49 files changed, 1216 insertions, 350 deletions

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index d13573bb879e..80456f72d70a 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -62,6 +62,9 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg);
 
 int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
                   const struct net_device *dev, int strict);
+int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
+                            const struct net_device *dev, int strict,
+                            u32 banned_flags);
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr);
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 58695ffeb138..e00455aab18c 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -273,7 +273,7 @@ struct l2cap_ctrl {
 
 struct hci_dev;
 
-typedef void (*hci_req_complete_t)(struct hci_dev *hdev, u8 status);
+typedef void (*hci_req_complete_t)(struct hci_dev *hdev, u8 status, u16 opcode);
 
 struct hci_req_ctrl {
         bool                    start;
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 40129b3838b2..8e54f825153c 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -102,6 +102,28 @@ enum {
          */
         HCI_QUIRK_FIXUP_BUFFER_SIZE,
 
+        /* When this quirk is set, then a controller that does not
+         * indicate support for Inquiry Result with RSSI is assumed to
+         * support it anyway. Some early Bluetooth 1.2 controllers had
+         * wrongly configured local features that will require forcing
+         * them to enable this mode. Getting RSSI information with the
+         * inquiry responses is preferred since it allows for a better
+         * user expierence.
+         *
+         * This quirk must be set before hci_register_dev is called.
+         */
+        HCI_QUIRK_FIXUP_INQUIRY_MODE,
+
+        /* When this quirk is set, then the HCI Read Local Supported
+         * Commands command is not supported. In general Bluetooth 1.2
+         * and later controllers should support this command. However
+         * some controllers indicate Bluetooth 1.2 support, but do
+         * not support this command.
+         *
+         * This quirk must be set before hci_register_dev is called.
+         */
+        HCI_QUIRK_BROKEN_LOCAL_COMMANDS,
+
         /* When this quirk is set, then no stored link key handling
          * is performed. This is mainly due to the fact that the
          * HCI Delete Stored Link Key command is advertised, but
@@ -162,8 +184,7 @@ enum {
  */
 enum {
         HCI_DUT_MODE,
-        HCI_FORCE_SC,
-        HCI_FORCE_LESC,
+        HCI_FORCE_BREDR_SMP,
         HCI_FORCE_STATIC_ADDR,
 };
 
@@ -343,6 +364,7 @@ enum {
 #define HCI_LE_ENCRYPTION               0x01
 #define HCI_LE_CONN_PARAM_REQ_PROC      0x02
 #define HCI_LE_PING                     0x10
+#define HCI_LE_DATA_LEN_EXT             0x20
 #define HCI_LE_EXT_SCAN_POLICY          0x80
 
 /* Connection modes */
@@ -833,11 +855,26 @@ struct hci_cp_set_event_flt {
 #define HCI_CONN_SETUP_AUTO_OFF 0x01
 #define HCI_CONN_SETUP_AUTO_ON  0x02
 
+#define HCI_OP_READ_STORED_LINK_KEY     0x0c0d
+struct hci_cp_read_stored_link_key {
+        bdaddr_t bdaddr;
+        __u8     read_all;
+} __packed;
+struct hci_rp_read_stored_link_key {
+        __u8     status;
+        __u8     max_keys;
+        __u8     num_keys;
+} __packed;
+
 #define HCI_OP_DELETE_STORED_LINK_KEY   0x0c12
 struct hci_cp_delete_stored_link_key {
         bdaddr_t bdaddr;
         __u8     delete_all;
 } __packed;
+struct hci_rp_delete_stored_link_key {
+        __u8     status;
+        __u8     num_keys;
+} __packed;
 
 #define HCI_MAX_NAME_LENGTH             248
 
@@ -1371,6 +1408,39 @@ struct hci_cp_le_conn_param_req_neg_reply {
         __u8    reason;
 } __packed;
 
+#define HCI_OP_LE_SET_DATA_LEN          0x2022
+struct hci_cp_le_set_data_len {
+        __le16  handle;
+        __le16  tx_len;
+        __le16  tx_time;
+} __packed;
+struct hci_rp_le_set_data_len {
+        __u8    status;
+        __le16  handle;
+} __packed;
+
+#define HCI_OP_LE_READ_DEF_DATA_LEN     0x2023
+struct hci_rp_le_read_def_data_len {
+        __u8    status;
+        __le16  tx_len;
+        __le16  tx_time;
+} __packed;
+
+#define HCI_OP_LE_WRITE_DEF_DATA_LEN    0x2024
+struct hci_cp_le_write_def_data_len {
+        __le16  tx_len;
+        __le16  tx_time;
+} __packed;
+
+#define HCI_OP_LE_READ_MAX_DATA_LEN     0x202f
+struct hci_rp_le_read_max_data_len {
+        __u8    status;
+        __le16  tx_len;
+        __le16  tx_time;
+        __le16  rx_len;
+        __le16  rx_time;
+} __packed;
+
 /* ---- HCI Events ---- */
 #define HCI_EV_INQUIRY_COMPLETE         0x01
 
@@ -1796,6 +1866,15 @@ struct hci_ev_le_remote_conn_param_req {
         __le16 timeout;
 } __packed;
 
+#define HCI_EV_LE_DATA_LEN_CHANGE       0x07
+struct hci_ev_le_data_len_change {
+        __le16  handle;
+        __le16  tx_len;
+        __le16  tx_time;
+        __le16  rx_len;
+        __le16  rx_time;
+} __packed;
+
 #define HCI_EV_LE_DIRECT_ADV_REPORT     0x0B
 struct hci_ev_le_direct_adv_info {
         __u8     evt_type;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 3c7827005c25..52863c3e0b13 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -79,6 +79,8 @@ struct discovery_state {
         s8                      rssi;
         u16                     uuid_count;
         u8                      (*uuids)[16];
+        unsigned long           scan_start;
+        unsigned long           scan_duration;
 };
 
 struct hci_conn_hash {
@@ -145,6 +147,7 @@ struct oob_data {
         struct list_head list;
         bdaddr_t bdaddr;
         u8 bdaddr_type;
+        u8 present;
         u8 hash192[16];
         u8 rand192[16];
         u8 hash256[16];
@@ -205,6 +208,8 @@ struct hci_dev {
         __u16           lmp_subver;
         __u16           voice_setting;
         __u8            num_iac;
+        __u8            stored_max_keys;
+        __u8            stored_num_keys;
         __u8            io_capability;
         __s8            inq_tx_power;
         __u16           page_scan_interval;
@@ -220,10 +225,17 @@ struct hci_dev {
         __u16           le_conn_max_interval;
         __u16           le_conn_latency;
         __u16           le_supv_timeout;
+        __u16           le_def_tx_len;
+        __u16           le_def_tx_time;
+        __u16           le_max_tx_len;
+        __u16           le_max_tx_time;
+        __u16           le_max_rx_len;
+        __u16           le_max_rx_time;
         __u16           discov_interleaved_timeout;
         __u16           conn_info_min_age;
         __u16           conn_info_max_age;
         __u8            ssp_debug_mode;
+        __u8            hw_error_code;
         __u32           clock;
 
         __u16           devid_source;
@@ -285,6 +297,7 @@ struct hci_dev {
 
         struct work_struct      power_on;
         struct delayed_work     power_off;
+        struct work_struct      error_reset;
 
         __u16                   discov_timeout;
         struct delayed_work     discov_off;
@@ -343,6 +356,7 @@ struct hci_dev {
         unsigned long           dev_flags;
 
         struct delayed_work     le_scan_disable;
+        struct delayed_work     le_scan_restart;
 
         __s8                    adv_tx_power;
         __u8                    adv_data[HCI_MAX_AD_LENGTH];
@@ -361,6 +375,7 @@ struct hci_dev {
         int (*setup)(struct hci_dev *hdev);
         int (*send)(struct hci_dev *hdev, struct sk_buff *skb);
         void (*notify)(struct hci_dev *hdev, unsigned int evt);
+        void (*hw_error)(struct hci_dev *hdev, u8 code);
         int (*set_bdaddr)(struct hci_dev *hdev, const bdaddr_t *bdaddr);
 };
 
@@ -434,6 +449,7 @@ struct hci_conn {
         struct delayed_work le_conn_timeout;
 
         struct device   dev;
+        struct dentry   *debugfs;
 
         struct hci_dev  *hdev;
         void            *l2cap_data;
@@ -518,6 +534,8 @@ static inline void hci_discovery_filter_clear(struct hci_dev *hdev)
         hdev->discovery.uuid_count = 0;
         kfree(hdev->discovery.uuids);
         hdev->discovery.uuids = NULL;
+        hdev->discovery.scan_start = 0;
+        hdev->discovery.scan_duration = 0;
 }
 
 bool hci_discovery_active(struct hci_dev *hdev);
@@ -772,7 +790,6 @@ int hci_conn_check_link_mode(struct hci_conn *conn);
 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
                       bool initiator);
-int hci_conn_change_link_key(struct hci_conn *conn);
 int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 
 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
@@ -920,8 +937,6 @@ struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
                                                bdaddr_t *addr, u8 addr_type);
 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
                                             bdaddr_t *addr, u8 addr_type);
-int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type,
-                        u8 auto_connect);
 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type);
 void hci_conn_params_clear_all(struct hci_dev *hdev);
 void hci_conn_params_clear_disabled(struct hci_dev *hdev);
@@ -930,8 +945,6 @@ struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
                                                   bdaddr_t *addr,
                                                   u8 addr_type);
 
-void hci_update_background_scan(struct hci_dev *hdev);
-
 void hci_uuids_clear(struct hci_dev *hdev);
 
 void hci_link_keys_clear(struct hci_dev *hdev);
@@ -1014,8 +1027,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 
 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
-#define bredr_sc_enabled(dev) ((lmp_sc_capable(dev) || \
-                                test_bit(HCI_FORCE_SC, &(dev)->dbg_flags)) && \
+#define bredr_sc_enabled(dev) (lmp_sc_capable(dev) && \
                                test_bit(HCI_SC_ENABLED, &(dev)->dev_flags))
 
 /* ----- HCI protocols ----- */
@@ -1284,30 +1296,8 @@ static inline int hci_check_conn_params(u16 min, u16 max, u16 latency,
 int hci_register_cb(struct hci_cb *hcb);
 int hci_unregister_cb(struct hci_cb *hcb);
 
-struct hci_request {
-        struct hci_dev          *hdev;
-        struct sk_buff_head     cmd_q;
-
-        /* If something goes wrong when building the HCI request, the error
-         * value is stored in this field.
-         */
-        int                     err;
-};
-
-void hci_req_init(struct hci_request *req, struct hci_dev *hdev);
-int hci_req_run(struct hci_request *req, hci_req_complete_t complete);
-void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
-                 const void *param);
-void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
-                    const void *param, u8 event);
-void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status);
 bool hci_req_pending(struct hci_dev *hdev);
 
-void hci_req_add_le_scan_disable(struct hci_request *req);
-void hci_req_add_le_passive_scan(struct hci_request *req);
-
-void hci_update_page_scan(struct hci_dev *hdev, struct hci_request *req);
-
 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
                                const void *param, u32 timeout);
 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
@@ -1344,6 +1334,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event);
 #define DISCOV_INTERLEAVED_TIMEOUT      5120    /* msec */
 #define DISCOV_INTERLEAVED_INQUIRY_LEN  0x04
 #define DISCOV_BREDR_INQUIRY_LEN        0x08
+#define DISCOV_LE_RESTART_DELAY         msecs_to_jiffies(200)   /* msec */
 
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
 int mgmt_new_settings(struct hci_dev *hdev);
@@ -1388,7 +1379,6 @@ int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
 void mgmt_auth_failed(struct hci_conn *conn, u8 status);
 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status);
 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
-void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
                                     u8 status);
 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status);
@@ -1417,8 +1407,6 @@ u8 hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
                                                         __u8 ltk[16]);
 
-int hci_update_random_address(struct hci_request *req, bool require_privacy,
-                              u8 *own_addr_type);
 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                u8 *bdaddr_type);
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index d1bb342d083f..2239a3753092 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -248,6 +248,7 @@ struct l2cap_conn_rsp {
 #define L2CAP_PSM_SDP           0x0001
 #define L2CAP_PSM_RFCOMM        0x0003
 #define L2CAP_PSM_3DSP          0x0021
+#define L2CAP_PSM_IPSP          0x0023 /* 6LoWPAN */
 
 /* channel identifier */
 #define L2CAP_CID_SIGNALING     0x0001
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 95c34d5180fa..e218a30f2061 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -301,10 +301,6 @@ struct mgmt_cp_user_passkey_neg_reply {
 #define MGMT_OP_READ_LOCAL_OOB_DATA     0x0020
 #define MGMT_READ_LOCAL_OOB_DATA_SIZE   0
 struct mgmt_rp_read_local_oob_data {
-        __u8    hash[16];
-        __u8    rand[16];
-} __packed;
-struct mgmt_rp_read_local_oob_ext_data {
         __u8    hash192[16];
         __u8    rand192[16];
         __u8    hash256[16];
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 578b83127af1..4190af53a46a 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -24,8 +24,6 @@
 #ifndef __RFCOMM_H
 #define __RFCOMM_H
 
-#define RFCOMM_PSM 3
-
 #define RFCOMM_CONN_TIMEOUT (HZ * 30)
 #define RFCOMM_DISC_TIMEOUT (HZ * 20)
 #define RFCOMM_AUTH_TIMEOUT (HZ * 25)
diff --git a/include/net/bond_3ad.h b/include/net/bond_3ad.h
index e01d903633ef..f04cdbb7848e 100644
--- a/include/net/bond_3ad.h
+++ b/include/net/bond_3ad.h
@@ -274,7 +274,6 @@ void bond_3ad_handle_link_change(struct slave *slave, char link);
 int  bond_3ad_get_active_agg_info(struct bonding *bond, struct ad_info *ad_info);
 int  __bond_3ad_get_active_agg_info(struct bonding *bond,
                                     struct ad_info *ad_info);
-int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev);
 int bond_3ad_lacpdu_recv(const struct sk_buff *skb, struct bonding *bond,
                          struct slave *slave);
 int bond_3ad_set_carrier(struct bonding *bond);
diff --git a/include/net/bonding.h b/include/net/bonding.h
index 983a94b86b95..fda6feeb6c1f 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -150,6 +150,12 @@ struct bond_parm_tbl {
         int mode;
 };
 
+struct netdev_notify_work {
+        struct delayed_work     work;
+        struct net_device       *dev;
+        struct netdev_bonding_info bonding_info;
+};
+
 struct slave {
         struct net_device *dev; /* first - useful for panic debug */
         struct bonding *bond; /* our master */
@@ -243,6 +249,8 @@ struct bonding {
 #define bond_slave_get_rtnl(dev) \
         ((struct slave *) rtnl_dereference(dev->rx_handler_data))
 
+void bond_queue_slave_event(struct slave *slave);
+
 struct bond_vlan_tag {
         __be16          vlan_proto;
         unsigned short  vlan_id;
@@ -315,6 +323,7 @@ static inline void bond_set_active_slave(struct slave *slave)
 {
         if (slave->backup) {
                 slave->backup = 0;
+                bond_queue_slave_event(slave);
                 rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
         }
 }
@@ -323,6 +332,7 @@ static inline void bond_set_backup_slave(struct slave *slave)
 {
         if (!slave->backup) {
                 slave->backup = 1;
+                bond_queue_slave_event(slave);
                 rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
         }
 }
@@ -336,6 +346,7 @@ static inline void bond_set_slave_state(struct slave *slave,
         slave->backup = slave_state;
         if (notify) {
                 rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_ATOMIC);
+                bond_queue_slave_event(slave);
                 slave->should_notify = 0;
         } else {
                 if (slave->should_notify)
@@ -490,6 +501,12 @@ static inline bool bond_is_slave_inactive(struct slave *slave)
         return slave->inactive;
 }
 
+static inline void bond_set_slave_link_state(struct slave *slave, int state)
+{
+        slave->link = state;
+        bond_queue_slave_event(slave);
+}
+
 static inline __be32 bond_confirm_addr(struct net_device *dev, __be32 dst, __be32 local)
 {
         struct in_device *in_dev;
@@ -525,6 +542,7 @@ void bond_sysfs_slave_del(struct slave *slave);
 int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev);
 int bond_release(struct net_device *bond_dev, struct net_device *slave_dev);
 u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb);
+int bond_set_carrier(struct bonding *bond);
 void bond_select_active_slave(struct bonding *bond);
 void bond_change_active_slave(struct bonding *bond, struct slave *new_active);
 void bond_create_debugfs(void);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 4ebb816241fa..64e09e1e8099 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -520,37 +520,41 @@ ieee80211_chandef_max_power(struct cfg80211_chan_def *chandef)
  *
  * @SURVEY_INFO_NOISE_DBM: noise (in dBm) was filled in
  * @SURVEY_INFO_IN_USE: channel is currently being used
- * @SURVEY_INFO_CHANNEL_TIME: channel active time (in ms) was filled in
- * @SURVEY_INFO_CHANNEL_TIME_BUSY: channel busy time was filled in
- * @SURVEY_INFO_CHANNEL_TIME_EXT_BUSY: extension channel busy time was filled in
- * @SURVEY_INFO_CHANNEL_TIME_RX: channel receive time was filled in
- * @SURVEY_INFO_CHANNEL_TIME_TX: channel transmit time was filled in
+ * @SURVEY_INFO_TIME: active time (in ms) was filled in
+ * @SURVEY_INFO_TIME_BUSY: busy time was filled in
+ * @SURVEY_INFO_TIME_EXT_BUSY: extension channel busy time was filled in
+ * @SURVEY_INFO_TIME_RX: receive time was filled in
+ * @SURVEY_INFO_TIME_TX: transmit time was filled in
+ * @SURVEY_INFO_TIME_SCAN: scan time was filled in
  *
  * Used by the driver to indicate which info in &struct survey_info
  * it has filled in during the get_survey().
  */
 enum survey_info_flags {
-        SURVEY_INFO_NOISE_DBM = 1<<0,
-        SURVEY_INFO_IN_USE = 1<<1,
-        SURVEY_INFO_CHANNEL_TIME = 1<<2,
-        SURVEY_INFO_CHANNEL_TIME_BUSY = 1<<3,
-        SURVEY_INFO_CHANNEL_TIME_EXT_BUSY = 1<<4,
-        SURVEY_INFO_CHANNEL_TIME_RX = 1<<5,
-        SURVEY_INFO_CHANNEL_TIME_TX = 1<<6,
+        SURVEY_INFO_NOISE_DBM           = BIT(0),
+        SURVEY_INFO_IN_USE              = BIT(1),
+        SURVEY_INFO_TIME                = BIT(2),
+        SURVEY_INFO_TIME_BUSY           = BIT(3),
+        SURVEY_INFO_TIME_EXT_BUSY       = BIT(4),
+        SURVEY_INFO_TIME_RX             = BIT(5),
+        SURVEY_INFO_TIME_TX             = BIT(6),
+        SURVEY_INFO_TIME_SCAN           = BIT(7),
 };
 
 /**
  * struct survey_info - channel survey response
  *
- * @channel: the channel this survey record reports, mandatory
+ * @channel: the channel this survey record reports, may be %NULL for a single
+ *      record to report global statistics
  * @filled: bitflag of flags from &enum survey_info_flags
  * @noise: channel noise in dBm. This and all following fields are
  *      optional
- * @channel_time: amount of time in ms the radio spent on the channel
- * @channel_time_busy: amount of time the primary channel was sensed busy
- * @channel_time_ext_busy: amount of time the extension channel was sensed busy
- * @channel_time_rx: amount of time the radio spent receiving data
- * @channel_time_tx: amount of time the radio spent transmitting data
+ * @time: amount of time in ms the radio was turn on (on the channel)
+ * @time_busy: amount of time the primary channel was sensed busy
+ * @time_ext_busy: amount of time the extension channel was sensed busy
+ * @time_rx: amount of time the radio spent receiving data
+ * @time_tx: amount of time the radio spent transmitting data
+ * @time_scan: amount of time the radio spent for scanning
  *
  * Used by dump_survey() to report back per-channel survey information.
  *
@@ -559,11 +563,12 @@ enum survey_info_flags {
  */
 struct survey_info {
         struct ieee80211_channel *channel;
-        u64 channel_time;
-        u64 channel_time_busy;
-        u64 channel_time_ext_busy;
-        u64 channel_time_rx;
-        u64 channel_time_tx;
+        u64 time;
+        u64 time_busy;
+        u64 time_ext_busy;
+        u64 time_rx;
+        u64 time_tx;
+        u64 time_scan;
         u32 filled;
         s8 noise;
 };
@@ -861,75 +866,6 @@ int cfg80211_check_station_change(struct wiphy *wiphy,
                                   enum cfg80211_station_type statype);
 
 /**
- * enum station_info_flags - station information flags
- *
- * Used by the driver to indicate which info in &struct station_info
- * it has filled in during get_station() or dump_station().
- *
- * @STATION_INFO_INACTIVE_TIME: @inactive_time filled
- * @STATION_INFO_RX_BYTES: @rx_bytes filled
- * @STATION_INFO_TX_BYTES: @tx_bytes filled
- * @STATION_INFO_RX_BYTES64: @rx_bytes filled with 64-bit value
- * @STATION_INFO_TX_BYTES64: @tx_bytes filled with 64-bit value
- * @STATION_INFO_LLID: @llid filled
- * @STATION_INFO_PLID: @plid filled
- * @STATION_INFO_PLINK_STATE: @plink_state filled
- * @STATION_INFO_SIGNAL: @signal filled
- * @STATION_INFO_TX_BITRATE: @txrate fields are filled
- *      (tx_bitrate, tx_bitrate_flags and tx_bitrate_mcs)
- * @STATION_INFO_RX_PACKETS: @rx_packets filled with 32-bit value
- * @STATION_INFO_TX_PACKETS: @tx_packets filled with 32-bit value
- * @STATION_INFO_TX_RETRIES: @tx_retries filled
- * @STATION_INFO_TX_FAILED: @tx_failed filled
- * @STATION_INFO_RX_DROP_MISC: @rx_dropped_misc filled
- * @STATION_INFO_SIGNAL_AVG: @signal_avg filled
- * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
- * @STATION_INFO_BSS_PARAM: @bss_param filled
- * @STATION_INFO_CONNECTED_TIME: @connected_time filled
- * @STATION_INFO_ASSOC_REQ_IES: @assoc_req_ies filled
- * @STATION_INFO_STA_FLAGS: @sta_flags filled
- * @STATION_INFO_BEACON_LOSS_COUNT: @beacon_loss_count filled
- * @STATION_INFO_T_OFFSET: @t_offset filled
- * @STATION_INFO_LOCAL_PM: @local_pm filled
- * @STATION_INFO_PEER_PM: @peer_pm filled
- * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
- * @STATION_INFO_CHAIN_SIGNAL: @chain_signal filled
- * @STATION_INFO_CHAIN_SIGNAL_AVG: @chain_signal_avg filled
- * @STATION_INFO_EXPECTED_THROUGHPUT: @expected_throughput filled
- */
-enum station_info_flags {
-        STATION_INFO_INACTIVE_TIME              = BIT(0),
-        STATION_INFO_RX_BYTES                   = BIT(1),
-        STATION_INFO_TX_BYTES                   = BIT(2),
-        STATION_INFO_LLID                       = BIT(3),
-        STATION_INFO_PLID                       = BIT(4),
-        STATION_INFO_PLINK_STATE                = BIT(5),
-        STATION_INFO_SIGNAL                     = BIT(6),
-        STATION_INFO_TX_BITRATE                 = BIT(7),
-        STATION_INFO_RX_PACKETS                 = BIT(8),
-        STATION_INFO_TX_PACKETS                 = BIT(9),
-        STATION_INFO_TX_RETRIES                 = BIT(10),
-        STATION_INFO_TX_FAILED                  = BIT(11),
-        STATION_INFO_RX_DROP_MISC               = BIT(12),
-        STATION_INFO_SIGNAL_AVG                 = BIT(13),
-        STATION_INFO_RX_BITRATE                 = BIT(14),
-        STATION_INFO_BSS_PARAM                  = BIT(15),
-        STATION_INFO_CONNECTED_TIME             = BIT(16),
-        STATION_INFO_ASSOC_REQ_IES              = BIT(17),
-        STATION_INFO_STA_FLAGS                  = BIT(18),
-        STATION_INFO_BEACON_LOSS_COUNT          = BIT(19),
-        STATION_INFO_T_OFFSET                   = BIT(20),
-        STATION_INFO_LOCAL_PM                   = BIT(21),
-        STATION_INFO_PEER_PM                    = BIT(22),
-        STATION_INFO_NONPEER_PM                 = BIT(23),
-        STATION_INFO_RX_BYTES64                 = BIT(24),
-        STATION_INFO_TX_BYTES64                 = BIT(25),
-        STATION_INFO_CHAIN_SIGNAL               = BIT(26),
-        STATION_INFO_CHAIN_SIGNAL_AVG           = BIT(27),
-        STATION_INFO_EXPECTED_THROUGHPUT        = BIT(28),
-};
-
-/**
  * enum station_info_rate_flags - bitrate info flags
  *
  * Used by the driver to indicate the specific rate transmission
@@ -937,22 +873,35 @@ enum station_info_flags {
  *
  * @RATE_INFO_FLAGS_MCS: mcs field filled with HT MCS
  * @RATE_INFO_FLAGS_VHT_MCS: mcs field filled with VHT MCS
- * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 MHz width transmission
- * @RATE_INFO_FLAGS_80_MHZ_WIDTH: 80 MHz width transmission
- * @RATE_INFO_FLAGS_80P80_MHZ_WIDTH: 80+80 MHz width transmission
- * @RATE_INFO_FLAGS_160_MHZ_WIDTH: 160 MHz width transmission
  * @RATE_INFO_FLAGS_SHORT_GI: 400ns guard interval
  * @RATE_INFO_FLAGS_60G: 60GHz MCS
  */
 enum rate_info_flags {
         RATE_INFO_FLAGS_MCS                     = BIT(0),
         RATE_INFO_FLAGS_VHT_MCS                 = BIT(1),
-        RATE_INFO_FLAGS_40_MHZ_WIDTH            = BIT(2),
-        RATE_INFO_FLAGS_80_MHZ_WIDTH            = BIT(3),
-        RATE_INFO_FLAGS_80P80_MHZ_WIDTH         = BIT(4),
-        RATE_INFO_FLAGS_160_MHZ_WIDTH           = BIT(5),
-        RATE_INFO_FLAGS_SHORT_GI                = BIT(6),
-        RATE_INFO_FLAGS_60G                     = BIT(7),
+        RATE_INFO_FLAGS_SHORT_GI                = BIT(2),
+        RATE_INFO_FLAGS_60G                     = BIT(3),
+};
+
+/**
+ * enum rate_info_bw - rate bandwidth information
+ *
+ * Used by the driver to indicate the rate bandwidth.
+ *
+ * @RATE_INFO_BW_5: 5 MHz bandwidth
+ * @RATE_INFO_BW_10: 10 MHz bandwidth
+ * @RATE_INFO_BW_20: 20 MHz bandwidth
+ * @RATE_INFO_BW_40: 40 MHz bandwidth
+ * @RATE_INFO_BW_80: 80 MHz bandwidth
+ * @RATE_INFO_BW_160: 160 MHz bandwidth
+ */
+enum rate_info_bw {
+        RATE_INFO_BW_5,
+        RATE_INFO_BW_10,
+        RATE_INFO_BW_20,
+        RATE_INFO_BW_40,
+        RATE_INFO_BW_80,
+        RATE_INFO_BW_160,
 };
 
 /**
@@ -964,12 +913,14 @@ enum rate_info_flags {
  * @mcs: mcs index if struct describes a 802.11n bitrate
  * @legacy: bitrate in 100kbit/s for 802.11abg
  * @nss: number of streams (VHT only)
+ * @bw: bandwidth (from &enum rate_info_bw)
  */
 struct rate_info {
         u8 flags;
         u8 mcs;
         u16 legacy;
         u8 nss;
+        u8 bw;
 };
 
 /**
@@ -1003,6 +954,24 @@ struct sta_bss_parameters {
         u16 beacon_interval;
 };
 
+/**
+ * struct cfg80211_tid_stats - per-TID statistics
+ * @filled: bitmap of flags using the bits of &enum nl80211_tid_stats to
+ *      indicate the relevant values in this struct are filled
+ * @rx_msdu: number of received MSDUs
+ * @tx_msdu: number of (attempted) transmitted MSDUs
+ * @tx_msdu_retries: number of retries (not counting the first) for
+ *      transmitted MSDUs
+ * @tx_msdu_failed: number of failed transmitted MSDUs
+ */
+struct cfg80211_tid_stats {
+        u32 filled;
+        u64 rx_msdu;
+        u64 tx_msdu;
+        u64 tx_msdu_retries;
+        u64 tx_msdu_failed;
+};
+
 #define IEEE80211_MAX_CHAINS    4
 
 /**
@@ -1010,11 +979,12 @@ struct sta_bss_parameters {
  *
  * Station information filled by driver for get_station() and dump_station.
  *
- * @filled: bitflag of flags from &enum station_info_flags
+ * @filled: bitflag of flags using the bits of &enum nl80211_sta_info to
+ *      indicate the relevant values in this struct for them
  * @connected_time: time(in secs) since a station is last connected
  * @inactive_time: time since last station activity (tx/rx) in milliseconds
- * @rx_bytes: bytes received from this station
- * @tx_bytes: bytes transmitted to this station
+ * @rx_bytes: bytes (size of MPDUs) received from this station
+ * @tx_bytes: bytes (size of MPDUs) transmitted to this station
  * @llid: mesh local link id
  * @plid: mesh peer link id
  * @plink_state: mesh peer link state
@@ -1027,10 +997,10 @@ struct sta_bss_parameters {
  * @chain_signal_avg: per-chain signal strength average in dBm
  * @txrate: current unicast bitrate from this station
  * @rxrate: current unicast bitrate to this station
- * @rx_packets: packets received from this station
- * @tx_packets: packets transmitted to this station
- * @tx_retries: cumulative retry counts
- * @tx_failed: number of failed transmissions (retries exceeded, no ACK)
+ * @rx_packets: packets (MSDUs & MMPDUs) received from this station
+ * @tx_packets: packets (MSDUs & MMPDUs) transmitted to this station
+ * @tx_retries: cumulative retry counts (MPDUs)
+ * @tx_failed: number of failed transmissions (MPDUs) (retries exceeded, no ACK)
  * @rx_dropped_misc:  Dropped for un-specified reason.
  * @bss_param: current BSS parameters
  * @generation: generation number for nl80211 dumps.
@@ -1050,6 +1020,11 @@ struct sta_bss_parameters {
  * @nonpeer_pm: non-peer mesh STA power save mode
  * @expected_throughput: expected throughput in kbps (including 802.11 headers)
  *      towards this station.
+ * @rx_beacon: number of beacons received from this peer
+ * @rx_beacon_signal_avg: signal strength average (in dBm) for beacons received
+ *      from this peer
+ * @pertid: per-TID statistics, see &struct cfg80211_tid_stats, using the last
+ *      (IEEE80211_NUM_TIDS) index for MSDUs not encapsulated in QoS-MPDUs.
  */
 struct station_info {
         u32 filled;
@@ -1090,10 +1065,9 @@ struct station_info {
 
         u32 expected_throughput;
 
-        /*
-         * Note: Add a new enum station_info_flags value for each new field and
-         * use it to check which fields are initialized.
-         */
+        u64 rx_beacon;
+        u8 rx_beacon_signal_avg;
+        struct cfg80211_tid_stats pertid[IEEE80211_NUM_TIDS + 1];
 };
 
 /**
@@ -1516,6 +1490,13 @@ struct cfg80211_match_set {
  * @mac_addr_mask: MAC address mask used with randomisation, bits that
  *      are 0 in the mask should be randomised, bits that are 1 should
  *      be taken from the @mac_addr
+ * @rcu_head: RCU callback used to free the struct
+ * @owner_nlportid: netlink portid of owner (if this should is a request
+ *      owned by a particular socket)
+ * @delay: delay in seconds to use before starting the first scan
+ *      cycle.  The driver may ignore this parameter and start
+ *      immediately (or at any other time), if this feature is not
+ *      supported.
  */
 struct cfg80211_sched_scan_request {
         struct cfg80211_ssid *ssids;
@@ -1529,6 +1510,7 @@ struct cfg80211_sched_scan_request {
         struct cfg80211_match_set *match_sets;
         int n_match_sets;
         s32 min_rssi_thold;
+        u32 delay;
 
         u8 mac_addr[ETH_ALEN] __aligned(2);
         u8 mac_addr_mask[ETH_ALEN] __aligned(2);
@@ -1537,6 +1519,8 @@ struct cfg80211_sched_scan_request {
         struct wiphy *wiphy;
         struct net_device *dev;
         unsigned long scan_start;
+        struct rcu_head rcu_head;
+        u32 owner_nlportid;
 
         /* keep last */
         struct ieee80211_channel *channels[0];
@@ -3011,6 +2995,8 @@ struct wiphy_vendor_command {
  * @regulatory_flags: wiphy regulatory flags, see
  *      &enum ieee80211_regulatory_flags
  * @features: features advertised to nl80211, see &enum nl80211_feature_flags.
+ * @ext_features: extended features advertised to nl80211, see
+ *      &enum nl80211_ext_feature_index.
  * @bss_priv_size: each BSS struct has private data allocated with it,
  *      this variable determines its size
  * @max_scan_ssids: maximum number of SSIDs the device can scan for in
@@ -3120,6 +3106,7 @@ struct wiphy {
         u16 max_acl_mac_addrs;
 
         u32 flags, regulatory_flags, features;
+        u8 ext_features[DIV_ROUND_UP(NUM_NL80211_EXT_FEATURES, 8)];
 
         u32 ap_sme_capa;
 
@@ -3808,6 +3795,34 @@ const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
 int regulatory_hint(struct wiphy *wiphy, const char *alpha2);
 
 /**
+ * regulatory_set_wiphy_regd - set regdom info for self managed drivers
+ * @wiphy: the wireless device we want to process the regulatory domain on
+ * @rd: the regulatory domain informatoin to use for this wiphy
+ *
+ * Set the regulatory domain information for self-managed wiphys, only they
+ * may use this function. See %REGULATORY_WIPHY_SELF_MANAGED for more
+ * information.
+ *
+ * Return: 0 on success. -EINVAL, -EPERM
+ */
+int regulatory_set_wiphy_regd(struct wiphy *wiphy,
+                              struct ieee80211_regdomain *rd);
+
+/**
+ * regulatory_set_wiphy_regd_sync_rtnl - set regdom for self-managed drivers
+ * @wiphy: the wireless device we want to process the regulatory domain on
+ * @rd: the regulatory domain information to use for this wiphy
+ *
+ * This functions requires the RTNL to be held and applies the new regdomain
+ * synchronously to this wiphy. For more details see
+ * regulatory_set_wiphy_regd().
+ *
+ * Return: 0 on success. -EINVAL, -EPERM
+ */
+int regulatory_set_wiphy_regd_sync_rtnl(struct wiphy *wiphy,
+                                        struct ieee80211_regdomain *rd);
+
+/**
  * wiphy_apply_custom_regulatory - apply a custom driver regulatory domain
  * @wiphy: the wireless device we want to process the regulatory domain on
  * @regd: the custom regulatory domain to use for this wiphy
@@ -4565,13 +4580,27 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
                       struct station_info *sinfo, gfp_t gfp);
 
 /**
+ * cfg80211_del_sta_sinfo - notify userspace about deletion of a station
+ * @dev: the netdev
+ * @mac_addr: the station's address
+ * @sinfo: the station information/statistics
+ * @gfp: allocation flags
+ */
+void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
+                            struct station_info *sinfo, gfp_t gfp);
+
+/**
  * cfg80211_del_sta - notify userspace about deletion of a station
  *
  * @dev: the netdev
  * @mac_addr: the station's address
  * @gfp: allocation flags
  */
-void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
+static inline void cfg80211_del_sta(struct net_device *dev,
+                                    const u8 *mac_addr, gfp_t gfp)
+{
+        cfg80211_del_sta_sinfo(dev, mac_addr, NULL, gfp);
+}
 
 /**
  * cfg80211_conn_failed - connection request failed notification
@@ -5033,6 +5062,42 @@ void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev,
  */
 void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy);
 
+/**
+ * wiphy_ext_feature_set - set the extended feature flag
+ *
+ * @wiphy: the wiphy to modify.
+ * @ftidx: extended feature bit index.
+ *
+ * The extended features are flagged in multiple bytes (see
+ * &struct wiphy.@ext_features)
+ */
+static inline void wiphy_ext_feature_set(struct wiphy *wiphy,
+                                         enum nl80211_ext_feature_index ftidx)
+{
+        u8 *ft_byte;
+
+        ft_byte = &wiphy->ext_features[ftidx / 8];
+        *ft_byte |= BIT(ftidx % 8);
+}
+
+/**
+ * wiphy_ext_feature_isset - check the extended feature flag
+ *
+ * @wiphy: the wiphy to modify.
+ * @ftidx: extended feature bit index.
+ *
+ * The extended features are flagged in multiple bytes (see
+ * &struct wiphy.@ext_features)
+ */
+static inline bool
+wiphy_ext_feature_isset(struct wiphy *wiphy,
+                        enum nl80211_ext_feature_index ftidx)
+{
+        u8 ft_byte;
+
+        ft_byte = wiphy->ext_features[ftidx / 8];
+        return (ft_byte & BIT(ftidx % 8)) != 0;
+}
 
 /* ethtool helper */
 void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info);
diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h
index 7f713acfa106..eeda67652766 100644
--- a/include/net/cfg802154.h
+++ b/include/net/cfg802154.h
@@ -25,6 +25,7 @@
 #include <net/nl802154.h>
 
 struct wpan_phy;
+struct wpan_phy_cca;
 
 struct cfg802154_ops {
         struct net_device * (*add_virtual_intf_deprecated)(struct wpan_phy *wpan_phy,
@@ -39,6 +40,8 @@ struct cfg802154_ops {
         int     (*del_virtual_intf)(struct wpan_phy *wpan_phy,
                                     struct wpan_dev *wpan_dev);
         int     (*set_channel)(struct wpan_phy *wpan_phy, u8 page, u8 channel);
+        int     (*set_cca_mode)(struct wpan_phy *wpan_phy,
+                                const struct wpan_phy_cca *cca);
         int     (*set_pan_id)(struct wpan_phy *wpan_phy,
                               struct wpan_dev *wpan_dev, __le16 pan_id);
         int     (*set_short_addr)(struct wpan_phy *wpan_phy,
@@ -56,6 +59,11 @@ struct cfg802154_ops {
                                 struct wpan_dev *wpan_dev, bool mode);
 };
 
+struct wpan_phy_cca {
+        enum nl802154_cca_modes mode;
+        enum nl802154_cca_opts opt;
+};
+
 struct wpan_phy {
         struct mutex pib_lock;
 
@@ -76,7 +84,7 @@ struct wpan_phy {
         u8 current_page;
         u32 channels_supported[IEEE802154_MAX_PAGE + 1];
         s8 transmit_power;
-        u8 cca_mode;
+        struct wpan_phy_cca cca;
 
         __le64 perm_extended_addr;
 
diff --git a/include/net/checksum.h b/include/net/checksum.h
index e339a9513e29..0a55ac715077 100644
--- a/include/net/checksum.h
+++ b/include/net/checksum.h
@@ -167,4 +167,9 @@ static inline __wsum remcsum_adjust(void *ptr, __wsum csum,
         return delta;
 }
 
+static inline void remcsum_unadjust(__sum16 *psum, __wsum delta)
+{
+        *psum = csum_fold(csum_sub(delta, *psum));
+}
+
 #endif
diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
index a6fd939f202d..3ebb168b9afc 100644
--- a/include/net/cipso_ipv4.h
+++ b/include/net/cipso_ipv4.h
@@ -121,13 +121,6 @@ extern int cipso_v4_rbm_strictvalid;
 #endif
 
 /*
- * Helper Functions
- */
-
-#define CIPSO_V4_OPTEXIST(x) (IPCB(x)->opt.cipso != 0)
-#define CIPSO_V4_OPTPTR(x) (skb_network_header(x) + IPCB(x)->opt.cipso)
-
-/*
  * DOI List Functions
  */
 
@@ -190,7 +183,7 @@ static inline int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
 
 #ifdef CONFIG_NETLABEL
 void cipso_v4_cache_invalidate(void);
-int cipso_v4_cache_add(const struct sk_buff *skb,
+int cipso_v4_cache_add(const unsigned char *cipso_ptr,
                        const struct netlbl_lsm_secattr *secattr);
 #else
 static inline void cipso_v4_cache_invalidate(void)
@@ -198,7 +191,7 @@ static inline void cipso_v4_cache_invalidate(void)
         return;
 }
 
-static inline int cipso_v4_cache_add(const struct sk_buff *skb,
+static inline int cipso_v4_cache_add(const unsigned char *cipso_ptr,
                                      const struct netlbl_lsm_secattr *secattr)
 {
         return 0;
@@ -211,6 +204,8 @@ static inline int cipso_v4_cache_add(const struct sk_buff *skb,
 
 #ifdef CONFIG_NETLABEL
 void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);
+int cipso_v4_getattr(const unsigned char *cipso,
+                     struct netlbl_lsm_secattr *secattr);
 int cipso_v4_sock_setattr(struct sock *sk,
                           const struct cipso_v4_doi *doi_def,
                           const struct netlbl_lsm_secattr *secattr);
@@ -226,6 +221,7 @@ int cipso_v4_skbuff_setattr(struct sk_buff *skb,
 int cipso_v4_skbuff_delattr(struct sk_buff *skb);
 int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
                             struct netlbl_lsm_secattr *secattr);
+unsigned char *cipso_v4_optptr(const struct sk_buff *skb);
 int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option);
 #else
 static inline void cipso_v4_error(struct sk_buff *skb,
@@ -235,6 +231,12 @@ static inline void cipso_v4_error(struct sk_buff *skb,
         return;
 }
 
+static inline int cipso_v4_getattr(const unsigned char *cipso,
+                                   struct netlbl_lsm_secattr *secattr)
+{
+        return -ENOSYS;
+}
+
 static inline int cipso_v4_sock_setattr(struct sock *sk,
                                       const struct cipso_v4_doi *doi_def,
                                       const struct netlbl_lsm_secattr *secattr)
@@ -282,6 +284,11 @@ static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
         return -ENOSYS;
 }
 
+static inline unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+{
+        return NULL;
+}
+
 static inline int cipso_v4_validate(const struct sk_buff *skb,
                                     unsigned char **option)
 {
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 6c92415311ca..0574abd3db86 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -211,6 +211,23 @@ static inline struct nlmsghdr *genlmsg_nlhdr(void *user_hdr,
 }
 
 /**
+ * genlmsg_parse - parse attributes of a genetlink message
+ * @nlh: netlink message header
+ * @family: genetlink message family
+ * @tb: destination array with maxtype+1 elements
+ * @maxtype: maximum attribute type to be expected
+ * @policy: validation policy
+ * */
+static inline int genlmsg_parse(const struct nlmsghdr *nlh,
+                                const struct genl_family *family,
+                                struct nlattr *tb[], int maxtype,
+                                const struct nla_policy *policy)
+{
+        return nlmsg_parse(nlh, family->hdrsize + GENL_HDRLEN, tb, maxtype,
+                           policy);
+}
+
+/**
  * genl_dump_check_consistent - check if sequence is consistent and advertise if not
  * @cb: netlink callback structure that stores the sequence number
  * @user_hdr: user header as returned from genlmsg_put()
@@ -250,9 +267,9 @@ static inline void *genlmsg_put_reply(struct sk_buff *skb,
  * @skb: socket buffer the message is stored in
  * @hdr: user specific header
  */
-static inline int genlmsg_end(struct sk_buff *skb, void *hdr)
+static inline void genlmsg_end(struct sk_buff *skb, void *hdr)
 {
-        return nlmsg_end(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
+        nlmsg_end(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
 }
 
 /**
diff --git a/include/net/geneve.h b/include/net/geneve.h
index 112132cf8e2e..14fb8d3390b4 100644
--- a/include/net/geneve.h
+++ b/include/net/geneve.h
@@ -68,13 +68,12 @@ struct geneve_sock;
 typedef void (geneve_rcv_t)(struct geneve_sock *gs, struct sk_buff *skb);
 
 struct geneve_sock {
-        struct hlist_node       hlist;
+        struct list_head        list;
         geneve_rcv_t            *rcv;
         void                    *rcv_data;
-        struct work_struct      del_work;
         struct socket           *sock;
         struct rcu_head         rcu;
-        atomic_t                refcnt;
+        int                     refcnt;
         struct udp_offload      udp_offloads;
 };
 
@@ -91,7 +90,7 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
                     struct sk_buff *skb, __be32 src, __be32 dst, __u8 tos,
                     __u8 ttl, __be16 df, __be16 src_port, __be16 dst_port,
                     __be16 tun_flags, u8 vni[3], u8 opt_len, u8 *opt,
-                    bool xnet);
+                    bool csum, bool xnet);
 #endif /*ifdef CONFIG_INET */
 
 #endif /*ifdef__NET_GENEVE_H */
diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
index 734d9b5f577a..0f712c0bc0bf 100644
--- a/include/net/gro_cells.h
+++ b/include/net/gro_cells.h
@@ -8,25 +8,23 @@
 struct gro_cell {
         struct sk_buff_head     napi_skbs;
         struct napi_struct      napi;
-} ____cacheline_aligned_in_smp;
+};
 
 struct gro_cells {
-        unsigned int            gro_cells_mask;
-        struct gro_cell         *cells;
+        struct gro_cell __percpu        *cells;
 };
 
 static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *skb)
 {
-        struct gro_cell *cell = gcells->cells;
+        struct gro_cell *cell;
         struct net_device *dev = skb->dev;
 
-        if (!cell || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) {
+        if (!gcells->cells || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) {
                 netif_rx(skb);
                 return;
         }
 
-        if (skb_rx_queue_recorded(skb))
-                cell += skb_get_rx_queue(skb) & gcells->gro_cells_mask;
+        cell = this_cpu_ptr(gcells->cells);
 
         if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) {
                 atomic_long_inc(&dev->rx_dropped);
@@ -72,15 +70,12 @@ static inline int gro_cells_init(struct gro_cells *gcells, struct net_device *de
 {
         int i;
 
-        gcells->gro_cells_mask = roundup_pow_of_two(netif_get_num_default_rss_queues()) - 1;
-        gcells->cells = kcalloc(gcells->gro_cells_mask + 1,
-                                sizeof(struct gro_cell),
-                                GFP_KERNEL);
+        gcells->cells = alloc_percpu(struct gro_cell);
         if (!gcells->cells)
                 return -ENOMEM;
 
-        for (i = 0; i <= gcells->gro_cells_mask; i++) {
-                struct gro_cell *cell = gcells->cells + i;
+        for_each_possible_cpu(i) {
+                struct gro_cell *cell = per_cpu_ptr(gcells->cells, i);
 
                 skb_queue_head_init(&cell->napi_skbs);
                 netif_napi_add(dev, &cell->napi, gro_cell_poll, 64);
@@ -91,16 +86,16 @@ static inline int gro_cells_init(struct gro_cells *gcells, struct net_device *de
 
 static inline void gro_cells_destroy(struct gro_cells *gcells)
 {
-        struct gro_cell *cell = gcells->cells;
         int i;
 
-        if (!cell)
+        if (!gcells->cells)
                 return;
-        for (i = 0; i <= gcells->gro_cells_mask; i++,cell++) {
+        for_each_possible_cpu(i) {
+                struct gro_cell *cell = per_cpu_ptr(gcells->cells, i);
                 netif_napi_del(&cell->napi);
                 skb_queue_purge(&cell->napi_skbs);
         }
-        kfree(gcells->cells);
+        free_percpu(gcells->cells);
         gcells->cells = NULL;
 }
 
diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
index 83bb8a73d23c..94a297052442 100644
--- a/include/net/ieee802154_netdev.h
+++ b/include/net/ieee802154_netdev.h
@@ -28,6 +28,8 @@
 #include <linux/skbuff.h>
 #include <linux/ieee802154.h>
 
+#include <net/cfg802154.h>
+
 struct ieee802154_sechdr {
 #if defined(__LITTLE_ENDIAN_BITFIELD)
         u8 level:3,
@@ -337,7 +339,7 @@ struct ieee802154_mac_params {
         s8 frame_retries;
 
         bool lbt;
-        u8 cca_mode;
+        struct wpan_phy_cca cca;
         s32 cca_ed_level;
 };
 
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 848e85cb5c61..5976bdecf58b 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -98,7 +98,8 @@ struct inet_connection_sock {
         const struct tcp_congestion_ops *icsk_ca_ops;
         const struct inet_connection_sock_af_ops *icsk_af_ops;
         unsigned int              (*icsk_sync_mss)(struct sock *sk, u32 pmtu);
-        __u8                      icsk_ca_state;
+        __u8                      icsk_ca_state:7,
+                                  icsk_ca_dst_locked:1;
         __u8                      icsk_retransmits;
         __u8                      icsk_pending;
         __u8                      icsk_backoff;
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index a829b77523cf..eb16c7beed1e 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -16,7 +16,7 @@
 #ifndef _INET_SOCK_H
 #define _INET_SOCK_H
 
-
+#include <linux/bitops.h>
 #include <linux/kmemcheck.h>
 #include <linux/string.h>
 #include <linux/types.h>
@@ -184,6 +184,7 @@ struct inet_sock {
                                 mc_all:1,
                                 nodefrag:1;
         __u8                    rcv_tos;
+        __u8                    convert_csum;
         int                     uc_index;
         int                     mc_index;
         __be32                  mc_addr;
@@ -194,6 +195,16 @@ struct inet_sock {
 #define IPCORK_OPT      1       /* ip-options has been held in ipcork.opt */
 #define IPCORK_ALLFRAG  2       /* always fragment (for ipv6 for now) */
 
+/* cmsg flags for inet */
+#define IP_CMSG_PKTINFO         BIT(0)
+#define IP_CMSG_TTL             BIT(1)
+#define IP_CMSG_TOS             BIT(2)
+#define IP_CMSG_RECVOPTS        BIT(3)
+#define IP_CMSG_RETOPTS         BIT(4)
+#define IP_CMSG_PASSSEC         BIT(5)
+#define IP_CMSG_ORIGDSTADDR     BIT(6)
+#define IP_CMSG_CHECKSUM        BIT(7)
+
 static inline struct inet_sock *inet_sk(const struct sock *sk)
 {
         return (struct inet_sock *)sk;
@@ -250,4 +261,20 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
         return flags;
 }
 
+static inline void inet_inc_convert_csum(struct sock *sk)
+{
+        inet_sk(sk)->convert_csum++;
+}
+
+static inline void inet_dec_convert_csum(struct sock *sk)
+{
+        if (inet_sk(sk)->convert_csum > 0)
+                inet_sk(sk)->convert_csum--;
+}
+
+static inline bool inet_get_convert_csum(struct sock *sk)
+{
+        return !!inet_sk(sk)->convert_csum;
+}
+
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/ip.h b/include/net/ip.h
index 09cf5aebb283..025c61c0dffb 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -538,7 +538,7 @@ int ip_options_rcv_srr(struct sk_buff *skb);
  */
 
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb);
-void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb);
+void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, int offset);
 int ip_cmsg_send(struct net *net, struct msghdr *msg,
                  struct ipcm_cookie *ipc, bool allow_ipv6);
 int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
@@ -558,6 +558,11 @@ void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
 void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,
                     u32 info);
 
+static inline void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)
+{
+        ip_cmsg_recv_offset(msg, skb, 0);
+}
+
 bool icmp_global_allow(void);
 extern int sysctl_icmp_msgs_per_sec;
 extern int sysctl_icmp_msgs_burst;
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 8eea35d32a75..20e80fa7bbdd 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -74,6 +74,11 @@ struct fib6_node {
 #define FIB6_SUBTREE(fn)        ((fn)->subtree)
 #endif
 
+struct mx6_config {
+        const u32 *mx;
+        DECLARE_BITMAP(mx_valid, RTAX_MAX);
+};
+
 /*
  *      routing information
  *
@@ -291,9 +296,8 @@ struct fib6_node *fib6_locate(struct fib6_node *root,
 void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
                     void *arg);
 
-int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info,
-             struct nlattr *mx, int mx_len);
-
+int fib6_add(struct fib6_node *root, struct rt6_info *rt,
+             struct nl_info *info, struct mx6_config *mxc);
 int fib6_del(struct rt6_info *rt, struct nl_info *info);
 
 void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info);
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index 9326c41c2d7f..76c091b53dae 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -70,6 +70,7 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t, const struct in6_addr *laddr,
 __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw);
 __u32 ip6_tnl_get_cap(struct ip6_tnl *t, const struct in6_addr *laddr,
                              const struct in6_addr *raddr);
+struct net *ip6_tnl_get_link_net(const struct net_device *dev);
 
 static inline void ip6tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 09a819ee2151..5bd120e4bc0a 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -222,16 +222,19 @@ static inline struct fib_table *fib_new_table(struct net *net, u32 id)
 static inline int fib_lookup(struct net *net, const struct flowi4 *flp,
                              struct fib_result *res)
 {
-        struct fib_table *table;
+        int err = -ENETUNREACH;
+
+        rcu_read_lock();
+
+        if (!fib_table_lookup(fib_get_table(net, RT_TABLE_LOCAL), flp, res,
+                              FIB_LOOKUP_NOREF) ||
+            !fib_table_lookup(fib_get_table(net, RT_TABLE_MAIN), flp, res,
+                              FIB_LOOKUP_NOREF))
+                err = 0;
 
-        table = fib_get_table(net, RT_TABLE_LOCAL);
-        if (!fib_table_lookup(table, flp, res, FIB_LOOKUP_NOREF))
-                return 0;
+        rcu_read_unlock();
 
-        table = fib_get_table(net, RT_TABLE_MAIN);
-        if (!fib_table_lookup(table, flp, res, FIB_LOOKUP_NOREF))
-                return 0;
-        return -ENETUNREACH;
+        return err;
 }
 
 #else /* CONFIG_IP_MULTIPLE_TABLES */
@@ -247,20 +250,25 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp,
                              struct fib_result *res)
 {
         if (!net->ipv4.fib_has_custom_rules) {
+                int err = -ENETUNREACH;
+
+                rcu_read_lock();
+
                 res->tclassid = 0;
-                if (net->ipv4.fib_local &&
-                    !fib_table_lookup(net->ipv4.fib_local, flp, res,
-                                      FIB_LOOKUP_NOREF))
-                        return 0;
-                if (net->ipv4.fib_main &&
-                    !fib_table_lookup(net->ipv4.fib_main, flp, res,
-                                      FIB_LOOKUP_NOREF))
-                        return 0;
-                if (net->ipv4.fib_default &&
-                    !fib_table_lookup(net->ipv4.fib_default, flp, res,
-                                      FIB_LOOKUP_NOREF))
-                        return 0;
-                return -ENETUNREACH;
+                if ((net->ipv4.fib_local &&
+                     !fib_table_lookup(net->ipv4.fib_local, flp, res,
+                                       FIB_LOOKUP_NOREF)) ||
+                    (net->ipv4.fib_main &&
+                     !fib_table_lookup(net->ipv4.fib_main, flp, res,
+                                       FIB_LOOKUP_NOREF)) ||
+                    (net->ipv4.fib_default &&
+                     !fib_table_lookup(net->ipv4.fib_default, flp, res,
+                                       FIB_LOOKUP_NOREF)))
+                        err = 0;
+
+                rcu_read_unlock();
+
+                return err;
         }
         return __fib_lookup(net, flp, res);
 }
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 25a59eb388a6..2c47061a6954 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -97,7 +97,10 @@ struct ip_tunnel {
 #define TUNNEL_DONT_FRAGMENT    __cpu_to_be16(0x0100)
 #define TUNNEL_OAM              __cpu_to_be16(0x0200)
 #define TUNNEL_CRIT_OPT         __cpu_to_be16(0x0400)
-#define TUNNEL_OPTIONS_PRESENT  __cpu_to_be16(0x0800)
+#define TUNNEL_GENEVE_OPT       __cpu_to_be16(0x0800)
+#define TUNNEL_VXLAN_OPT        __cpu_to_be16(0x1000)
+
+#define TUNNEL_OPTIONS_PRESENT  (TUNNEL_GENEVE_OPT | TUNNEL_VXLAN_OPT)
 
 struct tnl_ptk_info {
         __be16 flags;
@@ -138,6 +141,7 @@ int ip_tunnel_encap_del_ops(const struct ip_tunnel_encap_ops *op,
 int ip_tunnel_init(struct net_device *dev);
 void ip_tunnel_uninit(struct net_device *dev);
 void  ip_tunnel_dellink(struct net_device *dev, struct list_head *head);
+struct net *ip_tunnel_get_link_net(const struct net_device *dev);
 int ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
                        struct rtnl_link_ops *ops, char *devname);
 
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 6e416f6d3e3c..4c9fe224d73b 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -671,8 +671,6 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
         return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
 }
 
-u32 __ipv6_select_ident(u32 hashrnd, struct in6_addr *dst,
-                        struct in6_addr *src);
 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
 void ipv6_proxy_select_ident(struct sk_buff *skb);
 
@@ -791,6 +789,25 @@ int ip6_push_pending_frames(struct sock *sk);
 
 void ip6_flush_pending_frames(struct sock *sk);
 
+int ip6_send_skb(struct sk_buff *skb);
+
+struct sk_buff *__ip6_make_skb(struct sock *sk, struct sk_buff_head *queue,
+                               struct inet_cork_full *cork,
+                               struct inet6_cork *v6_cork);
+struct sk_buff *ip6_make_skb(struct sock *sk,
+                             int getfrag(void *from, char *to, int offset,
+                                         int len, int odd, struct sk_buff *skb),
+                             void *from, int length, int transhdrlen,
+                             int hlimit, int tclass, struct ipv6_txoptions *opt,
+                             struct flowi6 *fl6, struct rt6_info *rt,
+                             unsigned int flags, int dontfrag);
+
+static inline struct sk_buff *ip6_finish_skb(struct sock *sk)
+{
+        return __ip6_make_skb(sk, &sk->sk_write_queue, &inet_sk(sk)->cork,
+                              &inet6_sk(sk)->cork);
+}
+
 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6);
 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
                                       const struct in6_addr *final_dst);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 29c7be8808d5..d52914b75331 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -376,6 +376,12 @@ enum ieee80211_rssi_event {
  * @ssid_len: Length of SSID given in @ssid.
  * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
  * @txpower: TX power in dBm
+ * @txpower_type: TX power adjustment used to control per packet Transmit
+ *      Power Control (TPC) in lower driver for the current vif. In particular
+ *      TPC is enabled if value passed in %txpower_type is
+ *      NL80211_TX_POWER_LIMITED (allow using less than specified from
+ *      userspace), whereas TPC is disabled if %txpower_type is set to
+ *      NL80211_TX_POWER_FIXED (use value configured from userspace)
  * @p2p_noa_attr: P2P NoA attribute for P2P powersave
  */
 struct ieee80211_bss_conf {
@@ -411,6 +417,7 @@ struct ieee80211_bss_conf {
         size_t ssid_len;
         bool hidden_ssid;
         int txpower;
+        enum nl80211_tx_power_setting txpower_type;
         struct ieee80211_p2p_noa_attr p2p_noa_attr;
 };
 
@@ -505,8 +512,11 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_DONTFRAG: Don't fragment this packet even if it
  *      would be fragmented by size (this is optional, only used for
  *      monitor injection).
- * @IEEE80211_TX_CTL_PS_RESPONSE: This frame is a response to a poll
- *      frame (PS-Poll or uAPSD).
+ * @IEEE80211_TX_STAT_NOACK_TRANSMITTED: A frame that was marked with
+ *      IEEE80211_TX_CTL_NO_ACK has been successfully transmitted without
+ *      any errors (like issues specific to the driver/HW).
+ *      This flag must not be set for frames that don't request no-ack
+ *      behaviour with IEEE80211_TX_CTL_NO_ACK.
  *
  * Note: If you have to add new flags to the enumeration, then don't
  *       forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
@@ -542,7 +552,7 @@ enum mac80211_tx_info_flags {
         IEEE80211_TX_STATUS_EOSP                = BIT(28),
         IEEE80211_TX_CTL_USE_MINRATE            = BIT(29),
         IEEE80211_TX_CTL_DONTFRAG               = BIT(30),
-        IEEE80211_TX_CTL_PS_RESPONSE            = BIT(31),
+        IEEE80211_TX_STAT_NOACK_TRANSMITTED     = BIT(31),
 };
 
 #define IEEE80211_TX_CTL_STBC_SHIFT             23
@@ -552,11 +562,14 @@ enum mac80211_tx_info_flags {
  *
  * @IEEE80211_TX_CTRL_PORT_CTRL_PROTO: this frame is a port control
  *      protocol frame (e.g. EAP)
+ * @IEEE80211_TX_CTRL_PS_RESPONSE: This frame is a response to a poll
+ *      frame (PS-Poll or uAPSD).
  *
  * These flags are used in tx_info->control.flags.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTRL_PORT_CTRL_PROTO       = BIT(0),
+        IEEE80211_TX_CTRL_PS_RESPONSE           = BIT(1),
 };
 
 /*
@@ -925,15 +938,13 @@ enum mac80211_rx_flags {
  * These flags are used with the @vht_flag member of
  *      &struct ieee80211_rx_status.
  * @RX_VHT_FLAG_80MHZ: 80 MHz was used
- * @RX_VHT_FLAG_80P80MHZ: 80+80 MHz was used
  * @RX_VHT_FLAG_160MHZ: 160 MHz was used
  * @RX_VHT_FLAG_BF: packet was beamformed
  */
 enum mac80211_rx_vht_flags {
         RX_VHT_FLAG_80MHZ               = BIT(0),
-        RX_VHT_FLAG_80P80MHZ            = BIT(1),
-        RX_VHT_FLAG_160MHZ              = BIT(2),
-        RX_VHT_FLAG_BF                  = BIT(3),
+        RX_VHT_FLAG_160MHZ              = BIT(1),
+        RX_VHT_FLAG_BF                  = BIT(2),
 };
 
 /**
@@ -1181,10 +1192,15 @@ struct ieee80211_channel_switch {
  *      monitoring on this virtual interface -- i.e. it can monitor
  *      connection quality related parameters, such as the RSSI level and
  *      provide notifications if configured trigger levels are reached.
+ * @IEEE80211_VIF_SUPPORTS_UAPSD: The device can do U-APSD for this
+ *      interface. This flag should be set during interface addition,
+ *      but may be set/cleared as late as authentication to an AP. It is
+ *      only valid for managed/station mode interfaces.
  */
 enum ieee80211_vif_flags {
         IEEE80211_VIF_BEACON_FILTER             = BIT(0),
         IEEE80211_VIF_SUPPORTS_CQM_RSSI         = BIT(1),
+        IEEE80211_VIF_SUPPORTS_UAPSD            = BIT(2),
 };
 
 /**
@@ -1270,19 +1286,22 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
  *
  * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
  *      driver to indicate that it requires IV generation for this
- *      particular key.
+ *      particular key. Setting this flag does not necessarily mean that SKBs
+ *      will have sufficient tailroom for ICV or MIC.
  * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
  *      the driver for a TKIP key if it requires Michael MIC
  *      generation in software.
  * @IEEE80211_KEY_FLAG_PAIRWISE: Set by mac80211, this flag indicates
  *      that the key is pairwise rather then a shared key.
  * @IEEE80211_KEY_FLAG_SW_MGMT_TX: This flag should be set by the driver for a
- *      CCMP key if it requires CCMP encryption of management frames (MFP) to
- *      be done in software.
+ *      CCMP/GCMP key if it requires CCMP/GCMP encryption of management frames
+ *      (MFP) to be done in software.
  * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
  *      if space should be prepared for the IV, but the IV
  *      itself should not be generated. Do not set together with
- *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
+ *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key. Setting this flag does
+ *      not necessarily mean that SKBs will have sufficient tailroom for ICV or
+ *      MIC.
  * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received
  *      management frames. The flag can help drivers that have a hardware
  *      crypto implementation that doesn't deal with management frames
@@ -1291,8 +1310,11 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
  *      RX, if your crypto engine can't deal with TX you can also set the
  *      %IEEE80211_KEY_FLAG_SW_MGMT_TX flag to encrypt such frames in SW.
  * @IEEE80211_KEY_FLAG_GENERATE_IV_MGMT: This flag should be set by the
- *      driver for a CCMP key to indicate that is requires IV generation
+ *      driver for a CCMP/GCMP key to indicate that is requires IV generation
  *      only for managment frames (MFP).
+ * @IEEE80211_KEY_FLAG_RESERVE_TAILROOM: This flag should be set by the
+ *      driver for a key to indicate that sufficient tailroom must always
+ *      be reserved for ICV or MIC, even when HW encryption is enabled.
  */
 enum ieee80211_key_flags {
         IEEE80211_KEY_FLAG_GENERATE_IV_MGMT     = BIT(0),
@@ -1302,6 +1324,7 @@ enum ieee80211_key_flags {
         IEEE80211_KEY_FLAG_SW_MGMT_TX           = BIT(4),
         IEEE80211_KEY_FLAG_PUT_IV_SPACE         = BIT(5),
         IEEE80211_KEY_FLAG_RX_MGMT              = BIT(6),
+        IEEE80211_KEY_FLAG_RESERVE_TAILROOM     = BIT(7),
 };
 
 /**
@@ -1580,11 +1603,6 @@ struct ieee80211_tx_control {
  * @IEEE80211_HW_MFP_CAPABLE:
  *      Hardware supports management frame protection (MFP, IEEE 802.11w).
  *
- * @IEEE80211_HW_SUPPORTS_UAPSD:
- *      Hardware supports Unscheduled Automatic Power Save Delivery
- *      (U-APSD) in managed mode. The mode is configured with
- *      conf_tx() operation.
- *
  * @IEEE80211_HW_REPORTS_TX_ACK_STATUS:
  *      Hardware can provide ack status reports of Tx frames to
  *      the stack.
@@ -1623,6 +1641,12 @@ struct ieee80211_tx_control {
  *      be created.  It is expected user-space will create vifs as
  *      desired (and thus have them named as desired).
  *
+ * @IEEE80211_HW_SW_CRYPTO_CONTROL: The driver wants to control which of the
+ *      crypto algorithms can be done in software - so don't automatically
+ *      try to fall back to it if hardware crypto fails, but do so only if
+ *      the driver returns 1. This also forces the driver to advertise its
+ *      supported cipher suites.
+ *
  * @IEEE80211_HW_QUEUE_CONTROL: The driver wants to control per-interface
  *      queue mapping in order to use different queues (not just one per AC)
  *      for different virtual interfaces. See the doc section on HW queue
@@ -1670,8 +1694,8 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_MFP_CAPABLE                        = 1<<13,
         IEEE80211_HW_WANT_MONITOR_VIF                   = 1<<14,
         IEEE80211_HW_NO_AUTO_VIF                        = 1<<15,
-        /* free slot */
-        IEEE80211_HW_SUPPORTS_UAPSD                     = 1<<17,
+        IEEE80211_HW_SW_CRYPTO_CONTROL                  = 1<<16,
+        /* free slots */
         IEEE80211_HW_REPORTS_TX_ACK_STATUS              = 1<<18,
         IEEE80211_HW_CONNECTION_MONITOR                 = 1<<19,
         IEEE80211_HW_QUEUE_CONTROL                      = 1<<20,
@@ -1945,6 +1969,11 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * added; if you return 0 then hw_key_idx must be assigned to the
  * hardware key index, you are free to use the full u8 range.
  *
+ * Note that in the case that the @IEEE80211_HW_SW_CRYPTO_CONTROL flag is
+ * set, mac80211 will not automatically fall back to software crypto if
+ * enabling hardware crypto failed. The set_key() call may also return the
+ * value 1 to permit this specific key/algorithm to be done in software.
+ *
  * When the cmd is %DISABLE_KEY then it must succeed.
  *
  * Note that it is permissible to not decrypt a frame even if a key
@@ -2023,7 +2052,7 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * enabled whenever user has enabled powersave.
  *
  * Driver informs U-APSD client support by enabling
- * %IEEE80211_HW_SUPPORTS_UAPSD flag. The mode is configured through the
+ * %IEEE80211_VIF_SUPPORTS_UAPSD flag. The mode is configured through the
  * uapsd parameter in conf_tx() operation. Hardware needs to send the QoS
  * Nullfunc frames and stay awake until the service period has ended. To
  * utilize U-APSD, dynamic powersave is disabled for voip AC and all frames
@@ -2696,6 +2725,14 @@ enum ieee80211_reconfig_type {
  *      is only used if the configured rate control algorithm actually uses
  *      the new rate table API, and is therefore optional. Must be atomic.
  *
+ * @sta_statistics: Get statistics for this station. For example with beacon
+ *      filtering, the statistics kept by mac80211 might not be accurate, so
+ *      let the driver pre-fill the statistics. The driver can fill most of
+ *      the values (indicating which by setting the filled bitmap), but not
+ *      all of them make sense - see the source for which ones are possible.
+ *      Statistics that the driver doesn't fill will be filled by mac80211.
+ *      The callback can sleep.
+ *
  * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
  *      bursting) for a hardware TX queue.
  *      Returns a negative error code on failure.
@@ -2856,9 +2893,6 @@ enum ieee80211_reconfig_type {
  * @get_et_strings:  Ethtool API to get a set of strings to describe stats
  *      and perhaps other supported types of ethtool data-sets.
  *
- * @get_rssi: Get current signal strength in dBm, the function is optional
- *      and can sleep.
- *
  * @mgd_prepare_tx: Prepare for transmitting a management frame for association
  *      before associated. In multi-channel scenarios, a virtual interface is
  *      bound to a channel before it is associated, but as it isn't associated
@@ -3059,6 +3093,10 @@ struct ieee80211_ops {
         void (*sta_rate_tbl_update)(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     struct ieee80211_sta *sta);
+        void (*sta_statistics)(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta,
+                               struct station_info *sinfo);
         int (*conf_tx)(struct ieee80211_hw *hw,
                        struct ieee80211_vif *vif, u16 ac,
                        const struct ieee80211_tx_queue_params *params);
@@ -3126,8 +3164,6 @@ struct ieee80211_ops {
         void    (*get_et_strings)(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif,
                                   u32 sset, u8 *data);
-        int     (*get_rssi)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-                            struct ieee80211_sta *sta, s8 *rssi_dbm);
 
         void    (*mgd_prepare_tx)(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif);
@@ -4062,6 +4098,10 @@ void ieee80211_aes_cmac_calculate_k1_k2(struct ieee80211_key_conf *keyconf,
  *      reverse order than in packet)
  * @aes_cmac: PN data, most significant byte first (big endian,
  *      reverse order than in packet)
+ * @aes_gmac: PN data, most significant byte first (big endian,
+ *      reverse order than in packet)
+ * @gcmp: PN data, most significant byte first (big endian,
+ *      reverse order than in packet)
  */
 struct ieee80211_key_seq {
         union {
@@ -4075,6 +4115,12 @@ struct ieee80211_key_seq {
                 struct {
                         u8 pn[6];
                 } aes_cmac;
+                struct {
+                        u8 pn[6];
+                } aes_gmac;
+                struct {
+                        u8 pn[6];
+                } gcmp;
         };
 };
 
@@ -4099,7 +4145,7 @@ void ieee80211_get_key_tx_seq(struct ieee80211_key_conf *keyconf,
  * ieee80211_get_key_rx_seq - get key RX sequence counter
  *
  * @keyconf: the parameter passed with the set key
- * @tid: The TID, or -1 for the management frame value (CCMP only);
+ * @tid: The TID, or -1 for the management frame value (CCMP/GCMP only);
  *      the value on TID 0 is also used for non-QoS frames. For
  *      CMAC, only TID 0 is valid.
  * @seq: buffer to receive the sequence data
@@ -4135,7 +4181,7 @@ void ieee80211_set_key_tx_seq(struct ieee80211_key_conf *keyconf,
  * ieee80211_set_key_rx_seq - set key RX sequence counter
  *
  * @keyconf: the parameter passed with the set key
- * @tid: The TID, or -1 for the management frame value (CCMP only);
+ * @tid: The TID, or -1 for the management frame value (CCMP/GCMP only);
  *      the value on TID 0 is also used for non-QoS frames. For
  *      CMAC, only TID 0 is valid.
  * @seq: new sequence data
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index c823d910b46c..850647811749 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -20,6 +20,8 @@
 #include <linux/ieee802154.h>
 #include <linux/skbuff.h>
 
+#include <net/cfg802154.h>
+
 /* General MAC frame format:
  *  2 bytes: Frame Control
  *  1 byte:  Sequence Number
@@ -212,7 +214,8 @@ struct ieee802154_ops {
                                             unsigned long changed);
         int             (*set_txpower)(struct ieee802154_hw *hw, int db);
         int             (*set_lbt)(struct ieee802154_hw *hw, bool on);
-        int             (*set_cca_mode)(struct ieee802154_hw *hw, u8 mode);
+        int             (*set_cca_mode)(struct ieee802154_hw *hw,
+                                        const struct wpan_phy_cca *cca);
         int             (*set_cca_ed_level)(struct ieee802154_hw *hw,
                                             s32 level);
         int             (*set_csma_params)(struct ieee802154_hw *hw,
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 2e8756b8c775..36faf4990c4b 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -60,6 +60,7 @@ struct net {
         struct list_head        exit_list;      /* Use only net_mutex */
 
         struct user_namespace   *user_ns;       /* Owning user namespace */
+        struct idr              netns_ids;
 
         struct ns_common        ns;
 
@@ -290,6 +291,9 @@ static inline struct net *read_pnet(struct net * const *pnet)
 #define __net_initconst __initconst
 #endif
 
+int peernet2id(struct net *net, struct net *peer);
+struct net *get_net_ns_by_id(struct net *net, int id);
+
 struct pernet_operations {
         struct list_head list;
         int (*init)(struct net *net);
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index f0daed2b54d1..74f271a172dd 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -191,8 +191,6 @@ __nf_conntrack_find(struct net *net, u16 zone,
 int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 bool nf_ct_delete(struct nf_conn *ct, u32 pid, int report);
 
-void nf_conntrack_flush_report(struct net *net, u32 portid, int report);
-
 bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
                        u_int16_t l3num, struct nf_conntrack_tuple *tuple);
 bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 64158353ecb2..e010ee8da41d 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -490,14 +490,10 @@ static inline struct sk_buff *nlmsg_new(size_t payload, gfp_t flags)
  * Corrects the netlink message header to include the appeneded
  * attributes. Only necessary if attributes have been added to
  * the message.
- *
- * Returns the total data length of the skb.
  */
-static inline int nlmsg_end(struct sk_buff *skb, struct nlmsghdr *nlh)
+static inline void nlmsg_end(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         nlh->nlmsg_len = skb_tail_pointer(skb) - (unsigned char *)nlh;
-
-        return skb->len;
 }
 
 /**
@@ -520,8 +516,10 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
  */
 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
 {
-        if (mark)
+        if (mark) {
+                WARN_ON((unsigned char *) mark < skb->data);
                 skb_trim(skb, (unsigned char *) mark - skb->data);
+        }
 }
 
 /**
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 0ffef1a38efc..dbe225478adb 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -48,7 +48,8 @@ struct netns_ipv4 {
         struct hlist_head       *fib_table_hash;
         struct sock             *fibnl;
 
-        struct sock             **icmp_sk;
+        struct sock  * __percpu *icmp_sk;
+
         struct inet_peer_base   *peers;
         struct tcpm_hash_bucket *tcp_metrics_hash;
         unsigned int            tcp_metrics_hash_log;
@@ -81,6 +82,8 @@ struct netns_ipv4 {
 
         int sysctl_fwmark_reflect;
         int sysctl_tcp_fwmark_accept;
+        int sysctl_tcp_mtu_probing;
+        int sysctl_tcp_base_mss;
 
         struct ping_group_range ping_group_range;
 
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 14bd0e1c47fa..ab672b537dd4 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -51,8 +51,10 @@ struct nfc_hci_ops {
         int (*tm_send)(struct nfc_hci_dev *hdev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_hci_dev *hdev,
                               struct nfc_target *target);
-        int (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
+        int (*event_received)(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
                               struct sk_buff *skb);
+        void (*cmd_received)(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+                            struct sk_buff *skb);
         int (*fw_download)(struct nfc_hci_dev *hdev, const char *firmware_name);
         int (*discover_se)(struct nfc_hci_dev *dev);
         int (*enable_se)(struct nfc_hci_dev *dev, u32 se_idx);
@@ -63,8 +65,10 @@ struct nfc_hci_ops {
 };
 
 /* Pipes */
-#define NFC_HCI_INVALID_PIPE    0x80
 #define NFC_HCI_DO_NOT_CREATE_PIPE      0x81
+#define NFC_HCI_INVALID_PIPE    0x80
+#define NFC_HCI_INVALID_GATE    0xFF
+#define NFC_HCI_INVALID_HOST    0x80
 #define NFC_HCI_LINK_MGMT_PIPE  0x00
 #define NFC_HCI_ADMIN_PIPE      0x01
 
@@ -73,7 +77,13 @@ struct nfc_hci_gate {
         u8 pipe;
 };
 
+struct nfc_hci_pipe {
+        u8 gate;
+        u8 dest_host;
+};
+
 #define NFC_HCI_MAX_CUSTOM_GATES        50
+#define NFC_HCI_MAX_PIPES               127
 struct nfc_hci_init_data {
         u8 gate_count;
         struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES];
@@ -125,6 +135,7 @@ struct nfc_hci_dev {
         void *clientdata;
 
         u8 gate2pipe[NFC_HCI_MAX_GATES];
+        struct nfc_hci_pipe pipes[NFC_HCI_MAX_PIPES];
 
         u8 sw_romlib;
         u8 sw_patch;
@@ -167,6 +178,8 @@ void *nfc_hci_get_clientdata(struct nfc_hci_dev *hdev);
 void nfc_hci_driver_failure(struct nfc_hci_dev *hdev, int err);
 
 int nfc_hci_result_to_errno(u8 result);
+void nfc_hci_reset_pipes(struct nfc_hci_dev *dev);
+void nfc_hci_reset_pipes_per_host(struct nfc_hci_dev *hdev, u8 host);
 
 /* Host IDs */
 #define NFC_HCI_HOST_CONTROLLER_ID      0x00
@@ -219,6 +232,12 @@ int nfc_hci_result_to_errno(u8 result);
 #define NFC_HCI_EVT_POST_DATA                   0x02
 #define NFC_HCI_EVT_HOT_PLUG                    0x03
 
+/* Generic commands */
+#define NFC_HCI_ANY_SET_PARAMETER       0x01
+#define NFC_HCI_ANY_GET_PARAMETER       0x02
+#define NFC_HCI_ANY_OPEN_PIPE           0x03
+#define NFC_HCI_ANY_CLOSE_PIPE          0x04
+
 /* Reader RF gates events */
 #define NFC_HCI_EVT_READER_REQUESTED    0x10
 #define NFC_HCI_EVT_END_OPERATION       0x11
@@ -249,8 +268,6 @@ int nfc_hci_send_cmd(struct nfc_hci_dev *hdev, u8 gate, u8 cmd,
 int nfc_hci_send_cmd_async(struct nfc_hci_dev *hdev, u8 gate, u8 cmd,
                            const u8 *param, size_t param_len,
                            data_exchange_cb_t cb, void *cb_context);
-int nfc_hci_send_response(struct nfc_hci_dev *hdev, u8 gate, u8 response,
-                          const u8 *param, size_t param_len);
 int nfc_hci_send_event(struct nfc_hci_dev *hdev, u8 gate, u8 event,
                        const u8 *param, size_t param_len);
 int nfc_hci_target_discovered(struct nfc_hci_dev *hdev, u8 gate);
diff --git a/include/net/nfc/nci.h b/include/net/nfc/nci.h
index e7257a4653b4..a2f2f3d3196d 100644
--- a/include/net/nfc/nci.h
+++ b/include/net/nfc/nci.h
@@ -62,6 +62,25 @@
 #define NCI_STATUS_NFCEE_PROTOCOL_ERROR                         0xc2
 #define NCI_STATUS_NFCEE_TIMEOUT_ERROR                          0xc3
 
+/* NFCEE Interface/Protocols */
+#define NCI_NFCEE_INTERFACE_APDU           0x00
+#define NCI_NFCEE_INTERFACE_HCI_ACCESS     0x01
+#define NCI_NFCEE_INTERFACE_TYPE3_CMD_SET  0x02
+#define NCI_NFCEE_INTERFACE_TRANSPARENT        0x03
+
+/* Destination type */
+#define NCI_DESTINATION_NFCC_LOOPBACK      0x01
+#define NCI_DESTINATION_REMOTE_NFC_ENDPOINT    0x02
+#define NCI_DESTINATION_NFCEE              0x03
+
+/* Destination-specific parameters type */
+#define NCI_DESTINATION_SPECIFIC_PARAM_RF_TYPE     0x00
+#define NCI_DESTINATION_SPECIFIC_PARAM_NFCEE_TYPE  0x01
+
+/* NFCEE Discovery Action */
+#define NCI_NFCEE_DISCOVERY_ACTION_DISABLE                      0x00
+#define NCI_NFCEE_DISCOVERY_ACTION_ENABLE                       0x01
+
 /* NCI RF Technology and Mode */
 #define NCI_NFC_A_PASSIVE_POLL_MODE                             0x00
 #define NCI_NFC_B_PASSIVE_POLL_MODE                             0x01
@@ -224,6 +243,28 @@ struct nci_core_set_config_cmd {
         struct  set_config_param param; /* support 1 param per cmd is enough */
 } __packed;
 
+#define NCI_OP_CORE_CONN_CREATE_CMD     nci_opcode_pack(NCI_GID_CORE, 0x04)
+#define DEST_SPEC_PARAMS_ID_INDEX       0
+#define DEST_SPEC_PARAMS_PROTOCOL_INDEX 1
+struct dest_spec_params {
+        __u8    id;
+        __u8    protocol;
+} __packed;
+
+struct core_conn_create_dest_spec_params {
+        __u8    type;
+        __u8    length;
+        __u8    value[0];
+} __packed;
+
+struct nci_core_conn_create_cmd {
+        __u8    destination_type;
+        __u8    number_destination_params;
+        struct core_conn_create_dest_spec_params params[0];
+} __packed;
+
+#define NCI_OP_CORE_CONN_CLOSE_CMD      nci_opcode_pack(NCI_GID_CORE, 0x05)
+
 #define NCI_OP_RF_DISCOVER_MAP_CMD      nci_opcode_pack(NCI_GID_RF_MGMT, 0x00)
 struct disc_map_config {
         __u8    rf_protocol;
@@ -260,6 +301,19 @@ struct nci_rf_deactivate_cmd {
         __u8    type;
 } __packed;
 
+#define NCI_OP_NFCEE_DISCOVER_CMD nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x00)
+struct nci_nfcee_discover_cmd {
+        __u8    discovery_action;
+} __packed;
+
+#define NCI_OP_NFCEE_MODE_SET_CMD nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x01)
+#define NCI_NFCEE_DISABLE       0x00
+#define NCI_NFCEE_ENABLE        0x01
+struct nci_nfcee_mode_set_cmd {
+        __u8    nfcee_id;
+        __u8    nfcee_mode;
+} __packed;
+
 /* ----------------------- */
 /* ---- NCI Responses ---- */
 /* ----------------------- */
@@ -295,6 +349,16 @@ struct nci_core_set_config_rsp {
         __u8    params_id[0];   /* variable size array */
 } __packed;
 
+#define NCI_OP_CORE_CONN_CREATE_RSP     nci_opcode_pack(NCI_GID_CORE, 0x04)
+struct nci_core_conn_create_rsp {
+        __u8    status;
+        __u8    max_ctrl_pkt_payload_len;
+        __u8    credits_cnt;
+        __u8    conn_id;
+} __packed;
+
+#define NCI_OP_CORE_CONN_CLOSE_RSP      nci_opcode_pack(NCI_GID_CORE, 0x05)
+
 #define NCI_OP_RF_DISCOVER_MAP_RSP      nci_opcode_pack(NCI_GID_RF_MGMT, 0x00)
 
 #define NCI_OP_RF_DISCOVER_RSP          nci_opcode_pack(NCI_GID_RF_MGMT, 0x03)
@@ -303,6 +367,13 @@ struct nci_core_set_config_rsp {
 
 #define NCI_OP_RF_DEACTIVATE_RSP        nci_opcode_pack(NCI_GID_RF_MGMT, 0x06)
 
+#define NCI_OP_NFCEE_DISCOVER_RSP nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x00)
+struct nci_nfcee_discover_rsp {
+        __u8    status;
+        __u8    num_nfcee;
+} __packed;
+
+#define NCI_OP_NFCEE_MODE_SET_RSP nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x01)
 /* --------------------------- */
 /* ---- NCI Notifications ---- */
 /* --------------------------- */
@@ -430,4 +501,30 @@ struct nci_rf_deactivate_ntf {
         __u8    reason;
 } __packed;
 
+#define NCI_OP_RF_NFCEE_ACTION_NTF      nci_opcode_pack(NCI_GID_RF_MGMT, 0x09)
+struct nci_rf_nfcee_action_ntf {
+        __u8 nfcee_id;
+        __u8 trigger;
+        __u8 supported_data_length;
+        __u8 supported_data[0];
+} __packed;
+
+#define NCI_OP_NFCEE_DISCOVER_NTF nci_opcode_pack(NCI_GID_NFCEE_MGMT, 0x00)
+struct nci_nfcee_supported_protocol {
+        __u8    num_protocol;
+        __u8    supported_protocol[0];
+} __packed;
+
+struct nci_nfcee_information_tlv {
+        __u8    num_tlv;
+        __u8    information_tlv[0];
+} __packed;
+
+struct nci_nfcee_discover_ntf {
+        __u8    nfcee_id;
+        __u8    nfcee_status;
+        struct nci_nfcee_supported_protocol supported_protocols;
+        struct nci_nfcee_information_tlv        information_tlv;
+} __packed;
+
 #endif /* __NCI_H */
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 9e51bb4d841e..ff87f8611fa3 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -78,15 +78,107 @@ struct nci_ops {
         int   (*se_io)(struct nci_dev *ndev, u32 se_idx,
                                 u8 *apdu, size_t apdu_length,
                                 se_io_cb_t cb, void *cb_context);
+        int   (*hci_load_session)(struct nci_dev *ndev);
+        void  (*hci_event_received)(struct nci_dev *ndev, u8 pipe, u8 event,
+                                    struct sk_buff *skb);
+        void  (*hci_cmd_received)(struct nci_dev *ndev, u8 pipe, u8 cmd,
+                                  struct sk_buff *skb);
 };
 
 #define NCI_MAX_SUPPORTED_RF_INTERFACES         4
 #define NCI_MAX_DISCOVERED_TARGETS              10
+#define NCI_MAX_NUM_NFCEE   255
+#define NCI_MAX_CONN_ID         7
+
+struct nci_conn_info {
+        struct list_head list;
+        __u8    id; /* can be an RF Discovery ID or an NFCEE ID */
+        __u8    conn_id;
+        __u8    max_pkt_payload_len;
+
+        atomic_t credits_cnt;
+        __u8     initial_num_credits;
+
+        data_exchange_cb_t      data_exchange_cb;
+        void *data_exchange_cb_context;
+
+        struct sk_buff *rx_skb;
+};
+
+#define NCI_INVALID_CONN_ID 0x80
+
+#define NCI_HCI_ANY_OPEN_PIPE      0x03
+
+/* Gates */
+#define NCI_HCI_ADMIN_GATE         0x00
+#define NCI_HCI_LINK_MGMT_GATE     0x06
+
+/* Pipes */
+#define NCI_HCI_LINK_MGMT_PIPE             0x00
+#define NCI_HCI_ADMIN_PIPE                 0x01
+
+/* Generic responses */
+#define NCI_HCI_ANY_OK                     0x00
+#define NCI_HCI_ANY_E_NOT_CONNECTED        0x01
+#define NCI_HCI_ANY_E_CMD_PAR_UNKNOWN      0x02
+#define NCI_HCI_ANY_E_NOK                  0x03
+#define NCI_HCI_ANY_E_PIPES_FULL           0x04
+#define NCI_HCI_ANY_E_REG_PAR_UNKNOWN      0x05
+#define NCI_HCI_ANY_E_PIPE_NOT_OPENED      0x06
+#define NCI_HCI_ANY_E_CMD_NOT_SUPPORTED    0x07
+#define NCI_HCI_ANY_E_INHIBITED            0x08
+#define NCI_HCI_ANY_E_TIMEOUT              0x09
+#define NCI_HCI_ANY_E_REG_ACCESS_DENIED    0x0a
+#define NCI_HCI_ANY_E_PIPE_ACCESS_DENIED   0x0b
+
+#define NCI_HCI_DO_NOT_OPEN_PIPE           0x81
+#define NCI_HCI_INVALID_PIPE               0x80
+#define NCI_HCI_INVALID_GATE               0xFF
+#define NCI_HCI_INVALID_HOST               0x80
+
+#define NCI_HCI_MAX_CUSTOM_GATES   50
+#define NCI_HCI_MAX_PIPES          127
+
+struct nci_hci_gate {
+        u8 gate;
+        u8 pipe;
+        u8 dest_host;
+} __packed;
+
+struct nci_hci_pipe {
+        u8 gate;
+        u8 host;
+} __packed;
+
+struct nci_hci_init_data {
+        u8 gate_count;
+        struct nci_hci_gate gates[NCI_HCI_MAX_CUSTOM_GATES];
+        char session_id[9];
+};
+
+#define NCI_HCI_MAX_GATES          256
+
+struct nci_hci_dev {
+        u8 nfcee_id;
+        struct nci_dev *ndev;
+        struct nci_conn_info *conn_info;
+
+        struct nci_hci_init_data init_data;
+        struct nci_hci_pipe pipes[NCI_HCI_MAX_PIPES];
+        u8 gate2pipe[NCI_HCI_MAX_GATES];
+        int expected_pipes;
+        int count_pipes;
+
+        struct sk_buff_head rx_hcp_frags;
+        struct work_struct msg_rx_work;
+        struct sk_buff_head msg_rx_queue;
+};
 
 /* NCI Core structures */
 struct nci_dev {
         struct nfc_dev          *nfc_dev;
         struct nci_ops          *ops;
+        struct nci_hci_dev      *hci_dev;
 
         int                     tx_headroom;
         int                     tx_tailroom;
@@ -95,7 +187,10 @@ struct nci_dev {
         unsigned long           flags;
 
         atomic_t                cmd_cnt;
-        atomic_t                credits_cnt;
+        __u8                    cur_conn_id;
+
+        struct list_head        conn_info_list;
+        struct nci_conn_info    *rf_conn_info;
 
         struct timer_list       cmd_timer;
         struct timer_list       data_timer;
@@ -141,13 +236,10 @@ struct nci_dev {
         __u8                    manufact_id;
         __u32                   manufact_specific_info;
 
-        /* received during NCI_OP_RF_INTF_ACTIVATED_NTF */
-        __u8                    max_data_pkt_payload_size;
-        __u8                    initial_num_credits;
+        /* Save RF Discovery ID or NFCEE ID under conn_create */
+        __u8                    cur_id;
 
         /* stored during nci_data_exchange */
-        data_exchange_cb_t      data_exchange_cb;
-        void                    *data_exchange_cb_context;
         struct sk_buff          *rx_data_reassembly;
 
         /* stored during intf_activated_ntf */
@@ -163,9 +255,36 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
 void nci_free_device(struct nci_dev *ndev);
 int nci_register_device(struct nci_dev *ndev);
 void nci_unregister_device(struct nci_dev *ndev);
+int nci_request(struct nci_dev *ndev,
+                void (*req)(struct nci_dev *ndev,
+                            unsigned long opt),
+                unsigned long opt, __u32 timeout);
 int nci_recv_frame(struct nci_dev *ndev, struct sk_buff *skb);
 int nci_set_config(struct nci_dev *ndev, __u8 id, size_t len, __u8 *val);
 
+int nci_nfcee_discover(struct nci_dev *ndev, u8 action);
+int nci_nfcee_mode_set(struct nci_dev *ndev, u8 nfcee_id, u8 nfcee_mode);
+int nci_core_conn_create(struct nci_dev *ndev, u8 destination_type,
+                         u8 number_destination_params,
+                         size_t params_len,
+                         struct core_conn_create_dest_spec_params *params);
+int nci_core_conn_close(struct nci_dev *ndev, u8 conn_id);
+
+struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev);
+int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event,
+                       const u8 *param, size_t param_len);
+int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate,
+                     u8 cmd, const u8 *param, size_t param_len,
+                     struct sk_buff **skb);
+int nci_hci_open_pipe(struct nci_dev *ndev, u8 pipe);
+int nci_hci_connect_gate(struct nci_dev *ndev, u8 dest_host,
+                         u8 dest_gate, u8 pipe);
+int nci_hci_set_param(struct nci_dev *ndev, u8 gate, u8 idx,
+                      const u8 *param, size_t param_len);
+int nci_hci_get_param(struct nci_dev *ndev, u8 gate, u8 idx,
+                      struct sk_buff **skb);
+int nci_hci_dev_session_init(struct nci_dev *ndev);
+
 static inline struct sk_buff *nci_skb_alloc(struct nci_dev *ndev,
                                             unsigned int len,
                                             gfp_t how)
@@ -200,7 +319,9 @@ void nci_rx_data_packet(struct nci_dev *ndev, struct sk_buff *skb);
 int nci_send_cmd(struct nci_dev *ndev, __u16 opcode, __u8 plen, void *payload);
 int nci_send_data(struct nci_dev *ndev, __u8 conn_id, struct sk_buff *skb);
 void nci_data_exchange_complete(struct nci_dev *ndev, struct sk_buff *skb,
-                                int err);
+                                __u8 conn_id, int err);
+void nci_hci_data_received_cb(void *context, struct sk_buff *skb, int err);
+
 void nci_clear_target_list(struct nci_dev *ndev);
 
 /* ----- NCI requests ----- */
@@ -209,6 +330,8 @@ void nci_clear_target_list(struct nci_dev *ndev);
 #define NCI_REQ_CANCELED        2
 
 void nci_req_complete(struct nci_dev *ndev, int result);
+struct nci_conn_info *nci_get_conn_info_by_conn_id(struct nci_dev *ndev,
+                                                   int conn_id);
 
 /* ----- NCI status code ----- */
 int nci_to_errno(__u8 code);
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 12adb817c27a..73190e65d5c1 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -135,6 +135,31 @@ struct nfc_se {
         u16 state;
 };
 
+/**
+ * nfc_evt_transaction - A struct for NFC secure element event transaction.
+ *
+ * @aid: The application identifier triggering the event
+ *
+ * @aid_len: The application identifier length [5:16]
+ *
+ * @params: The application parameters transmitted during the transaction
+ *
+ * @params_len: The applications parameters length [0:255]
+ *
+ */
+#define NFC_MIN_AID_LENGTH      5
+#define NFC_MAX_AID_LENGTH      16
+#define NFC_MAX_PARAMS_LENGTH   255
+
+#define NFC_EVT_TRANSACTION_AID_TAG     0x81
+#define NFC_EVT_TRANSACTION_PARAMS_TAG  0x82
+struct nfc_evt_transaction {
+        u32 aid_len;
+        u8 aid[NFC_MAX_AID_LENGTH];
+        u8 params_len;
+        u8 params[NFC_MAX_PARAMS_LENGTH];
+} __packed;
+
 struct nfc_genl_data {
         u32 poll_req_portid;
         struct mutex genl_data_mutex;
@@ -262,6 +287,8 @@ int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb);
 
 void nfc_driver_failure(struct nfc_dev *dev, int err);
 
+int nfc_se_transaction(struct nfc_dev *dev, u8 se_idx,
+                       struct nfc_evt_transaction *evt_transaction);
 int nfc_add_se(struct nfc_dev *dev, u32 se_idx, u16 type);
 int nfc_remove_se(struct nfc_dev *dev, u32 se_idx);
 struct nfc_se *nfc_find_se(struct nfc_dev *dev, u32 se_idx);
diff --git a/include/net/nl802154.h b/include/net/nl802154.h
index 6dbd406ca41b..f8b5bc997959 100644
--- a/include/net/nl802154.h
+++ b/include/net/nl802154.h
@@ -82,7 +82,7 @@ enum nl802154_attrs {
         NL802154_ATTR_TX_POWER,
 
         NL802154_ATTR_CCA_MODE,
-        NL802154_ATTR_CCA_MODE3_AND,
+        NL802154_ATTR_CCA_OPT,
         NL802154_ATTR_CCA_ED_LEVEL,
 
         NL802154_ATTR_MAX_FRAME_RETRIES,
@@ -119,4 +119,47 @@ enum nl802154_iftype {
         NL802154_IFTYPE_MAX = NUM_NL802154_IFTYPES - 1
 };
 
+/**
+ * enum nl802154_cca_modes - cca modes
+ *
+ * @__NL802154_CCA_INVALID: cca mode number 0 is reserved
+ * @NL802154_CCA_ENERGY: Energy above threshold
+ * @NL802154_CCA_CARRIER: Carrier sense only
+ * @NL802154_CCA_ENERGY_CARRIER: Carrier sense with energy above threshold
+ * @NL802154_CCA_ALOHA: CCA shall always report an idle medium
+ * @NL802154_CCA_UWB_SHR: UWB preamble sense based on the SHR of a frame
+ * @NL802154_CCA_UWB_MULTIPEXED: UWB preamble sense based on the packet with
+ *      the multiplexed preamble
+ * @__NL802154_CCA_ATTR_AFTER_LAST: Internal
+ * @NL802154_CCA_ATTR_MAX: Maximum CCA attribute number
+ */
+enum nl802154_cca_modes {
+        __NL802154_CCA_INVALID,
+        NL802154_CCA_ENERGY,
+        NL802154_CCA_CARRIER,
+        NL802154_CCA_ENERGY_CARRIER,
+        NL802154_CCA_ALOHA,
+        NL802154_CCA_UWB_SHR,
+        NL802154_CCA_UWB_MULTIPEXED,
+
+        /* keep last */
+        __NL802154_CCA_ATTR_AFTER_LAST,
+        NL802154_CCA_ATTR_MAX = __NL802154_CCA_ATTR_AFTER_LAST - 1
+};
+
+/**
+ * enum nl802154_cca_opts - additional options for cca modes
+ *
+ * @NL802154_CCA_OPT_ENERGY_CARRIER_OR: NL802154_CCA_ENERGY_CARRIER with OR
+ * @NL802154_CCA_OPT_ENERGY_CARRIER_AND: NL802154_CCA_ENERGY_CARRIER with AND
+ */
+enum nl802154_cca_opts {
+        NL802154_CCA_OPT_ENERGY_CARRIER_AND,
+        NL802154_CCA_OPT_ENERGY_CARRIER_OR,
+
+        /* keep last */
+        __NL802154_CCA_OPT_ATTR_AFTER_LAST,
+        NL802154_CCA_OPT_ATTR_MAX = __NL802154_CCA_OPT_ATTR_AFTER_LAST - 1
+};
+
 #endif /* __NL802154_H */
diff --git a/include/net/ping.h b/include/net/ping.h
index f074060bc5de..cc16d413f681 100644
--- a/include/net/ping.h
+++ b/include/net/ping.h
@@ -59,7 +59,7 @@ extern struct pingv6_ops pingv6_ops;
 
 struct pingfakehdr {
         struct icmphdr icmph;
-        struct iovec *iov;
+        struct msghdr *msg;
         sa_family_t family;
         __wsum wcheck;
 };
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 27a33833ff4a..2342bf12cb78 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -3,6 +3,7 @@
 
 #include <linux/jiffies.h>
 #include <linux/ktime.h>
+#include <linux/if_vlan.h>
 #include <net/sch_generic.h>
 
 struct qdisc_walker {
@@ -114,6 +115,17 @@ int tc_classify_compat(struct sk_buff *skb, const struct tcf_proto *tp,
 int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                 struct tcf_result *res);
 
+static inline __be16 tc_skb_protocol(const struct sk_buff *skb)
+{
+        /* We need to take extra care in case the skb came via
+         * vlan accelerated path. In that case, use skb->vlan_proto
+         * as the original vlan header was already stripped.
+         */
+        if (skb_vlan_tag_present(skb))
+                return skb->vlan_proto;
+        return skb->protocol;
+}
+
 /* Calculate maximal size of packet seen by hard_start_xmit
    routine of this device.
  */
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index b776d72d84be..ebc5a2ed8631 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -147,6 +147,24 @@ struct regulatory_request {
  *      NL80211_IFTYPE_P2P_CLIENT, NL80211_IFTYPE_P2P_GO,
  *      NL80211_IFTYPE_P2P_DEVICE. The flag will be set by default if a device
  *      includes any modes unsupported for enforcement checking.
+ * @REGULATORY_WIPHY_SELF_MANAGED: for devices that employ wiphy-specific
+ *      regdom management. These devices will ignore all regdom changes not
+ *      originating from their own wiphy.
+ *      A self-managed wiphys only employs regulatory information obtained from
+ *      the FW and driver and does not use other cfg80211 sources like
+ *      beacon-hints, country-code IEs and hints from other devices on the same
+ *      system. Conversely, a self-managed wiphy does not share its regulatory
+ *      hints with other devices in the system. If a system contains several
+ *      devices, one or more of which are self-managed, there might be
+ *      contradictory regulatory settings between them. Usage of flag is
+ *      generally discouraged. Only use it if the FW/driver is incompatible
+ *      with non-locally originated hints.
+ *      This flag is incompatible with the flags: %REGULATORY_CUSTOM_REG,
+ *      %REGULATORY_STRICT_REG, %REGULATORY_COUNTRY_IE_FOLLOW_POWER,
+ *      %REGULATORY_COUNTRY_IE_IGNORE and %REGULATORY_DISABLE_BEACON_HINTS.
+ *      Mixing any of the above flags with this flag will result in a failure
+ *      to register the wiphy. This flag implies
+ *      %REGULATORY_DISABLE_BEACON_HINTS and %REGULATORY_COUNTRY_IE_IGNORE.
  */
 enum ieee80211_regulatory_flags {
         REGULATORY_CUSTOM_REG                   = BIT(0),
@@ -156,6 +174,7 @@ enum ieee80211_regulatory_flags {
         REGULATORY_COUNTRY_IE_IGNORE            = BIT(4),
         REGULATORY_ENABLE_RELAX_NO_IR           = BIT(5),
         REGULATORY_IGNORE_STALE_KICKOFF         = BIT(6),
+        REGULATORY_WIPHY_SELF_MANAGED           = BIT(7),
 };
 
 struct ieee80211_freq_range {
diff --git a/include/net/route.h b/include/net/route.h
index b17cf28f996e..fe22d03afb6a 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -46,6 +46,7 @@
 
 struct fib_nh;
 struct fib_info;
+struct uncached_list;
 struct rtable {
         struct dst_entry        dst;
 
@@ -64,6 +65,7 @@ struct rtable {
         u32                     rt_pmtu;
 
         struct list_head        rt_uncached;
+        struct uncached_list    *rt_uncached_list;
 };
 
 static inline bool rt_is_input_route(const struct rtable *rt)
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index e21b9f9653c0..6c6d5393fc34 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -46,6 +46,7 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
  *                          to create when creating a new device.
  *      @get_num_rx_queues: Function to determine number of receive queues
  *                          to create when creating a new device.
+ *      @get_link_net: Function to get the i/o netns of the device
  */
 struct rtnl_link_ops {
         struct list_head        list;
@@ -93,6 +94,7 @@ struct rtnl_link_ops {
         int                     (*fill_slave_info)(struct sk_buff *skb,
                                                    const struct net_device *dev,
                                                    const struct net_device *slave_dev);
+        struct net              *(*get_link_net)(const struct net_device *dev);
 };
 
 int __rtnl_link_register(struct rtnl_link_ops *ops);
diff --git a/include/net/sock.h b/include/net/sock.h
index 2210fec65669..ab186b1d31ff 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -857,18 +857,6 @@ static inline void sock_rps_record_flow_hash(__u32 hash)
 #endif
 }
 
-static inline void sock_rps_reset_flow_hash(__u32 hash)
-{
-#ifdef CONFIG_RPS
-        struct rps_sock_flow_table *sock_flow_table;
-
-        rcu_read_lock();
-        sock_flow_table = rcu_dereference(rps_sock_flow_table);
-        rps_reset_sock_flow(sock_flow_table, hash);
-        rcu_read_unlock();
-#endif
-}
-
 static inline void sock_rps_record_flow(const struct sock *sk)
 {
 #ifdef CONFIG_RPS
@@ -876,28 +864,18 @@ static inline void sock_rps_record_flow(const struct sock *sk)
 #endif
 }
 
-static inline void sock_rps_reset_flow(const struct sock *sk)
-{
-#ifdef CONFIG_RPS
-        sock_rps_reset_flow_hash(sk->sk_rxhash);
-#endif
-}
-
 static inline void sock_rps_save_rxhash(struct sock *sk,
                                         const struct sk_buff *skb)
 {
 #ifdef CONFIG_RPS
-        if (unlikely(sk->sk_rxhash != skb->hash)) {
-                sock_rps_reset_flow(sk);
+        if (unlikely(sk->sk_rxhash != skb->hash))
                 sk->sk_rxhash = skb->hash;
-        }
 #endif
 }
 
 static inline void sock_rps_reset_rxhash(struct sock *sk)
 {
 #ifdef CONFIG_RPS
-        sock_rps_reset_flow(sk);
         sk->sk_rxhash = 0;
 #endif
 }
@@ -1099,11 +1077,6 @@ static inline bool memcg_proto_active(struct cg_proto *cg_proto)
         return test_bit(MEMCG_SOCK_ACTIVE, &cg_proto->flags);
 }
 
-static inline bool memcg_proto_activated(struct cg_proto *cg_proto)
-{
-        return test_bit(MEMCG_SOCK_ACTIVATED, &cg_proto->flags);
-}
-
 #ifdef SOCK_REFCNT_DEBUG
 static inline void sk_refcnt_debug_inc(struct sock *sk)
 {
@@ -1374,29 +1347,6 @@ void sk_prot_clear_portaddr_nulls(struct sock *sk, int size);
 #define SOCK_BINDADDR_LOCK      4
 #define SOCK_BINDPORT_LOCK      8
 
-/* sock_iocb: used to kick off async processing of socket ios */
-struct sock_iocb {
-        struct list_head        list;
-
-        int                     flags;
-        int                     size;
-        struct socket           *sock;
-        struct sock             *sk;
-        struct scm_cookie       *scm;
-        struct msghdr           *msg, async_msg;
-        struct kiocb            *kiocb;
-};
-
-static inline struct sock_iocb *kiocb_to_siocb(struct kiocb *iocb)
-{
-        return (struct sock_iocb *)iocb->private;
-}
-
-static inline struct kiocb *siocb_to_kiocb(struct sock_iocb *si)
-{
-        return si->kiocb;
-}
-
 struct socket_alloc {
         struct socket socket;
         struct inode vfs_inode;
@@ -1826,27 +1776,25 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
 }
 
 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
-                                           char __user *from, char *to,
+                                           struct iov_iter *from, char *to,
                                            int copy, int offset)
 {
         if (skb->ip_summed == CHECKSUM_NONE) {
-                int err = 0;
-                __wsum csum = csum_and_copy_from_user(from, to, copy, 0, &err);
-                if (err)
-                        return err;
+                __wsum csum = 0;
+                if (csum_and_copy_from_iter(to, copy, &csum, from) != copy)
+                        return -EFAULT;
                 skb->csum = csum_block_add(skb->csum, csum, offset);
         } else if (sk->sk_route_caps & NETIF_F_NOCACHE_COPY) {
-                if (!access_ok(VERIFY_READ, from, copy) ||
-                    __copy_from_user_nocache(to, from, copy))
+                if (copy_from_iter_nocache(to, copy, from) != copy)
                         return -EFAULT;
-        } else if (copy_from_user(to, from, copy))
+        } else if (copy_from_iter(to, copy, from) != copy)
                 return -EFAULT;
 
         return 0;
 }
 
 static inline int skb_add_data_nocache(struct sock *sk, struct sk_buff *skb,
-                                       char __user *from, int copy)
+                                       struct iov_iter *from, int copy)
 {
         int err, offset = skb->len;
 
@@ -1858,7 +1806,7 @@ static inline int skb_add_data_nocache(struct sock *sk, struct sk_buff *skb,
         return err;
 }
 
-static inline int skb_copy_to_page_nocache(struct sock *sk, char __user *from,
+static inline int skb_copy_to_page_nocache(struct sock *sk, struct iov_iter *from,
                                            struct sk_buff *skb,
                                            struct page *page,
                                            int off, int copy)
@@ -2262,6 +2210,7 @@ bool sk_net_capable(const struct sock *sk, int cap);
 extern __u32 sysctl_wmem_max;
 extern __u32 sysctl_rmem_max;
 
+extern int sysctl_tstamp_allow_data;
 extern int sysctl_optmem_max;
 
 extern __u32 sysctl_wmem_default;
diff --git a/include/net/switchdev.h b/include/net/switchdev.h
index 8a6d1641fd9b..cfcdac2e5d25 100644
--- a/include/net/switchdev.h
+++ b/include/net/switchdev.h
@@ -11,13 +11,46 @@
 #define _LINUX_SWITCHDEV_H_
 
 #include <linux/netdevice.h>
+#include <linux/notifier.h>
+
+enum netdev_switch_notifier_type {
+        NETDEV_SWITCH_FDB_ADD = 1,
+        NETDEV_SWITCH_FDB_DEL,
+};
+
+struct netdev_switch_notifier_info {
+        struct net_device *dev;
+};
+
+struct netdev_switch_notifier_fdb_info {
+        struct netdev_switch_notifier_info info; /* must be first */
+        const unsigned char *addr;
+        u16 vid;
+};
+
+static inline struct net_device *
+netdev_switch_notifier_info_to_dev(const struct netdev_switch_notifier_info *info)
+{
+        return info->dev;
+}
 
 #ifdef CONFIG_NET_SWITCHDEV
 
 int netdev_switch_parent_id_get(struct net_device *dev,
                                 struct netdev_phys_item_id *psid);
 int netdev_switch_port_stp_update(struct net_device *dev, u8 state);
-
+int register_netdev_switch_notifier(struct notifier_block *nb);
+int unregister_netdev_switch_notifier(struct notifier_block *nb);
+int call_netdev_switch_notifiers(unsigned long val, struct net_device *dev,
+                                 struct netdev_switch_notifier_info *info);
+int netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                struct nlmsghdr *nlh, u16 flags);
+int netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                struct nlmsghdr *nlh, u16 flags);
+int ndo_dflt_netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                               struct nlmsghdr *nlh, u16 flags);
+int ndo_dflt_netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                               struct nlmsghdr *nlh, u16 flags);
 #else
 
 static inline int netdev_switch_parent_id_get(struct net_device *dev,
@@ -32,6 +65,50 @@ static inline int netdev_switch_port_stp_update(struct net_device *dev,
         return -EOPNOTSUPP;
 }
 
+static inline int register_netdev_switch_notifier(struct notifier_block *nb)
+{
+        return 0;
+}
+
+static inline int unregister_netdev_switch_notifier(struct notifier_block *nb)
+{
+        return 0;
+}
+
+static inline int call_netdev_switch_notifiers(unsigned long val, struct net_device *dev,
+                                               struct netdev_switch_notifier_info *info)
+{
+        return NOTIFY_DONE;
+}
+
+static inline int netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                                    struct nlmsghdr *nlh,
+                                                    u16 flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                                    struct nlmsghdr *nlh,
+                                                    u16 flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int ndo_dflt_netdev_switch_port_bridge_dellink(struct net_device *dev,
+                                                        struct nlmsghdr *nlh,
+                                                        u16 flags)
+{
+        return 0;
+}
+
+static inline int ndo_dflt_netdev_switch_port_bridge_setlink(struct net_device *dev,
+                                                        struct nlmsghdr *nlh,
+                                                        u16 flags)
+{
+        return 0;
+}
+
 #endif
 
 #endif /* _LINUX_SWITCHDEV_H_ */
diff --git a/include/net/tc_act/tc_bpf.h b/include/net/tc_act/tc_bpf.h
new file mode 100644
index 000000000000..86a070ffc930
--- /dev/null
+++ b/include/net/tc_act/tc_bpf.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2015 Jiri Pirko <jiri@resnulli.us>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __NET_TC_BPF_H
+#define __NET_TC_BPF_H
+
+#include <linux/filter.h>
+#include <net/act_api.h>
+
+struct tcf_bpf {
+        struct tcf_common       common;
+        struct bpf_prog         *filter;
+        struct sock_filter      *bpf_ops;
+        u16                     bpf_num_ops;
+};
+#define to_bpf(a) \
+        container_of(a->priv, struct tcf_bpf, common)
+
+#endif /* __NET_TC_BPF_H */
diff --git a/include/net/tc_act/tc_connmark.h b/include/net/tc_act/tc_connmark.h
new file mode 100644
index 000000000000..5c1104c2e24f
--- /dev/null
+++ b/include/net/tc_act/tc_connmark.h
@@ -0,0 +1,14 @@
+#ifndef __NET_TC_CONNMARK_H
+#define __NET_TC_CONNMARK_H
+
+#include <net/act_api.h>
+
+struct tcf_connmark_info {
+        struct tcf_common common;
+        u16 zone;
+};
+
+#define to_connmark(a) \
+        container_of(a->priv, struct tcf_connmark_info, common)
+
+#endif /* __NET_TC_CONNMARK_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 9d9111ef43ae..8d6b983d5099 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -262,8 +262,6 @@ extern int sysctl_tcp_low_latency;
 extern int sysctl_tcp_nometrics_save;
 extern int sysctl_tcp_moderate_rcvbuf;
 extern int sysctl_tcp_tso_win_divisor;
-extern int sysctl_tcp_mtu_probing;
-extern int sysctl_tcp_base_mss;
 extern int sysctl_tcp_workaround_signed_windows;
 extern int sysctl_tcp_slow_start_after_idle;
 extern int sysctl_tcp_thin_linear_timeouts;
@@ -274,6 +272,7 @@ extern int sysctl_tcp_challenge_ack_limit;
 extern unsigned int sysctl_tcp_notsent_lowat;
 extern int sysctl_tcp_min_tso_segs;
 extern int sysctl_tcp_autocorking;
+extern int sysctl_tcp_invalid_ratelimit;
 
 extern atomic_long_t tcp_memory_allocated;
 extern struct percpu_counter tcp_sockets_allocated;
@@ -448,6 +447,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb);
 struct sock *tcp_create_openreq_child(struct sock *sk,
                                       struct request_sock *req,
                                       struct sk_buff *skb);
+void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst);
 struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                                   struct request_sock *req,
                                   struct dst_entry *dst);
@@ -636,6 +636,11 @@ static inline u32 tcp_rto_min_us(struct sock *sk)
         return jiffies_to_usecs(tcp_rto_min(sk));
 }
 
+static inline bool tcp_ca_dst_locked(const struct dst_entry *dst)
+{
+        return dst_metric_locked(dst, RTAX_CC_ALGO);
+}
+
 /* Compute the actual receive window we are currently advertising.
  * Rcv_nxt can be after the window if our peer push more data
  * than the offered window.
@@ -787,6 +792,8 @@ enum tcp_ca_ack_event_flags {
 #define TCP_CA_MAX      128
 #define TCP_CA_BUF_MAX  (TCP_CA_NAME_MAX*TCP_CA_MAX)
 
+#define TCP_CA_UNSPEC   0
+
 /* Algorithm can be set on socket without CAP_NET_ADMIN privileges */
 #define TCP_CONG_NON_RESTRICTED 0x1
 /* Requires ECN/ECT set on all packets */
@@ -794,7 +801,8 @@ enum tcp_ca_ack_event_flags {
 
 struct tcp_congestion_ops {
         struct list_head        list;
-        unsigned long flags;
+        u32 key;
+        u32 flags;
 
         /* initialize private data (optional) */
         void (*init)(struct sock *sk);
@@ -841,6 +849,17 @@ u32 tcp_reno_ssthresh(struct sock *sk);
 void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 acked);
 extern struct tcp_congestion_ops tcp_reno;
 
+struct tcp_congestion_ops *tcp_ca_find_key(u32 key);
+u32 tcp_ca_get_key_by_name(const char *name);
+#ifdef CONFIG_INET
+char *tcp_ca_get_name_by_key(u32 key, char *buffer);
+#else
+static inline char *tcp_ca_get_name_by_key(u32 key, char *buffer)
+{
+        return NULL;
+}
+#endif
+
 static inline bool tcp_ca_needs_ecn(const struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -1124,6 +1143,7 @@ static inline void tcp_openreq_init(struct request_sock *req,
         tcp_rsk(req)->rcv_isn = TCP_SKB_CB(skb)->seq;
         tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
         tcp_rsk(req)->snt_synack = tcp_time_stamp;
+        tcp_rsk(req)->last_oow_ack_time = 0;
         req->mss = rx_opt->mss_clamp;
         req->ts_recent = rx_opt->saw_tstamp ? rx_opt->rcv_tsval : 0;
         ireq->tstamp_ok = rx_opt->tstamp_ok;
@@ -1216,6 +1236,37 @@ static inline bool tcp_paws_reject(const struct tcp_options_received *rx_opt,
         return true;
 }
 
+/* Return true if we're currently rate-limiting out-of-window ACKs and
+ * thus shouldn't send a dupack right now. We rate-limit dupacks in
+ * response to out-of-window SYNs or ACKs to mitigate ACK loops or DoS
+ * attacks that send repeated SYNs or ACKs for the same connection. To
+ * do this, we do not send a duplicate SYNACK or ACK if the remote
+ * endpoint is sending out-of-window SYNs or pure ACKs at a high rate.
+ */
+static inline bool tcp_oow_rate_limited(struct net *net,
+                                        const struct sk_buff *skb,
+                                        int mib_idx, u32 *last_oow_ack_time)
+{
+        /* Data packets without SYNs are not likely part of an ACK loop. */
+        if ((TCP_SKB_CB(skb)->seq != TCP_SKB_CB(skb)->end_seq) &&
+            !tcp_hdr(skb)->syn)
+                goto not_rate_limited;
+
+        if (*last_oow_ack_time) {
+                s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time);
+
+                if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
+                        NET_INC_STATS_BH(net, mib_idx);
+                        return true;    /* rate-limited: don't send yet! */
+                }
+        }
+
+        *last_oow_ack_time = tcp_time_stamp;
+
+not_rate_limited:
+        return false;   /* not rate-limited: go ahead, send dupack now! */
+}
+
 static inline void tcp_mib_init(struct net *net)
 {
         /* See RFC 2012 */
@@ -1693,4 +1744,19 @@ static inline struct ip_options_rcu *tcp_v4_save_options(struct sk_buff *skb)
         return dopt;
 }
 
+/* locally generated TCP pure ACKs have skb->truesize == 2
+ * (check tcp_send_ack() in net/ipv4/tcp_output.c )
+ * This is much faster than dissecting the packet to find out.
+ * (Think of GRE encapsulations, IPv4, IPv6, ...)
+ */
+static inline bool skb_is_tcp_pure_ack(const struct sk_buff *skb)
+{
+        return skb->truesize == 2;
+}
+
+static inline void skb_set_tcp_pure_ack(struct sk_buff *skb)
+{
+        skb->truesize = 2;
+}
+
 #endif  /* _TCP_H */
diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h
index 2a50a70ef587..1a20d33d56bc 100644
--- a/include/net/udp_tunnel.h
+++ b/include/net/udp_tunnel.h
@@ -77,17 +77,17 @@ void setup_udp_tunnel_sock(struct net *net, struct socket *sock,
                            struct udp_tunnel_sock_cfg *sock_cfg);
 
 /* Transmit the skb using UDP encapsulation. */
-int udp_tunnel_xmit_skb(struct socket *sock, struct rtable *rt,
-                        struct sk_buff *skb, __be32 src, __be32 dst,
-                        __u8 tos, __u8 ttl, __be16 df, __be16 src_port,
-                        __be16 dst_port, bool xnet);
+int udp_tunnel_xmit_skb(struct rtable *rt, struct sk_buff *skb,
+                        __be32 src, __be32 dst, __u8 tos, __u8 ttl,
+                        __be16 df, __be16 src_port, __be16 dst_port,
+                        bool xnet, bool nocheck);
 
 #if IS_ENABLED(CONFIG_IPV6)
-int udp_tunnel6_xmit_skb(struct socket *sock, struct dst_entry *dst,
-                         struct sk_buff *skb, struct net_device *dev,
-                         struct in6_addr *saddr, struct in6_addr *daddr,
+int udp_tunnel6_xmit_skb(struct dst_entry *dst, struct sk_buff *skb,
+                         struct net_device *dev, struct in6_addr *saddr,
+                         struct in6_addr *daddr,
                          __u8 prio, __u8 ttl, __be16 src_port,
-                         __be16 dst_port);
+                         __be16 dst_port, bool nocheck);
 #endif
 
 void udp_tunnel_sock_release(struct socket *sock);
diff --git a/include/net/udplite.h b/include/net/udplite.h
index ae7c8d1fbcad..80761938b9a7 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -20,8 +20,7 @@ static __inline__ int udplite_getfrag(void *from, char *to, int  offset,
                                       int len, int odd, struct sk_buff *skb)
 {
         struct msghdr *msg = from;
-        /* XXX: stripping const */
-        return memcpy_fromiovecend(to, (struct iovec *)msg->msg_iter.iov, offset, len);
+        return copy_from_iter(to, len, &msg->msg_iter) != len ? -EFAULT : 0;
 }
 
 /* Designate sk as UDP-Lite socket */
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 903461aa5644..eabd3a038674 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -11,14 +11,96 @@
 #define VNI_HASH_BITS   10
 #define VNI_HASH_SIZE   (1<<VNI_HASH_BITS)
 
-/* VXLAN protocol header */
+/*
+ * VXLAN Group Based Policy Extension:
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |1|-|-|-|1|-|-|-|R|D|R|R|A|R|R|R|        Group Policy ID        |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                VXLAN Network Identifier (VNI) |   Reserved    |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ * D = Don't Learn bit. When set, this bit indicates that the egress
+ *     VTEP MUST NOT learn the source address of the encapsulated frame.
+ *
+ * A = Indicates that the group policy has already been applied to
+ *     this packet. Policies MUST NOT be applied by devices when the
+ *     A bit is set.
+ *
+ * [0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy
+ */
+struct vxlanhdr_gbp {
+        __u8    vx_flags;
+#ifdef __LITTLE_ENDIAN_BITFIELD
+        __u8    reserved_flags1:3,
+                policy_applied:1,
+                reserved_flags2:2,
+                dont_learn:1,
+                reserved_flags3:1;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+        __u8    reserved_flags1:1,
+                dont_learn:1,
+                reserved_flags2:2,
+                policy_applied:1,
+                reserved_flags3:3;
+#else
+#error  "Please fix <asm/byteorder.h>"
+#endif
+        __be16  policy_id;
+        __be32  vx_vni;
+};
+
+#define VXLAN_GBP_USED_BITS (VXLAN_HF_GBP | 0xFFFFFF)
+
+/* skb->mark mapping
+ *
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |R|R|R|R|R|R|R|R|R|D|R|R|A|R|R|R|        Group Policy ID        |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+#define VXLAN_GBP_DONT_LEARN            (BIT(6) << 16)
+#define VXLAN_GBP_POLICY_APPLIED        (BIT(3) << 16)
+#define VXLAN_GBP_ID_MASK               (0xFFFF)
+
+/* VXLAN protocol header:
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |G|R|R|R|I|R|R|C|               Reserved                        |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                VXLAN Network Identifier (VNI) |   Reserved    |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *
+ * G = 1        Group Policy (VXLAN-GBP)
+ * I = 1        VXLAN Network Identifier (VNI) present
+ * C = 1        Remote checksum offload (RCO)
+ */
 struct vxlanhdr {
         __be32 vx_flags;
         __be32 vx_vni;
 };
 
+/* VXLAN header flags. */
+#define VXLAN_HF_RCO BIT(24)
+#define VXLAN_HF_VNI BIT(27)
+#define VXLAN_HF_GBP BIT(31)
+
+/* Remote checksum offload header option */
+#define VXLAN_RCO_MASK  0x7f    /* Last byte of vni field */
+#define VXLAN_RCO_UDP   0x80    /* Indicate UDP RCO (TCP when not set *) */
+#define VXLAN_RCO_SHIFT 1       /* Left shift of start */
+#define VXLAN_RCO_SHIFT_MASK ((1 << VXLAN_RCO_SHIFT) - 1)
+#define VXLAN_MAX_REMCSUM_START (VXLAN_RCO_MASK << VXLAN_RCO_SHIFT)
+
+#define VXLAN_N_VID     (1u << 24)
+#define VXLAN_VID_MASK  (VXLAN_N_VID - 1)
+#define VXLAN_HLEN (sizeof(struct udphdr) + sizeof(struct vxlanhdr))
+
+struct vxlan_metadata {
+        __be32          vni;
+        u32             gbp;
+};
+
 struct vxlan_sock;
-typedef void (vxlan_rcv_t)(struct vxlan_sock *vh, struct sk_buff *skb, __be32 key);
+typedef void (vxlan_rcv_t)(struct vxlan_sock *vh, struct sk_buff *skb,
+                           struct vxlan_metadata *md);
 
 /* per UDP socket information */
 struct vxlan_sock {
@@ -31,6 +113,7 @@ struct vxlan_sock {
         struct hlist_head vni_list[VNI_HASH_SIZE];
         atomic_t          refcnt;
         struct udp_offload udp_offloads;
+        u32               flags;
 };
 
 #define VXLAN_F_LEARN                   0x01
@@ -42,6 +125,18 @@ struct vxlan_sock {
 #define VXLAN_F_UDP_CSUM                0x40
 #define VXLAN_F_UDP_ZERO_CSUM6_TX       0x80
 #define VXLAN_F_UDP_ZERO_CSUM6_RX       0x100
+#define VXLAN_F_REMCSUM_TX              0x200
+#define VXLAN_F_REMCSUM_RX              0x400
+#define VXLAN_F_GBP                     0x800
+#define VXLAN_F_REMCSUM_NOPARTIAL       0x1000
+
+/* Flags that are used in the receive patch. These flags must match in
+ * order for a socket to be shareable
+ */
+#define VXLAN_F_RCV_FLAGS               (VXLAN_F_GBP |                  \
+                                         VXLAN_F_UDP_ZERO_CSUM6_RX |    \
+                                         VXLAN_F_REMCSUM_RX |           \
+                                         VXLAN_F_REMCSUM_NOPARTIAL)
 
 struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
                                   vxlan_rcv_t *rcv, void *data,
@@ -49,10 +144,10 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
 
 void vxlan_sock_release(struct vxlan_sock *vs);
 
-int vxlan_xmit_skb(struct vxlan_sock *vs,
-                   struct rtable *rt, struct sk_buff *skb,
+int vxlan_xmit_skb(struct rtable *rt, struct sk_buff *skb,
                    __be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
-                   __be16 src_port, __be16 dst_port, __be32 vni, bool xnet);
+                   __be16 src_port, __be16 dst_port, struct vxlan_metadata *md,
+                   bool xnet, u32 vxflags);
 
 static inline netdev_features_t vxlan_features_check(struct sk_buff *skb,
                                                      netdev_features_t features)