
- *      of remote STA. Taking as is.
+ * @ht_cap: HT capabilities of this STA; restricted to our own capabilities
+ * @vht_cap: VHT capabilities of this STA; restricted to our own capabilities
  * @wme: indicates whether the STA supports WME. Only valid during AP-mode.
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *), size is determined in hw information.
@@ -1246,6 +1276,7 @@ enum ieee80211_sta_rx_bandwidth {
  *      notifications and capabilities. The value is only valid after
  *      the station moves to associated state.
  * @smps_mode: current SMPS mode (off, static or dynamic)
+ * @tx_rates: rate control selection table
  */
 struct ieee80211_sta {
         u32 supp_rates[IEEE80211_NUM_BANDS];
@@ -1259,6 +1290,7 @@ struct ieee80211_sta {
         u8 rx_nss;
         enum ieee80211_sta_rx_bandwidth bandwidth;
         enum ieee80211_smps_mode smps_mode;
+        struct ieee80211_sta_rates __rcu *rates;
 
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
@@ -1414,6 +1446,9 @@ struct ieee80211_tx_control {
  *      for different virtual interfaces. See the doc section on HW queue
  *      control for more details.
  *
+ * @IEEE80211_HW_SUPPORTS_RC_TABLE: The driver supports using a rate
+ *      selection table provided by the rate control algorithm.
+ *
  * @IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF: Use the P2P Device address for any
  *      P2P Interface. This will be honoured even if more than one interface
  *      is supported.
@@ -1446,6 +1481,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_SUPPORTS_PER_STA_GTK               = 1<<21,
         IEEE80211_HW_AP_LINK_PS                         = 1<<22,
         IEEE80211_HW_TX_AMPDU_SETUP_IN_HW               = 1<<23,
+        IEEE80211_HW_SUPPORTS_RC_TABLE                  = 1<<24,
         IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
         IEEE80211_HW_TIMING_BEACON_ONLY                 = 1<<26,
 };
@@ -1531,6 +1567,17 @@ enum ieee80211_hw_flags {
  * @netdev_features: netdev features to be set in each netdev created
  *      from this HW. Note only HW checksum features are currently
  *      compatible with mac80211. Other feature bits will be rejected.
+ *
+ * @uapsd_queues: This bitmap is included in (re)association frame to indicate
+ *      for each access category if it is uAPSD trigger-enabled and delivery-
+ *      enabled. Use IEEE80211_WMM_IE_STA_QOSINFO_AC_* to set this bitmap.
+ *      Each bit corresponds to different AC. Value '1' in specific bit means
+ *      that corresponding AC is both trigger- and delivery-enabled. '0' means
+ *      neither enabled.
+ *
+ * @uapsd_max_sp_len: maximum number of total buffered frames the WMM AP may
+ *      deliver to a WMM STA during any Service Period triggered by the WMM STA.
+ *      Use IEEE80211_WMM_IE_STA_QOSINFO_SP_* for correct values.
  */
 struct ieee80211_hw {
         struct ieee80211_conf conf;
@@ -1556,6 +1603,8 @@ struct ieee80211_hw {
         u8 radiotap_mcs_details;
         u16 radiotap_vht_details;
         netdev_features_t netdev_features;
+        u8 uapsd_queues;
+        u8 uapsd_max_sp_len;
 };
 
 /**
@@ -1950,14 +1999,14 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * filter those response frames except in the case of frames that
  * are buffered in the driver -- those must remain buffered to avoid
  * reordering. Because it is possible that no frames are released
- * in this case, the driver must call ieee80211_sta_eosp_irqsafe()
+ * in this case, the driver must call ieee80211_sta_eosp()
  * to indicate to mac80211 that the service period ended anyway.
  *
  * Finally, if frames from multiple TIDs are released from mac80211
  * but the driver might reorder them, it must clear & set the flags
  * appropriately (only the last frame may have %IEEE80211_TX_STATUS_EOSP)
  * and also take care of the EOSP and MORE_DATA bits in the frame.
- * The driver may also use ieee80211_sta_eosp_irqsafe() in this case.
+ * The driver may also use ieee80211_sta_eosp() in this case.
  */
 
 /**
@@ -2135,6 +2184,24 @@ enum ieee80211_rate_control_changed {
 };
 
 /**
+ * enum ieee80211_roc_type - remain on channel type
+ *
+ * With the support for multi channel contexts and multi channel operations,
+ * remain on channel operations might be limited/deferred/aborted by other
+ * flows/operations which have higher priority (and vise versa).
+ * Specifying the ROC type can be used by devices to prioritize the ROC
+ * operations compared to other operations/flows.
+ *
+ * @IEEE80211_ROC_TYPE_NORMAL: There are no special requirements for this ROC.
+ * @IEEE80211_ROC_TYPE_MGMT_TX: The remain on channel request is required
+ *      for sending managment frames offchannel.
+ */
+enum ieee80211_roc_type {
+        IEEE80211_ROC_TYPE_NORMAL = 0,
+        IEEE80211_ROC_TYPE_MGMT_TX,
+};
+
+/**
  * struct ieee80211_ops - callbacks from mac80211 to the driver
  *
  * This structure contains various callbacks that the driver may
@@ -2212,18 +2279,6 @@ enum ieee80211_rate_control_changed {
  *      MAC address of the device going away.
  *      Hence, this callback must be implemented. It can sleep.
  *
- * @add_interface_debugfs: Drivers can use this callback to add debugfs files
- *      when a vif is added to mac80211. This callback and
- *      @remove_interface_debugfs should be within a CONFIG_MAC80211_DEBUGFS
- *      conditional. @remove_interface_debugfs must be provided for cleanup.
- *      This callback can sleep.
- *
- * @remove_interface_debugfs: Remove the debugfs files which were added using
- *      @add_interface_debugfs. This callback must remove all debugfs entries
- *      that were added because mac80211 only removes interface debugfs when the
- *      interface is destroyed, not when it is removed from the driver.
- *      This callback can sleep.
- *
  * @config: Handler for configuration requests. IEEE 802.11 code calls this
  *      function to change hardware configuration, e.g., channel.
  *      This function should never fail but returns a negative error code
@@ -2245,6 +2300,9 @@ enum ieee80211_rate_control_changed {
  *      See the section "Frame filtering" for more information.
  *      This callback must be implemented and can sleep.
  *
+ * @set_multicast_list: Configure the device's interface specific RX multicast
+ *      filter. This callback is optional. This callback must be atomic.
+ *
  * @set_tim: Set TIM bit. mac80211 calls this function when a TIM bit
  *      must be set or cleared for a given STA. Must be atomic.
  *
@@ -2426,8 +2484,11 @@ enum ieee80211_rate_control_changed {
  * @testmode_dump: Implement a cfg80211 test mode dump. The callback can sleep.
  *
  * @flush: Flush all pending frames from the hardware queue, making sure
- *      that the hardware queues are empty. If the parameter @drop is set
- *      to %true, pending frames may be dropped. The callback can sleep.
+ *      that the hardware queues are empty. The @queues parameter is a bitmap
+ *      of queues to flush, which is useful if different virtual interfaces
+ *      use different hardware queues; it may also indicate all queues.
+ *      If the parameter @drop is set to %true, pending frames may be dropped.
+ *      The callback can sleep.
  *
  * @channel_switch: Drivers that need (or want) to offload the channel
  *      switch operation for CSAs received from the AP may implement this
@@ -2492,7 +2553,7 @@ enum ieee80211_rate_control_changed {
  *      setting the EOSP flag in the QoS header of the frames. Also, when the
  *      service period ends, the driver must set %IEEE80211_TX_STATUS_EOSP
  *      on the last frame in the SP. Alternatively, it may call the function
- *      ieee80211_sta_eosp_irqsafe() to inform mac80211 of the end of the SP.
+ *      ieee80211_sta_eosp() to inform mac80211 of the end of the SP.
  *      This callback must be atomic.
  * @allow_buffered_frames: Prepare device to allow the given number of frames
  *      to go out to the given station. The frames will be sent by mac80211
@@ -2503,7 +2564,7 @@ enum ieee80211_rate_control_changed {
  *      them between the TIDs, it must set the %IEEE80211_TX_STATUS_EOSP flag
  *      on the last frame and clear it on all others and also handle the EOSP
  *      bit in the QoS header correctly. Alternatively, it can also call the
- *      ieee80211_sta_eosp_irqsafe() function.
+ *      ieee80211_sta_eosp() function.
  *      The @tids parameter is a bitmap and tells the driver which TIDs the
  *      frames will be on; it will at most have two bits set.
  *      This callback must be atomic.
@@ -2591,6 +2652,10 @@ struct ieee80211_ops {
                                  unsigned int changed_flags,
                                  unsigned int *total_flags,
                                  u64 multicast);
+        void (*set_multicast_list)(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif, bool allmulti,
+                                   struct netdev_hw_addr_list *mc_list);
+
         int (*set_tim)(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
                        bool set);
         int (*set_key)(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -2637,12 +2702,6 @@ struct ieee80211_ops {
                                    struct ieee80211_vif *vif,
                                    struct ieee80211_sta *sta,
                                    struct dentry *dir);
-        void (*add_interface_debugfs)(struct ieee80211_hw *hw,
-                                      struct ieee80211_vif *vif,
-                                      struct dentry *dir);
-        void (*remove_interface_debugfs)(struct ieee80211_hw *hw,
-                                         struct ieee80211_vif *vif,
-                                         struct dentry *dir);
 #endif
         void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         enum sta_notify_cmd, struct ieee80211_sta *sta);
@@ -2677,7 +2736,7 @@ struct ieee80211_ops {
                              struct netlink_callback *cb,
                              void *data, int len);
 #endif
-        void (*flush)(struct ieee80211_hw *hw, bool drop);
+        void (*flush)(struct ieee80211_hw *hw, u32 queues, bool drop);
         void (*channel_switch)(struct ieee80211_hw *hw,
                                struct ieee80211_channel_switch *ch_switch);
         int (*napi_poll)(struct ieee80211_hw *hw, int budget);
@@ -2687,7 +2746,8 @@ struct ieee80211_ops {
         int (*remain_on_channel)(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_channel *chan,
-                                 int duration);
+                                 int duration,
+                                 enum ieee80211_roc_type type);
         int (*cancel_remain_on_channel)(struct ieee80211_hw *hw);
         int (*set_ringparam)(struct ieee80211_hw *hw, u32 tx, u32 rx);
         void (*get_ringparam)(struct ieee80211_hw *hw,
@@ -3108,6 +3168,25 @@ void ieee80211_sta_set_buffered(struct ieee80211_sta *sta,
                                 u8 tid, bool buffered);
 
 /**
+ * ieee80211_get_tx_rates - get the selected transmit rates for a packet
+ *
+ * Call this function in a driver with per-packet rate selection support
+ * to combine the rate info in the packet tx info with the most recent
+ * rate selection table for the station entry.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @sta: the receiver station to which this packet is sent.
+ * @skb: the frame to be transmitted.
+ * @dest: buffer for extracted rate/retry information
+ * @max_rates: maximum number of rates to fetch
+ */
+void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta,
+                            struct sk_buff *skb,
+                            struct ieee80211_tx_rate *dest,
+                            int max_rates);
+
+/**
  * ieee80211_tx_status - transmit status callback
  *
  * Call this function for all transmitted frames after they have been
@@ -3842,14 +3921,17 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
  * %IEEE80211_TX_STATUS_EOSP bit and call this function instead.
  * This applies for PS-Poll as well as uAPSD.
  *
- * Note that there is no non-_irqsafe version right now as
- * it wasn't needed, but just like _tx_status() and _rx()
- * must not be mixed in irqsafe/non-irqsafe versions, this
- * function must not be mixed with those either. Use the
- * all irqsafe, or all non-irqsafe, don't mix! If you need
- * the non-irqsafe version of this, you need to add it.
+ * Note that just like with _tx_status() and _rx() drivers must
+ * not mix calls to irqsafe/non-irqsafe versions, this function
+ * must not be mixed with those either. Use the all irqsafe, or
+ * all non-irqsafe, don't mix!
+ *
+ * NB: the _irqsafe version of this function doesn't exist, no
+ *     driver needs it right now. Don't call this function if
+ *     you'd need the _irqsafe version, look at the git history
+ *     and restore the _irqsafe version!
  */
-void ieee80211_sta_eosp_irqsafe(struct ieee80211_sta *pubsta);
+void ieee80211_sta_eosp(struct ieee80211_sta *pubsta);
 
 /**
  * ieee80211_iter_keys - iterate keys programmed into the device
@@ -4079,7 +4161,7 @@ void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn);
  *      (deprecated; this will be removed once drivers get updated to use
  *      rate_idx_mask)
  * @rate_idx_mask: user-requested (legacy) rate mask
- * @rate_idx_mcs_mask: user-requested MCS rate mask
+ * @rate_idx_mcs_mask: user-requested MCS rate mask (NULL if not in use)
  * @bss: whether this frame is sent out in AP or IBSS mode
  */
 struct ieee80211_tx_rate_control {
@@ -4091,7 +4173,7 @@ struct ieee80211_tx_rate_control {
         bool rts, short_preamble;
         u8 max_rate_idx;
         u32 rate_idx_mask;
-        u8 rate_idx_mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
+        u8 *rate_idx_mcs_mask;
         bool bss;
 };
 
@@ -4180,37 +4262,55 @@ bool rate_usable_index_exists(struct ieee80211_supported_band *sband,
         return false;
 }
 
+/**
+ * rate_control_set_rates - pass the sta rate selection to mac80211/driver
+ *
+ * When not doing a rate control probe to test rates, rate control should pass
+ * its rate selection to mac80211. If the driver supports receiving a station
+ * rate table, it will use it to ensure that frames are always sent based on
+ * the most recent rate control module decision.
+ *
+ * @hw: pointer as obtained from ieee80211_alloc_hw()
+ * @pubsta: &struct ieee80211_sta pointer to the target destination.
+ * @rates: new tx rate set to be used for this station.
+ */
+int rate_control_set_rates(struct ieee80211_hw *hw,
+                           struct ieee80211_sta *pubsta,
+                           struct ieee80211_sta_rates *rates);
+
 int ieee80211_rate_control_register(struct rate_control_ops *ops);
 void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
 
 static inline bool
 conf_is_ht20(struct ieee80211_conf *conf)
 {
-        return conf->channel_type == NL80211_CHAN_HT20;
+        return conf->chandef.width == NL80211_CHAN_WIDTH_20;
 }
 
 static inline bool
 conf_is_ht40_minus(struct ieee80211_conf *conf)
 {
-        return conf->channel_type == NL80211_CHAN_HT40MINUS;
+        return conf->chandef.width == NL80211_CHAN_WIDTH_40 &&
+               conf->chandef.center_freq1 < conf->chandef.chan->center_freq;
 }
 
 static inline bool
 conf_is_ht40_plus(struct ieee80211_conf *conf)
 {
-        return conf->channel_type == NL80211_CHAN_HT40PLUS;
+        return conf->chandef.width == NL80211_CHAN_WIDTH_40 &&
+               conf->chandef.center_freq1 > conf->chandef.chan->center_freq;
 }
 
 static inline bool
 conf_is_ht40(struct ieee80211_conf *conf)
 {
-        return conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf);
+        return conf->chandef.width == NL80211_CHAN_WIDTH_40;
 }
 
 static inline bool
 conf_is_ht(struct ieee80211_conf *conf)
 {
-        return conf->channel_type != NL80211_CHAN_NO_HT;
+        return conf->chandef.width != NL80211_CHAN_WIDTH_20_NOHT;
 }
 
 static inline enum nl80211_iftype
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index de644bcd8613..b17697827482 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -17,6 +17,7 @@
 #include <net/netns/ipv6.h>
 #include <net/netns/sctp.h>
 #include <net/netns/dccp.h>
+#include <net/netns/netfilter.h>
 #include <net/netns/x_tables.h>
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 #include <net/netns/conntrack.h>
@@ -94,6 +95,7 @@ struct net {
         struct netns_dccp       dccp;
 #endif
 #ifdef CONFIG_NETFILTER
+        struct netns_nf         nf;
         struct netns_xt         xt;
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
         struct netns_ct         ct;
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index caca0c4d6b4b..644d9c223d24 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -184,7 +184,7 @@ extern int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 extern void nf_ct_delete_from_lists(struct nf_conn *ct);
 extern void nf_ct_dying_timeout(struct nf_conn *ct);
 
-extern void nf_conntrack_flush_report(struct net *net, u32 pid, int report);
+extern void nf_conntrack_flush_report(struct net *net, u32 portid, int report);
 
 extern bool nf_ct_get_tuplepr(const struct sk_buff *skb,
                               unsigned int nhoff, u_int16_t l3num,
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 930275fa2ea6..fb2b6234e937 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -27,6 +27,7 @@ extern unsigned int nf_conntrack_in(struct net *net,
 
 extern int nf_conntrack_init_net(struct net *net);
 extern void nf_conntrack_cleanup_net(struct net *net);
+extern void nf_conntrack_cleanup_net_list(struct list_head *net_exit_list);
 
 extern int nf_conntrack_proto_pernet_init(struct net *net);
 extern void nf_conntrack_proto_pernet_fini(struct net *net);
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index cbbae7621e22..3f3aecbc8632 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -88,7 +88,7 @@ nf_ct_find_expectation(struct net *net, u16 zone,
                        const struct nf_conntrack_tuple *tuple);
 
 void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
-                                u32 pid, int report);
+                                u32 portid, int report);
 static inline void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
 {
         nf_ct_unlink_expect_report(exp, 0, 0);
@@ -106,7 +106,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *, unsigned int, u_int8_t,
                        u_int8_t, const __be16 *, const __be16 *);
 void nf_ct_expect_put(struct nf_conntrack_expect *exp);
 int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, 
-                                u32 pid, int report);
+                                u32 portid, int report);
 static inline int nf_ct_expect_related(struct nf_conntrack_expect *expect)
 {
         return nf_ct_expect_related_report(expect, 0, 0);
diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h
index e991bd0a27af..31f1fb9eb784 100644
--- a/include/net/netfilter/nf_log.h
+++ b/include/net/netfilter/nf_log.h
@@ -49,12 +49,18 @@ struct nf_logger {
 int nf_log_register(u_int8_t pf, struct nf_logger *logger);
 void nf_log_unregister(struct nf_logger *logger);
 
-int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger);
-void nf_log_unbind_pf(u_int8_t pf);
+void nf_log_set(struct net *net, u_int8_t pf,
+                const struct nf_logger *logger);
+void nf_log_unset(struct net *net, const struct nf_logger *logger);
+
+int nf_log_bind_pf(struct net *net, u_int8_t pf,
+                   const struct nf_logger *logger);
+void nf_log_unbind_pf(struct net *net, u_int8_t pf);
 
 /* Calls the registered backend logging function */
-__printf(7, 8)
-void nf_log_packet(u_int8_t pf,
+__printf(8, 9)
+void nf_log_packet(struct net *net,
+                   u_int8_t pf,
                    unsigned int hooknum,
                    const struct sk_buff *skb,
                    const struct net_device *in,
diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
index fb1c0be38b6d..aaba4bbcdda0 100644
--- a/include/net/netfilter/nf_queue.h
+++ b/include/net/netfilter/nf_queue.h
@@ -9,10 +9,13 @@ struct nf_queue_entry {
 
         struct nf_hook_ops      *elem;
         u_int8_t                pf;
+        u16                     size; /* sizeof(entry) + saved route keys */
         unsigned int            hook;
         struct net_device       *indev;
         struct net_device       *outdev;
         int                     (*okfn)(struct sk_buff *);
+
+        /* extra space to store route keys */
 };
 
 #define nf_queue_entry_reroute(x) ((void *)x + sizeof(struct nf_queue_entry))
@@ -27,4 +30,7 @@ void nf_register_queue_handler(const struct nf_queue_handler *qh);
 void nf_unregister_queue_handler(void);
 extern void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);
 
+bool nf_queue_entry_get_refs(struct nf_queue_entry *entry);
+void nf_queue_entry_release_refs(struct nf_queue_entry *entry);
+
 #endif /* _NF_QUEUE_H */
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index 1242f371718b..005e2c2e39a9 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -71,6 +71,7 @@ struct netns_ipv6 {
         struct fib_rules_ops    *mr6_rules_ops;
 #endif
 #endif
+        atomic_t                dev_addr_genid;
 };
 
 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h
new file mode 100644
index 000000000000..88740024ccf3
--- /dev/null
+++ b/include/net/netns/netfilter.h
@@ -0,0 +1,18 @@
+#ifndef __NETNS_NETFILTER_H
+#define __NETNS_NETFILTER_H
+
+#include <linux/proc_fs.h>
+#include <linux/netfilter.h>
+
+struct nf_logger;
+
+struct netns_nf {
+#if defined CONFIG_PROC_FS
+        struct proc_dir_entry *proc_netfilter;
+#endif
+        const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO];
+#ifdef CONFIG_SYSCTL
+        struct ctl_table_header *nf_log_dir_header;
+#endif
+};
+#endif
diff --git a/include/net/netprio_cgroup.h b/include/net/netprio_cgroup.h
index 1d04b6f0fbd4..50ab8c26ab59 100644
--- a/include/net/netprio_cgroup.h
+++ b/include/net/netprio_cgroup.h
@@ -29,7 +29,7 @@ struct cgroup_netprio_state {
         struct cgroup_subsys_state css;
 };
 
-extern void sock_update_netprioidx(struct sock *sk, struct task_struct *task);
+extern void sock_update_netprioidx(struct sock *sk);
 
 #if IS_BUILTIN(CONFIG_NETPRIO_CGROUP)
 
@@ -68,7 +68,7 @@ static inline u32 task_netprioidx(struct task_struct *p)
         return 0;
 }
 
-#define sock_update_netprioidx(sk, task)
+#define sock_update_netprioidx(sk)
 
 #endif /* CONFIG_NETPRIO_CGROUP */
 
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 87a6417fc934..5eb80bb3cbb2 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -122,6 +122,8 @@ struct nfc_dev {
 
         bool shutting_down;
 
+        struct rfkill *rfkill;
+
         struct nfc_ops *ops;
 };
 #define to_nfc_dev(_dev) container_of(_dev, struct nfc_dev, dev)
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index a51dbd17c2de..59795e42c8b6 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -27,19 +27,13 @@ struct sk_buff;
 struct dst_entry;
 struct proto;
 
-/* empty to "strongly type" an otherwise void parameter.
- */
-struct request_values {
-};
-
 struct request_sock_ops {
         int             family;
         int             obj_size;
         struct kmem_cache       *slab;
         char            *slab_name;
         int             (*rtx_syn_ack)(struct sock *sk,
-                                       struct request_sock *req,
-                                       struct request_values *rvp);
+                                       struct request_sock *req);
         void            (*send_ack)(struct sock *sk, struct sk_buff *skb,
                                     struct request_sock *req);
         void            (*send_reset)(struct sock *sk,
@@ -54,7 +48,7 @@ extern int inet_rtx_syn_ack(struct sock *parent, struct request_sock *req);
 /* struct request_sock - mini sock to represent a connection request
  */
 struct request_sock {
-        struct request_sock             *dl_next; /* Must be first member! */
+        struct request_sock             *dl_next;
         u16                             mss;
         u8                              num_retrans; /* number of retransmits */
         u8                              cookie_ts:1; /* syncookie: encode tcpopts in timestamp */
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 5a15fabd6a75..702664833a53 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -4,7 +4,7 @@
 #include <linux/rtnetlink.h>
 #include <net/netlink.h>
 
-typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *, void *);
+typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *);
 typedef int (*rtnl_dumpit_func)(struct sk_buff *, struct netlink_callback *);
 typedef u16 (*rtnl_calcit_func)(struct sk_buff *, struct nlmsghdr *);
 
diff --git a/include/net/scm.h b/include/net/scm.h
index b11708105681..8de2d37d2077 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -26,7 +26,6 @@ struct scm_fp_list {
 
 struct scm_cookie {
         struct pid              *pid;           /* Skb credentials */
-        const struct cred       *cred;
         struct scm_fp_list      *fp;            /* Passed files         */
         struct scm_creds        creds;          /* Skb credentials      */
 #ifdef CONFIG_SECURITY_NETWORK
@@ -51,23 +50,18 @@ static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_co
 #endif /* CONFIG_SECURITY_NETWORK */
 
 static __inline__ void scm_set_cred(struct scm_cookie *scm,
-                                    struct pid *pid, const struct cred *cred)
+                                    struct pid *pid, kuid_t uid, kgid_t gid)
 {
         scm->pid  = get_pid(pid);
-        scm->cred = cred ? get_cred(cred) : NULL;
         scm->creds.pid = pid_vnr(pid);
-        scm->creds.uid = cred ? cred->uid : INVALID_UID;
-        scm->creds.gid = cred ? cred->gid : INVALID_GID;
+        scm->creds.uid = uid;
+        scm->creds.gid = gid;
 }
 
 static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
 {
         put_pid(scm->pid);
         scm->pid  = NULL;
-
-        if (scm->cred)
-                put_cred(scm->cred);
-        scm->cred = NULL;
 }
 
 static __inline__ void scm_destroy(struct scm_cookie *scm)
@@ -81,8 +75,10 @@ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
                                struct scm_cookie *scm, bool forcecreds)
 {
         memset(scm, 0, sizeof(*scm));
+        scm->creds.uid = INVALID_UID;
+        scm->creds.gid = INVALID_GID;
         if (forcecreds)
-                scm_set_cred(scm, task_tgid(current), current_cred());
+                scm_set_cred(scm, task_tgid(current), current_uid(), current_gid());
         unix_get_peersec_dgram(sock, scm);
         if (msg->msg_controllen <= 0)
                 return 0;
diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h
index befc8d2a1b9f..5a2110d3176d 100644
--- a/include/net/sctp/checksum.h
+++ b/include/net/sctp/checksum.h
@@ -77,7 +77,7 @@ static inline __u32 sctp_update_cksum(__u8 *buffer, __u16 length, __u32 crc32)
         return sctp_crc32c(crc32, buffer, length);
 }
 
-static inline __le32 sctp_end_cksum(__be32 crc32)
+static inline __le32 sctp_end_cksum(__u32 crc32)
 {
         return cpu_to_le32(~crc32);
 }
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index a7dd5c50df79..ca50e0751e47 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -49,7 +49,6 @@
 
 #include <linux/sctp.h>
 #include <linux/ipv6.h> /* For ipv6hdr. */
-#include <net/sctp/user.h>
 #include <net/tcp_states.h>  /* For TCP states used in sctp_sock_state_t */
 
 /* Value used for stream negotiation. */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 0e0f9d2322e3..1bd4c4144fe8 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -399,7 +399,6 @@ struct sctp_stream {
 struct sctp_ssnmap {
         struct sctp_stream in;
         struct sctp_stream out;
-        int malloced;
 };
 
 struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
@@ -715,8 +714,7 @@ struct sctp_packet {
             has_sack:1,         /* This packet contains a SACK chunk. */
             has_auth:1,         /* This packet contains an AUTH chunk */
             has_data:1,         /* This packet contains at least 1 DATA chunk */
-            ipfragok:1,         /* So let ip fragment this packet */
-            malloced:1;         /* Is it malloced? */
+            ipfragok:1;         /* So let ip fragment this packet */
 };
 
 struct sctp_packet *sctp_packet_init(struct sctp_packet *,
@@ -780,10 +778,7 @@ struct sctp_transport {
                 hb_sent:1,
 
                 /* Is the Path MTU update pending on this tranport */
-                pmtu_pending:1,
-
-                /* Is this structure kfree()able? */
-                malloced:1;
+                pmtu_pending:1;
 
         /* Has this transport moved the ctsn since we last sacked */
         __u32 sack_generation;
@@ -992,8 +987,6 @@ struct sctp_inq {
          * messages.
          */
         struct work_struct immediate;
-
-        int malloced;        /* Is this structure kfree()able?  */
 };
 
 void sctp_inq_init(struct sctp_inq *);
@@ -1062,9 +1055,6 @@ struct sctp_outq {
 
         /* Is this structure empty?  */
         char empty;
-
-        /* Are we kfree()able? */
-        char malloced;
 };
 
 void sctp_outq_init(struct sctp_association *, struct sctp_outq *);
@@ -1102,8 +1092,6 @@ struct sctp_bind_addr {
          *      peer(s) in INIT and INIT ACK chunks.
          */
         struct list_head address_list;
-
-        int malloced;        /* Are we kfree()able?  */
 };
 
 void sctp_bind_addr_init(struct sctp_bind_addr *, __u16 port);
@@ -1174,11 +1162,9 @@ struct sctp_ep_common {
         /* Some fields to help us manage this object.
          *   refcnt   - Reference count access to this object.
          *   dead     - Do not attempt to use this object.
-         *   malloced - Do we need to kfree this object?
          */
         atomic_t    refcnt;
-        char        dead;
-        char        malloced;
+        bool        dead;
 
         /* What socket does this endpoint belong to?  */
         struct sock *sk;
diff --git a/include/net/sctp/ulpqueue.h b/include/net/sctp/ulpqueue.h
index ff1b8ba73ab1..00e50ba3f24b 100644
--- a/include/net/sctp/ulpqueue.h
+++ b/include/net/sctp/ulpqueue.h
@@ -49,7 +49,6 @@
 
 /* A structure to carry information to the ULP (e.g. Sockets API) */
 struct sctp_ulpq {
-        char malloced;
         char pd_mode;
         struct sctp_association *asoc;
         struct sk_buff_head reasm;
diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
index c2e542b27a5a..6ca975bebd37 100644
--- a/include/net/secure_seq.h
+++ b/include/net/secure_seq.h
@@ -3,6 +3,7 @@
 
 #include <linux/types.h>
 
+extern void net_secret_init(void);
 extern __u32 secure_ip_id(__be32 daddr);
 extern __u32 secure_ipv6_id(const __be32 daddr[4]);
 extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
diff --git a/include/net/sock.h b/include/net/sock.h
index 14f6e9d19dc7..5c97b0fc5623 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -667,6 +667,7 @@ enum sock_flags {
                      * user-space instead.
                      */
         SOCK_FILTER_LOCKED, /* Filter cannot be changed anymore */
+        SOCK_SELECT_ERR_QUEUE, /* Wake select on error queue */
 };
 
 static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
@@ -2158,10 +2159,9 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
  * @sk:         socket sending this packet
  * @tx_flags:   filled with instructions for time stamping
  *
- * Currently only depends on SOCK_TIMESTAMPING* flags. Returns error code if
- * parameters are invalid.
+ * Currently only depends on SOCK_TIMESTAMPING* flags.
  */
-extern int sock_tx_timestamp(struct sock *sk, __u8 *tx_flags);
+extern void sock_tx_timestamp(struct sock *sk, __u8 *tx_flags);
 
 /**
  * sk_eat_skb - Release a skb if it is no longer needed
diff --git a/include/net/tcp.h b/include/net/tcp.h
index cf0694d4ad60..5bba80fbd1d9 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -179,7 +179,6 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCPOPT_SACK             5       /* SACK Block */
 #define TCPOPT_TIMESTAMP        8       /* Better RTT estimations/PAWS */
 #define TCPOPT_MD5SIG           19      /* MD5 Signature (RFC2385) */
-#define TCPOPT_COOKIE           253     /* Cookie extension (experimental) */
 #define TCPOPT_EXP              254     /* Experimental */
 /* Magic number to be after the option value for sharing TCP
  * experimental options. See draft-ietf-tcpm-experimental-options-00.txt
@@ -273,7 +272,6 @@ extern int sysctl_tcp_app_win;
 extern int sysctl_tcp_adv_win_scale;
 extern int sysctl_tcp_tw_reuse;
 extern int sysctl_tcp_frto;
-extern int sysctl_tcp_frto_response;
 extern int sysctl_tcp_low_latency;
 extern int sysctl_tcp_dma_copybreak;
 extern int sysctl_tcp_nometrics_save;
@@ -284,7 +282,6 @@ extern int sysctl_tcp_base_mss;
 extern int sysctl_tcp_workaround_signed_windows;
 extern int sysctl_tcp_slow_start_after_idle;
 extern int sysctl_tcp_max_ssthresh;
-extern int sysctl_tcp_cookie_size;
 extern int sysctl_tcp_thin_linear_timeouts;
 extern int sysctl_tcp_thin_dupack;
 extern int sysctl_tcp_early_retrans;
@@ -373,6 +370,7 @@ extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 extern int tcp_sendpage(struct sock *sk, struct page *page, int offset,
                         size_t size, int flags);
 extern void tcp_release_cb(struct sock *sk);
+extern void tcp_wfree(struct sk_buff *skb);
 extern void tcp_write_timer_handler(struct sock *sk);
 extern void tcp_delack_timer_handler(struct sock *sk);
 extern int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg);
@@ -425,8 +423,6 @@ extern struct sock * tcp_check_req(struct sock *sk,struct sk_buff *skb,
                                    bool fastopen);
 extern int tcp_child_process(struct sock *parent, struct sock *child,
                              struct sk_buff *skb);
-extern bool tcp_use_frto(struct sock *sk);
-extern void tcp_enter_frto(struct sock *sk);
 extern void tcp_enter_loss(struct sock *sk, int how);
 extern void tcp_clear_retrans(struct tcp_sock *tp);
 extern void tcp_update_metrics(struct sock *sk);
@@ -454,7 +450,7 @@ extern void tcp_syn_ack_timeout(struct sock *sk, struct request_sock *req);
 extern int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        size_t len, int nonblock, int flags, int *addr_len);
 extern void tcp_parse_options(const struct sk_buff *skb,
-                              struct tcp_options_received *opt_rx, const u8 **hvpp,
+                              struct tcp_options_received *opt_rx,
                               int estab, struct tcp_fastopen_cookie *foc);
 extern const u8 *tcp_parse_md5sig_option(const struct tcphdr *th);
 
@@ -476,7 +472,6 @@ extern int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr,
 extern int tcp_connect(struct sock *sk);
 extern struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                                         struct request_sock *req,
-                                        struct request_values *rvp,
                                         struct tcp_fastopen_cookie *foc);
 extern int tcp_disconnect(struct sock *sk, int flags);
 
@@ -543,6 +538,8 @@ extern bool tcp_syn_flood_action(struct sock *sk,
 extern void tcp_push_one(struct sock *, unsigned int mss_now);
 extern void tcp_send_ack(struct sock *sk);
 extern void tcp_send_delayed_ack(struct sock *sk);
+extern void tcp_send_loss_probe(struct sock *sk);
+extern bool tcp_schedule_loss_probe(struct sock *sk);
 
 /* tcp_input.c */
 extern void tcp_cwnd_application_limited(struct sock *sk);
@@ -756,7 +753,6 @@ enum tcp_ca_event {
         CA_EVENT_TX_START,      /* first transmit when no packets in flight */
         CA_EVENT_CWND_RESTART,  /* congestion window restart */
         CA_EVENT_COMPLETE_CWR,  /* end of congestion recovery */
-        CA_EVENT_FRTO,          /* fast recovery timeout */
         CA_EVENT_LOSS,          /* loss timeout */
         CA_EVENT_FAST_ACK,      /* in sequence ack */
         CA_EVENT_SLOW_ACK,      /* other ack */
@@ -873,8 +869,8 @@ static inline void tcp_enable_fack(struct tcp_sock *tp)
 static inline void tcp_enable_early_retrans(struct tcp_sock *tp)
 {
         tp->do_early_retrans = sysctl_tcp_early_retrans &&
-                !sysctl_tcp_thin_dupack && sysctl_tcp_reordering == 3;
-        tp->early_retrans_delayed = 0;
+                sysctl_tcp_early_retrans < 4 && !sysctl_tcp_thin_dupack &&
+                sysctl_tcp_reordering == 3;
 }
 
 static inline void tcp_disable_early_retrans(struct tcp_sock *tp)
@@ -1030,50 +1026,7 @@ static inline void tcp_prequeue_init(struct tcp_sock *tp)
 #endif
 }
 
-/* Packet is added to VJ-style prequeue for processing in process
- * context, if a reader task is waiting. Apparently, this exciting
- * idea (VJ's mail "Re: query about TCP header on tcp-ip" of 07 Sep 93)
- * failed somewhere. Latency? Burstiness? Well, at least now we will
- * see, why it failed. 8)8)                               --ANK
- *
- * NOTE: is this not too big to inline?
- */
-static inline bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        if (sysctl_tcp_low_latency || !tp->ucopy.task)
-                return false;
-
-        if (skb->len <= tcp_hdrlen(skb) &&
-            skb_queue_len(&tp->ucopy.prequeue) == 0)
-                return false;
-
-        __skb_queue_tail(&tp->ucopy.prequeue, skb);
-        tp->ucopy.memory += skb->truesize;
-        if (tp->ucopy.memory > sk->sk_rcvbuf) {
-                struct sk_buff *skb1;
-
-                BUG_ON(sock_owned_by_user(sk));
-
-                while ((skb1 = __skb_dequeue(&tp->ucopy.prequeue)) != NULL) {
-                        sk_backlog_rcv(sk, skb1);
-                        NET_INC_STATS_BH(sock_net(sk),
-                                         LINUX_MIB_TCPPREQUEUEDROPPED);
-                }
-
-                tp->ucopy.memory = 0;
-        } else if (skb_queue_len(&tp->ucopy.prequeue) == 1) {
-                wake_up_interruptible_sync_poll(sk_sleep(sk),
-                                           POLLIN | POLLRDNORM | POLLRDBAND);
-                if (!inet_csk_ack_scheduled(sk))
-                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-                                                  (3 * tcp_rto_min(sk)) / 4,
-                                                  TCP_RTO_MAX);
-        }
-        return true;
-}
-
+extern bool tcp_prequeue(struct sock *sk, struct sk_buff *skb);
 
 #undef STATE_TRACE
 
@@ -1630,91 +1583,6 @@ struct tcp_request_sock_ops {
 #endif
 };
 
-/* Using SHA1 for now, define some constants.
- */
-#define COOKIE_DIGEST_WORDS (SHA_DIGEST_WORDS)
-#define COOKIE_MESSAGE_WORDS (SHA_MESSAGE_BYTES / 4)
-#define COOKIE_WORKSPACE_WORDS (COOKIE_DIGEST_WORDS + COOKIE_MESSAGE_WORDS)
-
-extern int tcp_cookie_generator(u32 *bakery);
-
-/**
- *      struct tcp_cookie_values - each socket needs extra space for the
- *      cookies, together with (optional) space for any SYN data.
- *
- *      A tcp_sock contains a pointer to the current value, and this is
- *      cloned to the tcp_timewait_sock.
- *
- * @cookie_pair:        variable data from the option exchange.
- *
- * @cookie_desired:     user specified tcpct_cookie_desired.  Zero
- *                      indicates default (sysctl_tcp_cookie_size).
- *                      After cookie sent, remembers size of cookie.
- *                      Range 0, TCP_COOKIE_MIN to TCP_COOKIE_MAX.
- *
- * @s_data_desired:     user specified tcpct_s_data_desired.  When the
- *                      constant payload is specified (@s_data_constant),
- *                      holds its length instead.
- *                      Range 0 to TCP_MSS_DESIRED.
- *
- * @s_data_payload:     constant data that is to be included in the
- *                      payload of SYN or SYNACK segments when the
- *                      cookie option is present.
- */
-struct tcp_cookie_values {
-        struct kref     kref;
-        u8              cookie_pair[TCP_COOKIE_PAIR_SIZE];
-        u8              cookie_pair_size;
-        u8              cookie_desired;
-        u16             s_data_desired:11,
-                        s_data_constant:1,
-                        s_data_in:1,
-                        s_data_out:1,
-                        s_data_unused:2;
-        u8              s_data_payload[0];
-};
-
-static inline void tcp_cookie_values_release(struct kref *kref)
-{
-        kfree(container_of(kref, struct tcp_cookie_values, kref));
-}
-
-/* The length of constant payload data.  Note that s_data_desired is
- * overloaded, depending on s_data_constant: either the length of constant
- * data (returned here) or the limit on variable data.
- */
-static inline int tcp_s_data_size(const struct tcp_sock *tp)
-{
-        return (tp->cookie_values != NULL && tp->cookie_values->s_data_constant)
-                ? tp->cookie_values->s_data_desired
-                : 0;
-}
-
-/**
- *      struct tcp_extend_values - tcp_ipv?.c to tcp_output.c workspace.
- *
- *      As tcp_request_sock has already been extended in other places, the
- *      only remaining method is to pass stack values along as function
- *      parameters.  These parameters are not needed after sending SYNACK.
- *
- * @cookie_bakery:      cryptographic secret and message workspace.
- *
- * @cookie_plus:        bytes in authenticator/cookie option, copied from
- *                      struct tcp_options_received (above).
- */
-struct tcp_extend_values {
-        struct request_values           rv;
-        u32                             cookie_bakery[COOKIE_WORKSPACE_WORDS];
-        u8                              cookie_plus:6,
-                                        cookie_out_never:1,
-                                        cookie_in_always:1;
-};
-
-static inline struct tcp_extend_values *tcp_xv(struct request_values *rvp)
-{
-        return (struct tcp_extend_values *)rvp;
-}
-
 extern void tcp_v4_init(void);
 extern void tcp_init(void);
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 24c8886fd969..ae16531d0d35 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -162,6 +162,7 @@ struct xfrm_state {
                 xfrm_address_t  saddr;
                 int             header_len;
                 int             trailer_len;
+                u32             extra_flags;
         } props;
 
         struct xfrm_lifetime_cfg lft;
diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index 4ef3acbba5da..c5d2e3a1cf68 100644
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h
@@ -74,4 +74,6 @@
 
 #define SO_LOCK_FILTER          44
 
+#define SO_SELECT_ERR_QUEUE     45
+
 #endif /* __ASM_GENERIC_SOCKET_H */
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 5c8a1d25e21c..ab5d4992e568 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -285,6 +285,7 @@ header-y += nvram.h
 header-y += omap3isp.h
 header-y += omapfb.h
 header-y += oom.h
+header-y += openvswitch.h
 header-y += packet_diag.h
 header-y += param.h
 header-y += parport.h
@@ -331,6 +332,7 @@ header-y += rtnetlink.h
 header-y += scc.h
 header-y += sched.h
 header-y += screen_info.h
+header-y += sctp.h
 header-y += sdla.h
 header-y += seccomp.h
 header-y += securebits.h
diff --git a/include/uapi/linux/caif/caif_socket.h b/include/uapi/linux/caif/caif_socket.h
index 3f3bac6af7bc..586e9f98184f 100644
--- a/include/uapi/linux/caif/caif_socket.h
+++ b/include/uapi/linux/caif/caif_socket.h
@@ -1,7 +1,7 @@
 /* linux/caif_socket.h
  * CAIF Definitions for CAIF socket and network layer
  * Copyright (C) ST-Ericsson AB 2010
- * Author:       Sjur Brendeland/ sjur.brandeland@stericsson.com
+ * Author:       Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/uapi/linux/caif/if_caif.h b/include/uapi/linux/caif/if_caif.h
index 5e7eed4edf51..7618aabe8c6b 100644
--- a/include/uapi/linux/caif/if_caif.h
+++ b/include/uapi/linux/caif/if_caif.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/ sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/uapi/linux/cn_proc.h b/include/uapi/linux/cn_proc.h
index 0d7b49973bb3..f6c271035bbd 100644
--- a/include/uapi/linux/cn_proc.h
+++ b/include/uapi/linux/cn_proc.h
@@ -56,7 +56,9 @@ struct proc_event {
                 PROC_EVENT_PTRACE = 0x00000100,
                 PROC_EVENT_COMM = 0x00000200,
                 /* "next" should be 0x00000400 */
-                /* "last" is the last process event: exit */
+                /* "last" is the last process event: exit,
+                 * while "next to last" is coredumping event */
+                PROC_EVENT_COREDUMP = 0x40000000,
                 PROC_EVENT_EXIT = 0x80000000
         } what;
         __u32 cpu;
@@ -110,11 +112,17 @@ struct proc_event {
                         char           comm[16];
                 } comm;
 
+                struct coredump_proc_event {
+                        __kernel_pid_t process_pid;
+                        __kernel_pid_t process_tgid;
+                } coredump;
+
                 struct exit_proc_event {
                         __kernel_pid_t process_pid;
                         __kernel_pid_t process_tgid;
                         __u32 exit_code, exit_signal;
                 } exit;
+
         } event_data;
 };
 
diff --git a/include/uapi/linux/filter.h b/include/uapi/linux/filter.h
index 9cfde6941099..8eb9ccaa5b48 100644
--- a/include/uapi/linux/filter.h
+++ b/include/uapi/linux/filter.h
@@ -129,7 +129,8 @@ struct sock_fprog {	/* Required for SO_ATTACH_FILTER. */
 #define SKF_AD_ALU_XOR_X        40
 #define SKF_AD_VLAN_TAG 44
 #define SKF_AD_VLAN_TAG_PRESENT 48
-#define SKF_AD_MAX      52
+#define SKF_AD_PAY_OFFSET       52
+#define SKF_AD_MAX      56
 #define SKF_NET_OFF   (-0x100000)
 #define SKF_LL_OFF    (-0x200000)
 
diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
index 798032d01112..ade07f1c491a 100644
--- a/include/uapi/linux/if_ether.h
+++ b/include/uapi/linux/if_ether.h
@@ -94,6 +94,9 @@
 #define ETH_P_EDSA      0xDADA          /* Ethertype DSA [ NOT AN OFFICIALLY REGISTERED ID ] */
 #define ETH_P_AF_IUCV   0xFBFB          /* IBM af_iucv [ NOT AN OFFICIALLY REGISTERED ID ] */
 
+#define ETH_P_802_3_MIN 0x0600          /* If the value in the ethernet type is less than this value
+                                         * then the frame is Ethernet II. Else it is 802.3 */
+
 /*
  *      Non DIX types. Won't clash for 1500 types.
  */
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index c4edfe11f1f7..b05823cae784 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -201,6 +201,7 @@ enum {
         IFLA_INET6_MCAST,       /* MC things. What of them?     */
         IFLA_INET6_CACHEINFO,   /* time values and max reasm size */
         IFLA_INET6_ICMP6STATS,  /* statistics (icmpv6)          */
+        IFLA_INET6_TOKEN,       /* device token                 */
         __IFLA_INET6_MAX
 };
 
@@ -249,6 +250,7 @@ enum {
         IFLA_VLAN_FLAGS,
         IFLA_VLAN_EGRESS_QOS,
         IFLA_VLAN_INGRESS_QOS,
+        IFLA_VLAN_PROTOCOL,
         __IFLA_VLAN_MAX,
 };
 
@@ -295,7 +297,7 @@ enum macvlan_mode {
 enum {
         IFLA_VXLAN_UNSPEC,
         IFLA_VXLAN_ID,
-        IFLA_VXLAN_GROUP,
+        IFLA_VXLAN_GROUP,       /* group or remote address */
         IFLA_VXLAN_LINK,
         IFLA_VXLAN_LOCAL,
         IFLA_VXLAN_TTL,
@@ -303,11 +305,12 @@ enum {
         IFLA_VXLAN_LEARNING,
         IFLA_VXLAN_AGEING,
         IFLA_VXLAN_LIMIT,
-        IFLA_VXLAN_PORT_RANGE,
+        IFLA_VXLAN_PORT_RANGE,  /* source port */
         IFLA_VXLAN_PROXY,
         IFLA_VXLAN_RSC,
         IFLA_VXLAN_L2MISS,
         IFLA_VXLAN_L3MISS,
+        IFLA_VXLAN_PORT,        /* destination port */
         __IFLA_VXLAN_MAX
 };
 #define IFLA_VXLAN_MAX  (__IFLA_VXLAN_MAX - 1)
diff --git a/include/uapi/linux/if_packet.h b/include/uapi/linux/if_packet.h
index f9a60375f0d0..b950c02030c0 100644
--- a/include/uapi/linux/if_packet.h
+++ b/include/uapi/linux/if_packet.h
@@ -55,6 +55,8 @@ struct sockaddr_ll {
 #define PACKET_FANOUT_HASH              0
 #define PACKET_FANOUT_LB                1
 #define PACKET_FANOUT_CPU               2
+#define PACKET_FANOUT_ROLLOVER          3
+#define PACKET_FANOUT_FLAG_ROLLOVER     0x1000
 #define PACKET_FANOUT_FLAG_DEFRAG       0x8000
 
 struct tpacket_stats {
@@ -84,19 +86,24 @@ struct tpacket_auxdata {
 };
 
 /* Rx ring - header status */
-#define TP_STATUS_KERNEL        0x0
-#define TP_STATUS_USER          0x1
-#define TP_STATUS_COPY          0x2
-#define TP_STATUS_LOSING        0x4
-#define TP_STATUS_CSUMNOTREADY  0x8
-#define TP_STATUS_VLAN_VALID   0x10 /* auxdata has valid tp_vlan_tci */
-#define TP_STATUS_BLK_TMO       0x20
+#define TP_STATUS_KERNEL              0
+#define TP_STATUS_USER          (1 << 0)
+#define TP_STATUS_COPY          (1 << 1)
+#define TP_STATUS_LOSING        (1 << 2)
+#define TP_STATUS_CSUMNOTREADY  (1 << 3)
+#define TP_STATUS_VLAN_VALID    (1 << 4) /* auxdata has valid tp_vlan_tci */
+#define TP_STATUS_BLK_TMO       (1 << 5)
 
 /* Tx ring - header status */
-#define TP_STATUS_AVAILABLE     0x0
-#define TP_STATUS_SEND_REQUEST  0x1
-#define TP_STATUS_SENDING       0x2
-#define TP_STATUS_WRONG_FORMAT  0x4
+#define TP_STATUS_AVAILABLE           0
+#define TP_STATUS_SEND_REQUEST  (1 << 0)
+#define TP_STATUS_SENDING       (1 << 1)
+#define TP_STATUS_WRONG_FORMAT  (1 << 2)
+
+/* Rx and Tx ring - header status */
+#define TP_STATUS_TS_SOFTWARE           (1 << 29)
+#define TP_STATUS_TS_SYS_HARDWARE       (1 << 30)
+#define TP_STATUS_TS_RAW_HARDWARE       (1 << 31)
 
 /* Rx ring - feature request bits */
 #define TP_FT_REQ_FILL_RXHASH   0x1
diff --git a/include/uapi/linux/ip_vs.h b/include/uapi/linux/ip_vs.h
index 8a2d438dc499..a24537725e80 100644
--- a/include/uapi/linux/ip_vs.h
+++ b/include/uapi/linux/ip_vs.h
@@ -280,8 +280,8 @@ struct ip_vs_daemon_user {
 #define IPVS_GENL_VERSION       0x1
 
 struct ip_vs_flags {
-        __be32 flags;
-        __be32 mask;
+        __u32 flags;
+        __u32 mask;
 };
 
 /* Generic Netlink command attributes */
diff --git a/include/uapi/linux/neighbour.h b/include/uapi/linux/neighbour.h
index adb068c53c4e..f175212420ab 100644
--- a/include/uapi/linux/neighbour.h
+++ b/include/uapi/linux/neighbour.h
@@ -21,6 +21,9 @@ enum {
         NDA_CACHEINFO,
         NDA_PROBES,
         NDA_VLAN,
+        NDA_PORT,
+        NDA_VNI,
+        NDA_IFINDEX,
         __NDA_MAX
 };
 
diff --git a/include/uapi/linux/netfilter/ipset/ip_set.h b/include/uapi/linux/netfilter/ipset/ip_set.h
index fbee42807a11..8024cdf13b70 100644
--- a/include/uapi/linux/netfilter/ipset/ip_set.h
+++ b/include/uapi/linux/netfilter/ipset/ip_set.h
@@ -108,6 +108,8 @@ enum {
         IPSET_ATTR_CIDR2,
         IPSET_ATTR_IP2_TO,
         IPSET_ATTR_IFACE,
+        IPSET_ATTR_BYTES,
+        IPSET_ATTR_PACKETS,
         __IPSET_ATTR_ADT_MAX,
 };
 #define IPSET_ATTR_ADT_MAX      (__IPSET_ATTR_ADT_MAX - 1)
@@ -137,12 +139,13 @@ enum ipset_errno {
         IPSET_ERR_REFERENCED,
         IPSET_ERR_IPADDR_IPV4,
         IPSET_ERR_IPADDR_IPV6,
+        IPSET_ERR_COUNTER,
 
         /* Type specific error codes */
         IPSET_ERR_TYPE_SPECIFIC = 4352,
 };
 
-/* Flags at command level */
+/* Flags at command level or match/target flags, lower half of cmdattrs*/
 enum ipset_cmd_flags {
         IPSET_FLAG_BIT_EXIST    = 0,
         IPSET_FLAG_EXIST        = (1 << IPSET_FLAG_BIT_EXIST),
@@ -150,10 +153,20 @@ enum ipset_cmd_flags {
         IPSET_FLAG_LIST_SETNAME = (1 << IPSET_FLAG_BIT_LIST_SETNAME),
         IPSET_FLAG_BIT_LIST_HEADER = 2,
         IPSET_FLAG_LIST_HEADER  = (1 << IPSET_FLAG_BIT_LIST_HEADER),
-        IPSET_FLAG_CMD_MAX = 15,        /* Lower half */
+        IPSET_FLAG_BIT_SKIP_COUNTER_UPDATE = 3,
+        IPSET_FLAG_SKIP_COUNTER_UPDATE =
+                (1 << IPSET_FLAG_BIT_SKIP_COUNTER_UPDATE),
+        IPSET_FLAG_BIT_SKIP_SUBCOUNTER_UPDATE = 4,
+        IPSET_FLAG_SKIP_SUBCOUNTER_UPDATE =
+                (1 << IPSET_FLAG_BIT_SKIP_SUBCOUNTER_UPDATE),
+        IPSET_FLAG_BIT_MATCH_COUNTERS = 5,
+        IPSET_FLAG_MATCH_COUNTERS = (1 << IPSET_FLAG_BIT_MATCH_COUNTERS),
+        IPSET_FLAG_BIT_RETURN_NOMATCH = 7,
+        IPSET_FLAG_RETURN_NOMATCH = (1 << IPSET_FLAG_BIT_RETURN_NOMATCH),
+        IPSET_FLAG_CMD_MAX = 15,
 };
 
-/* Flags at CADT attribute level */
+/* Flags at CADT attribute level, upper half of cmdattrs */
 enum ipset_cadt_flags {
         IPSET_FLAG_BIT_BEFORE   = 0,
         IPSET_FLAG_BEFORE       = (1 << IPSET_FLAG_BIT_BEFORE),
@@ -161,7 +174,9 @@ enum ipset_cadt_flags {
         IPSET_FLAG_PHYSDEV      = (1 << IPSET_FLAG_BIT_PHYSDEV),
         IPSET_FLAG_BIT_NOMATCH  = 2,
         IPSET_FLAG_NOMATCH      = (1 << IPSET_FLAG_BIT_NOMATCH),
-        IPSET_FLAG_CADT_MAX     = 15,   /* Upper half */
+        IPSET_FLAG_BIT_WITH_COUNTERS = 3,
+        IPSET_FLAG_WITH_COUNTERS = (1 << IPSET_FLAG_BIT_WITH_COUNTERS),
+        IPSET_FLAG_CADT_MAX     = 15,
 };
 
 /* Commands with settype-specific attributes */
@@ -190,6 +205,7 @@ enum ip_set_dim {
          * If changed, new revision of iptables match/target is required.
          */
         IPSET_DIM_MAX = 6,
+        /* Backward compatibility: set match revision 2 */
         IPSET_BIT_RETURN_NOMATCH = 7,
 };
 
@@ -202,6 +218,18 @@ enum ip_set_kopt {
         IPSET_RETURN_NOMATCH = (1 << IPSET_BIT_RETURN_NOMATCH),
 };
 
+enum {
+        IPSET_COUNTER_NONE = 0,
+        IPSET_COUNTER_EQ,
+        IPSET_COUNTER_NE,
+        IPSET_COUNTER_LT,
+        IPSET_COUNTER_GT,
+};
+
+struct ip_set_counter_match {
+        __u8 op;
+        __u64 value;
+};
 
 /* Interface to iptables/ip6tables */
 
diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h
index 70ec8c2bc11a..a2308ae5a73d 100644
--- a/include/uapi/linux/netfilter/nfnetlink_queue.h
+++ b/include/uapi/linux/netfilter/nfnetlink_queue.h
@@ -45,6 +45,7 @@ enum nfqnl_attr_type {
         NFQA_CT,                        /* nf_conntrack_netlink.h */
         NFQA_CT_INFO,                   /* enum ip_conntrack_info */
         NFQA_CAP_LEN,                   /* __u32 length of captured packet */
+        NFQA_SKB_INFO,                  /* __u32 skb meta information */
 
         __NFQA_MAX
 };
@@ -96,6 +97,13 @@ enum nfqnl_attr_config {
 /* Flags for NFQA_CFG_FLAGS */
 #define NFQA_CFG_F_FAIL_OPEN                    (1 << 0)
 #define NFQA_CFG_F_CONNTRACK                    (1 << 1)
-#define NFQA_CFG_F_MAX                          (1 << 2)
+#define NFQA_CFG_F_GSO                          (1 << 2)
+#define NFQA_CFG_F_MAX                          (1 << 3)
+
+/* flags for NFQA_SKB_INFO */
+/* packet appears to have wrong checksums, but they are ok */
+#define NFQA_SKB_CSUMNOTREADY (1 << 0)
+/* packet is GSO (i.e., exceeds device mtu) */
+#define NFQA_SKB_GSO (1 << 1)
 
 #endif /* _NFNETLINK_QUEUE_H */
diff --git a/include/uapi/linux/netfilter/xt_NFQUEUE.h b/include/uapi/linux/netfilter/xt_NFQUEUE.h
index 9eafdbbb401c..8bb5fe657d34 100644
--- a/include/uapi/linux/netfilter/xt_NFQUEUE.h
+++ b/include/uapi/linux/netfilter/xt_NFQUEUE.h
@@ -26,4 +26,13 @@ struct xt_NFQ_info_v2 {
         __u16 bypass;
 };
 
+struct xt_NFQ_info_v3 {
+        __u16 queuenum;
+        __u16 queues_total;
+        __u16 flags;
+#define NFQ_FLAG_BYPASS         0x01 /* for compatibility with v2 */
+#define NFQ_FLAG_CPU_FANOUT     0x02 /* use current CPU (no hashing) */
+#define NFQ_FLAG_MASK           0x03
+};
+
 #endif /* _XT_NFQ_TARGET_H */
diff --git a/include/uapi/linux/netfilter/xt_set.h b/include/uapi/linux/netfilter/xt_set.h
index e3a9978f259f..964d3d42f874 100644
--- a/include/uapi/linux/netfilter/xt_set.h
+++ b/include/uapi/linux/netfilter/xt_set.h
@@ -62,4 +62,13 @@ struct xt_set_info_target_v2 {
         __u32 timeout;
 };
 
+/* Revision 3 match */
+
+struct xt_set_info_match_v3 {
+        struct xt_set_info match_set;
+        struct ip_set_counter_match packets;
+        struct ip_set_counter_match bytes;
+        __u32 flags;
+};
+
 #endif /*_XT_SET_H*/
diff --git a/include/uapi/linux/netfilter_ipv6/ip6t_frag.h b/include/uapi/linux/netfilter_ipv6/ip6t_frag.h
index b47f61b9e082..dfd8bc2268cf 100644
--- a/include/uapi/linux/netfilter_ipv6/ip6t_frag.h
+++ b/include/uapi/linux/netfilter_ipv6/ip6t_frag.h
@@ -4,9 +4,9 @@
 #include <linux/types.h>
 
 struct ip6t_frag {
-        __u32 ids[2];                   /* Security Parameter Index */
+        __u32 ids[2];                   /* Identification range */
         __u32 hdrlen;                   /* Header Length */
-        __u8  flags;                    /*  */
+        __u8  flags;                    /* Flags */
         __u8  invflags;                 /* Inverse flags */
 };
 
diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h
index 78d5b8a546d6..1a85940f8ab7 100644
--- a/include/uapi/linux/netlink.h
+++ b/include/uapi/linux/netlink.h
@@ -1,6 +1,7 @@
 #ifndef _UAPI__LINUX_NETLINK_H
 #define _UAPI__LINUX_NETLINK_H
 
+#include <linux/kernel.h>
 #include <linux/socket.h> /* for __kernel_sa_family_t */
 #include <linux/types.h>
 
@@ -78,7 +79,7 @@ struct nlmsghdr {
 #define NLMSG_ALIGNTO   4U
 #define NLMSG_ALIGN(len) ( ((len)+NLMSG_ALIGNTO-1) & ~(NLMSG_ALIGNTO-1) )
 #define NLMSG_HDRLEN     ((int) NLMSG_ALIGN(sizeof(struct nlmsghdr)))
-#define NLMSG_LENGTH(len) ((len)+NLMSG_ALIGN(NLMSG_HDRLEN))
+#define NLMSG_LENGTH(len) ((len) + NLMSG_HDRLEN)
 #define NLMSG_SPACE(len) NLMSG_ALIGN(NLMSG_LENGTH(len))
 #define NLMSG_DATA(nlh)  ((void*)(((char*)nlh) + NLMSG_LENGTH(0)))
 #define NLMSG_NEXT(nlh,len)      ((len) -= NLMSG_ALIGN((nlh)->nlmsg_len), \
@@ -105,11 +106,42 @@ struct nlmsgerr {
 #define NETLINK_PKTINFO         3
 #define NETLINK_BROADCAST_ERROR 4
 #define NETLINK_NO_ENOBUFS      5
+#define NETLINK_RX_RING         6
+#define NETLINK_TX_RING         7
 
 struct nl_pktinfo {
         __u32   group;
 };
 
+struct nl_mmap_req {
+        unsigned int    nm_block_size;
+        unsigned int    nm_block_nr;
+        unsigned int    nm_frame_size;
+        unsigned int    nm_frame_nr;
+};
+
+struct nl_mmap_hdr {
+        unsigned int    nm_status;
+        unsigned int    nm_len;
+        __u32           nm_group;
+        /* credentials */
+        __u32           nm_pid;
+        __u32           nm_uid;
+        __u32           nm_gid;
+};
+
+enum nl_mmap_status {
+        NL_MMAP_STATUS_UNUSED,
+        NL_MMAP_STATUS_RESERVED,
+        NL_MMAP_STATUS_VALID,
+        NL_MMAP_STATUS_COPY,
+        NL_MMAP_STATUS_SKIP,
+};
+
+#define NL_MMAP_MSG_ALIGNMENT           NLMSG_ALIGNTO
+#define NL_MMAP_MSG_ALIGN(sz)           __ALIGN_KERNEL(sz, NL_MMAP_MSG_ALIGNMENT)
+#define NL_MMAP_HDRLEN                  NL_MMAP_MSG_ALIGN(sizeof(struct nl_mmap_hdr))
+
 #define NET_MAJOR 36            /* Major 36 is reserved for networking                                          */
 
 enum {
diff --git a/include/uapi/linux/netlink_diag.h b/include/uapi/linux/netlink_diag.h
new file mode 100644
index 000000000000..4e31db4eea41
--- /dev/null
+++ b/include/uapi/linux/netlink_diag.h
@@ -0,0 +1,52 @@
+#ifndef __NETLINK_DIAG_H__
+#define __NETLINK_DIAG_H__
+
+#include <linux/types.h>
+
+struct netlink_diag_req {
+        __u8    sdiag_family;
+        __u8    sdiag_protocol;
+        __u16   pad;
+        __u32   ndiag_ino;
+        __u32   ndiag_show;
+        __u32   ndiag_cookie[2];
+};
+
+struct netlink_diag_msg {
+        __u8    ndiag_family;
+        __u8    ndiag_type;
+        __u8    ndiag_protocol;
+        __u8    ndiag_state;
+
+        __u32   ndiag_portid;
+        __u32   ndiag_dst_portid;
+        __u32   ndiag_dst_group;
+        __u32   ndiag_ino;
+        __u32   ndiag_cookie[2];
+};
+
+struct netlink_diag_ring {
+        __u32   ndr_block_size;
+        __u32   ndr_block_nr;
+        __u32   ndr_frame_size;
+        __u32   ndr_frame_nr;
+};
+
+enum {
+        NETLINK_DIAG_MEMINFO,
+        NETLINK_DIAG_GROUPS,
+        NETLINK_DIAG_RX_RING,
+        NETLINK_DIAG_TX_RING,
+
+        __NETLINK_DIAG_MAX,
+};
+
+#define NETLINK_DIAG_MAX (__NETLINK_DIAG_MAX - 1)
+
+#define NDIAG_PROTO_ALL         ((__u8) ~0)
+
+#define NDIAG_SHOW_MEMINFO      0x00000001 /* show memory info of a socket */
+#define NDIAG_SHOW_GROUPS       0x00000002 /* show groups of a netlink socket */
+#define NDIAG_SHOW_RING_CFG     0x00000004 /* show ring configuration */
+
+#endif
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 7969f46f1bb3..7c6f627a717d 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -90,6 +90,8 @@ enum nfc_commands {
         NFC_CMD_LLC_SET_PARAMS,
         NFC_CMD_ENABLE_SE,
         NFC_CMD_DISABLE_SE,
+        NFC_CMD_LLC_SDREQ,
+        NFC_EVENT_LLC_SDRES,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -140,11 +142,21 @@ enum nfc_attrs {
         NFC_ATTR_LLC_PARAM_RW,
         NFC_ATTR_LLC_PARAM_MIUX,
         NFC_ATTR_SE,
+        NFC_ATTR_LLC_SDP,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
 #define NFC_ATTR_MAX (__NFC_ATTR_AFTER_LAST - 1)
 
+enum nfc_sdp_attr {
+        NFC_SDP_ATTR_UNSPEC,
+        NFC_SDP_ATTR_URI,
+        NFC_SDP_ATTR_SAP,
+/* private: internal use only */
+        __NFC_SDP_ATTR_AFTER_LAST
+};
+#define NFC_SDP_ATTR_MAX (__NFC_SDP_ATTR_AFTER_LAST - 1)
+
 #define NFC_DEVICE_NAME_MAXSIZE 8
 #define NFC_NFCID1_MAXSIZE 10
 #define NFC_SENSB_RES_MAXSIZE 12
@@ -220,4 +232,11 @@ struct sockaddr_nfc_llcp {
 #define NFC_LLCP_DIRECTION_RX           0x00
 #define NFC_LLCP_DIRECTION_TX           0x01
 
+/* socket option names */
+#define NFC_LLCP_RW             0
+#define NFC_LLCP_MIUX           1
+#define NFC_LLCP_REMOTE_MIU     2
+#define NFC_LLCP_REMOTE_LTO     3
+#define NFC_LLCP_REMOTE_RW      4
+
 #endif /*__LINUX_NFC_H */
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index c46bb016f4e4..d1e48b5e348f 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -36,7 +36,21 @@
  * The station is still assumed to belong to the AP interface it was added
  * to.
  *
- * TODO: need more info?
+ * Station handling varies per interface type and depending on the driver's
+ * capabilities.
+ *
+ * For drivers supporting TDLS with external setup (WIPHY_FLAG_SUPPORTS_TDLS
+ * and WIPHY_FLAG_TDLS_EXTERNAL_SETUP), the station lifetime is as follows:
+ *  - a setup station entry is added, not yet authorized, without any rate
+ *    or capability information, this just exists to avoid race conditions
+ *  - when the TDLS setup is done, a single NL80211_CMD_SET_STATION is valid
+ *    to add rate and capability information to the station and at the same
+ *    time mark it authorized.
+ *  - %NL80211_TDLS_ENABLE_LINK is then used
+ *  - after this, the only valid operation is to remove it by tearing down
+ *    the TDLS link (%NL80211_TDLS_DISABLE_LINK)
+ *
+ * TODO: need more info for other interface types
  */
 
 /**
@@ -499,9 +513,11 @@
  * @NL80211_CMD_NEW_PEER_CANDIDATE: Notification on the reception of a
  *      beacon or probe response from a compatible mesh peer.  This is only
  *      sent while no station information (sta_info) exists for the new peer
- *      candidate and when @NL80211_MESH_SETUP_USERSPACE_AUTH is set.  On
- *      reception of this notification, userspace may decide to create a new
- *      station (@NL80211_CMD_NEW_STATION).  To stop this notification from
+ *      candidate and when @NL80211_MESH_SETUP_USERSPACE_AUTH,
+ *      @NL80211_MESH_SETUP_USERSPACE_AMPE, or
+ *      @NL80211_MESH_SETUP_USERSPACE_MPM is set.  On reception of this
+ *      notification, userspace may decide to create a new station
+ *      (@NL80211_CMD_NEW_STATION).  To stop this notification from
  *      reoccurring, the userspace authentication daemon may want to create the
  *      new station with the AUTHENTICATED flag unset and maybe change it later
  *      depending on the authentication result.
@@ -611,6 +627,25 @@
  *      %NL80211_ATTR_RADAR_EVENT is used to inform about the type of the
  *      event.
  *
+ * @NL80211_CMD_GET_PROTOCOL_FEATURES: Get global nl80211 protocol features,
+ *      i.e. features for the nl80211 protocol rather than device features.
+ *      Returns the features in the %NL80211_ATTR_PROTOCOL_FEATURES bitmap.
+ *
+ * @NL80211_CMD_UPDATE_FT_IES: Pass down the most up-to-date Fast Transition
+ *      Information Element to the WLAN driver
+ *
+ * @NL80211_CMD_FT_EVENT: Send a Fast transition event from the WLAN driver
+ *      to the supplicant. This will carry the target AP's MAC address along
+ *      with the relevant Information Elements. This event is used to report
+ *      received FT IEs (MDIE, FTIE, RSN IE, TIE, RICIE).
+ *
+ * @NL80211_CMD_CRIT_PROTOCOL_START: Indicates user-space will start running
+ *      a critical protocol that needs more reliability in the connection to
+ *      complete.
+ *
+ * @NL80211_CMD_CRIT_PROTOCOL_STOP: Indicates the connection reliability can
+ *      return back to normal.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -765,6 +800,14 @@ enum nl80211_commands {
 
         NL80211_CMD_RADAR_DETECT,
 
+        NL80211_CMD_GET_PROTOCOL_FEATURES,
+
+        NL80211_CMD_UPDATE_FT_IES,
+        NL80211_CMD_FT_EVENT,
+
+        NL80211_CMD_CRIT_PROTOCOL_START,
+        NL80211_CMD_CRIT_PROTOCOL_STOP,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -884,7 +927,8 @@ enum nl80211_commands {
  *      consisting of a nested array.
  *
  * @NL80211_ATTR_MESH_ID: mesh id (1-32 bytes).
- * @NL80211_ATTR_STA_PLINK_ACTION: action to perform on the mesh peer link.
+ * @NL80211_ATTR_STA_PLINK_ACTION: action to perform on the mesh peer link
+ *      (see &enum nl80211_plink_action).
  * @NL80211_ATTR_MPATH_NEXT_HOP: MAC address of the next hop for a mesh path.
  * @NL80211_ATTR_MPATH_INFO: information about a mesh_path, part of mesh path
  *      info given for %NL80211_CMD_GET_MPATH, nested attribute described at
@@ -1167,10 +1211,10 @@ enum nl80211_commands {
  * @NL80211_ATTR_SUPPORT_MESH_AUTH: Currently, this means the underlying driver
  *      allows auth frames in a mesh to be passed to userspace for processing via
  *      the @NL80211_MESH_SETUP_USERSPACE_AUTH flag.
- * @NL80211_ATTR_STA_PLINK_STATE: The state of a mesh peer link as
- *      defined in &enum nl80211_plink_state. Used when userspace is
- *      driving the peer link management state machine.
- *      @NL80211_MESH_SETUP_USERSPACE_AMPE must be enabled.
+ * @NL80211_ATTR_STA_PLINK_STATE: The state of a mesh peer link as defined in
+ *      &enum nl80211_plink_state. Used when userspace is driving the peer link
+ *      management state machine.  @NL80211_MESH_SETUP_USERSPACE_AMPE or
+ *      @NL80211_MESH_SETUP_USERSPACE_MPM must be enabled.
  *
  * @NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED: indicates, as part of the wiphy
  *      capabilities, the supported WoWLAN triggers
@@ -1368,6 +1412,23 @@ enum nl80211_commands {
  *      advertised to the driver, e.g., to enable TDLS off channel operations
  *      and PU-APSD.
  *
+ * @NL80211_ATTR_PROTOCOL_FEATURES: global nl80211 feature flags, see
+ *      &enum nl80211_protocol_features, the attribute is a u32.
+ *
+ * @NL80211_ATTR_SPLIT_WIPHY_DUMP: flag attribute, userspace supports
+ *      receiving the data for a single wiphy split across multiple
+ *      messages, given with wiphy dump message
+ *
+ * @NL80211_ATTR_MDID: Mobility Domain Identifier
+ *
+ * @NL80211_ATTR_IE_RIC: Resource Information Container Information
+ *      Element
+ *
+ * @NL80211_ATTR_CRIT_PROT_ID: critical protocol identifier requiring increased
+ *      reliability, see &enum nl80211_crit_proto_id (u16).
+ * @NL80211_ATTR_MAX_CRIT_PROT_DURATION: duration in milliseconds in which
+ *      the connection should have increased reliability (u16).
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1654,6 +1715,18 @@ enum nl80211_attrs {
         NL80211_ATTR_STA_CAPABILITY,
         NL80211_ATTR_STA_EXT_CAPABILITY,
 
+        NL80211_ATTR_PROTOCOL_FEATURES,
+        NL80211_ATTR_SPLIT_WIPHY_DUMP,
+
+        NL80211_ATTR_DISABLE_VHT,
+        NL80211_ATTR_VHT_CAPABILITY_MASK,
+
+        NL80211_ATTR_MDID,
+        NL80211_ATTR_IE_RIC,
+
+        NL80211_ATTR_CRIT_PROT_ID,
+        NL80211_ATTR_MAX_CRIT_PROT_DURATION,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -2412,8 +2485,10 @@ enum nl80211_mesh_power_mode {
  * @NL80211_MESHCONF_TTL: specifies the value of TTL field set at a source mesh
  *      point.
  *
- * @NL80211_MESHCONF_AUTO_OPEN_PLINKS: whether we should automatically
- *      open peer links when we detect compatible mesh peers.
+ * @NL80211_MESHCONF_AUTO_OPEN_PLINKS: whether we should automatically open
+ *      peer links when we detect compatible mesh peers. Disabled if
+ *      @NL80211_MESH_SETUP_USERSPACE_MPM or @NL80211_MESH_SETUP_USERSPACE_AMPE are
+ *      set.
  *
  * @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES: the number of action frames
  *      containing a PREQ that an MP can send to a particular destination (path
@@ -2559,6 +2634,9 @@ enum nl80211_meshconf_params {
  *      vendor specific synchronization method or disable it to use the default
  *      neighbor offset synchronization
  *
+ * @NL80211_MESH_SETUP_USERSPACE_MPM: Enable this option if userspace will
+ *      implement an MPM which handles peer allocation and state.
+ *
  * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
  *
  * @__NL80211_MESH_SETUP_ATTR_AFTER_LAST: Internal use
@@ -2571,6 +2649,7 @@ enum nl80211_mesh_setup_params {
         NL80211_MESH_SETUP_USERSPACE_AUTH,
         NL80211_MESH_SETUP_USERSPACE_AMPE,
         NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC,
+        NL80211_MESH_SETUP_USERSPACE_MPM,
 
         /* keep last */
         __NL80211_MESH_SETUP_ATTR_AFTER_LAST,
@@ -3307,6 +3386,23 @@ enum nl80211_plink_state {
         MAX_NL80211_PLINK_STATES = NUM_NL80211_PLINK_STATES - 1
 };
 
+/**
+ * enum nl80211_plink_action - actions to perform in mesh peers
+ *
+ * @NL80211_PLINK_ACTION_NO_ACTION: perform no action
+ * @NL80211_PLINK_ACTION_OPEN: start mesh peer link establishment
+ * @NL80211_PLINK_ACTION_BLOCK: block traffic from this mesh peer
+ * @NUM_NL80211_PLINK_ACTIONS: number of possible actions
+ */
+enum plink_actions {
+        NL80211_PLINK_ACTION_NO_ACTION,
+        NL80211_PLINK_ACTION_OPEN,
+        NL80211_PLINK_ACTION_BLOCK,
+
+        NUM_NL80211_PLINK_ACTIONS,
+};
+
+
 #define NL80211_KCK_LEN                 16
 #define NL80211_KEK_LEN                 16
 #define NL80211_REPLAY_CTR_LEN          8
@@ -3456,6 +3552,10 @@ enum nl80211_ap_sme_features {
  *      stations the authenticated/associated bits have to be set in the mask.
  * @NL80211_FEATURE_ADVERTISE_CHAN_LIMITS: cfg80211 advertises channel limits
  *      (HT40, VHT 80/160 MHz) if this flag is set
+ * @NL80211_FEATURE_USERSPACE_MPM: This driver supports a userspace Mesh
+ *      Peering Management entity which may be implemented by registering for
+ *      beacons or NL80211_CMD_NEW_PEER_CANDIDATE events. The mesh beacon is
+ *      still generated by the driver.
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -3474,6 +3574,7 @@ enum nl80211_feature_flags {
         /* bit 13 is reserved */
         NL80211_FEATURE_ADVERTISE_CHAN_LIMITS           = 1 << 14,
         NL80211_FEATURE_FULL_AP_CLIENT_STATE            = 1 << 15,
+        NL80211_FEATURE_USERSPACE_MPM                   = 1 << 16,
 };
 
 /**
@@ -3587,4 +3688,37 @@ enum nl80211_dfs_state {
         NL80211_DFS_AVAILABLE,
 };
 
+/**
+ * enum enum nl80211_protocol_features - nl80211 protocol features
+ * @NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP: nl80211 supports splitting
+ *      wiphy dumps (if requested by the application with the attribute
+ *      %NL80211_ATTR_SPLIT_WIPHY_DUMP. Also supported is filtering the
+ *      wiphy dump by %NL80211_ATTR_WIPHY, %NL80211_ATTR_IFINDEX or
+ *      %NL80211_ATTR_WDEV.
+ */
+enum nl80211_protocol_features {
+        NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP =     1 << 0,
+};
+
+/**
+ * enum nl80211_crit_proto_id - nl80211 critical protocol identifiers
+ *
+ * @NL80211_CRIT_PROTO_UNSPEC: protocol unspecified.
+ * @NL80211_CRIT_PROTO_DHCP: BOOTP or DHCPv6 protocol.
+ * @NL80211_CRIT_PROTO_EAPOL: EAPOL protocol.
+ * @NL80211_CRIT_PROTO_APIPA: APIPA protocol.
+ * @NUM_NL80211_CRIT_PROTO: must be kept last.
+ */
+enum nl80211_crit_proto_id {
+        NL80211_CRIT_PROTO_UNSPEC,
+        NL80211_CRIT_PROTO_DHCP,
+        NL80211_CRIT_PROTO_EAPOL,
+        NL80211_CRIT_PROTO_APIPA,
+        /* add other protocols before this one */
+        NUM_NL80211_CRIT_PROTO
+};
+
+/* maximum duration for critical protocol measures */
+#define NL80211_CRIT_PROTO_MAX_DURATION         5000 /* msec */
+
 #endif /* __LINUX_NL80211_H */
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
new file mode 100644
index 000000000000..405918dd7b3f
--- /dev/null
+++ b/include/uapi/linux/openvswitch.h
@@ -0,0 +1,456 @@
+
+/*
+ * Copyright (c) 2007-2011 Nicira Networks.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ */
+
+#ifndef _UAPI__LINUX_OPENVSWITCH_H
+#define _UAPI__LINUX_OPENVSWITCH_H 1
+
+#include <linux/types.h>
+#include <linux/if_ether.h>
+
+/**
+ * struct ovs_header - header for OVS Generic Netlink messages.
+ * @dp_ifindex: ifindex of local port for datapath (0 to make a request not
+ * specific to a datapath).
+ *
+ * Attributes following the header are specific to a particular OVS Generic
+ * Netlink family, but all of the OVS families use this header.
+ */
+
+struct ovs_header {
+        int dp_ifindex;
+};
+
+/* Datapaths. */
+
+#define OVS_DATAPATH_FAMILY  "ovs_datapath"
+#define OVS_DATAPATH_MCGROUP "ovs_datapath"
+#define OVS_DATAPATH_VERSION 0x1
+
+enum ovs_datapath_cmd {
+        OVS_DP_CMD_UNSPEC,
+        OVS_DP_CMD_NEW,
+        OVS_DP_CMD_DEL,
+        OVS_DP_CMD_GET,
+        OVS_DP_CMD_SET
+};
+
+/**
+ * enum ovs_datapath_attr - attributes for %OVS_DP_* commands.
+ * @OVS_DP_ATTR_NAME: Name of the network device that serves as the "local
+ * port".  This is the name of the network device whose dp_ifindex is given in
+ * the &struct ovs_header.  Always present in notifications.  Required in
+ * %OVS_DP_NEW requests.  May be used as an alternative to specifying
+ * dp_ifindex in other requests (with a dp_ifindex of 0).
+ * @OVS_DP_ATTR_UPCALL_PID: The Netlink socket in userspace that is initially
+ * set on the datapath port (for OVS_ACTION_ATTR_MISS).  Only valid on
+ * %OVS_DP_CMD_NEW requests. A value of zero indicates that upcalls should
+ * not be sent.
+ * @OVS_DP_ATTR_STATS: Statistics about packets that have passed through the
+ * datapath.  Always present in notifications.
+ *
+ * These attributes follow the &struct ovs_header within the Generic Netlink
+ * payload for %OVS_DP_* commands.
+ */
+enum ovs_datapath_attr {
+        OVS_DP_ATTR_UNSPEC,
+        OVS_DP_ATTR_NAME,       /* name of dp_ifindex netdev */
+        OVS_DP_ATTR_UPCALL_PID, /* Netlink PID to receive upcalls */
+        OVS_DP_ATTR_STATS,      /* struct ovs_dp_stats */
+        __OVS_DP_ATTR_MAX
+};
+
+#define OVS_DP_ATTR_MAX (__OVS_DP_ATTR_MAX - 1)
+
+struct ovs_dp_stats {
+        __u64 n_hit;             /* Number of flow table matches. */
+        __u64 n_missed;          /* Number of flow table misses. */
+        __u64 n_lost;            /* Number of misses not sent to userspace. */
+        __u64 n_flows;           /* Number of flows present */
+};
+
+struct ovs_vport_stats {
+        __u64   rx_packets;             /* total packets received       */
+        __u64   tx_packets;             /* total packets transmitted    */
+        __u64   rx_bytes;               /* total bytes received         */
+        __u64   tx_bytes;               /* total bytes transmitted      */
+        __u64   rx_errors;              /* bad packets received         */
+        __u64   tx_errors;              /* packet transmit problems     */
+        __u64   rx_dropped;             /* no space in linux buffers    */
+        __u64   tx_dropped;             /* no space available in linux  */
+};
+
+/* Fixed logical ports. */
+#define OVSP_LOCAL      ((__u32)0)
+
+/* Packet transfer. */
+
+#define OVS_PACKET_FAMILY "ovs_packet"
+#define OVS_PACKET_VERSION 0x1
+
+enum ovs_packet_cmd {
+        OVS_PACKET_CMD_UNSPEC,
+
+        /* Kernel-to-user notifications. */
+        OVS_PACKET_CMD_MISS,    /* Flow table miss. */
+        OVS_PACKET_CMD_ACTION,  /* OVS_ACTION_ATTR_USERSPACE action. */
+
+        /* Userspace commands. */
+        OVS_PACKET_CMD_EXECUTE  /* Apply actions to a packet. */
+};
+
+/**
+ * enum ovs_packet_attr - attributes for %OVS_PACKET_* commands.
+ * @OVS_PACKET_ATTR_PACKET: Present for all notifications.  Contains the entire
+ * packet as received, from the start of the Ethernet header onward.  For
+ * %OVS_PACKET_CMD_ACTION, %OVS_PACKET_ATTR_PACKET reflects changes made by
+ * actions preceding %OVS_ACTION_ATTR_USERSPACE, but %OVS_PACKET_ATTR_KEY is
+ * the flow key extracted from the packet as originally received.
+ * @OVS_PACKET_ATTR_KEY: Present for all notifications.  Contains the flow key
+ * extracted from the packet as nested %OVS_KEY_ATTR_* attributes.  This allows
+ * userspace to adapt its flow setup strategy by comparing its notion of the
+ * flow key against the kernel's.
+ * @OVS_PACKET_ATTR_ACTIONS: Contains actions for the packet.  Used
+ * for %OVS_PACKET_CMD_EXECUTE.  It has nested %OVS_ACTION_ATTR_* attributes.
+ * @OVS_PACKET_ATTR_USERDATA: Present for an %OVS_PACKET_CMD_ACTION
+ * notification if the %OVS_ACTION_ATTR_USERSPACE action specified an
+ * %OVS_USERSPACE_ATTR_USERDATA attribute, with the same length and content
+ * specified there.
+ *
+ * These attributes follow the &struct ovs_header within the Generic Netlink
+ * payload for %OVS_PACKET_* commands.
+ */
+enum ovs_packet_attr {
+        OVS_PACKET_ATTR_UNSPEC,
+        OVS_PACKET_ATTR_PACKET,      /* Packet data. */
+        OVS_PACKET_ATTR_KEY,         /* Nested OVS_KEY_ATTR_* attributes. */
+        OVS_PACKET_ATTR_ACTIONS,     /* Nested OVS_ACTION_ATTR_* attributes. */
+        OVS_PACKET_ATTR_USERDATA,    /* OVS_ACTION_ATTR_USERSPACE arg. */
+        __OVS_PACKET_ATTR_MAX
+};
+
+#define OVS_PACKET_ATTR_MAX (__OVS_PACKET_ATTR_MAX - 1)
+
+/* Virtual ports. */
+
+#define OVS_VPORT_FAMILY  "ovs_vport"
+#define OVS_VPORT_MCGROUP "ovs_vport"
+#define OVS_VPORT_VERSION 0x1
+
+enum ovs_vport_cmd {
+        OVS_VPORT_CMD_UNSPEC,
+        OVS_VPORT_CMD_NEW,
+        OVS_VPORT_CMD_DEL,
+        OVS_VPORT_CMD_GET,
+        OVS_VPORT_CMD_SET
+};
+
+enum ovs_vport_type {
+        OVS_VPORT_TYPE_UNSPEC,
+        OVS_VPORT_TYPE_NETDEV,   /* network device */
+        OVS_VPORT_TYPE_INTERNAL, /* network device implemented by datapath */
+        __OVS_VPORT_TYPE_MAX
+};
+
+#define OVS_VPORT_TYPE_MAX (__OVS_VPORT_TYPE_MAX - 1)
+
+/**
+ * enum ovs_vport_attr - attributes for %OVS_VPORT_* commands.
+ * @OVS_VPORT_ATTR_PORT_NO: 32-bit port number within datapath.
+ * @OVS_VPORT_ATTR_TYPE: 32-bit %OVS_VPORT_TYPE_* constant describing the type
+ * of vport.
+ * @OVS_VPORT_ATTR_NAME: Name of vport.  For a vport based on a network device
+ * this is the name of the network device.  Maximum length %IFNAMSIZ-1 bytes
+ * plus a null terminator.
+ * @OVS_VPORT_ATTR_OPTIONS: Vport-specific configuration information.
+ * @OVS_VPORT_ATTR_UPCALL_PID: The Netlink socket in userspace that
+ * OVS_PACKET_CMD_MISS upcalls will be directed to for packets received on
+ * this port.  A value of zero indicates that upcalls should not be sent.
+ * @OVS_VPORT_ATTR_STATS: A &struct ovs_vport_stats giving statistics for
+ * packets sent or received through the vport.
+ *
+ * These attributes follow the &struct ovs_header within the Generic Netlink
+ * payload for %OVS_VPORT_* commands.
+ *
+ * For %OVS_VPORT_CMD_NEW requests, the %OVS_VPORT_ATTR_TYPE and
+ * %OVS_VPORT_ATTR_NAME attributes are required.  %OVS_VPORT_ATTR_PORT_NO is
+ * optional; if not specified a free port number is automatically selected.
+ * Whether %OVS_VPORT_ATTR_OPTIONS is required or optional depends on the type
+ * of vport.
+ * and other attributes are ignored.
+ *
+ * For other requests, if %OVS_VPORT_ATTR_NAME is specified then it is used to
+ * look up the vport to operate on; otherwise dp_idx from the &struct
+ * ovs_header plus %OVS_VPORT_ATTR_PORT_NO determine the vport.
+ */
+enum ovs_vport_attr {
+        OVS_VPORT_ATTR_UNSPEC,
+        OVS_VPORT_ATTR_PORT_NO, /* u32 port number within datapath */
+        OVS_VPORT_ATTR_TYPE,    /* u32 OVS_VPORT_TYPE_* constant. */
+        OVS_VPORT_ATTR_NAME,    /* string name, up to IFNAMSIZ bytes long */
+        OVS_VPORT_ATTR_OPTIONS, /* nested attributes, varies by vport type */
+        OVS_VPORT_ATTR_UPCALL_PID, /* u32 Netlink PID to receive upcalls */
+        OVS_VPORT_ATTR_STATS,   /* struct ovs_vport_stats */
+        __OVS_VPORT_ATTR_MAX
+};
+
+#define OVS_VPORT_ATTR_MAX (__OVS_VPORT_ATTR_MAX - 1)
+
+/* Flows. */
+
+#define OVS_FLOW_FAMILY  "ovs_flow"
+#define OVS_FLOW_MCGROUP "ovs_flow"
+#define OVS_FLOW_VERSION 0x1
+
+enum ovs_flow_cmd {
+        OVS_FLOW_CMD_UNSPEC,
+        OVS_FLOW_CMD_NEW,
+        OVS_FLOW_CMD_DEL,
+        OVS_FLOW_CMD_GET,
+        OVS_FLOW_CMD_SET
+};
+
+struct ovs_flow_stats {
+        __u64 n_packets;         /* Number of matched packets. */
+        __u64 n_bytes;           /* Number of matched bytes. */
+};
+
+enum ovs_key_attr {
+        OVS_KEY_ATTR_UNSPEC,
+        OVS_KEY_ATTR_ENCAP,     /* Nested set of encapsulated attributes. */
+        OVS_KEY_ATTR_PRIORITY,  /* u32 skb->priority */
+        OVS_KEY_ATTR_IN_PORT,   /* u32 OVS dp port number */
+        OVS_KEY_ATTR_ETHERNET,  /* struct ovs_key_ethernet */
+        OVS_KEY_ATTR_VLAN,      /* be16 VLAN TCI */
+        OVS_KEY_ATTR_ETHERTYPE, /* be16 Ethernet type */
+        OVS_KEY_ATTR_IPV4,      /* struct ovs_key_ipv4 */
+        OVS_KEY_ATTR_IPV6,      /* struct ovs_key_ipv6 */
+        OVS_KEY_ATTR_TCP,       /* struct ovs_key_tcp */
+        OVS_KEY_ATTR_UDP,       /* struct ovs_key_udp */
+        OVS_KEY_ATTR_ICMP,      /* struct ovs_key_icmp */
+        OVS_KEY_ATTR_ICMPV6,    /* struct ovs_key_icmpv6 */
+        OVS_KEY_ATTR_ARP,       /* struct ovs_key_arp */
+        OVS_KEY_ATTR_ND,        /* struct ovs_key_nd */
+        OVS_KEY_ATTR_SKB_MARK,  /* u32 skb mark */
+        __OVS_KEY_ATTR_MAX
+};
+
+#define OVS_KEY_ATTR_MAX (__OVS_KEY_ATTR_MAX - 1)
+
+/**
+ * enum ovs_frag_type - IPv4 and IPv6 fragment type
+ * @OVS_FRAG_TYPE_NONE: Packet is not a fragment.
+ * @OVS_FRAG_TYPE_FIRST: Packet is a fragment with offset 0.
+ * @OVS_FRAG_TYPE_LATER: Packet is a fragment with nonzero offset.
+ *
+ * Used as the @ipv4_frag in &struct ovs_key_ipv4 and as @ipv6_frag &struct
+ * ovs_key_ipv6.
+ */
+enum ovs_frag_type {
+        OVS_FRAG_TYPE_NONE,
+        OVS_FRAG_TYPE_FIRST,
+        OVS_FRAG_TYPE_LATER,
+        __OVS_FRAG_TYPE_MAX
+};
+
+#define OVS_FRAG_TYPE_MAX (__OVS_FRAG_TYPE_MAX - 1)
+
+struct ovs_key_ethernet {
+        __u8     eth_src[ETH_ALEN];
+        __u8     eth_dst[ETH_ALEN];
+};
+
+struct ovs_key_ipv4 {
+        __be32 ipv4_src;
+        __be32 ipv4_dst;
+        __u8   ipv4_proto;
+        __u8   ipv4_tos;
+        __u8   ipv4_ttl;
+        __u8   ipv4_frag;       /* One of OVS_FRAG_TYPE_*. */
+};
+
+struct ovs_key_ipv6 {
+        __be32 ipv6_src[4];
+        __be32 ipv6_dst[4];
+        __be32 ipv6_label;      /* 20-bits in least-significant bits. */
+        __u8   ipv6_proto;
+        __u8   ipv6_tclass;
+        __u8   ipv6_hlimit;
+        __u8   ipv6_frag;       /* One of OVS_FRAG_TYPE_*. */
+};
+
+struct ovs_key_tcp {
+        __be16 tcp_src;
+        __be16 tcp_dst;
+};
+
+struct ovs_key_udp {
+        __be16 udp_src;
+        __be16 udp_dst;
+};
+
+struct ovs_key_icmp {
+        __u8 icmp_type;
+        __u8 icmp_code;
+};
+
+struct ovs_key_icmpv6 {
+        __u8 icmpv6_type;
+        __u8 icmpv6_code;
+};
+
+struct ovs_key_arp {
+        __be32 arp_sip;
+        __be32 arp_tip;
+        __be16 arp_op;
+        __u8   arp_sha[ETH_ALEN];
+        __u8   arp_tha[ETH_ALEN];
+};
+
+struct ovs_key_nd {
+        __u32 nd_target[4];
+        __u8  nd_sll[ETH_ALEN];
+        __u8  nd_tll[ETH_ALEN];
+};
+
+/**
+ * enum ovs_flow_attr - attributes for %OVS_FLOW_* commands.
+ * @OVS_FLOW_ATTR_KEY: Nested %OVS_KEY_ATTR_* attributes specifying the flow
+ * key.  Always present in notifications.  Required for all requests (except
+ * dumps).
+ * @OVS_FLOW_ATTR_ACTIONS: Nested %OVS_ACTION_ATTR_* attributes specifying
+ * the actions to take for packets that match the key.  Always present in
+ * notifications.  Required for %OVS_FLOW_CMD_NEW requests, optional for
+ * %OVS_FLOW_CMD_SET requests.
+ * @OVS_FLOW_ATTR_STATS: &struct ovs_flow_stats giving statistics for this
+ * flow.  Present in notifications if the stats would be nonzero.  Ignored in
+ * requests.
+ * @OVS_FLOW_ATTR_TCP_FLAGS: An 8-bit value giving the OR'd value of all of the
+ * TCP flags seen on packets in this flow.  Only present in notifications for
+ * TCP flows, and only if it would be nonzero.  Ignored in requests.
+ * @OVS_FLOW_ATTR_USED: A 64-bit integer giving the time, in milliseconds on
+ * the system monotonic clock, at which a packet was last processed for this
+ * flow.  Only present in notifications if a packet has been processed for this
+ * flow.  Ignored in requests.
+ * @OVS_FLOW_ATTR_CLEAR: If present in a %OVS_FLOW_CMD_SET request, clears the
+ * last-used time, accumulated TCP flags, and statistics for this flow.
+ * Otherwise ignored in requests.  Never present in notifications.
+ *
+ * These attributes follow the &struct ovs_header within the Generic Netlink
+ * payload for %OVS_FLOW_* commands.
+ */
+enum ovs_flow_attr {
+        OVS_FLOW_ATTR_UNSPEC,
+        OVS_FLOW_ATTR_KEY,       /* Sequence of OVS_KEY_ATTR_* attributes. */
+        OVS_FLOW_ATTR_ACTIONS,   /* Nested OVS_ACTION_ATTR_* attributes. */
+        OVS_FLOW_ATTR_STATS,     /* struct ovs_flow_stats. */
+        OVS_FLOW_ATTR_TCP_FLAGS, /* 8-bit OR'd TCP flags. */
+        OVS_FLOW_ATTR_USED,      /* u64 msecs last used in monotonic time. */
+        OVS_FLOW_ATTR_CLEAR,     /* Flag to clear stats, tcp_flags, used. */
+        __OVS_FLOW_ATTR_MAX
+};
+
+#define OVS_FLOW_ATTR_MAX (__OVS_FLOW_ATTR_MAX - 1)
+
+/**
+ * enum ovs_sample_attr - Attributes for %OVS_ACTION_ATTR_SAMPLE action.
+ * @OVS_SAMPLE_ATTR_PROBABILITY: 32-bit fraction of packets to sample with
+ * @OVS_ACTION_ATTR_SAMPLE.  A value of 0 samples no packets, a value of
+ * %UINT32_MAX samples all packets and intermediate values sample intermediate
+ * fractions of packets.
+ * @OVS_SAMPLE_ATTR_ACTIONS: Set of actions to execute in sampling event.
+ * Actions are passed as nested attributes.
+ *
+ * Executes the specified actions with the given probability on a per-packet
+ * basis.
+ */
+enum ovs_sample_attr {
+        OVS_SAMPLE_ATTR_UNSPEC,
+        OVS_SAMPLE_ATTR_PROBABILITY, /* u32 number */
+        OVS_SAMPLE_ATTR_ACTIONS,     /* Nested OVS_ACTION_ATTR_* attributes. */
+        __OVS_SAMPLE_ATTR_MAX,
+};
+
+#define OVS_SAMPLE_ATTR_MAX (__OVS_SAMPLE_ATTR_MAX - 1)
+
+/**
+ * enum ovs_userspace_attr - Attributes for %OVS_ACTION_ATTR_USERSPACE action.
+ * @OVS_USERSPACE_ATTR_PID: u32 Netlink PID to which the %OVS_PACKET_CMD_ACTION
+ * message should be sent.  Required.
+ * @OVS_USERSPACE_ATTR_USERDATA: If present, its variable-length argument is
+ * copied to the %OVS_PACKET_CMD_ACTION message as %OVS_PACKET_ATTR_USERDATA.
+ */
+enum ovs_userspace_attr {
+        OVS_USERSPACE_ATTR_UNSPEC,
+        OVS_USERSPACE_ATTR_PID,       /* u32 Netlink PID to receive upcalls. */
+        OVS_USERSPACE_ATTR_USERDATA,  /* Optional user-specified cookie. */
+        __OVS_USERSPACE_ATTR_MAX
+};
+
+#define OVS_USERSPACE_ATTR_MAX (__OVS_USERSPACE_ATTR_MAX - 1)
+
+/**
+ * struct ovs_action_push_vlan - %OVS_ACTION_ATTR_PUSH_VLAN action argument.
+ * @vlan_tpid: Tag protocol identifier (TPID) to push.
+ * @vlan_tci: Tag control identifier (TCI) to push.  The CFI bit must be set
+ * (but it will not be set in the 802.1Q header that is pushed).
+ *
+ * The @vlan_tpid value is typically %ETH_P_8021Q.  The only acceptable TPID
+ * values are those that the kernel module also parses as 802.1Q headers, to
+ * prevent %OVS_ACTION_ATTR_PUSH_VLAN followed by %OVS_ACTION_ATTR_POP_VLAN
+ * from having surprising results.
+ */
+struct ovs_action_push_vlan {
+        __be16 vlan_tpid;       /* 802.1Q TPID. */
+        __be16 vlan_tci;        /* 802.1Q TCI (VLAN ID and priority). */
+};
+
+/**
+ * enum ovs_action_attr - Action types.
+ *
+ * @OVS_ACTION_ATTR_OUTPUT: Output packet to port.
+ * @OVS_ACTION_ATTR_USERSPACE: Send packet to userspace according to nested
+ * %OVS_USERSPACE_ATTR_* attributes.
+ * @OVS_ACTION_ATTR_SET: Replaces the contents of an existing header.  The
+ * single nested %OVS_KEY_ATTR_* attribute specifies a header to modify and its
+ * value.
+ * @OVS_ACTION_ATTR_PUSH_VLAN: Push a new outermost 802.1Q header onto the
+ * packet.
+ * @OVS_ACTION_ATTR_POP_VLAN: Pop the outermost 802.1Q header off the packet.
+ * @OVS_ACTION_ATTR_SAMPLE: Probabilitically executes actions, as specified in
+ * the nested %OVS_SAMPLE_ATTR_* attributes.
+ *
+ * Only a single header can be set with a single %OVS_ACTION_ATTR_SET.  Not all
+ * fields within a header are modifiable, e.g. the IPv4 protocol and fragment
+ * type may not be changed.
+ */
+
+enum ovs_action_attr {
+        OVS_ACTION_ATTR_UNSPEC,
+        OVS_ACTION_ATTR_OUTPUT,       /* u32 port number. */
+        OVS_ACTION_ATTR_USERSPACE,    /* Nested OVS_USERSPACE_ATTR_*. */
+        OVS_ACTION_ATTR_SET,          /* One nested OVS_KEY_ATTR_*. */
+        OVS_ACTION_ATTR_PUSH_VLAN,    /* struct ovs_action_push_vlan. */
+        OVS_ACTION_ATTR_POP_VLAN,     /* No argument. */
+        OVS_ACTION_ATTR_SAMPLE,       /* Nested OVS_SAMPLE_ATTR_*. */
+        __OVS_ACTION_ATTR_MAX
+};
+
+#define OVS_ACTION_ATTR_MAX (__OVS_ACTION_ATTR_MAX - 1)
+
+#endif /* _LINUX_OPENVSWITCH_H */
diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h
index afafd703ad92..b2cc0cd9c4d9 100644
--- a/include/uapi/linux/packet_diag.h
+++ b/include/uapi/linux/packet_diag.h
@@ -16,6 +16,8 @@ struct packet_diag_req {
 #define PACKET_SHOW_MCLIST      0x00000002 /* A set of packet_diag_mclist-s */
 #define PACKET_SHOW_RING_CFG    0x00000004 /* Rings configuration parameters */
 #define PACKET_SHOW_FANOUT      0x00000008
+#define PACKET_SHOW_MEMINFO     0x00000010
+#define PACKET_SHOW_FILTER      0x00000020
 
 struct packet_diag_msg {
         __u8    pdiag_family;
@@ -32,6 +34,9 @@ enum {
         PACKET_DIAG_RX_RING,
         PACKET_DIAG_TX_RING,
         PACKET_DIAG_FANOUT,
+        PACKET_DIAG_UID,
+        PACKET_DIAG_MEMINFO,
+        PACKET_DIAG_FILTER,
 
         __PACKET_DIAG_MAX,
 };
diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h
index 32aef0a439ef..dbd71b0c7d8c 100644
--- a/include/uapi/linux/pkt_sched.h
+++ b/include/uapi/linux/pkt_sched.h
@@ -348,6 +348,7 @@ enum {
         TCA_HTB_INIT,
         TCA_HTB_CTAB,
         TCA_HTB_RTAB,
+        TCA_HTB_DIRECT_QLEN,
         __TCA_HTB_MAX,
 };
 
diff --git a/include/uapi/linux/rfkill.h b/include/uapi/linux/rfkill.h
index 2753c6cc9740..058757f7a733 100644
--- a/include/uapi/linux/rfkill.h
+++ b/include/uapi/linux/rfkill.h
@@ -37,6 +37,7 @@
  * @RFKILL_TYPE_WWAN: switch is on a wireless WAN device.
  * @RFKILL_TYPE_GPS: switch is on a GPS device.
  * @RFKILL_TYPE_FM: switch is on a FM radio device.
+ * @RFKILL_TYPE_NFC: switch is on an NFC device.
  * @NUM_RFKILL_TYPES: number of defined rfkill types
  */
 enum rfkill_type {
@@ -48,6 +49,7 @@ enum rfkill_type {
         RFKILL_TYPE_WWAN,
         RFKILL_TYPE_GPS,
         RFKILL_TYPE_FM,
+        RFKILL_TYPE_NFC,
         NUM_RFKILL_TYPES,
 };
 
diff --git a/include/net/sctp/user.h b/include/uapi/linux/sctp.h
index 9a0ae091366d..66b466e4ca08 100644
--- a/include/net/sctp/user.h
+++ b/include/uapi/linux/sctp.h
@@ -42,15 +42,17 @@
  *    Jon Grimm                <jgrimm@us.ibm.com>
  *    Daisy Chang              <daisyc@us.ibm.com>
  *    Ryan Layer               <rmlayer@us.ibm.com>
- *    Ardelle Fan              <ardelle.fan@intel.com>
+ *    Ardelle Fan              <ardelle.fan@intel.com>
  *    Sridhar Samudrala        <sri@us.ibm.com>
+ *    Inaky Perez-Gonzalez     <inaky.gonzalez@intel.com>
+ *    Vlad Yasevich            <vladislav.yasevich@hp.com>
  *
  * Any bugs reported given to us we will try to fix... any fixes shared will
  * be incorporated into the next SCTP release.
  */
 
-#ifndef __net_sctp_user_h__
-#define __net_sctp_user_h__
+#ifndef _UAPI_SCTP_H
+#define _UAPI_SCTP_H
 
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -165,17 +167,23 @@ enum sctp_sinfo_flags {
         SCTP_ADDR_OVER = 2,  /* Override the primary destination. */
         SCTP_ABORT=4,        /* Send an ABORT message to the peer. */
         SCTP_SACK_IMMEDIATELY = 8,      /* SACK should be sent without delay */
-        SCTP_EOF=MSG_FIN,    /* Initiate graceful shutdown process. */  
+        SCTP_EOF=MSG_FIN,    /* Initiate graceful shutdown process. */
 };
 
+typedef union {
+        __u8                    raw;
+        struct sctp_initmsg     init;
+        struct sctp_sndrcvinfo  sndrcv;
+} sctp_cmsg_data_t;
 
 /* These are cmsg_types.  */
 typedef enum sctp_cmsg_type {
         SCTP_INIT,              /* 5.2.1 SCTP Initiation Structure */
+#define SCTP_INIT       SCTP_INIT
         SCTP_SNDRCV,            /* 5.2.2 SCTP Header Information Structure */
+#define SCTP_SNDRCV     SCTP_SNDRCV
 } sctp_cmsg_t;
 
-
 /*
  * 5.3.1.1 SCTP_ASSOC_CHANGE
  *
@@ -345,6 +353,12 @@ struct sctp_pdapi_event {
 
 enum { SCTP_PARTIAL_DELIVERY_ABORTED=0, };
 
+/*
+ * 5.3.1.8.  SCTP_AUTHENTICATION_EVENT
+ *
+ *  When a receiver is using authentication this message will provide
+ *  notifications regarding new keys being made active as well as errors.
+ */
 struct sctp_authkey_event {
         __u16 auth_type;
         __u16 auth_flags;
@@ -421,15 +435,23 @@ union sctp_notification {
 enum sctp_sn_type {
         SCTP_SN_TYPE_BASE     = (1<<15),
         SCTP_ASSOC_CHANGE,
+#define SCTP_ASSOC_CHANGE               SCTP_ASSOC_CHANGE
         SCTP_PEER_ADDR_CHANGE,
+#define SCTP_PEER_ADDR_CHANGE           SCTP_PEER_ADDR_CHANGE
         SCTP_SEND_FAILED,
+#define SCTP_SEND_FAILED                SCTP_SEND_FAILED
         SCTP_REMOTE_ERROR,
+#define SCTP_REMOTE_ERROR               SCTP_REMOTE_ERROR
         SCTP_SHUTDOWN_EVENT,
+#define SCTP_SHUTDOWN_EVENT             SCTP_SHUTDOWN_EVENT
         SCTP_PARTIAL_DELIVERY_EVENT,
+#define SCTP_PARTIAL_DELIVERY_EVENT     SCTP_PARTIAL_DELIVERY_EVENT
         SCTP_ADAPTATION_INDICATION,
+#define SCTP_ADAPTATION_INDICATION      SCTP_ADAPTATION_INDICATION
         SCTP_AUTHENTICATION_EVENT,
 #define SCTP_AUTHENTICATION_INDICATION  SCTP_AUTHENTICATION_EVENT
         SCTP_SENDER_DRY_EVENT,
+#define SCTP_SENDER_DRY_EVENT           SCTP_SENDER_DRY_EVENT
 };
 
 /* Notification error codes used to fill up the error fields in some
@@ -454,7 +476,7 @@ typedef enum sctp_sn_error {
  *
  *   The protocol parameters used to initialize and bound retransmission
  *   timeout (RTO) are tunable.  See [SCTP] for more information on how
- *   these parameters are used in RTO calculation. 
+ *   these parameters are used in RTO calculation.
  */
 struct sctp_rtoinfo {
         sctp_assoc_t    srto_assoc_id;
@@ -504,6 +526,9 @@ struct sctp_prim {
         struct sockaddr_storage ssp_addr;
 } __attribute__((packed, aligned(4)));
 
+/* For backward compatibility use, define the old name too */
+#define sctp_setprim    sctp_prim
+
 /*
  * 7.1.11 Set Adaptation Layer Indicator (SCTP_ADAPTATION_LAYER)
  *
@@ -564,12 +589,27 @@ struct sctp_authchunk {
  *
  * This option gets or sets the list of HMAC algorithms that the local
  * endpoint requires the peer to use.
-*/
+ */
+#ifndef __KERNEL__
+/* This here is only used by user space as is. It might not be a good idea
+ * to export/reveal the whole structure with reserved fields etc.
+ */
+enum {
+        SCTP_AUTH_HMAC_ID_SHA1 = 1,
+        SCTP_AUTH_HMAC_ID_SHA256 = 3,
+};
+#endif
+
 struct sctp_hmacalgo {
         __u32           shmac_num_idents;
         __u16           shmac_idents[];
 };
 
+/* Sadly, user and kernel space have different names for
+ * this structure member, so this is to not break anything.
+ */
+#define shmac_number_of_idents  shmac_num_idents
+
 /*
  * 7.1.20.  Set a shared key (SCTP_AUTH_KEY)
  *
@@ -691,6 +731,24 @@ struct sctp_authchunks {
         uint8_t         gauth_chunks[];
 };
 
+/* The broken spelling has been released already in lksctp-tools header,
+ * so don't break anyone, now that it's fixed.
+ */
+#define guth_number_of_chunks   gauth_number_of_chunks
+
+/* Association states.  */
+enum sctp_sstat_state {
+        SCTP_EMPTY                = 0,
+        SCTP_CLOSED               = 1,
+        SCTP_COOKIE_WAIT          = 2,
+        SCTP_COOKIE_ECHOED        = 3,
+        SCTP_ESTABLISHED          = 4,
+        SCTP_SHUTDOWN_PENDING     = 5,
+        SCTP_SHUTDOWN_SENT        = 6,
+        SCTP_SHUTDOWN_RECEIVED    = 7,
+        SCTP_SHUTDOWN_ACK_SENT    = 8,
+};
+
 /*
  * 8.2.6. Get the Current Identifiers of Associations
  *        (SCTP_GET_ASSOC_ID_LIST)
@@ -705,15 +763,20 @@ struct sctp_assoc_ids {
 
 /*
  * 8.3, 8.5 get all peer/local addresses in an association.
- * This parameter struct is used by SCTP_GET_PEER_ADDRS and 
+ * This parameter struct is used by SCTP_GET_PEER_ADDRS and
  * SCTP_GET_LOCAL_ADDRS socket options used internally to implement
- * sctp_getpaddrs() and sctp_getladdrs() API. 
+ * sctp_getpaddrs() and sctp_getladdrs() API.
  */
 struct sctp_getaddrs_old {
         sctp_assoc_t            assoc_id;
         int                     addr_num;
+#ifdef __KERNEL__
         struct sockaddr         __user *addrs;
+#else
+        struct sockaddr         *addrs;
+#endif
 };
+
 struct sctp_getaddrs {
         sctp_assoc_t            assoc_id; /*input*/
         __u32                   addr_num; /*output*/
@@ -779,4 +842,5 @@ struct sctp_paddrthlds {
         __u16 spt_pathmaxrxt;
         __u16 spt_pathpfthld;
 };
-#endif /* __net_sctp_user_h__ */
+
+#endif /* _UAPI_SCTP_H */
diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index b49eab89c9fd..df2e8b4f9c03 100644
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -50,6 +50,7 @@ enum
         IPSTATS_MIB_OUTMCASTOCTETS,             /* OutMcastOctets */
         IPSTATS_MIB_INBCASTOCTETS,              /* InBcastOctets */
         IPSTATS_MIB_OUTBCASTOCTETS,             /* OutBcastOctets */
+        IPSTATS_MIB_CSUMERRORS,                 /* InCsumErrors */
         __IPSTATS_MIB_MAX
 };
 
@@ -87,6 +88,7 @@ enum
         ICMP_MIB_OUTTIMESTAMPREPS,              /* OutTimestampReps */
         ICMP_MIB_OUTADDRMASKS,                  /* OutAddrMasks */
         ICMP_MIB_OUTADDRMASKREPS,               /* OutAddrMaskReps */
+        ICMP_MIB_CSUMERRORS,                    /* InCsumErrors */
         __ICMP_MIB_MAX
 };
 
@@ -103,6 +105,7 @@ enum
         ICMP6_MIB_INERRORS,                     /* InErrors */
         ICMP6_MIB_OUTMSGS,                      /* OutMsgs */
         ICMP6_MIB_OUTERRORS,                    /* OutErrors */
+        ICMP6_MIB_CSUMERRORS,                   /* InCsumErrors */
         __ICMP6_MIB_MAX
 };
 
@@ -130,6 +133,7 @@ enum
         TCP_MIB_RETRANSSEGS,                    /* RetransSegs */
         TCP_MIB_INERRS,                         /* InErrs */
         TCP_MIB_OUTRSTS,                        /* OutRsts */
+        TCP_MIB_CSUMERRORS,                     /* InCsumErrors */
         __TCP_MIB_MAX
 };
 
@@ -147,6 +151,7 @@ enum
         UDP_MIB_OUTDATAGRAMS,                   /* OutDatagrams */
         UDP_MIB_RCVBUFERRORS,                   /* RcvbufErrors */
         UDP_MIB_SNDBUFERRORS,                   /* SndbufErrors */
+        UDP_MIB_CSUMERRORS,                     /* InCsumErrors */
         __UDP_MIB_MAX
 };
 
@@ -202,6 +207,8 @@ enum
         LINUX_MIB_TCPFORWARDRETRANS,            /* TCPForwardRetrans */
         LINUX_MIB_TCPSLOWSTARTRETRANS,          /* TCPSlowStartRetrans */
         LINUX_MIB_TCPTIMEOUTS,                  /* TCPTimeouts */
+        LINUX_MIB_TCPLOSSPROBES,                /* TCPLossProbes */
+        LINUX_MIB_TCPLOSSPROBERECOVERY,         /* TCPLossProbeRecovery */
         LINUX_MIB_TCPRENORECOVERYFAIL,          /* TCPRenoRecoveryFail */
         LINUX_MIB_TCPSACKRECOVERYFAIL,          /* TCPSackRecoveryFail */
         LINUX_MIB_TCPSCHEDULERFAILED,           /* TCPSchedulerFailed */
@@ -245,6 +252,7 @@ enum
         LINUX_MIB_TCPFASTOPENPASSIVEFAIL,       /* TCPFastOpenPassiveFail */
         LINUX_MIB_TCPFASTOPENLISTENOVERFLOW,    /* TCPFastOpenListenOverflow */
         LINUX_MIB_TCPFASTOPENCOOKIEREQD,        /* TCPFastOpenCookieReqd */
+        LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES, /* TCPSpuriousRtxHostQueues */
         __LINUX_MIB_MAX
 };
 
diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
index 6b1ead0b0c9d..8d776ebc4829 100644
--- a/include/uapi/linux/tcp.h
+++ b/include/uapi/linux/tcp.h
@@ -102,7 +102,6 @@ enum {
 #define TCP_QUICKACK            12      /* Block/reenable quick acks */
 #define TCP_CONGESTION          13      /* Congestion control algorithm */
 #define TCP_MD5SIG              14      /* TCP MD5 Signature (RFC2385) */
-#define TCP_COOKIE_TRANSACTIONS 15      /* TCP Cookie Transactions */
 #define TCP_THIN_LINEAR_TIMEOUTS 16      /* Use linear timeouts for thin streams*/
 #define TCP_THIN_DUPACK         17      /* Fast retrans. after 1 dupack */
 #define TCP_USER_TIMEOUT        18      /* How long for loss retry before timeout */
@@ -199,29 +198,4 @@ struct tcp_md5sig {
         __u8    tcpm_key[TCP_MD5SIG_MAXKEYLEN];         /* key (binary) */
 };
 
-/* for TCP_COOKIE_TRANSACTIONS (TCPCT) socket option */
-#define TCP_COOKIE_MIN           8              /*  64-bits */
-#define TCP_COOKIE_MAX          16              /* 128-bits */
-#define TCP_COOKIE_PAIR_SIZE    (2*TCP_COOKIE_MAX)
-
-/* Flags for both getsockopt and setsockopt */
-#define TCP_COOKIE_IN_ALWAYS    (1 << 0)        /* Discard SYN without cookie */
-#define TCP_COOKIE_OUT_NEVER    (1 << 1)        /* Prohibit outgoing cookies,
-                                                 * supercedes everything. */
-
-/* Flags for getsockopt */
-#define TCP_S_DATA_IN           (1 << 2)        /* Was data received? */
-#define TCP_S_DATA_OUT          (1 << 3)        /* Was data sent? */
-
-/* TCP_COOKIE_TRANSACTIONS data */
-struct tcp_cookie_transactions {
-        __u16   tcpct_flags;                    /* see above */
-        __u8    __tcpct_pad1;                   /* zero */
-        __u8    tcpct_cookie_desired;           /* bytes */
-        __u16   tcpct_s_data_desired;           /* bytes of variable data */
-        __u16   tcpct_used;                     /* bytes in value */
-        __u8    tcpct_value[TCP_MSS_DEFAULT];
-};
-
-
 #endif /* _UAPI_LINUX_TCP_H */
diff --git a/include/uapi/linux/vm_sockets.h b/include/uapi/linux/vm_sockets.h
index df91301847ec..b4ed5d895699 100644
--- a/include/uapi/linux/vm_sockets.h
+++ b/include/uapi/linux/vm_sockets.h
@@ -13,12 +13,10 @@
  * more details.
  */
 
-#ifndef _VM_SOCKETS_H_
-#define _VM_SOCKETS_H_
+#ifndef _UAPI_VM_SOCKETS_H
+#define _UAPI_VM_SOCKETS_H
 
-#if !defined(__KERNEL__)
-#include <sys/socket.h>
-#endif
+#include <linux/socket.h>
 
 /* Option name for STREAM socket buffer size.  Use as the option name in
  * setsockopt(3) or getsockopt(3) to set or get an unsigned long long that
@@ -137,14 +135,13 @@
 #define VM_SOCKETS_VERSION_MINOR(_v) (((_v) & 0x0000FFFF))
 
 /* Address structure for vSockets.   The address family should be set to
- * whatever vmci_sock_get_af_value_fd() returns.  The structure members should
- * all align on their natural boundaries without resorting to compiler packing
- * directives.  The total size of this structure should be exactly the same as
- * that of struct sockaddr.
+ * AF_VSOCK.  The structure members should all align on their natural
+ * boundaries without resorting to compiler packing directives.  The total size
+ * of this structure should be exactly the same as that of struct sockaddr.
  */
 
 struct sockaddr_vm {
-        sa_family_t svm_family;
+        __kernel_sa_family_t svm_family;
         unsigned short svm_reserved1;
         unsigned int svm_port;
         unsigned int svm_cid;
@@ -156,8 +153,4 @@ struct sockaddr_vm {
 
 #define IOCTL_VM_SOCKETS_GET_LOCAL_CID          _IO(7, 0xb9)
 
-#if defined(__KERNEL__)
-int vm_sockets_get_local_cid(void);
-#endif
-
-#endif
+#endif /* _UAPI_VM_SOCKETS_H */
diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
index 28e493b5b94c..a8cd6a4a2970 100644
--- a/include/uapi/linux/xfrm.h
+++ b/include/uapi/linux/xfrm.h
@@ -297,6 +297,7 @@ enum xfrm_attr_type_t {
         XFRMA_MARK,             /* struct xfrm_mark */
         XFRMA_TFCPAD,           /* __u32 */
         XFRMA_REPLAY_ESN_VAL,   /* struct xfrm_replay_esn */
+        XFRMA_SA_EXTRA_FLAGS,   /* __u32 */
         __XFRMA_MAX
 
 #define XFRMA_MAX (__XFRMA_MAX - 1)
@@ -367,6 +368,8 @@ struct xfrm_usersa_info {
 #define XFRM_STATE_ESN          128
 };
 
+#define XFRM_SA_XFLAG_DONT_ENCAP_DSCP   1
+
 struct xfrm_usersa_id {
         xfrm_address_t                  daddr;
         __be32                          spi;
diff --git a/include/xen/interface/io/netif.h b/include/xen/interface/io/netif.h
index 9dfc12000980..3ef3fe05ee99 100644
--- a/include/xen/interface/io/netif.h
+++ b/include/xen/interface/io/netif.h
@@ -13,6 +13,24 @@
 #include <xen/interface/grant_table.h>
 
 /*
+ * Older implementation of Xen network frontend / backend has an
+ * implicit dependency on the MAX_SKB_FRAGS as the maximum number of
+ * ring slots a skb can use. Netfront / netback may not work as
+ * expected when frontend and backend have different MAX_SKB_FRAGS.
+ *
+ * A better approach is to add mechanism for netfront / netback to
+ * negotiate this value. However we cannot fix all possible
+ * frontends, so we need to define a value which states the minimum
+ * slots backend must support.
+ *
+ * The minimum value derives from older Linux kernel's MAX_SKB_FRAGS
+ * (18), which is proved to work with most frontends. Any new backend
+ * which doesn't negotiate with frontend should expect frontend to
+ * send a valid packet using slots up to this value.
+ */
+#define XEN_NETIF_NR_SLOTS_MIN 18
+
+/*
  * Notifications after enqueuing any type of message should be conditional on
  * the appropriate req_event or rsp_event field in the shared ring.
  * If the client sends notification for rx requests then it should specify
@@ -47,6 +65,7 @@
 #define _XEN_NETTXF_extra_info          (3)
 #define  XEN_NETTXF_extra_info          (1U<<_XEN_NETTXF_extra_info)
 
+#define XEN_NETIF_MAX_TX_SIZE 0xFFFF
 struct xen_netif_tx_request {
     grant_ref_t gref;      /* Reference to buffer page */
     uint16_t offset;       /* Offset within buffer page */