56 files changed, 965 insertions, 1310 deletions

diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 0a996a3517ed..dbdfd2b0f3b3 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -29,7 +29,8 @@ struct unix_address {
 
 struct unix_skb_parms {
         struct pid              *pid;           /* Skb credentials      */
-        const struct cred       *cred;
+        kuid_t                  uid;
+        kgid_t                  gid;
         struct scm_fp_list      *fp;            /* Passed files         */
 #ifdef CONFIG_SECURITY_NETWORK
         u32                     secid;          /* Security ID          */
@@ -56,9 +57,10 @@ struct unix_sock {
         struct list_head        link;
         atomic_long_t           inflight;
         spinlock_t              lock;
-        unsigned int            gc_candidate : 1;
-        unsigned int            gc_maybe_cycle : 1;
         unsigned char           recursion_level;
+        unsigned long           gc_flags;
+#define UNIX_GC_CANDIDATE       0
+#define UNIX_GC_MAYBE_CYCLE     1
         struct socket_wq        peer_wq;
 };
 #define unix_sk(__sk) ((struct unix_sock *)__sk)
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 9531beee09b5..6912ef9a1881 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -193,11 +193,11 @@ static inline bool bdaddr_type_is_le(__u8 type)
 #define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff} })
 
 /* Copy, swap, convert BD Address */
-static inline int bacmp(bdaddr_t *ba1, bdaddr_t *ba2)
+static inline int bacmp(const bdaddr_t *ba1, const bdaddr_t *ba2)
 {
         return memcmp(ba1, ba2, sizeof(bdaddr_t));
 }
-static inline void bacpy(bdaddr_t *dst, bdaddr_t *src)
+static inline void bacpy(bdaddr_t *dst, const bdaddr_t *src)
 {
         memcpy(dst, src, sizeof(bdaddr_t));
 }
@@ -232,7 +232,7 @@ struct bt_sock_list {
 };
 
 int  bt_sock_register(int proto, const struct net_proto_family *ops);
-int  bt_sock_unregister(int proto);
+void bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
 int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
@@ -260,12 +260,23 @@ struct l2cap_ctrl {
         __u8            retries;
 };
 
+struct hci_dev;
+
+typedef void (*hci_req_complete_t)(struct hci_dev *hdev, u8 status);
+
+struct hci_req_ctrl {
+        bool                    start;
+        u8                      event;
+        hci_req_complete_t      complete;
+};
+
 struct bt_skb_cb {
         __u8 pkt_type;
         __u8 incoming;
         __u16 expect;
         __u8 force_active;
         struct l2cap_ctrl control;
+        struct hci_req_ctrl req;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
 
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 7f12c25f1fca..e0512aaef4b8 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -119,10 +119,16 @@ enum {
         HCI_CONNECTABLE,
         HCI_DISCOVERABLE,
         HCI_LINK_SECURITY,
-        HCI_PENDING_CLASS,
         HCI_PERIODIC_INQ,
+        HCI_FAST_CONNECTABLE,
 };
 
+/* A mask for the flags that are supposed to remain when a reset happens
+ * or the HCI device is closed.
+ */
+#define HCI_PERSISTENT_MASK (BIT(HCI_LE_SCAN) | BIT(HCI_PERIODIC_INQ) | \
+                              BIT(HCI_FAST_CONNECTABLE))
+
 /* HCI ioctl defines */
 #define HCIDEVUP        _IOW('H', 201, int)
 #define HCIDEVDOWN      _IOW('H', 202, int)
@@ -881,12 +887,25 @@ struct hci_rp_read_data_block_size {
         __le16   num_blocks;
 } __packed;
 
+#define HCI_OP_READ_PAGE_SCAN_ACTIVITY  0x0c1b
+struct hci_rp_read_page_scan_activity {
+        __u8     status;
+        __le16   interval;
+        __le16   window;
+} __packed;
+
 #define HCI_OP_WRITE_PAGE_SCAN_ACTIVITY 0x0c1c
 struct hci_cp_write_page_scan_activity {
         __le16   interval;
         __le16   window;
 } __packed;
 
+#define HCI_OP_READ_PAGE_SCAN_TYPE      0x0c46
+struct hci_rp_read_page_scan_type {
+        __u8     status;
+        __u8     type;
+} __packed;
+
 #define HCI_OP_WRITE_PAGE_SCAN_TYPE     0x0c47
         #define PAGE_SCAN_TYPE_STANDARD         0x00
         #define PAGE_SCAN_TYPE_INTERLACED       0x01
@@ -965,6 +984,9 @@ struct hci_cp_le_set_adv_data {
 
 #define HCI_OP_LE_SET_ADV_ENABLE        0x200a
 
+#define LE_SCAN_PASSIVE                 0x00
+#define LE_SCAN_ACTIVE                  0x01
+
 #define HCI_OP_LE_SET_SCAN_PARAM        0x200b
 struct hci_cp_le_set_scan_param {
         __u8    type;
@@ -974,8 +996,10 @@ struct hci_cp_le_set_scan_param {
         __u8    filter_policy;
 } __packed;
 
-#define LE_SCANNING_DISABLED            0x00
-#define LE_SCANNING_ENABLED             0x01
+#define LE_SCAN_DISABLE                 0x00
+#define LE_SCAN_ENABLE                  0x01
+#define LE_SCAN_FILTER_DUP_DISABLE      0x00
+#define LE_SCAN_FILTER_DUP_ENABLE       0x01
 
 #define HCI_OP_LE_SET_SCAN_ENABLE       0x200c
 struct hci_cp_le_set_scan_enable {
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 90cf75afcb02..35a57cd1704c 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -134,6 +134,8 @@ struct amp_assoc {
         __u8    data[HCI_MAX_AMP_ASSOC_SIZE];
 };
 
+#define HCI_MAX_PAGES   3
+
 #define NUM_REASSEMBLY 4
 struct hci_dev {
         struct list_head list;
@@ -151,8 +153,8 @@ struct hci_dev {
         __u8            dev_class[3];
         __u8            major_class;
         __u8            minor_class;
-        __u8            features[8];
-        __u8            host_features[8];
+        __u8            max_page;
+        __u8            features[HCI_MAX_PAGES][8];
         __u8            le_features[8];
         __u8            le_white_list_size;
         __u8            le_states[8];
@@ -165,6 +167,10 @@ struct hci_dev {
         __u16           voice_setting;
         __u8            io_capability;
         __s8            inq_tx_power;
+        __u16           page_scan_interval;
+        __u16           page_scan_window;
+        __u8            page_scan_type;
+
         __u16           devid_source;
         __u16           devid_vendor;
         __u16           devid_product;
@@ -240,6 +246,7 @@ struct hci_dev {
         struct sk_buff_head     raw_q;
         struct sk_buff_head     cmd_q;
 
+        struct sk_buff          *recv_evt;
         struct sk_buff          *sent_cmd;
         struct sk_buff          *reassembly[NUM_REASSEMBLY];
 
@@ -248,8 +255,6 @@ struct hci_dev {
         __u32                   req_status;
         __u32                   req_result;
 
-        __u16                   init_last_cmd;
-
         struct list_head        mgmt_pending;
 
         struct discovery_state  discovery;
@@ -266,8 +271,6 @@ struct hci_dev {
 
         struct hci_dev_stats    stat;
 
-        struct sk_buff_head     driver_init;
-
         atomic_t                promisc;
 
         struct dentry           *debugfs;
@@ -290,6 +293,7 @@ struct hci_dev {
         int (*open)(struct hci_dev *hdev);
         int (*close)(struct hci_dev *hdev);
         int (*flush)(struct hci_dev *hdev);
+        int (*setup)(struct hci_dev *hdev);
         int (*send)(struct sk_buff *skb);
         void (*notify)(struct hci_dev *hdev, unsigned int evt);
         int (*ioctl)(struct hci_dev *hdev, unsigned int cmd, unsigned long arg);
@@ -311,7 +315,7 @@ struct hci_conn {
         bool            out;
         __u8            attempt;
         __u8            dev_class[3];
-        __u8            features[8];
+        __u8            features[HCI_MAX_PAGES][8];
         __u16           interval;
         __u16           pkt_type;
         __u16           link_policy;
@@ -343,7 +347,6 @@ struct hci_conn {
         struct timer_list auto_accept_timer;
 
         struct device   dev;
-        atomic_t        devref;
 
         struct hci_dev  *hdev;
         void            *l2cap_data;
@@ -574,7 +577,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_state(struct hci_dev *hdev,
         return NULL;
 }
 
-void hci_acl_disconn(struct hci_conn *conn, __u8 reason);
+void hci_disconnect(struct hci_conn *conn, __u8 reason);
 void hci_setup_sync(struct hci_conn *conn, __u16 handle);
 void hci_sco_setup(struct hci_conn *conn, __u8 status);
 
@@ -582,7 +585,6 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst);
 int hci_conn_del(struct hci_conn *conn);
 void hci_conn_hash_flush(struct hci_dev *hdev);
 void hci_conn_check_pending(struct hci_dev *hdev);
-void hci_conn_accept(struct hci_conn *conn, int mask);
 
 struct hci_chan *hci_chan_create(struct hci_conn *conn);
 void hci_chan_del(struct hci_chan *chan);
@@ -599,8 +601,36 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 
 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
 
-void hci_conn_hold_device(struct hci_conn *conn);
-void hci_conn_put_device(struct hci_conn *conn);
+/*
+ * hci_conn_get() and hci_conn_put() are used to control the life-time of an
+ * "hci_conn" object. They do not guarantee that the hci_conn object is running,
+ * working or anything else. They just guarantee that the object is available
+ * and can be dereferenced. So you can use its locks, local variables and any
+ * other constant data.
+ * Before accessing runtime data, you _must_ lock the object and then check that
+ * it is still running. As soon as you release the locks, the connection might
+ * get dropped, though.
+ *
+ * On the other hand, hci_conn_hold() and hci_conn_drop() are used to control
+ * how long the underlying connection is held. So every channel that runs on the
+ * hci_conn object calls this to prevent the connection from disappearing. As
+ * long as you hold a device, you must also guarantee that you have a valid
+ * reference to the device via hci_conn_get() (or the initial reference from
+ * hci_conn_add()).
+ * The hold()/drop() ref-count is known to drop below 0 sometimes, which doesn't
+ * break because nobody cares for that. But this means, we cannot use
+ * _get()/_drop() in it, but require the caller to have a valid ref (FIXME).
+ */
+
+static inline void hci_conn_get(struct hci_conn *conn)
+{
+        get_device(&conn->dev);
+}
+
+static inline void hci_conn_put(struct hci_conn *conn)
+{
+        put_device(&conn->dev);
+}
 
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
@@ -610,7 +640,7 @@ static inline void hci_conn_hold(struct hci_conn *conn)
         cancel_delayed_work(&conn->disc_work);
 }
 
-static inline void hci_conn_put(struct hci_conn *conn)
+static inline void hci_conn_drop(struct hci_conn *conn)
 {
         BT_DBG("hcon %p orig refcnt %d", conn, atomic_read(&conn->refcnt));
 
@@ -742,8 +772,6 @@ int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
                                                                 u8 *randomizer);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
-int hci_update_ad(struct hci_dev *hdev);
-
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
 
 int hci_recv_frame(struct sk_buff *skb);
@@ -760,29 +788,29 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define SET_HCIDEV_DEV(hdev, pdev) ((hdev)->dev.parent = (pdev))
 
 /* ----- LMP capabilities ----- */
-#define lmp_encrypt_capable(dev)   ((dev)->features[0] & LMP_ENCRYPT)
-#define lmp_rswitch_capable(dev)   ((dev)->features[0] & LMP_RSWITCH)
-#define lmp_hold_capable(dev)      ((dev)->features[0] & LMP_HOLD)
-#define lmp_sniff_capable(dev)     ((dev)->features[0] & LMP_SNIFF)
-#define lmp_park_capable(dev)      ((dev)->features[1] & LMP_PARK)
-#define lmp_inq_rssi_capable(dev)  ((dev)->features[3] & LMP_RSSI_INQ)
-#define lmp_esco_capable(dev)      ((dev)->features[3] & LMP_ESCO)
-#define lmp_bredr_capable(dev)     (!((dev)->features[4] & LMP_NO_BREDR))
-#define lmp_le_capable(dev)        ((dev)->features[4] & LMP_LE)
-#define lmp_sniffsubr_capable(dev) ((dev)->features[5] & LMP_SNIFF_SUBR)
-#define lmp_pause_enc_capable(dev) ((dev)->features[5] & LMP_PAUSE_ENC)
-#define lmp_ext_inq_capable(dev)   ((dev)->features[6] & LMP_EXT_INQ)
-#define lmp_le_br_capable(dev)     !!((dev)->features[6] & LMP_SIMUL_LE_BR)
-#define lmp_ssp_capable(dev)       ((dev)->features[6] & LMP_SIMPLE_PAIR)
-#define lmp_no_flush_capable(dev)  ((dev)->features[6] & LMP_NO_FLUSH)
-#define lmp_lsto_capable(dev)      ((dev)->features[7] & LMP_LSTO)
-#define lmp_inq_tx_pwr_capable(dev) ((dev)->features[7] & LMP_INQ_TX_PWR)
-#define lmp_ext_feat_capable(dev)  ((dev)->features[7] & LMP_EXTFEATURES)
+#define lmp_encrypt_capable(dev)   ((dev)->features[0][0] & LMP_ENCRYPT)
+#define lmp_rswitch_capable(dev)   ((dev)->features[0][0] & LMP_RSWITCH)
+#define lmp_hold_capable(dev)      ((dev)->features[0][0] & LMP_HOLD)
+#define lmp_sniff_capable(dev)     ((dev)->features[0][0] & LMP_SNIFF)
+#define lmp_park_capable(dev)      ((dev)->features[0][1] & LMP_PARK)
+#define lmp_inq_rssi_capable(dev)  ((dev)->features[0][3] & LMP_RSSI_INQ)
+#define lmp_esco_capable(dev)      ((dev)->features[0][3] & LMP_ESCO)
+#define lmp_bredr_capable(dev)     (!((dev)->features[0][4] & LMP_NO_BREDR))
+#define lmp_le_capable(dev)        ((dev)->features[0][4] & LMP_LE)
+#define lmp_sniffsubr_capable(dev) ((dev)->features[0][5] & LMP_SNIFF_SUBR)
+#define lmp_pause_enc_capable(dev) ((dev)->features[0][5] & LMP_PAUSE_ENC)
+#define lmp_ext_inq_capable(dev)   ((dev)->features[0][6] & LMP_EXT_INQ)
+#define lmp_le_br_capable(dev)     (!!((dev)->features[0][6] & LMP_SIMUL_LE_BR))
+#define lmp_ssp_capable(dev)       ((dev)->features[0][6] & LMP_SIMPLE_PAIR)
+#define lmp_no_flush_capable(dev)  ((dev)->features[0][6] & LMP_NO_FLUSH)
+#define lmp_lsto_capable(dev)      ((dev)->features[0][7] & LMP_LSTO)
+#define lmp_inq_tx_pwr_capable(dev) ((dev)->features[0][7] & LMP_INQ_TX_PWR)
+#define lmp_ext_feat_capable(dev)  ((dev)->features[0][7] & LMP_EXTFEATURES)
 
 /* ----- Extended LMP capabilities ----- */
-#define lmp_host_ssp_capable(dev)  ((dev)->host_features[0] & LMP_HOST_SSP)
-#define lmp_host_le_capable(dev)   !!((dev)->host_features[0] & LMP_HOST_LE)
-#define lmp_host_le_br_capable(dev) !!((dev)->host_features[0] & LMP_HOST_LE_BREDR)
+#define lmp_host_ssp_capable(dev)  ((dev)->features[1][0] & LMP_HOST_SSP)
+#define lmp_host_le_capable(dev)   (!!((dev)->features[1][0] & LMP_HOST_LE))
+#define lmp_host_le_br_capable(dev) (!!((dev)->features[1][0] & LMP_HOST_LE_BREDR))
 
 /* returns true if at least one AMP active */
 static inline bool hci_amp_capable(void)
@@ -1041,7 +1069,31 @@ static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
 int hci_register_cb(struct hci_cb *hcb);
 int hci_unregister_cb(struct hci_cb *hcb);
 
-int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param);
+struct hci_request {
+        struct hci_dev          *hdev;
+        struct sk_buff_head     cmd_q;
+
+        /* If something goes wrong when building the HCI request, the error
+         * value is stored in this field.
+         */
+        int                     err;
+};
+
+void hci_req_init(struct hci_request *req, struct hci_dev *hdev);
+int hci_req_run(struct hci_request *req, hci_req_complete_t complete);
+void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
+                 const void *param);
+void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
+                    const void *param, u8 event);
+void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status);
+
+struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
+                               const void *param, u32 timeout);
+struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
+                                  const void *param, u8 event, u32 timeout);
+
+int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
+                 const void *param);
 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags);
 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb);
 
@@ -1153,7 +1205,7 @@ struct hci_sec_filter {
 #define hci_req_lock(d)         mutex_lock(&d->req_lock)
 #define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
 
-void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result);
+void hci_update_ad(struct hci_request *req);
 
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index cdd33021f831..fb94cf13c777 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -583,6 +583,14 @@ struct l2cap_conn {
 
         struct list_head        chan_l;
         struct mutex            chan_lock;
+        struct kref             ref;
+        struct list_head        users;
+};
+
+struct l2cap_user {
+        struct list_head list;
+        int (*probe) (struct l2cap_conn *conn, struct l2cap_user *user);
+        void (*remove) (struct l2cap_conn *conn, struct l2cap_user *user);
 };
 
 #define L2CAP_INFO_CL_MTU_REQ_SENT      0x01
@@ -786,6 +794,7 @@ extern bool disable_ertm;
 
 int l2cap_init_sockets(void);
 void l2cap_cleanup_sockets(void);
+bool l2cap_is_socket(struct socket *sock);
 
 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan);
 int __l2cap_wait_ack(struct sock *sk);
@@ -812,4 +821,10 @@ void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
                        u8 status);
 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result);
 
+void l2cap_conn_get(struct l2cap_conn *conn);
+void l2cap_conn_put(struct l2cap_conn *conn);
+
+int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user);
+void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user);
+
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index e2e3ecad1008..7afd4199d6b6 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -158,7 +158,6 @@ struct rfcomm_session {
         struct timer_list timer;
         unsigned long    state;
         unsigned long    flags;
-        atomic_t         refcnt;
         int              initiator;
 
         /* Default DLC parameters */
@@ -276,11 +275,6 @@ static inline void rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 void   rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src,
                                                                 bdaddr_t *dst);
 
-static inline void rfcomm_session_hold(struct rfcomm_session *s)
-{
-        atomic_inc(&s->refcnt);
-}
-
 /* ---- RFCOMM sockets ---- */
 struct sockaddr_rc {
         sa_family_t     rc_family;
diff --git a/include/net/caif/caif_dev.h b/include/net/caif/caif_dev.h
index ef2dd9438bb1..028b754ae9b1 100644
--- a/include/net/caif/caif_dev.h
+++ b/include/net/caif/caif_dev.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/ sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/caif_device.h b/include/net/caif/caif_device.h
index d02f044adb8a..d6e3c4267c81 100644
--- a/include/net/caif/caif_device.h
+++ b/include/net/caif/caif_device.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/ sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
index bcb9cc3ce98b..4795e817afe5 100644
--- a/include/net/caif/caif_hsi.h
+++ b/include/net/caif/caif_hsi.h
@@ -1,6 +1,5 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Contact: Sjur Brendeland / sjur.brandeland@stericsson.com
  * Author:  Daniel Martensson / daniel.martensson@stericsson.com
  *          Dmitry.Tarnyagin  / dmitry.tarnyagin@stericsson.com
  * License terms: GNU General Public License (GPL) version 2
diff --git a/include/net/caif/caif_layer.h b/include/net/caif/caif_layer.h
index 0f3a39125f90..94e5ed64dc6d 100644
--- a/include/net/caif/caif_layer.h
+++ b/include/net/caif/caif_layer.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland / sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/caif_shm.h b/include/net/caif/caif_shm.h
deleted file mode 100644
index 5bcce55438cf..000000000000
--- a/include/net/caif/caif_shm.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) ST-Ericsson AB 2010
- * Contact: Sjur Brendeland / sjur.brandeland@stericsson.com
- * Author: Amarnath Revanna / amarnath.bangalore.revanna@stericsson.com
- * License terms: GNU General Public License (GPL) version 2
- */
-
-#ifndef CAIF_SHM_H_
-#define CAIF_SHM_H_
-
-struct shmdev_layer {
-        u32 shm_base_addr;
-        u32 shm_total_sz;
-        u32 shm_id;
-        u32 shm_loopback;
-        void *hmbx;
-        int (*pshmdev_mbxsend) (u32 shm_id, u32 mbx_msg);
-        int (*pshmdev_mbxsetup) (void *pshmdrv_cb,
-                                struct shmdev_layer *pshm_dev, void *pshm_drv);
-        struct net_device *pshm_netdev;
-};
-
-extern int caif_shmcore_probe(struct shmdev_layer *pshm_dev);
-extern void caif_shmcore_remove(struct net_device *pshm_netdev);
-
-#endif
diff --git a/include/net/caif/cfcnfg.h b/include/net/caif/cfcnfg.h
index 90b4ff8bad83..70bfd017581f 100644
--- a/include/net/caif/cfcnfg.h
+++ b/include/net/caif/cfcnfg.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
index 9e5425b4a1d7..f2ae33d23baf 100644
--- a/include/net/caif/cfctrl.h
+++ b/include/net/caif/cfctrl.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cffrml.h b/include/net/caif/cffrml.h
index afac1a48cce7..a06e33fbaa8b 100644
--- a/include/net/caif/cffrml.h
+++ b/include/net/caif/cffrml.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cfmuxl.h b/include/net/caif/cfmuxl.h
index 5847a196b8ad..752999572f21 100644
--- a/include/net/caif/cfmuxl.h
+++ b/include/net/caif/cfmuxl.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cfpkt.h b/include/net/caif/cfpkt.h
index 83a89ba3005b..1c1ad46250d5 100644
--- a/include/net/caif/cfpkt.h
+++ b/include/net/caif/cfpkt.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cfserl.h b/include/net/caif/cfserl.h
index f121299a3427..b5b020f3c72e 100644
--- a/include/net/caif/cfserl.h
+++ b/include/net/caif/cfserl.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/caif/cfsrvl.h b/include/net/caif/cfsrvl.h
index 0f5905241843..cd47705c2cc3 100644
--- a/include/net/caif/cfsrvl.h
+++ b/include/net/caif/cfsrvl.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
- * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
+ * Author:      Sjur Brendeland
  * License terms: GNU General Public License (GPL) version 2
  */
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index d581c6de5d64..26b5b692c22b 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -611,22 +611,10 @@ struct cfg80211_ap_settings {
 };
 
 /**
- * enum plink_action - actions to perform in mesh peers
- *
- * @PLINK_ACTION_INVALID: action 0 is reserved
- * @PLINK_ACTION_OPEN: start mesh peer link establishment
- * @PLINK_ACTION_BLOCK: block traffic from this mesh peer
- */
-enum plink_actions {
-        PLINK_ACTION_INVALID,
-        PLINK_ACTION_OPEN,
-        PLINK_ACTION_BLOCK,
-};
-
-/**
  * enum station_parameters_apply_mask - station parameter values to apply
  * @STATION_PARAM_APPLY_UAPSD: apply new uAPSD parameters (uapsd_queues, max_sp)
  * @STATION_PARAM_APPLY_CAPABILITY: apply new capability
+ * @STATION_PARAM_APPLY_PLINK_STATE: apply new plink state
  *
  * Not all station parameters have in-band "no change" signalling,
  * for those that don't these flags will are used.
@@ -634,6 +622,7 @@ enum plink_actions {
 enum station_parameters_apply_mask {
         STATION_PARAM_APPLY_UAPSD = BIT(0),
         STATION_PARAM_APPLY_CAPABILITY = BIT(1),
+        STATION_PARAM_APPLY_PLINK_STATE = BIT(2),
 };
 
 /**
@@ -669,7 +658,7 @@ enum station_parameters_apply_mask {
  * @ext_capab_len: number of extended capabilities
  */
 struct station_parameters {
-        u8 *supported_rates;
+        const u8 *supported_rates;
         struct net_device *vlan;
         u32 sta_flags_mask, sta_flags_set;
         u32 sta_modify_mask;
@@ -678,17 +667,60 @@ struct station_parameters {
         u8 supported_rates_len;
         u8 plink_action;
         u8 plink_state;
-        struct ieee80211_ht_cap *ht_capa;
-        struct ieee80211_vht_cap *vht_capa;
+        const struct ieee80211_ht_cap *ht_capa;
+        const struct ieee80211_vht_cap *vht_capa;
         u8 uapsd_queues;
         u8 max_sp;
         enum nl80211_mesh_power_mode local_pm;
         u16 capability;
-        u8 *ext_capab;
+        const u8 *ext_capab;
         u8 ext_capab_len;
 };
 
 /**
+ * enum cfg80211_station_type - the type of station being modified
+ * @CFG80211_STA_AP_CLIENT: client of an AP interface
+ * @CFG80211_STA_AP_MLME_CLIENT: client of an AP interface that has
+ *      the AP MLME in the device
+ * @CFG80211_STA_AP_STA: AP station on managed interface
+ * @CFG80211_STA_IBSS: IBSS station
+ * @CFG80211_STA_TDLS_PEER_SETUP: TDLS peer on managed interface (dummy entry
+ *      while TDLS setup is in progress, it moves out of this state when
+ *      being marked authorized; use this only if TDLS with external setup is
+ *      supported/used)
+ * @CFG80211_STA_TDLS_PEER_ACTIVE: TDLS peer on managed interface (active
+ *      entry that is operating, has been marked authorized by userspace)
+ * @CFG80211_STA_MESH_PEER_KERNEL: peer on mesh interface (kernel managed)
+ * @CFG80211_STA_MESH_PEER_USER: peer on mesh interface (user managed)
+ */
+enum cfg80211_station_type {
+        CFG80211_STA_AP_CLIENT,
+        CFG80211_STA_AP_MLME_CLIENT,
+        CFG80211_STA_AP_STA,
+        CFG80211_STA_IBSS,
+        CFG80211_STA_TDLS_PEER_SETUP,
+        CFG80211_STA_TDLS_PEER_ACTIVE,
+        CFG80211_STA_MESH_PEER_KERNEL,
+        CFG80211_STA_MESH_PEER_USER,
+};
+
+/**
+ * cfg80211_check_station_change - validate parameter changes
+ * @wiphy: the wiphy this operates on
+ * @params: the new parameters for a station
+ * @statype: the type of station being modified
+ *
+ * Utility function for the @change_station driver method. Call this function
+ * with the appropriate station type looking up the station (and checking that
+ * it exists). It will verify whether the station change is acceptable, and if
+ * not will return an error code. Note that it may modify the parameters for
+ * backward compatibility reasons, so don't use them before calling this.
+ */
+int cfg80211_check_station_change(struct wiphy *wiphy,
+                                  struct station_parameters *params,
+                                  enum cfg80211_station_type statype);
+
+/**
  * enum station_info_flags - station information flags
  *
  * Used by the driver to indicate which info in &struct station_info
@@ -1119,6 +1151,7 @@ struct mesh_config {
  * @ie_len: length of vendor information elements
  * @is_authenticated: this mesh requires authentication
  * @is_secure: this mesh uses security
+ * @user_mpm: userspace handles all MPM functions
  * @dtim_period: DTIM period to use
  * @beacon_interval: beacon interval to use
  * @mcast_rate: multicat rate for Mesh Node [6Mbps is the default for 802.11a]
@@ -1136,6 +1169,7 @@ struct mesh_setup {
         u8 ie_len;
         bool is_authenticated;
         bool is_secure;
+        bool user_mpm;
         u8 dtim_period;
         u16 beacon_interval;
         int mcast_rate[IEEE80211_NUM_BANDS];
@@ -1398,9 +1432,11 @@ struct cfg80211_auth_request {
  * enum cfg80211_assoc_req_flags - Over-ride default behaviour in association.
  *
  * @ASSOC_REQ_DISABLE_HT:  Disable HT (802.11n)
+ * @ASSOC_REQ_DISABLE_VHT:  Disable VHT
  */
 enum cfg80211_assoc_req_flags {
         ASSOC_REQ_DISABLE_HT            = BIT(0),
+        ASSOC_REQ_DISABLE_VHT           = BIT(1),
 };
 
 /**
@@ -1422,6 +1458,8 @@ enum cfg80211_assoc_req_flags {
  * @ht_capa:  HT Capabilities over-rides.  Values set in ht_capa_mask
  *   will be used in ht_capa.  Un-supported values will be ignored.
  * @ht_capa_mask:  The bits of ht_capa which are to be used.
+ * @vht_capa: VHT capability override
+ * @vht_capa_mask: VHT capability mask indicating which fields to use
  */
 struct cfg80211_assoc_request {
         struct cfg80211_bss *bss;
@@ -1432,6 +1470,7 @@ struct cfg80211_assoc_request {
         u32 flags;
         struct ieee80211_ht_cap ht_capa;
         struct ieee80211_ht_cap ht_capa_mask;
+        struct ieee80211_vht_cap vht_capa, vht_capa_mask;
 };
 
 /**
@@ -1542,6 +1581,8 @@ struct cfg80211_ibss_params {
  * @ht_capa:  HT Capabilities over-rides.  Values set in ht_capa_mask
  *   will be used in ht_capa.  Un-supported values will be ignored.
  * @ht_capa_mask:  The bits of ht_capa which are to be used.
+ * @vht_capa:  VHT Capability overrides
+ * @vht_capa_mask: The bits of vht_capa which are to be used.
  */
 struct cfg80211_connect_params {
         struct ieee80211_channel *channel;
@@ -1560,6 +1601,8 @@ struct cfg80211_connect_params {
         int bg_scan_period;
         struct ieee80211_ht_cap ht_capa;
         struct ieee80211_ht_cap ht_capa_mask;
+        struct ieee80211_vht_cap vht_capa;
+        struct ieee80211_vht_cap vht_capa_mask;
 };
 
 /**
@@ -1722,6 +1765,21 @@ struct cfg80211_gtk_rekey_data {
 };
 
 /**
+ * struct cfg80211_update_ft_ies_params - FT IE Information
+ *
+ * This structure provides information needed to update the fast transition IE
+ *
+ * @md: The Mobility Domain ID, 2 Octet value
+ * @ie: Fast Transition IEs
+ * @ie_len: Length of ft_ie in octets
+ */
+struct cfg80211_update_ft_ies_params {
+        u16 md;
+        const u8 *ie;
+        size_t ie_len;
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -1781,9 +1839,8 @@ struct cfg80211_gtk_rekey_data {
  * @change_station: Modify a given station. Note that flags changes are not much
  *      validated in cfg80211, in particular the auth/assoc/authorized flags
  *      might come to the driver in invalid combinations -- make sure to check
- *      them, also against the existing state! Also, supported_rates changes are
- *      not checked in station mode -- drivers need to reject (or ignore) them
- *      for anything but TDLS peers.
+ *      them, also against the existing state! Drivers must call
+ *      cfg80211_check_station_change() to validate the information.
  * @get_station: get station information for the station identified by @mac
  * @dump_station: dump station callback -- resume dump at index @idx
  *
@@ -1941,6 +1998,16 @@ struct cfg80211_gtk_rekey_data {
  *      advertise the support for MAC based ACL have to implement this callback.
  *
  * @start_radar_detection: Start radar detection in the driver.
+ *
+ * @update_ft_ies: Provide updated Fast BSS Transition information to the
+ *      driver. If the SME is in the driver/firmware, this information can be
+ *      used in building Authentication and Reassociation Request frames.
+ *
+ * @crit_proto_start: Indicates a critical protocol needs more link reliability
+ *      for a given duration (milliseconds). The protocol is provided so the
+ *      driver can take the most appropriate actions.
+ * @crit_proto_stop: Indicates critical protocol no longer needs increased link
+ *      reliability. This operation can not fail.
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -2168,6 +2235,14 @@ struct cfg80211_ops {
         int     (*start_radar_detection)(struct wiphy *wiphy,
                                          struct net_device *dev,
                                          struct cfg80211_chan_def *chandef);
+        int     (*update_ft_ies)(struct wiphy *wiphy, struct net_device *dev,
+                                 struct cfg80211_update_ft_ies_params *ftie);
+        int     (*crit_proto_start)(struct wiphy *wiphy,
+                                    struct wireless_dev *wdev,
+                                    enum nl80211_crit_proto_id protocol,
+                                    u16 duration);
+        void    (*crit_proto_stop)(struct wiphy *wiphy,
+                                   struct wireless_dev *wdev);
 };
 
 /*
@@ -2485,6 +2560,8 @@ struct wiphy_wowlan_support {
  * @ap_sme_capa: AP SME capabilities, flags from &enum nl80211_ap_sme_features.
  * @ht_capa_mod_mask:  Specify what ht_cap values can be over-ridden.
  *      If null, then none can be over-ridden.
+ * @vht_capa_mod_mask:  Specify what VHT capabilities can be over-ridden.
+ *      If null, then none can be over-ridden.
  *
  * @max_acl_mac_addrs: Maximum number of MAC addresses that the device
  *      supports for ACL.
@@ -2593,6 +2670,7 @@ struct wiphy {
         struct dentry *debugfsdir;
 
         const struct ieee80211_ht_cap *ht_capa_mod_mask;
+        const struct ieee80211_vht_cap *vht_capa_mod_mask;
 
 #ifdef CONFIG_NET_NS
         /* the network namespace this phy lives in currently */
@@ -3958,6 +4036,17 @@ bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
 void cfg80211_ch_switch_notify(struct net_device *dev,
                                struct cfg80211_chan_def *chandef);
 
+/**
+ * ieee80211_operating_class_to_band - convert operating class to band
+ *
+ * @operating_class: the operating class to convert
+ * @band: band pointer to fill
+ *
+ * Returns %true if the conversion was successful, %false otherwise.
+ */
+bool ieee80211_operating_class_to_band(u8 operating_class,
+                                       enum ieee80211_band *band);
+
 /*
  * cfg80211_tdls_oper_request - request userspace to perform TDLS operation
  * @dev: the device on which the operation is requested
@@ -4002,6 +4091,30 @@ u32 cfg80211_calculate_bitrate(struct rate_info *rate);
 void cfg80211_unregister_wdev(struct wireless_dev *wdev);
 
 /**
+ * struct cfg80211_ft_event - FT Information Elements
+ * @ies: FT IEs
+ * @ies_len: length of the FT IE in bytes
+ * @target_ap: target AP's MAC address
+ * @ric_ies: RIC IE
+ * @ric_ies_len: length of the RIC IE in bytes
+ */
+struct cfg80211_ft_event_params {
+        const u8 *ies;
+        size_t ies_len;
+        const u8 *target_ap;
+        const u8 *ric_ies;
+        size_t ric_ies_len;
+};
+
+/**
+ * cfg80211_ft_event - notify userspace about FT IE and RIC IE
+ * @netdev: network device
+ * @ft_event: IE information
+ */
+void cfg80211_ft_event(struct net_device *netdev,
+                       struct cfg80211_ft_event_params *ft_event);
+
+/**
  * cfg80211_get_p2p_attr - find and copy a P2P attribute from IE buffer
  * @ies: the input IE buffer
  * @len: the input length
@@ -4036,6 +4149,17 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                                    struct cfg80211_wowlan_wakeup *wakeup,
                                    gfp_t gfp);
 
+/**
+ * cfg80211_crit_proto_stopped() - indicate critical protocol stopped by driver.
+ *
+ * @wdev: the wireless device for which critical protocol is stopped.
+ *
+ * This function can be called by the driver to indicate it has reverted
+ * operation back to normal. One reason could be that the duration given
+ * by .crit_proto_start() has expired.
+ */
+void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
index 2581638f4a3d..0fee0617fb7d 100644
--- a/include/net/cls_cgroup.h
+++ b/include/net/cls_cgroup.h
@@ -24,7 +24,7 @@ struct cgroup_cls_state
         u32 classid;
 };
 
-extern void sock_update_classid(struct sock *sk, struct task_struct *task);
+extern void sock_update_classid(struct sock *sk);
 
 #if IS_BUILTIN(CONFIG_NET_CLS_CGROUP)
 static inline u32 task_cls_classid(struct task_struct *p)
@@ -61,7 +61,7 @@ static inline u32 task_cls_classid(struct task_struct *p)
 }
 #endif
 #else /* !CGROUP_NET_CLS_CGROUP */
-static inline void sock_update_classid(struct sock *sk, struct task_struct *task)
+static inline void sock_update_classid(struct sock *sk)
 {
 }
 
diff --git a/include/net/dn_fib.h b/include/net/dn_fib.h
index 1ee9d4bda30d..74004af31c48 100644
--- a/include/net/dn_fib.h
+++ b/include/net/dn_fib.h
@@ -1,24 +1,9 @@
 #ifndef _NET_DN_FIB_H
 #define _NET_DN_FIB_H
 
-/* WARNING: The ordering of these elements must match ordering
- *          of RTA_* rtnetlink attribute numbers.
- */
-struct dn_kern_rta {
-        void            *rta_dst;
-        void            *rta_src;
-        int             *rta_iif;
-        int             *rta_oif;
-        void            *rta_gw;
-        u32             *rta_priority;
-        void            *rta_prefsrc;
-        struct rtattr   *rta_mx;
-        struct rtattr   *rta_mp;
-        unsigned char   *rta_protoinfo;
-        u32             *rta_flow;
-        struct rta_cacheinfo *rta_ci;
-        struct rta_session *rta_sess;
-};
+#include <linux/netlink.h>
+
+extern const struct nla_policy rtm_dn_policy[];
 
 struct dn_fib_res {
         struct fib_rule *r;
@@ -93,10 +78,10 @@ struct dn_fib_table {
         u32 n;
 
         int (*insert)(struct dn_fib_table *t, struct rtmsg *r, 
-                        struct dn_kern_rta *rta, struct nlmsghdr *n, 
+                        struct nlattr *attrs[], struct nlmsghdr *n,
                         struct netlink_skb_parms *req);
         int (*delete)(struct dn_fib_table *t, struct rtmsg *r,
-                        struct dn_kern_rta *rta, struct nlmsghdr *n,
+                        struct nlattr *attrs[], struct nlmsghdr *n,
                         struct netlink_skb_parms *req);
         int (*lookup)(struct dn_fib_table *t, const struct flowidn *fld,
                         struct dn_fib_res *res);
@@ -116,13 +101,12 @@ extern void dn_fib_cleanup(void);
 extern int dn_fib_ioctl(struct socket *sock, unsigned int cmd, 
                         unsigned long arg);
 extern struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, 
-                                struct dn_kern_rta *rta, 
+                                struct nlattr *attrs[],
                                 const struct nlmsghdr *nlh, int *errp);
 extern int dn_fib_semantic_match(int type, struct dn_fib_info *fi, 
                         const struct flowidn *fld,
                         struct dn_fib_res *res);
 extern void dn_fib_release_info(struct dn_fib_info *fi);
-extern __le16 dn_fib_get_attr16(struct rtattr *attr, int attrlen, int type);
 extern void dn_fib_flush(void);
 extern void dn_fib_select_multipath(const struct flowidn *fld,
                                         struct dn_fib_res *res);
diff --git a/include/net/firewire.h b/include/net/firewire.h
new file mode 100644
index 000000000000..31bcbfe7a220
--- /dev/null
+++ b/include/net/firewire.h
@@ -0,0 +1,25 @@
+#ifndef _NET_FIREWIRE_H
+#define _NET_FIREWIRE_H
+
+/* Pseudo L2 address */
+#define FWNET_ALEN      16
+union fwnet_hwaddr {
+        u8 u[FWNET_ALEN];
+        /* "Hardware address" defined in RFC2734/RF3146 */
+        struct {
+                __be64 uniq_id;         /* EUI-64                       */
+                u8 max_rec;             /* max packet size              */
+                u8 sspd;                /* max speed                    */
+                __be16 fifo_hi;         /* hi 16bits of FIFO addr       */
+                __be32 fifo_lo;         /* lo 32bits of FIFO addr       */
+        } __packed uc;
+};
+
+/* Pseudo L2 Header */
+#define FWNET_HLEN      18
+struct fwnet_header {
+        u8 h_dest[FWNET_ALEN];  /* destination address */
+        __be16 h_proto;         /* packet type ID field */
+} __packed;
+
+#endif
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index bdfbe68c1c3b..93024a47e0e2 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -50,6 +50,7 @@ struct genl_family {
         unsigned int            version;
         unsigned int            maxattr;
         bool                    netnsok;
+        bool                    parallel_ops;
         int                     (*pre_doit)(struct genl_ops *ops,
                                             struct sk_buff *skb,
                                             struct genl_info *info);
diff --git a/include/net/gre.h b/include/net/gre.h
index 82665474bcb7..9f03a390c826 100644
--- a/include/net/gre.h
+++ b/include/net/gre.h
@@ -2,6 +2,7 @@
 #define __LINUX_GRE_H
 
 #include <linux/skbuff.h>
+#include <net/ip_tunnels.h>
 
 #define GREPROTO_CISCO          0
 #define GREPROTO_PPTP           1
@@ -12,7 +13,57 @@ struct gre_protocol {
         void (*err_handler)(struct sk_buff *skb, u32 info);
 };
 
+struct gre_base_hdr {
+        __be16 flags;
+        __be16 protocol;
+};
+#define GRE_HEADER_SECTION 4
+
 int gre_add_protocol(const struct gre_protocol *proto, u8 version);
 int gre_del_protocol(const struct gre_protocol *proto, u8 version);
 
+static inline __be16 gre_flags_to_tnl_flags(__be16 flags)
+{
+        __be16 tflags = 0;
+
+        if (flags & GRE_CSUM)
+                tflags |= TUNNEL_CSUM;
+        if (flags & GRE_ROUTING)
+                tflags |= TUNNEL_ROUTING;
+        if (flags & GRE_KEY)
+                tflags |= TUNNEL_KEY;
+        if (flags & GRE_SEQ)
+                tflags |= TUNNEL_SEQ;
+        if (flags & GRE_STRICT)
+                tflags |= TUNNEL_STRICT;
+        if (flags & GRE_REC)
+                tflags |= TUNNEL_REC;
+        if (flags & GRE_VERSION)
+                tflags |= TUNNEL_VERSION;
+
+        return tflags;
+}
+
+static inline __be16 tnl_flags_to_gre_flags(__be16 tflags)
+{
+        __be16 flags = 0;
+
+        if (tflags & TUNNEL_CSUM)
+                flags |= GRE_CSUM;
+        if (tflags & TUNNEL_ROUTING)
+                flags |= GRE_ROUTING;
+        if (tflags & TUNNEL_KEY)
+                flags |= GRE_KEY;
+        if (tflags & TUNNEL_SEQ)
+                flags |= GRE_SEQ;
+        if (tflags & TUNNEL_STRICT)
+                flags |= GRE_STRICT;
+        if (tflags & TUNNEL_REC)
+                flags |= GRE_REC;
+        if (tflags & TUNNEL_VERSION)
+                flags |= GRE_VERSION;
+
+        return flags;
+}
+
 #endif
diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
index d104c882fc29..8196d5d40359 100644
--- a/include/net/ieee802154_netdev.h
+++ b/include/net/ieee802154_netdev.h
@@ -85,6 +85,8 @@ struct wpan_phy;
  * Use wpan_wpy_put to put that reference.
  */
 struct ieee802154_mlme_ops {
+        /* The following fields are optional (can be NULL). */
+
         int (*assoc_req)(struct net_device *dev,
                         struct ieee802154_addr *addr,
                         u8 channel, u8 page, u8 cap);
@@ -101,6 +103,8 @@ struct ieee802154_mlme_ops {
         int (*scan_req)(struct net_device *dev,
                         u8 type, u32 channels, u8 page, u8 duration);
 
+        /* The fields below are required. */
+
         struct wpan_phy *(*get_phy)(const struct net_device *dev);
 
         /*
@@ -110,7 +114,6 @@ struct ieee802154_mlme_ops {
         u16 (*get_pan_id)(const struct net_device *dev);
         u16 (*get_short_addr)(const struct net_device *dev);
         u8 (*get_dsn)(const struct net_device *dev);
-        u8 (*get_bsn)(const struct net_device *dev);
 };
 
 /* The IEEE 802.15.4 standard defines 2 type of the devices:
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 93563221d29a..100fb8cec17c 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -71,6 +71,8 @@ struct inet6_ifaddr {
         struct inet6_ifaddr     *ifpub;
         int                     regen_count;
 #endif
+        bool                    tokenized;
+
         struct rcu_head         rcu;
 };
 
@@ -187,6 +189,8 @@ struct inet6_dev {
         struct list_head        tempaddr_list;
 #endif
 
+        struct in6_addr         token;
+
         struct neigh_parms      *nd_parms;
         struct inet6_dev        *next;
         struct ipv6_devconf     cnf;
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 183292722f6e..de2c78529afa 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -133,6 +133,8 @@ struct inet_connection_sock {
 #define ICSK_TIME_RETRANS       1       /* Retransmit timer */
 #define ICSK_TIME_DACK          2       /* Delayed ack timer */
 #define ICSK_TIME_PROBE0        3       /* Zero window probe timer */
+#define ICSK_TIME_EARLY_RETRANS 4       /* Early retransmit timer */
+#define ICSK_TIME_LOSS_PROBE    5       /* Tail loss probe timer */
 
 static inline struct inet_connection_sock *inet_csk(const struct sock *sk)
 {
@@ -222,7 +224,8 @@ static inline void inet_csk_reset_xmit_timer(struct sock *sk, const int what,
                 when = max_when;
         }
 
-        if (what == ICSK_TIME_RETRANS || what == ICSK_TIME_PROBE0) {
+        if (what == ICSK_TIME_RETRANS || what == ICSK_TIME_PROBE0 ||
+            what == ICSK_TIME_EARLY_RETRANS || what ==  ICSK_TIME_LOSS_PROBE) {
                 icsk->icsk_pending = what;
                 icsk->icsk_timeout = jiffies + when;
                 sk_reset_timer(sk, &icsk->icsk_retransmit_timer, icsk->icsk_timeout);
diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
index 0a1dcc2fa2f5..4182c9be8bb5 100644
--- a/include/net/inet_frag.h
+++ b/include/net/inet_frag.h
@@ -41,7 +41,7 @@ struct inet_frag_queue {
         struct netns_frags      *net;
 };
 
-#define INETFRAGS_HASHSZ                64
+#define INETFRAGS_HASHSZ        1024
 
 /* averaged:
  * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ /
@@ -50,10 +50,16 @@ struct inet_frag_queue {
  */
 #define INETFRAGS_MAXDEPTH              128
 
+struct inet_frag_bucket {
+        struct hlist_head       chain;
+        spinlock_t              chain_lock;
+};
+
 struct inet_frags {
-        struct hlist_head       hash[INETFRAGS_HASHSZ];
+        struct inet_frag_bucket hash[INETFRAGS_HASHSZ];
         /* This rwlock is a global lock (seperate per IPv4, IPv6 and
          * netfilter). Important to keep this on a seperate cacheline.
+         * Its primarily a rebuild protection rwlock.
          */
         rwlock_t                lock ____cacheline_aligned_in_smp;
         int                     secret_interval;
@@ -143,6 +149,7 @@ static inline void inet_frag_lru_del(struct inet_frag_queue *q)
 {
         spin_lock(&q->net->lru_lock);
         list_del(&q->lru_list);
+        q->net->nqueues--;
         spin_unlock(&q->net->lru_lock);
 }
 
@@ -151,6 +158,19 @@ static inline void inet_frag_lru_add(struct netns_frags *nf,
 {
         spin_lock(&nf->lru_lock);
         list_add_tail(&q->lru_list, &nf->lru_list);
+        q->net->nqueues++;
         spin_unlock(&nf->lru_lock);
 }
+
+/* RFC 3168 support :
+ * We want to check ECN values of all fragments, do detect invalid combinations.
+ * In ipq->ecn, we store the OR value of each ip4_frag_ecn() fragment value.
+ */
+#define IPFRAG_ECN_NOT_ECT      0x01 /* one frag had ECN_NOT_ECT */
+#define IPFRAG_ECN_ECT_1        0x02 /* one frag had ECN_ECT_1 */
+#define IPFRAG_ECN_ECT_0        0x04 /* one frag had ECN_ECT_0 */
+#define IPFRAG_ECN_CE           0x08 /* one frag had ECN_CE */
+
+extern const u8 ip_frag_ecn_table[16];
+
 #endif
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index e03047f7090b..4da5de10d1d4 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -3,6 +3,7 @@
 
 #include <linux/ipv6.h>
 #include <linux/netdevice.h>
+#include <linux/if_tunnel.h>
 #include <linux/ip6_tunnel.h>
 
 #define IP6TUNNEL_ERR_TIMEO (30*HZ)
@@ -68,4 +69,24 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw);
 __u32 ip6_tnl_get_cap(struct ip6_tnl *t, const struct in6_addr *laddr,
                              const struct in6_addr *raddr);
 
+static inline void ip6tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct net_device_stats *stats = &dev->stats;
+        int pkt_len, err;
+
+        nf_reset(skb);
+        pkt_len = skb->len;
+        err = ip6_local_out(skb);
+
+        if (net_xmit_eval(err) == 0) {
+                struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
+                tstats->tx_bytes += pkt_len;
+                tstats->tx_packets++;
+                u64_stats_update_end(&tstats->syncp);
+        } else {
+                stats->tx_errors++;
+                stats->tx_aborted_errors++;
+        }
+}
 #endif
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
new file mode 100644
index 000000000000..4b6f0b28f41f
--- /dev/null
+++ b/include/net/ip_tunnels.h
@@ -0,0 +1,177 @@
+#ifndef __NET_IP_TUNNELS_H
+#define __NET_IP_TUNNELS_H 1
+
+#include <linux/if_tunnel.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <linux/types.h>
+#include <linux/u64_stats_sync.h>
+#include <net/dsfield.h>
+#include <net/gro_cells.h>
+#include <net/inet_ecn.h>
+#include <net/ip.h>
+#include <net/rtnetlink.h>
+
+#if IS_ENABLED(CONFIG_IPV6)
+#include <net/ipv6.h>
+#include <net/ip6_fib.h>
+#include <net/ip6_route.h>
+#endif
+
+/* Keep error state on tunnel for 30 sec */
+#define IPTUNNEL_ERR_TIMEO      (30*HZ)
+
+/* 6rd prefix/relay information */
+#ifdef CONFIG_IPV6_SIT_6RD
+struct ip_tunnel_6rd_parm {
+        struct in6_addr         prefix;
+        __be32                  relay_prefix;
+        u16                     prefixlen;
+        u16                     relay_prefixlen;
+};
+#endif
+
+struct ip_tunnel_prl_entry {
+        struct ip_tunnel_prl_entry __rcu *next;
+        __be32                          addr;
+        u16                             flags;
+        struct rcu_head                 rcu_head;
+};
+
+struct ip_tunnel {
+        struct ip_tunnel __rcu  *next;
+        struct hlist_node hash_node;
+        struct net_device       *dev;
+
+        int             err_count;      /* Number of arrived ICMP errors */
+        unsigned long   err_time;       /* Time when the last ICMP error
+                                         * arrived */
+
+        /* These four fields used only by GRE */
+        __u32           i_seqno;        /* The last seen seqno  */
+        __u32           o_seqno;        /* The last output seqno */
+        int             hlen;           /* Precalculated header length */
+        int             mlink;
+
+        struct ip_tunnel_parm parms;
+
+        /* for SIT */
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel_6rd_parm ip6rd;
+#endif
+        struct ip_tunnel_prl_entry __rcu *prl;  /* potential router list */
+        unsigned int            prl_count;      /* # of entries in PRL */
+        int                     ip_tnl_net_id;
+        struct gro_cells        gro_cells;
+};
+
+#define TUNNEL_CSUM     __cpu_to_be16(0x01)
+#define TUNNEL_ROUTING  __cpu_to_be16(0x02)
+#define TUNNEL_KEY      __cpu_to_be16(0x04)
+#define TUNNEL_SEQ      __cpu_to_be16(0x08)
+#define TUNNEL_STRICT   __cpu_to_be16(0x10)
+#define TUNNEL_REC      __cpu_to_be16(0x20)
+#define TUNNEL_VERSION  __cpu_to_be16(0x40)
+#define TUNNEL_NO_KEY   __cpu_to_be16(0x80)
+
+struct tnl_ptk_info {
+        __be16 flags;
+        __be16 proto;
+        __be32 key;
+        __be32 seq;
+};
+
+#define PACKET_RCVD     0
+#define PACKET_REJECT   1
+
+#define IP_TNL_HASH_BITS   10
+#define IP_TNL_HASH_SIZE   (1 << IP_TNL_HASH_BITS)
+
+struct ip_tunnel_net {
+        struct hlist_head *tunnels;
+        struct net_device *fb_tunnel_dev;
+};
+
+int ip_tunnel_init(struct net_device *dev);
+void ip_tunnel_uninit(struct net_device *dev);
+void  ip_tunnel_dellink(struct net_device *dev, struct list_head *head);
+int __net_init ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
+                                  struct rtnl_link_ops *ops, char *devname);
+
+void __net_exit ip_tunnel_delete_net(struct ip_tunnel_net *itn);
+
+void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+                    const struct iphdr *tnl_params);
+int ip_tunnel_ioctl(struct net_device *dev, struct ip_tunnel_parm *p, int cmd);
+int ip_tunnel_change_mtu(struct net_device *dev, int new_mtu);
+
+struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
+                                                struct rtnl_link_stats64 *tot);
+struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
+                                   int link, __be16 flags,
+                                   __be32 remote, __be32 local,
+                                   __be32 key);
+
+int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+                  const struct tnl_ptk_info *tpi, bool log_ecn_error);
+int ip_tunnel_changelink(struct net_device *dev, struct nlattr *tb[],
+                         struct ip_tunnel_parm *p);
+int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
+                      struct ip_tunnel_parm *p);
+void ip_tunnel_setup(struct net_device *dev, int net_id);
+
+/* Extract dsfield from inner protocol */
+static inline u8 ip_tunnel_get_dsfield(const struct iphdr *iph,
+                                       const struct sk_buff *skb)
+{
+        if (skb->protocol == htons(ETH_P_IP))
+                return iph->tos;
+        else if (skb->protocol == htons(ETH_P_IPV6))
+                return ipv6_get_dsfield((const struct ipv6hdr *)iph);
+        else
+                return 0;
+}
+
+/* Propogate ECN bits out */
+static inline u8 ip_tunnel_ecn_encap(u8 tos, const struct iphdr *iph,
+                                     const struct sk_buff *skb)
+{
+        u8 inner = ip_tunnel_get_dsfield(iph, skb);
+
+        return INET_ECN_encapsulate(tos, inner);
+}
+
+static inline void tunnel_ip_select_ident(struct sk_buff *skb,
+                                          const struct iphdr  *old_iph,
+                                          struct dst_entry *dst)
+{
+        struct iphdr *iph = ip_hdr(skb);
+
+        /* Use inner packet iph-id if possible. */
+        if (skb->protocol == htons(ETH_P_IP) && old_iph->id)
+                iph->id = old_iph->id;
+        else
+                __ip_select_ident(iph, dst,
+                                  (skb_shinfo(skb)->gso_segs ?: 1) - 1);
+}
+
+static inline void iptunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        int err;
+        int pkt_len = skb->len - skb_transport_offset(skb);
+        struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
+
+        nf_reset(skb);
+
+        err = ip_local_out(skb);
+        if (likely(net_xmit_eval(err) == 0)) {
+                u64_stats_update_begin(&tstats->syncp);
+                tstats->tx_bytes += pkt_len;
+                tstats->tx_packets++;
+                u64_stats_update_end(&tstats->syncp);
+        } else {
+                dev->stats.tx_errors++;
+                dev->stats.tx_aborted_errors++;
+        }
+}
+#endif /* __NET_IP_TUNNELS_H */
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index fce8e6b66d55..4c062ccff9aa 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -233,6 +233,21 @@ static inline void ip_vs_addr_copy(int af, union nf_inet_addr *dst,
         dst->ip = src->ip;
 }
 
+static inline void ip_vs_addr_set(int af, union nf_inet_addr *dst,
+                                  const union nf_inet_addr *src)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6) {
+                dst->in6 = src->in6;
+                return;
+        }
+#endif
+        dst->ip = src->ip;
+        dst->all[1] = 0;
+        dst->all[2] = 0;
+        dst->all[3] = 0;
+}
+
 static inline int ip_vs_addr_equal(int af, const union nf_inet_addr *a,
                                    const union nf_inet_addr *b)
 {
@@ -344,8 +359,6 @@ static inline const char *ip_vs_dbg_addr(int af, char *buf, size_t buf_len,
 #define LeaveFunction(level)   do {} while (0)
 #endif
 
-#define IP_VS_WAIT_WHILE(expr)  while (expr) { cpu_relax(); }
-
 
 /*
  *      The port number of FTP service (in network order).
@@ -459,7 +472,7 @@ struct ip_vs_estimator {
 struct ip_vs_stats {
         struct ip_vs_stats_user ustats;         /* statistics */
         struct ip_vs_estimator  est;            /* estimator */
-        struct ip_vs_cpu_stats  *cpustats;      /* per cpu counters */
+        struct ip_vs_cpu_stats __percpu *cpustats;      /* per cpu counters */
         spinlock_t              lock;           /* spin lock */
         struct ip_vs_stats_user ustats0;        /* reset values */
 };
@@ -566,20 +579,19 @@ struct ip_vs_conn_param {
  */
 struct ip_vs_conn {
         struct hlist_node       c_list;         /* hashed list heads */
-#ifdef CONFIG_NET_NS
-        struct net              *net;           /* Name space */
-#endif
         /* Protocol, addresses and port numbers */
-        u16                     af;             /* address family */
         __be16                  cport;
-        __be16                  vport;
         __be16                  dport;
-        __u32                   fwmark;         /* Fire wall mark from skb */
+        __be16                  vport;
+        u16                     af;             /* address family */
         union nf_inet_addr      caddr;          /* client address */
         union nf_inet_addr      vaddr;          /* virtual address */
         union nf_inet_addr      daddr;          /* destination address */
         volatile __u32          flags;          /* status flags */
         __u16                   protocol;       /* Which protocol (TCP/UDP) */
+#ifdef CONFIG_NET_NS
+        struct net              *net;           /* Name space */
+#endif
 
         /* counter and timer */
         atomic_t                refcnt;         /* reference count */
@@ -593,6 +605,7 @@ struct ip_vs_conn {
                                                  * state transition triggerd
                                                  * synchronization
                                                  */
+        __u32                   fwmark;         /* Fire wall mark from skb */
         unsigned long           sync_endtime;   /* jiffies + sent_retries */
 
         /* Control members */
@@ -620,6 +633,8 @@ struct ip_vs_conn {
         const struct ip_vs_pe   *pe;
         char                    *pe_data;
         __u8                    pe_data_len;
+
+        struct rcu_head         rcu_head;
 };
 
 /*
@@ -663,7 +678,7 @@ struct ip_vs_service_user_kern {
         u16                     af;
         u16                     protocol;
         union nf_inet_addr      addr;           /* virtual ip address */
-        u16                     port;
+        __be16                  port;
         u32                     fwmark;         /* firwall mark of service */
 
         /* virtual service options */
@@ -671,14 +686,14 @@ struct ip_vs_service_user_kern {
         char                    *pe_name;
         unsigned int            flags;          /* virtual service flags */
         unsigned int            timeout;        /* persistent timeout in sec */
-        u32                     netmask;        /* persistent netmask */
+        __be32                  netmask;        /* persistent netmask or plen */
 };
 
 
 struct ip_vs_dest_user_kern {
         /* destination server address */
         union nf_inet_addr      addr;
-        u16                     port;
+        __be16                  port;
 
         /* real server options */
         unsigned int            conn_flags;     /* connection flags */
@@ -695,10 +710,9 @@ struct ip_vs_dest_user_kern {
  *      and the forwarding entries
  */
 struct ip_vs_service {
-        struct list_head        s_list;   /* for normal service table */
-        struct list_head        f_list;   /* for fwmark-based service table */
+        struct hlist_node       s_list;   /* for normal service table */
+        struct hlist_node       f_list;   /* for fwmark-based service table */
         atomic_t                refcnt;   /* reference counter */
-        atomic_t                usecnt;   /* use counter */
 
         u16                     af;       /* address family */
         __u16                   protocol; /* which protocol (TCP/UDP) */
@@ -707,31 +721,41 @@ struct ip_vs_service {
         __u32                   fwmark;   /* firewall mark of the service */
         unsigned int            flags;    /* service status flags */
         unsigned int            timeout;  /* persistent timeout in ticks */
-        __be32                  netmask;  /* grouping granularity */
+        __be32                  netmask;  /* grouping granularity, mask/plen */
         struct net              *net;
 
         struct list_head        destinations;  /* real server d-linked list */
         __u32                   num_dests;     /* number of servers */
         struct ip_vs_stats      stats;         /* statistics for the service */
-        struct ip_vs_app        *inc;     /* bind conns to this app inc */
 
         /* for scheduling */
-        struct ip_vs_scheduler  *scheduler;    /* bound scheduler object */
-        rwlock_t                sched_lock;    /* lock sched_data */
+        struct ip_vs_scheduler __rcu *scheduler; /* bound scheduler object */
+        spinlock_t              sched_lock;    /* lock sched_data */
         void                    *sched_data;   /* scheduler application data */
 
         /* alternate persistence engine */
-        struct ip_vs_pe         *pe;
+        struct ip_vs_pe __rcu   *pe;
+
+        struct rcu_head         rcu_head;
 };
 
+/* Information for cached dst */
+struct ip_vs_dest_dst {
+        struct dst_entry        *dst_cache;     /* destination cache entry */
+        u32                     dst_cookie;
+        union nf_inet_addr      dst_saddr;
+        struct rcu_head         rcu_head;
+};
 
+/* In grace period after removing */
+#define IP_VS_DEST_STATE_REMOVING       0x01
 /*
  *      The real server destination forwarding entry
  *      with ip address, port number, and so on.
  */
 struct ip_vs_dest {
         struct list_head        n_list;   /* for the dests in the service */
-        struct list_head        d_list;   /* for table with all the dests */
+        struct hlist_node       d_list;   /* for table with all the dests */
 
         u16                     af;             /* address family */
         __be16                  port;           /* port number of the server */
@@ -742,6 +766,7 @@ struct ip_vs_dest {
 
         atomic_t                refcnt;         /* reference counter */
         struct ip_vs_stats      stats;          /* statistics */
+        unsigned long           state;          /* state flags */
 
         /* connection counters and thresholds */
         atomic_t                activeconns;    /* active connections */
@@ -752,10 +777,7 @@ struct ip_vs_dest {
 
         /* for destination cache */
         spinlock_t              dst_lock;       /* lock of dst_cache */
-        struct dst_entry        *dst_cache;     /* destination cache entry */
-        u32                     dst_rtos;       /* RT_TOS(tos) for dst */
-        u32                     dst_cookie;
-        union nf_inet_addr      dst_saddr;
+        struct ip_vs_dest_dst __rcu *dest_dst;  /* cached dst info */
 
         /* for virtual service */
         struct ip_vs_service    *svc;           /* service it belongs to */
@@ -763,6 +785,10 @@ struct ip_vs_dest {
         __be16                  vport;          /* virtual port number */
         union nf_inet_addr      vaddr;          /* virtual IP address */
         __u32                   vfwmark;        /* firewall mark of service */
+
+        struct list_head        t_list;         /* in dest_trash */
+        struct rcu_head         rcu_head;
+        unsigned int            in_rs_table:1;  /* we are in rs_table */
 };
 
 
@@ -778,9 +804,13 @@ struct ip_vs_scheduler {
         /* scheduler initializing service */
         int (*init_service)(struct ip_vs_service *svc);
         /* scheduling service finish */
-        int (*done_service)(struct ip_vs_service *svc);
-        /* scheduler updating service */
-        int (*update_service)(struct ip_vs_service *svc);
+        void (*done_service)(struct ip_vs_service *svc);
+        /* dest is linked */
+        int (*add_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest);
+        /* dest is unlinked */
+        int (*del_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest);
+        /* dest is updated */
+        int (*upd_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest);
 
         /* selecting a server from the given service */
         struct ip_vs_dest* (*schedule)(struct ip_vs_service *svc,
@@ -819,6 +849,7 @@ struct ip_vs_app {
         struct ip_vs_app        *app;           /* its real application */
         __be16                  port;           /* port number in net order */
         atomic_t                usecnt;         /* usage counter */
+        struct rcu_head         rcu_head;
 
         /*
          * output hook: Process packet in inout direction, diff set for TCP.
@@ -881,6 +912,9 @@ struct ipvs_master_sync_state {
         struct netns_ipvs       *ipvs;
 };
 
+/* How much time to keep dests in trash */
+#define IP_VS_DEST_TRASH_PERIOD         (120 * HZ)
+
 /* IPVS in network namespace */
 struct netns_ipvs {
         int                     gen;            /* Generation */
@@ -892,7 +926,7 @@ struct netns_ipvs {
         #define IP_VS_RTAB_SIZE (1 << IP_VS_RTAB_BITS)
         #define IP_VS_RTAB_MASK (IP_VS_RTAB_SIZE - 1)
 
-        struct list_head        rs_table[IP_VS_RTAB_SIZE];
+        struct hlist_head       rs_table[IP_VS_RTAB_SIZE];
         /* ip_vs_app */
         struct list_head        app_list;
         /* ip_vs_proto */
@@ -904,7 +938,6 @@ struct netns_ipvs {
         #define TCP_APP_TAB_SIZE        (1 << TCP_APP_TAB_BITS)
         #define TCP_APP_TAB_MASK        (TCP_APP_TAB_SIZE - 1)
         struct list_head        tcp_apps[TCP_APP_TAB_SIZE];
-        spinlock_t              tcp_app_lock;
 #endif
         /* ip_vs_proto_udp */
 #ifdef CONFIG_IP_VS_PROTO_UDP
@@ -912,7 +945,6 @@ struct netns_ipvs {
         #define UDP_APP_TAB_SIZE        (1 << UDP_APP_TAB_BITS)
         #define UDP_APP_TAB_MASK        (UDP_APP_TAB_SIZE - 1)
         struct list_head        udp_apps[UDP_APP_TAB_SIZE];
-        spinlock_t              udp_app_lock;
 #endif
         /* ip_vs_proto_sctp */
 #ifdef CONFIG_IP_VS_PROTO_SCTP
@@ -921,7 +953,6 @@ struct netns_ipvs {
         #define SCTP_APP_TAB_MASK       (SCTP_APP_TAB_SIZE - 1)
         /* Hash table for SCTP application incarnations  */
         struct list_head        sctp_apps[SCTP_APP_TAB_SIZE];
-        spinlock_t              sctp_app_lock;
 #endif
         /* ip_vs_conn */
         atomic_t                conn_count;      /*  connection counter */
@@ -931,9 +962,10 @@ struct netns_ipvs {
 
         int                     num_services;    /* no of virtual services */
 
-        rwlock_t                rs_lock;         /* real services table */
         /* Trash for destinations */
         struct list_head        dest_trash;
+        spinlock_t              dest_trash_lock;
+        struct timer_list       dest_trash_timer; /* expiration timer */
         /* Service counters */
         atomic_t                ftpsvc_counter;
         atomic_t                nullsvc_counter;
@@ -1181,9 +1213,19 @@ struct ip_vs_conn * ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,
                                              const struct ip_vs_iphdr *iph,
                                              int inverse);
 
+/* Get reference to gain full access to conn.
+ * By default, RCU read-side critical sections have access only to
+ * conn fields and its PE data, see ip_vs_conn_rcu_free() for reference.
+ */
+static inline bool __ip_vs_conn_get(struct ip_vs_conn *cp)
+{
+        return atomic_inc_not_zero(&cp->refcnt);
+}
+
 /* put back the conn without restarting its timer */
 static inline void __ip_vs_conn_put(struct ip_vs_conn *cp)
 {
+        smp_mb__before_atomic_dec();
         atomic_dec(&cp->refcnt);
 }
 extern void ip_vs_conn_put(struct ip_vs_conn *cp);
@@ -1298,8 +1340,6 @@ extern void ip_vs_app_inc_put(struct ip_vs_app *inc);
 extern int ip_vs_app_pkt_out(struct ip_vs_conn *, struct sk_buff *skb);
 extern int ip_vs_app_pkt_in(struct ip_vs_conn *, struct sk_buff *skb);
 
-void ip_vs_bind_pe(struct ip_vs_service *svc, struct ip_vs_pe *pe);
-void ip_vs_unbind_pe(struct ip_vs_service *svc);
 int register_ip_vs_pe(struct ip_vs_pe *pe);
 int unregister_ip_vs_pe(struct ip_vs_pe *pe);
 struct ip_vs_pe *ip_vs_pe_getbyname(const char *name);
@@ -1346,7 +1386,8 @@ extern int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler);
 extern int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler);
 extern int ip_vs_bind_scheduler(struct ip_vs_service *svc,
                                 struct ip_vs_scheduler *scheduler);
-extern int ip_vs_unbind_scheduler(struct ip_vs_service *svc);
+extern void ip_vs_unbind_scheduler(struct ip_vs_service *svc,
+                                   struct ip_vs_scheduler *sched);
 extern struct ip_vs_scheduler *ip_vs_scheduler_get(const char *sched_name);
 extern void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler);
 extern struct ip_vs_conn *
@@ -1366,17 +1407,12 @@ extern struct ip_vs_stats ip_vs_stats;
 extern int sysctl_ip_vs_sync_ver;
 
 extern struct ip_vs_service *
-ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
+ip_vs_service_find(struct net *net, int af, __u32 fwmark, __u16 protocol,
                   const union nf_inet_addr *vaddr, __be16 vport);
 
-static inline void ip_vs_service_put(struct ip_vs_service *svc)
-{
-        atomic_dec(&svc->usecnt);
-}
-
-extern struct ip_vs_dest *
-ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
-                          const union nf_inet_addr *daddr, __be16 dport);
+extern bool
+ip_vs_has_real_service(struct net *net, int af, __u16 protocol,
+                       const union nf_inet_addr *daddr, __be16 dport);
 
 extern int ip_vs_use_count_inc(void);
 extern void ip_vs_use_count_dec(void);
@@ -1388,8 +1424,18 @@ extern struct ip_vs_dest *
 ip_vs_find_dest(struct net *net, int af, const union nf_inet_addr *daddr,
                 __be16 dport, const union nf_inet_addr *vaddr, __be16 vport,
                 __u16 protocol, __u32 fwmark, __u32 flags);
-extern struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp);
+extern void ip_vs_try_bind_dest(struct ip_vs_conn *cp);
 
+static inline void ip_vs_dest_hold(struct ip_vs_dest *dest)
+{
+        atomic_inc(&dest->refcnt);
+}
+
+static inline void ip_vs_dest_put(struct ip_vs_dest *dest)
+{
+        smp_mb__before_atomic_dec();
+        atomic_dec(&dest->refcnt);
+}
 
 /*
  *      IPVS sync daemon data and function prototypes
@@ -1428,7 +1474,7 @@ extern int ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 extern int ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                            struct ip_vs_protocol *pp, int offset,
                            unsigned int hooknum, struct ip_vs_iphdr *iph);
-extern void ip_vs_dst_reset(struct ip_vs_dest *dest);
+extern void ip_vs_dest_dst_rcu_free(struct rcu_head *head);
 
 #ifdef CONFIG_IP_VS_IPV6
 extern int ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
diff --git a/include/net/ipip.h b/include/net/ipip.h
deleted file mode 100644
index 982141c15200..000000000000
--- a/include/net/ipip.h
+++ /dev/null
@@ -1,87 +0,0 @@
-#ifndef __NET_IPIP_H
-#define __NET_IPIP_H 1
-
-#include <linux/if_tunnel.h>
-#include <net/gro_cells.h>
-#include <net/ip.h>
-
-/* Keep error state on tunnel for 30 sec */
-#define IPTUNNEL_ERR_TIMEO      (30*HZ)
-
-/* 6rd prefix/relay information */
-struct ip_tunnel_6rd_parm {
-        struct in6_addr         prefix;
-        __be32                  relay_prefix;
-        u16                     prefixlen;
-        u16                     relay_prefixlen;
-};
-
-struct ip_tunnel {
-        struct ip_tunnel __rcu  *next;
-        struct net_device       *dev;
-
-        int                     err_count;      /* Number of arrived ICMP errors */
-        unsigned long           err_time;       /* Time when the last ICMP error arrived */
-
-        /* These four fields used only by GRE */
-        __u32                   i_seqno;        /* The last seen seqno  */
-        __u32                   o_seqno;        /* The last output seqno */
-        int                     hlen;           /* Precalculated GRE header length */
-        int                     mlink;
-
-        struct ip_tunnel_parm   parms;
-
-        /* for SIT */
-#ifdef CONFIG_IPV6_SIT_6RD
-        struct ip_tunnel_6rd_parm       ip6rd;
-#endif
-        struct ip_tunnel_prl_entry __rcu *prl;          /* potential router list */
-        unsigned int                    prl_count;      /* # of entries in PRL */
-
-        struct gro_cells                gro_cells;
-};
-
-struct ip_tunnel_prl_entry {
-        struct ip_tunnel_prl_entry __rcu *next;
-        __be32                          addr;
-        u16                             flags;
-        struct rcu_head                 rcu_head;
-};
-
-static inline void iptunnel_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-        int err;
-        struct iphdr *iph = ip_hdr(skb);
-        int pkt_len = skb->len - skb_transport_offset(skb);
-        struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
-
-        nf_reset(skb);
-        skb->ip_summed = CHECKSUM_NONE;
-        ip_select_ident(iph, skb_dst(skb), NULL);
-
-        err = ip_local_out(skb);
-        if (likely(net_xmit_eval(err) == 0)) {
-                u64_stats_update_begin(&tstats->syncp);
-                tstats->tx_bytes += pkt_len;
-                tstats->tx_packets++;
-                u64_stats_update_end(&tstats->syncp);
-        } else {
-                dev->stats.tx_errors++;
-                dev->stats.tx_aborted_errors++;
-        }
-}
-
-static inline void tunnel_ip_select_ident(struct sk_buff *skb,
-                                          const struct iphdr  *old_iph,
-                                          struct dst_entry *dst)
-{
-        struct iphdr *iph = ip_hdr(skb);
-
-        /* Use inner packet iph-id if possible. */
-        if (skb->protocol == htons(ETH_P_IP) && old_iph->id)
-                iph->id = old_iph->id;
-        else
-                __ip_select_ident(iph, dst,
-                                  (skb_shinfo(skb)->gso_segs ?: 1) - 1);
-}
-#endif
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 64d12e77719a..0810aa57c780 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -217,7 +217,7 @@ struct ipv6_txoptions {
 };
 
 struct ip6_flowlabel {
-        struct ip6_flowlabel    *next;
+        struct ip6_flowlabel __rcu *next;
         __be32                  label;
         atomic_t                users;
         struct in6_addr         dst;
@@ -238,9 +238,9 @@ struct ip6_flowlabel {
 #define IPV6_FLOWLABEL_MASK     cpu_to_be32(0x000FFFFF)
 
 struct ipv6_fl_socklist {
-        struct ipv6_fl_socklist *next;
-        struct ip6_flowlabel    *fl;
-        struct rcu_head         rcu;
+        struct ipv6_fl_socklist __rcu   *next;
+        struct ip6_flowlabel            *fl;
+        struct rcu_head                 rcu;
 };
 
 extern struct ip6_flowlabel     *fl6_sock_lookup(struct sock *sk, __be32 label);
@@ -320,6 +320,18 @@ static inline int ipv6_addr_src_scope(const struct in6_addr *addr)
         return __ipv6_addr_src_scope(__ipv6_addr_type(addr));
 }
 
+static inline bool __ipv6_addr_needs_scope_id(int type)
+{
+        return type & IPV6_ADDR_LINKLOCAL ||
+               (type & IPV6_ADDR_MULTICAST &&
+                (type & (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)));
+}
+
+static inline __u32 ipv6_iface_scope_id(const struct in6_addr *addr, int iface)
+{
+        return __ipv6_addr_needs_scope_id(__ipv6_addr_type(addr)) ? iface : 0;
+}
+
 static inline int ipv6_addr_cmp(const struct in6_addr *a1, const struct in6_addr *a2)
 {
         return memcmp(a1, a2, sizeof(struct in6_addr));
@@ -466,6 +478,7 @@ struct ip6_create_arg {
         u32 user;
         const struct in6_addr *src;
         const struct in6_addr *dst;
+        u8 ecn;
 };
 
 void ip6_frag_init(struct inet_frag_queue *q, void *a);
@@ -485,6 +498,7 @@ struct frag_queue {
         int                     iif;
         unsigned int            csum;
         __u16                   nhoffset;
+        u8                      ecn;
 };
 
 void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq,
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index f7eba1300d82..04c2d4670dc6 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -93,9 +93,11 @@ struct device;
  * enum ieee80211_max_queues - maximum number of queues
  *
  * @IEEE80211_MAX_QUEUES: Maximum number of regular device queues.
+ * @IEEE80211_MAX_QUEUE_MAP: bitmap with maximum queues set
  */
 enum ieee80211_max_queues {
         IEEE80211_MAX_QUEUES =          16,
+        IEEE80211_MAX_QUEUE_MAP =       BIT(IEEE80211_MAX_QUEUES) - 1,
 };
 
 #define IEEE80211_INVAL_HW_QUEUE        0xff
@@ -126,6 +128,7 @@ enum ieee80211_ac_numbers {
  *      2^n-1 in the range 1..32767]
  * @cw_max: maximum contention window [like @cw_min]
  * @txop: maximum burst time in units of 32 usecs, 0 meaning disabled
+ * @acm: is mandatory admission control required for the access category
  * @uapsd: is U-APSD mode enabled for the queue
  */
 struct ieee80211_tx_queue_params {
@@ -133,6 +136,7 @@ struct ieee80211_tx_queue_params {
         u16 cw_min;
         u16 cw_max;
         u8 aifs;
+        bool acm;
         bool uapsd;
 };
 
@@ -207,7 +211,7 @@ struct ieee80211_chanctx_conf {
  * @BSS_CHANGED_QOS: QoS for this association was enabled/disabled. Note
  *      that it is only ever disabled for station mode.
  * @BSS_CHANGED_IDLE: Idle changed for this BSS/interface.
- * @BSS_CHANGED_SSID: SSID changed for this BSS (AP mode)
+ * @BSS_CHANGED_SSID: SSID changed for this BSS (AP and IBSS mode)
  * @BSS_CHANGED_AP_PROBE_RESP: Probe Response changed for this BSS (AP mode)
  * @BSS_CHANGED_PS: PS changed for this BSS (STA mode)
  * @BSS_CHANGED_TXPOWER: TX power setting changed for this interface
@@ -324,12 +328,11 @@ enum ieee80211_rssi_event {
  *      your driver/device needs to do.
  * @ps: power-save mode (STA only). This flag is NOT affected by
  *      offchannel/dynamic_ps operations.
- * @ssid: The SSID of the current vif. Only valid in AP-mode.
+ * @ssid: The SSID of the current vif. Valid in AP and IBSS mode.
  * @ssid_len: Length of SSID given in @ssid.
  * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
  * @txpower: TX power in dBm
- * @p2p_ctwindow: P2P CTWindow, only for P2P client interfaces
- * @p2p_oppps: P2P opportunistic PS is enabled
+ * @p2p_noa_attr: P2P NoA attribute for P2P powersave
  */
 struct ieee80211_bss_conf {
         const u8 *bssid;
@@ -363,8 +366,7 @@ struct ieee80211_bss_conf {
         size_t ssid_len;
         bool hidden_ssid;
         int txpower;
-        u8 p2p_ctwindow;
-        bool p2p_oppps;
+        struct ieee80211_p2p_noa_attr p2p_noa_attr;
 };
 
 /**
@@ -561,6 +563,9 @@ enum mac80211_rate_control_flags {
 /* maximum number of rate stages */
 #define IEEE80211_TX_MAX_RATES  4
 
+/* maximum number of rate table entries */
+#define IEEE80211_TX_RATE_TABLE_SIZE    4
+
 /**
  * struct ieee80211_tx_rate - rate selection/status
  *
@@ -601,8 +606,8 @@ static inline void ieee80211_rate_set_vht(struct ieee80211_tx_rate *rate,
                                           u8 mcs, u8 nss)
 {
         WARN_ON(mcs & ~0xF);
-        WARN_ON(nss & ~0x7);
-        rate->idx = (nss << 4) | mcs;
+        WARN_ON((nss - 1) & ~0x7);
+        rate->idx = ((nss - 1) << 4) | mcs;
 }
 
 static inline u8
@@ -614,7 +619,7 @@ ieee80211_rate_get_vht_mcs(const struct ieee80211_tx_rate *rate)
 static inline u8
 ieee80211_rate_get_vht_nss(const struct ieee80211_tx_rate *rate)
 {
-        return rate->idx >> 4;
+        return (rate->idx >> 4) + 1;
 }
 
 /**
@@ -655,7 +660,11 @@ struct ieee80211_tx_info {
                                         struct ieee80211_tx_rate rates[
                                                 IEEE80211_TX_MAX_RATES];
                                         s8 rts_cts_rate_idx;
-                                        /* 3 bytes free */
+                                        u8 use_rts:1;
+                                        u8 use_cts_prot:1;
+                                        u8 short_preamble:1;
+                                        u8 skip_table:1;
+                                        /* 2 bytes free */
                                 };
                                 /* only needed before rate control */
                                 unsigned long jiffies;
@@ -676,6 +685,8 @@ struct ieee80211_tx_info {
                 struct {
                         struct ieee80211_tx_rate driver_rates[
                                 IEEE80211_TX_MAX_RATES];
+                        u8 pad[4];
+
                         void *rate_driver_data[
                                 IEEE80211_TX_INFO_RATE_DRIVER_DATA_SIZE / sizeof(void *)];
                 };
@@ -974,8 +985,7 @@ enum ieee80211_smps_mode {
  * @power_level: requested transmit power (in dBm), backward compatibility
  *      value only that is set to the minimum of all interfaces
  *
- * @channel: the channel to tune to
- * @channel_type: the channel (HT) type
+ * @chandef: the channel definition to tune to
  * @radar_enabled: whether radar detection is enabled
  *
  * @long_frame_max_tx_count: Maximum number of transmissions for a "long" frame
@@ -1001,8 +1011,7 @@ struct ieee80211_conf {
 
         u8 long_frame_max_tx_count, short_frame_max_tx_count;
 
-        struct ieee80211_channel *channel;
-        enum nl80211_channel_type channel_type;
+        struct cfg80211_chan_def chandef;
         bool radar_enabled;
         enum ieee80211_smps_mode smps_mode;
 };
@@ -1019,13 +1028,13 @@ struct ieee80211_conf {
  *      the driver passed into mac80211.
  * @block_tx: Indicates whether transmission must be blocked before the
  *      scheduled channel switch, as indicated by the AP.
- * @channel: the new channel to switch to
+ * @chandef: the new channel to switch to
  * @count: the number of TBTT's until the channel switch event
  */
 struct ieee80211_channel_switch {
         u64 timestamp;
         bool block_tx;
-        struct ieee80211_channel *channel;
+        struct cfg80211_chan_def chandef;
         u8 count;
 };
 
@@ -1067,6 +1076,9 @@ enum ieee80211_vif_flags {
  *      path needing to access it; even though the netdev carrier will always
  *      be off when it is %NULL there can still be races and packets could be
  *      processed after it switches back to %NULL.
+ * @debugfs_dir: debugfs dentry, can be used by drivers to create own per
+ *      interface debug files. Note that it will be NULL for the virtual
+ *      monitor interface (if that is requested.)
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *).
  */
@@ -1083,6 +1095,10 @@ struct ieee80211_vif {
 
         u32 driver_flags;
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+        struct dentry *debugfs_dir;
+#endif
+
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
 };
@@ -1101,8 +1117,6 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
  * These flags are used for communication about keys between the driver
  * and mac80211, with the @flags parameter of &struct ieee80211_key_conf.
  *
- * @IEEE80211_KEY_FLAG_WMM_STA: Set by mac80211, this flag indicates
- *      that the STA this key will be used with could be using QoS.
  * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
  *      driver to indicate that it requires IV generation for this
  *      particular key.
@@ -1127,7 +1141,6 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
  *      %IEEE80211_KEY_FLAG_SW_MGMT_TX flag to encrypt such frames in SW.
  */
 enum ieee80211_key_flags {
-        IEEE80211_KEY_FLAG_WMM_STA      = 1<<0,
         IEEE80211_KEY_FLAG_GENERATE_IV  = 1<<1,
         IEEE80211_KEY_FLAG_GENERATE_MMIC= 1<<2,
         IEEE80211_KEY_FLAG_PAIRWISE     = 1<<3,
@@ -1219,6 +1232,24 @@ enum ieee80211_sta_rx_bandwidth {
 };
 
 /**
+ * struct ieee80211_sta_rates - station rate selection table
+ *
+ * @rcu_head: RCU head used for freeing the table on update
+ * @rates: transmit rates/flags to be used by default.
+ *      Overriding entries per-packet is possible by using cb tx control.
+ */
+struct ieee80211_sta_rates {
+        struct rcu_head rcu_head;
+        struct {
+                s8 idx;
+                u8 count;
+                u8 count_cts;
+                u8 count_rts;
+                u16 flags;
+        } rate[IEEE80211_TX_RATE_TABLE_SIZE];
+};
+
+/**
  * struct ieee80211_sta - station table entry
  *
  * A station table entry represents a station we are possibly
@@ -1231,9 +1262,8 @@ enum ieee80211_sta_rx_bandwidth {
  * @addr: MAC address
  * @aid: AID we assigned to the station if we're an AP
  * @supp_rates: Bitmap of supported rates (per band)
- * @ht_cap: HT capabilities of this STA; restricted to our own TX capabilities
- * @vht_cap: VHT capabilities of this STA; Not restricting any capabilities
- *      of remote STA. Taking as is.
+ * @ht_cap: HT capabilities of this STA; restricted to our own capabilities
+ * @vht_cap: VHT capabilities of this STA; restricted to our own capabilities
  * @wme: indicates whether the STA supports WME. Only valid during AP-mode.
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *), size is determined in hw information.
@@ -1246,6 +1276,7 @@ enum ieee80211_sta_rx_bandwidth {
  *      notifications and capabilities. The value is only valid after
  *      the station moves to associated state.
  * @smps_mode: current SMPS mode (off, static or dynamic)
+ * @tx_rates: rate control selection table
  */
 struct ieee80211_sta {
         u32 supp_rates[IEEE80211_NUM_BANDS];
@@ -1259,6 +1290,7 @@ struct ieee80211_sta {
         u8 rx_nss;
         enum ieee80211_sta_rx_bandwidth bandwidth;
         enum ieee80211_smps_mode smps_mode;
+        struct ieee80211_sta_rates __rcu *rates;
 
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
@@ -1414,6 +1446,9 @@ struct ieee80211_tx_control {
  *      for different virtual interfaces. See the doc section on HW queue
  *      control for more details.
  *
+ * @IEEE80211_HW_SUPPORTS_RC_TABLE: The driver supports using a rate
+ *      selection table provided by the rate control algorithm.
+ *
  * @IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF: Use the P2P Device address for any
  *      P2P Interface. This will be honoured even if more than one interface
  *      is supported.
@@ -1446,6 +1481,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_SUPPORTS_PER_STA_GTK               = 1<<21,
         IEEE80211_HW_AP_LINK_PS                         = 1<<22,
         IEEE80211_HW_TX_AMPDU_SETUP_IN_HW               = 1<<23,
+        IEEE80211_HW_SUPPORTS_RC_TABLE                  = 1<<24,
         IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
         IEEE80211_HW_TIMING_BEACON_ONLY                 = 1<<26,
 };
@@ -1531,6 +1567,17 @@ enum ieee80211_hw_flags {
  * @netdev_features: netdev features to be set in each netdev created
  *      from this HW. Note only HW checksum features are currently
  *      compatible with mac80211. Other feature bits will be rejected.
+ *
+ * @uapsd_queues: This bitmap is included in (re)association frame to indicate
+ *      for each access category if it is uAPSD trigger-enabled and delivery-
+ *      enabled. Use IEEE80211_WMM_IE_STA_QOSINFO_AC_* to set this bitmap.
+ *      Each bit corresponds to different AC. Value '1' in specific bit means
+ *      that corresponding AC is both trigger- and delivery-enabled. '0' means
+ *      neither enabled.
+ *
+ * @uapsd_max_sp_len: maximum number of total buffered frames the WMM AP may
+ *      deliver to a WMM STA during any Service Period triggered by the WMM STA.
+ *      Use IEEE80211_WMM_IE_STA_QOSINFO_SP_* for correct values.
  */
 struct ieee80211_hw {
         struct ieee80211_conf conf;
@@ -1556,6 +1603,8 @@ struct ieee80211_hw {
         u8 radiotap_mcs_details;
         u16 radiotap_vht_details;
         netdev_features_t netdev_features;
+        u8 uapsd_queues;
+        u8 uapsd_max_sp_len;
 };
 
 /**
@@ -1950,14 +1999,14 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * filter those response frames except in the case of frames that
  * are buffered in the driver -- those must remain buffered to avoid
  * reordering. Because it is possible that no frames are released
- * in this case, the driver must call ieee80211_sta_eosp_irqsafe()
+ * in this case, the driver must call ieee80211_sta_eosp()
  * to indicate to mac80211 that the service period ended anyway.
  *
  * Finally, if frames from multiple TIDs are released from mac80211
  * but the driver might reorder them, it must clear & set the flags
  * appropriately (only the last frame may have %IEEE80211_TX_STATUS_EOSP)
  * and also take care of the EOSP and MORE_DATA bits in the frame.
- * The driver may also use ieee80211_sta_eosp_irqsafe() in this case.
+ * The driver may also use ieee80211_sta_eosp() in this case.
  */
 
 /**
@@ -2135,6 +2184,24 @@ enum ieee80211_rate_control_changed {
 };
 
 /**
+ * enum ieee80211_roc_type - remain on channel type
+ *
+ * With the support for multi channel contexts and multi channel operations,
+ * remain on channel operations might be limited/deferred/aborted by other
+ * flows/operations which have higher priority (and vise versa).
+ * Specifying the ROC type can be used by devices to prioritize the ROC
+ * operations compared to other operations/flows.
+ *
+ * @IEEE80211_ROC_TYPE_NORMAL: There are no special requirements for this ROC.
+ * @IEEE80211_ROC_TYPE_MGMT_TX: The remain on channel request is required
+ *      for sending managment frames offchannel.
+ */
+enum ieee80211_roc_type {
+        IEEE80211_ROC_TYPE_NORMAL = 0,
+        IEEE80211_ROC_TYPE_MGMT_TX,
+};
+
+/**
  * struct ieee80211_ops - callbacks from mac80211 to the driver
  *
  * This structure contains various callbacks that the driver may
@@ -2212,18 +2279,6 @@ enum ieee80211_rate_control_changed {
  *      MAC address of the device going away.
  *      Hence, this callback must be implemented. It can sleep.
  *
- * @add_interface_debugfs: Drivers can use this callback to add debugfs files
- *      when a vif is added to mac80211. This callback and
- *      @remove_interface_debugfs should be within a CONFIG_MAC80211_DEBUGFS
- *      conditional. @remove_interface_debugfs must be provided for cleanup.
- *      This callback can sleep.
- *
- * @remove_interface_debugfs: Remove the debugfs files which were added using
- *      @add_interface_debugfs. This callback must remove all debugfs entries
- *      that were added because mac80211 only removes interface debugfs when the
- *      interface is destroyed, not when it is removed from the driver.
- *      This callback can sleep.
- *
  * @config: Handler for configuration requests. IEEE 802.11 code calls this
  *      function to change hardware configuration, e.g., channel.
  *      This function should never fail but returns a negative error code
@@ -2245,6 +2300,9 @@ enum ieee80211_rate_control_changed {
  *      See the section "Frame filtering" for more information.
  *      This callback must be implemented and can sleep.
  *
+ * @set_multicast_list: Configure the device's interface specific RX multicast
+ *      filter. This callback is optional. This callback must be atomic.
+ *
  * @set_tim: Set TIM bit. mac80211 calls this function when a TIM bit
  *      must be set or cleared for a given STA. Must be atomic.
  *
@@ -2426,8 +2484,11 @@ enum ieee80211_rate_control_changed {
  * @testmode_dump: Implement a cfg80211 test mode dump. The callback can sleep.
  *
  * @flush: Flush all pending frames from the hardware queue, making sure
- *      that the hardware queues are empty. If the parameter @drop is set
- *      to %true, pending frames may be dropped. The callback can sleep.
+ *      that the hardware queues are empty. The @queues parameter is a bitmap
+ *      of queues to flush, which is useful if different virtual interfaces
+ *      use different hardware queues; it may also indicate all queues.
+ *      If the parameter @drop is set to %true, pending frames may be dropped.
+ *      The callback can sleep.
  *
  * @channel_switch: Drivers that need (or want) to offload the channel
  *      switch operation for CSAs received from the AP may implement this
@@ -2492,7 +2553,7 @@ enum ieee80211_rate_control_changed {
  *      setting the EOSP flag in the QoS header of the frames. Also, when the
  *      service period ends, the driver must set %IEEE80211_TX_STATUS_EOSP
  *      on the last frame in the SP. Alternatively, it may call the function
- *      ieee80211_sta_eosp_irqsafe() to inform mac80211 of the end of the SP.
+ *      ieee80211_sta_eosp() to inform mac80211 of the end of the SP.
  *      This callback must be atomic.
  * @allow_buffered_frames: Prepare device to allow the given number of frames
  *      to go out to the given station. The frames will be sent by mac80211
@@ -2503,7 +2564,7 @@ enum ieee80211_rate_control_changed {
  *      them between the TIDs, it must set the %IEEE80211_TX_STATUS_EOSP flag
  *      on the last frame and clear it on all others and also handle the EOSP
  *      bit in the QoS header correctly. Alternatively, it can also call the
- *      ieee80211_sta_eosp_irqsafe() function.
+ *      ieee80211_sta_eosp() function.
  *      The @tids parameter is a bitmap and tells the driver which TIDs the
  *      frames will be on; it will at most have two bits set.
  *      This callback must be atomic.
@@ -2591,6 +2652,10 @@ struct ieee80211_ops {
                                  unsigned int changed_flags,
                                  unsigned int *total_flags,
                                  u64 multicast);
+        void (*set_multicast_list)(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif, bool allmulti,
+                                   struct netdev_hw_addr_list *mc_list);
+
         int (*set_tim)(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
                        bool set);
         int (*set_key)(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -2637,12 +2702,6 @@ struct ieee80211_ops {
                                    struct ieee80211_vif *vif,
                                    struct ieee80211_sta *sta,
                                    struct dentry *dir);
-        void (*add_interface_debugfs)(struct ieee80211_hw *hw,
-                                      struct ieee80211_vif *vif,
-                                      struct dentry *dir);
-        void (*remove_interface_debugfs)(struct ieee80211_hw *hw,
-                                         struct ieee80211_vif *vif,
-                                         struct dentry *dir);
 #endif
         void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         enum sta_notify_cmd, struct ieee80211_sta *sta);
@@ -2677,7 +2736,7 @@ struct ieee80211_ops {
                              struct netlink_callback *cb,
                              void *data, int len);
 #endif
-        void (*flush)(struct ieee80211_hw *hw, bool drop);
+        void (*flush)(struct ieee80211_hw *hw, u32 queues, bool drop);
         void (*channel_switch)(struct ieee80211_hw *hw,
                                struct ieee80211_channel_switch *ch_switch);
         int (*napi_poll)(struct ieee80211_hw *hw, int budget);
@@ -2687,7 +2746,8 @@ struct ieee80211_ops {
         int (*remain_on_channel)(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_channel *chan,
-                                 int duration);
+                                 int duration,
+                                 enum ieee80211_roc_type type);
         int (*cancel_remain_on_channel)(struct ieee80211_hw *hw);
         int (*set_ringparam)(struct ieee80211_hw *hw, u32 tx, u32 rx);
         void (*get_ringparam)(struct ieee80211_hw *hw,
@@ -3108,6 +3168,25 @@ void ieee80211_sta_set_buffered(struct ieee80211_sta *sta,
                                 u8 tid, bool buffered);
 
 /**
+ * ieee80211_get_tx_rates - get the selected transmit rates for a packet
+ *
+ * Call this function in a driver with per-packet rate selection support
+ * to combine the rate info in the packet tx info with the most recent
+ * rate selection table for the station entry.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @sta: the receiver station to which this packet is sent.
+ * @skb: the frame to be transmitted.
+ * @dest: buffer for extracted rate/retry information
+ * @max_rates: maximum number of rates to fetch
+ */
+void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta,
+                            struct sk_buff *skb,
+                            struct ieee80211_tx_rate *dest,
+                            int max_rates);
+
+/**
  * ieee80211_tx_status - transmit status callback
  *
  * Call this function for all transmitted frames after they have been
@@ -3842,14 +3921,17 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
  * %IEEE80211_TX_STATUS_EOSP bit and call this function instead.
  * This applies for PS-Poll as well as uAPSD.
  *
- * Note that there is no non-_irqsafe version right now as
- * it wasn't needed, but just like _tx_status() and _rx()
- * must not be mixed in irqsafe/non-irqsafe versions, this
- * function must not be mixed with those either. Use the
- * all irqsafe, or all non-irqsafe, don't mix! If you need
- * the non-irqsafe version of this, you need to add it.
+ * Note that just like with _tx_status() and _rx() drivers must
+ * not mix calls to irqsafe/non-irqsafe versions, this function
+ * must not be mixed with those either. Use the all irqsafe, or
+ * all non-irqsafe, don't mix!
+ *
+ * NB: the _irqsafe version of this function doesn't exist, no
+ *     driver needs it right now. Don't call this function if
+ *     you'd need the _irqsafe version, look at the git history
+ *     and restore the _irqsafe version!
  */
-void ieee80211_sta_eosp_irqsafe(struct ieee80211_sta *pubsta);
+void ieee80211_sta_eosp(struct ieee80211_sta *pubsta);
 
 /**
  * ieee80211_iter_keys - iterate keys programmed into the device
@@ -4079,7 +4161,7 @@ void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn);
  *      (deprecated; this will be removed once drivers get updated to use
  *      rate_idx_mask)
  * @rate_idx_mask: user-requested (legacy) rate mask
- * @rate_idx_mcs_mask: user-requested MCS rate mask
+ * @rate_idx_mcs_mask: user-requested MCS rate mask (NULL if not in use)
  * @bss: whether this frame is sent out in AP or IBSS mode
  */
 struct ieee80211_tx_rate_control {
@@ -4091,7 +4173,7 @@ struct ieee80211_tx_rate_control {
         bool rts, short_preamble;
         u8 max_rate_idx;
         u32 rate_idx_mask;
-        u8 rate_idx_mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
+        u8 *rate_idx_mcs_mask;
         bool bss;
 };
 
@@ -4180,37 +4262,55 @@ bool rate_usable_index_exists(struct ieee80211_supported_band *sband,
         return false;
 }
 
+/**
+ * rate_control_set_rates - pass the sta rate selection to mac80211/driver
+ *
+ * When not doing a rate control probe to test rates, rate control should pass
+ * its rate selection to mac80211. If the driver supports receiving a station
+ * rate table, it will use it to ensure that frames are always sent based on
+ * the most recent rate control module decision.
+ *
+ * @hw: pointer as obtained from ieee80211_alloc_hw()
+ * @pubsta: &struct ieee80211_sta pointer to the target destination.
+ * @rates: new tx rate set to be used for this station.
+ */
+int rate_control_set_rates(struct ieee80211_hw *hw,
+                           struct ieee80211_sta *pubsta,
+                           struct ieee80211_sta_rates *rates);
+
 int ieee80211_rate_control_register(struct rate_control_ops *ops);
 void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
 
 static inline bool
 conf_is_ht20(struct ieee80211_conf *conf)
 {
-        return conf->channel_type == NL80211_CHAN_HT20;
+        return conf->chandef.width == NL80211_CHAN_WIDTH_20;
 }
 
 static inline bool
 conf_is_ht40_minus(struct ieee80211_conf *conf)
 {
-        return conf->channel_type == NL80211_CHAN_HT40MINUS;
+        return conf->chandef.width == NL80211_CHAN_WIDTH_40 &&
+               conf->chandef.center_freq1 < conf->chandef.chan->center_freq;
 }
 
 static inline bool
 conf_is_ht40_plus(struct ieee80211_conf *conf)
 {
-        return conf->channel_type == NL80211_CHAN_HT40PLUS;
+        return conf->chandef.width == NL80211_CHAN_WIDTH_40 &&
+               conf->chandef.center_freq1 > conf->chandef.chan->center_freq;
 }
 
 static inline bool
 conf_is_ht40(struct ieee80211_conf *conf)
 {
-        return conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf);
+        return conf->chandef.width == NL80211_CHAN_WIDTH_40;
 }
 
 static inline bool
 conf_is_ht(struct ieee80211_conf *conf)
 {
-        return conf->channel_type != NL80211_CHAN_NO_HT;
+        return conf->chandef.width != NL80211_CHAN_WIDTH_20_NOHT;
 }
 
 static inline enum nl80211_iftype
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index de644bcd8613..b17697827482 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -17,6 +17,7 @@
 #include <net/netns/ipv6.h>
 #include <net/netns/sctp.h>
 #include <net/netns/dccp.h>
+#include <net/netns/netfilter.h>
 #include <net/netns/x_tables.h>
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 #include <net/netns/conntrack.h>
@@ -94,6 +95,7 @@ struct net {
         struct netns_dccp       dccp;
 #endif
 #ifdef CONFIG_NETFILTER
+        struct netns_nf         nf;
         struct netns_xt         xt;
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
         struct netns_ct         ct;
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index caca0c4d6b4b..644d9c223d24 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -184,7 +184,7 @@ extern int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 extern void nf_ct_delete_from_lists(struct nf_conn *ct);
 extern void nf_ct_dying_timeout(struct nf_conn *ct);
 
-extern void nf_conntrack_flush_report(struct net *net, u32 pid, int report);
+extern void nf_conntrack_flush_report(struct net *net, u32 portid, int report);
 
 extern bool nf_ct_get_tuplepr(const struct sk_buff *skb,
                               unsigned int nhoff, u_int16_t l3num,
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 930275fa2ea6..fb2b6234e937 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -27,6 +27,7 @@ extern unsigned int nf_conntrack_in(struct net *net,
 
 extern int nf_conntrack_init_net(struct net *net);
 extern void nf_conntrack_cleanup_net(struct net *net);
+extern void nf_conntrack_cleanup_net_list(struct list_head *net_exit_list);
 
 extern int nf_conntrack_proto_pernet_init(struct net *net);
 extern void nf_conntrack_proto_pernet_fini(struct net *net);
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index cbbae7621e22..3f3aecbc8632 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -88,7 +88,7 @@ nf_ct_find_expectation(struct net *net, u16 zone,
                        const struct nf_conntrack_tuple *tuple);
 
 void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
-                                u32 pid, int report);
+                                u32 portid, int report);
 static inline void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
 {
         nf_ct_unlink_expect_report(exp, 0, 0);
@@ -106,7 +106,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *, unsigned int, u_int8_t,
                        u_int8_t, const __be16 *, const __be16 *);
 void nf_ct_expect_put(struct nf_conntrack_expect *exp);
 int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, 
-                                u32 pid, int report);
+                                u32 portid, int report);
 static inline int nf_ct_expect_related(struct nf_conntrack_expect *expect)
 {
         return nf_ct_expect_related_report(expect, 0, 0);
diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h
index e991bd0a27af..31f1fb9eb784 100644
--- a/include/net/netfilter/nf_log.h
+++ b/include/net/netfilter/nf_log.h
@@ -49,12 +49,18 @@ struct nf_logger {
 int nf_log_register(u_int8_t pf, struct nf_logger *logger);
 void nf_log_unregister(struct nf_logger *logger);
 
-int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger);
-void nf_log_unbind_pf(u_int8_t pf);
+void nf_log_set(struct net *net, u_int8_t pf,
+                const struct nf_logger *logger);
+void nf_log_unset(struct net *net, const struct nf_logger *logger);
+
+int nf_log_bind_pf(struct net *net, u_int8_t pf,
+                   const struct nf_logger *logger);
+void nf_log_unbind_pf(struct net *net, u_int8_t pf);
 
 /* Calls the registered backend logging function */
-__printf(7, 8)
-void nf_log_packet(u_int8_t pf,
+__printf(8, 9)
+void nf_log_packet(struct net *net,
+                   u_int8_t pf,
                    unsigned int hooknum,
                    const struct sk_buff *skb,
                    const struct net_device *in,
diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
index fb1c0be38b6d..aaba4bbcdda0 100644
--- a/include/net/netfilter/nf_queue.h
+++ b/include/net/netfilter/nf_queue.h
@@ -9,10 +9,13 @@ struct nf_queue_entry {
 
         struct nf_hook_ops      *elem;
         u_int8_t                pf;
+        u16                     size; /* sizeof(entry) + saved route keys */
         unsigned int            hook;
         struct net_device       *indev;
         struct net_device       *outdev;
         int                     (*okfn)(struct sk_buff *);
+
+        /* extra space to store route keys */
 };
 
 #define nf_queue_entry_reroute(x) ((void *)x + sizeof(struct nf_queue_entry))
@@ -27,4 +30,7 @@ void nf_register_queue_handler(const struct nf_queue_handler *qh);
 void nf_unregister_queue_handler(void);
 extern void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);
 
+bool nf_queue_entry_get_refs(struct nf_queue_entry *entry);
+void nf_queue_entry_release_refs(struct nf_queue_entry *entry);
+
 #endif /* _NF_QUEUE_H */
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index 1242f371718b..005e2c2e39a9 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -71,6 +71,7 @@ struct netns_ipv6 {
         struct fib_rules_ops    *mr6_rules_ops;
 #endif
 #endif
+        atomic_t                dev_addr_genid;
 };
 
 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h
new file mode 100644
index 000000000000..88740024ccf3
--- /dev/null
+++ b/include/net/netns/netfilter.h
@@ -0,0 +1,18 @@
+#ifndef __NETNS_NETFILTER_H
+#define __NETNS_NETFILTER_H
+
+#include <linux/proc_fs.h>
+#include <linux/netfilter.h>
+
+struct nf_logger;
+
+struct netns_nf {
+#if defined CONFIG_PROC_FS
+        struct proc_dir_entry *proc_netfilter;
+#endif
+        const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO];
+#ifdef CONFIG_SYSCTL
+        struct ctl_table_header *nf_log_dir_header;
+#endif
+};
+#endif
diff --git a/include/net/netprio_cgroup.h b/include/net/netprio_cgroup.h
index 1d04b6f0fbd4..50ab8c26ab59 100644
--- a/include/net/netprio_cgroup.h
+++ b/include/net/netprio_cgroup.h
@@ -29,7 +29,7 @@ struct cgroup_netprio_state {
         struct cgroup_subsys_state css;
 };
 
-extern void sock_update_netprioidx(struct sock *sk, struct task_struct *task);
+extern void sock_update_netprioidx(struct sock *sk);
 
 #if IS_BUILTIN(CONFIG_NETPRIO_CGROUP)
 
@@ -68,7 +68,7 @@ static inline u32 task_netprioidx(struct task_struct *p)
         return 0;
 }
 
-#define sock_update_netprioidx(sk, task)
+#define sock_update_netprioidx(sk)
 
 #endif /* CONFIG_NETPRIO_CGROUP */
 
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 87a6417fc934..5eb80bb3cbb2 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -122,6 +122,8 @@ struct nfc_dev {
 
         bool shutting_down;
 
+        struct rfkill *rfkill;
+
         struct nfc_ops *ops;
 };
 #define to_nfc_dev(_dev) container_of(_dev, struct nfc_dev, dev)
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index a51dbd17c2de..59795e42c8b6 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -27,19 +27,13 @@ struct sk_buff;
 struct dst_entry;
 struct proto;
 
-/* empty to "strongly type" an otherwise void parameter.
- */
-struct request_values {
-};
-
 struct request_sock_ops {
         int             family;
         int             obj_size;
         struct kmem_cache       *slab;
         char            *slab_name;
         int             (*rtx_syn_ack)(struct sock *sk,
-                                       struct request_sock *req,
-                                       struct request_values *rvp);
+                                       struct request_sock *req);
         void            (*send_ack)(struct sock *sk, struct sk_buff *skb,
                                     struct request_sock *req);
         void            (*send_reset)(struct sock *sk,
@@ -54,7 +48,7 @@ extern int inet_rtx_syn_ack(struct sock *parent, struct request_sock *req);
 /* struct request_sock - mini sock to represent a connection request
  */
 struct request_sock {
-        struct request_sock             *dl_next; /* Must be first member! */
+        struct request_sock             *dl_next;
         u16                             mss;
         u8                              num_retrans; /* number of retransmits */
         u8                              cookie_ts:1; /* syncookie: encode tcpopts in timestamp */
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 5a15fabd6a75..702664833a53 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -4,7 +4,7 @@
 #include <linux/rtnetlink.h>
 #include <net/netlink.h>
 
-typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *, void *);
+typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *);
 typedef int (*rtnl_dumpit_func)(struct sk_buff *, struct netlink_callback *);
 typedef u16 (*rtnl_calcit_func)(struct sk_buff *, struct nlmsghdr *);
 
diff --git a/include/net/scm.h b/include/net/scm.h
index b11708105681..8de2d37d2077 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -26,7 +26,6 @@ struct scm_fp_list {
 
 struct scm_cookie {
         struct pid              *pid;           /* Skb credentials */
-        const struct cred       *cred;
         struct scm_fp_list      *fp;            /* Passed files         */
         struct scm_creds        creds;          /* Skb credentials      */
 #ifdef CONFIG_SECURITY_NETWORK
@@ -51,23 +50,18 @@ static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_co
 #endif /* CONFIG_SECURITY_NETWORK */
 
 static __inline__ void scm_set_cred(struct scm_cookie *scm,
-                                    struct pid *pid, const struct cred *cred)
+                                    struct pid *pid, kuid_t uid, kgid_t gid)
 {
         scm->pid  = get_pid(pid);
-        scm->cred = cred ? get_cred(cred) : NULL;
         scm->creds.pid = pid_vnr(pid);
-        scm->creds.uid = cred ? cred->uid : INVALID_UID;
-        scm->creds.gid = cred ? cred->gid : INVALID_GID;
+        scm->creds.uid = uid;
+        scm->creds.gid = gid;
 }
 
 static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
 {
         put_pid(scm->pid);
         scm->pid  = NULL;
-
-        if (scm->cred)
-                put_cred(scm->cred);
-        scm->cred = NULL;
 }
 
 static __inline__ void scm_destroy(struct scm_cookie *scm)
@@ -81,8 +75,10 @@ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
                                struct scm_cookie *scm, bool forcecreds)
 {
         memset(scm, 0, sizeof(*scm));
+        scm->creds.uid = INVALID_UID;
+        scm->creds.gid = INVALID_GID;
         if (forcecreds)
-                scm_set_cred(scm, task_tgid(current), current_cred());
+                scm_set_cred(scm, task_tgid(current), current_uid(), current_gid());
         unix_get_peersec_dgram(sock, scm);
         if (msg->msg_controllen <= 0)
                 return 0;
diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h
index befc8d2a1b9f..5a2110d3176d 100644
--- a/include/net/sctp/checksum.h
+++ b/include/net/sctp/checksum.h
@@ -77,7 +77,7 @@ static inline __u32 sctp_update_cksum(__u8 *buffer, __u16 length, __u32 crc32)
         return sctp_crc32c(crc32, buffer, length);
 }
 
-static inline __le32 sctp_end_cksum(__be32 crc32)
+static inline __le32 sctp_end_cksum(__u32 crc32)
 {
         return cpu_to_le32(~crc32);
 }
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index a7dd5c50df79..ca50e0751e47 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -49,7 +49,6 @@
 
 #include <linux/sctp.h>
 #include <linux/ipv6.h> /* For ipv6hdr. */
-#include <net/sctp/user.h>
 #include <net/tcp_states.h>  /* For TCP states used in sctp_sock_state_t */
 
 /* Value used for stream negotiation. */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 0e0f9d2322e3..1bd4c4144fe8 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -399,7 +399,6 @@ struct sctp_stream {
 struct sctp_ssnmap {
         struct sctp_stream in;
         struct sctp_stream out;
-        int malloced;
 };
 
 struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
@@ -715,8 +714,7 @@ struct sctp_packet {
             has_sack:1,         /* This packet contains a SACK chunk. */
             has_auth:1,         /* This packet contains an AUTH chunk */
             has_data:1,         /* This packet contains at least 1 DATA chunk */
-            ipfragok:1,         /* So let ip fragment this packet */
-            malloced:1;         /* Is it malloced? */
+            ipfragok:1;         /* So let ip fragment this packet */
 };
 
 struct sctp_packet *sctp_packet_init(struct sctp_packet *,
@@ -780,10 +778,7 @@ struct sctp_transport {
                 hb_sent:1,
 
                 /* Is the Path MTU update pending on this tranport */
-                pmtu_pending:1,
-
-                /* Is this structure kfree()able? */
-                malloced:1;
+                pmtu_pending:1;
 
         /* Has this transport moved the ctsn since we last sacked */
         __u32 sack_generation;
@@ -992,8 +987,6 @@ struct sctp_inq {
          * messages.
          */
         struct work_struct immediate;
-
-        int malloced;        /* Is this structure kfree()able?  */
 };
 
 void sctp_inq_init(struct sctp_inq *);
@@ -1062,9 +1055,6 @@ struct sctp_outq {
 
         /* Is this structure empty?  */
         char empty;
-
-        /* Are we kfree()able? */
-        char malloced;
 };
 
 void sctp_outq_init(struct sctp_association *, struct sctp_outq *);
@@ -1102,8 +1092,6 @@ struct sctp_bind_addr {
          *      peer(s) in INIT and INIT ACK chunks.
          */
         struct list_head address_list;
-
-        int malloced;        /* Are we kfree()able?  */
 };
 
 void sctp_bind_addr_init(struct sctp_bind_addr *, __u16 port);
@@ -1174,11 +1162,9 @@ struct sctp_ep_common {
         /* Some fields to help us manage this object.
          *   refcnt   - Reference count access to this object.
          *   dead     - Do not attempt to use this object.
-         *   malloced - Do we need to kfree this object?
          */
         atomic_t    refcnt;
-        char        dead;
-        char        malloced;
+        bool        dead;
 
         /* What socket does this endpoint belong to?  */
         struct sock *sk;
diff --git a/include/net/sctp/ulpqueue.h b/include/net/sctp/ulpqueue.h
index ff1b8ba73ab1..00e50ba3f24b 100644
--- a/include/net/sctp/ulpqueue.h
+++ b/include/net/sctp/ulpqueue.h
@@ -49,7 +49,6 @@
 
 /* A structure to carry information to the ULP (e.g. Sockets API) */
 struct sctp_ulpq {
-        char malloced;
         char pd_mode;
         struct sctp_association *asoc;
         struct sk_buff_head reasm;
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
deleted file mode 100644
index 9a0ae091366d..000000000000
--- a/include/net/sctp/user.h
+++ /dev/null
@@ -1,782 +0,0 @@
-/* SCTP kernel implementation
- * (C) Copyright IBM Corp. 2001, 2004
- * Copyright (c) 1999-2000 Cisco, Inc.
- * Copyright (c) 1999-2001 Motorola, Inc.
- * Copyright (c) 2002 Intel Corp.
- *
- * This file is part of the SCTP kernel implementation
- *
- * This header represents the structures and constants needed to support
- * the SCTP Extension to the Sockets API.
- *
- * This SCTP implementation is free software;
- * you can redistribute it and/or modify it under the terms of
- * the GNU General Public License as published by
- * the Free Software Foundation; either version 2, or (at your option)
- * any later version.
- *
- * This SCTP implementation is distributed in the hope that it
- * will be useful, but WITHOUT ANY WARRANTY; without even the implied
- *                 ************************
- * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
- * See the GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
- * the Free Software Foundation, 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.
- *
- * Please send any bug reports or fixes you make to the
- * email address(es):
- *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- *
- * Or submit a bug report through the following website:
- *    http://www.sf.net/projects/lksctp
- *
- * Written or modified by:
- *    La Monte H.P. Yarroll    <piggy@acm.org>
- *    R. Stewart               <randall@sctp.chicago.il.us>
- *    K. Morneau               <kmorneau@cisco.com>
- *    Q. Xie                   <qxie1@email.mot.com>
- *    Karl Knutson             <karl@athena.chicago.il.us>
- *    Jon Grimm                <jgrimm@us.ibm.com>
- *    Daisy Chang              <daisyc@us.ibm.com>
- *    Ryan Layer               <rmlayer@us.ibm.com>
- *    Ardelle Fan              <ardelle.fan@intel.com>
- *    Sridhar Samudrala        <sri@us.ibm.com>
- *
- * Any bugs reported given to us we will try to fix... any fixes shared will
- * be incorporated into the next SCTP release.
- */
-
-#ifndef __net_sctp_user_h__
-#define __net_sctp_user_h__
-
-#include <linux/types.h>
-#include <linux/socket.h>
-
-typedef __s32 sctp_assoc_t;
-
-/* The following symbols come from the Sockets API Extensions for
- * SCTP <draft-ietf-tsvwg-sctpsocket-07.txt>.
- */
-#define SCTP_RTOINFO    0
-#define SCTP_ASSOCINFO  1
-#define SCTP_INITMSG    2
-#define SCTP_NODELAY    3               /* Get/set nodelay option. */
-#define SCTP_AUTOCLOSE  4
-#define SCTP_SET_PEER_PRIMARY_ADDR 5
-#define SCTP_PRIMARY_ADDR       6
-#define SCTP_ADAPTATION_LAYER   7
-#define SCTP_DISABLE_FRAGMENTS  8
-#define SCTP_PEER_ADDR_PARAMS   9
-#define SCTP_DEFAULT_SEND_PARAM 10
-#define SCTP_EVENTS     11
-#define SCTP_I_WANT_MAPPED_V4_ADDR 12   /* Turn on/off mapped v4 addresses  */
-#define SCTP_MAXSEG     13              /* Get/set maximum fragment. */
-#define SCTP_STATUS     14
-#define SCTP_GET_PEER_ADDR_INFO 15
-#define SCTP_DELAYED_ACK_TIME   16
-#define SCTP_DELAYED_ACK SCTP_DELAYED_ACK_TIME
-#define SCTP_DELAYED_SACK SCTP_DELAYED_ACK_TIME
-#define SCTP_CONTEXT    17
-#define SCTP_FRAGMENT_INTERLEAVE        18
-#define SCTP_PARTIAL_DELIVERY_POINT     19 /* Set/Get partial delivery point */
-#define SCTP_MAX_BURST  20              /* Set/Get max burst */
-#define SCTP_AUTH_CHUNK 21      /* Set only: add a chunk type to authenticate */
-#define SCTP_HMAC_IDENT 22
-#define SCTP_AUTH_KEY   23
-#define SCTP_AUTH_ACTIVE_KEY    24
-#define SCTP_AUTH_DELETE_KEY    25
-#define SCTP_PEER_AUTH_CHUNKS   26      /* Read only */
-#define SCTP_LOCAL_AUTH_CHUNKS  27      /* Read only */
-#define SCTP_GET_ASSOC_NUMBER   28      /* Read only */
-#define SCTP_GET_ASSOC_ID_LIST  29      /* Read only */
-#define SCTP_AUTO_ASCONF       30
-#define SCTP_PEER_ADDR_THLDS    31
-
-/* Internal Socket Options. Some of the sctp library functions are
- * implemented using these socket options.
- */
-#define SCTP_SOCKOPT_BINDX_ADD  100     /* BINDX requests for adding addrs */
-#define SCTP_SOCKOPT_BINDX_REM  101     /* BINDX requests for removing addrs. */
-#define SCTP_SOCKOPT_PEELOFF    102     /* peel off association. */
-/* Options 104-106 are deprecated and removed. Do not use this space */
-#define SCTP_SOCKOPT_CONNECTX_OLD       107     /* CONNECTX old requests. */
-#define SCTP_GET_PEER_ADDRS     108             /* Get all peer address. */
-#define SCTP_GET_LOCAL_ADDRS    109             /* Get all local address. */
-#define SCTP_SOCKOPT_CONNECTX   110             /* CONNECTX requests. */
-#define SCTP_SOCKOPT_CONNECTX3  111     /* CONNECTX requests (updated) */
-#define SCTP_GET_ASSOC_STATS    112     /* Read only */
-
-/*
- * 5.2.1 SCTP Initiation Structure (SCTP_INIT)
- *
- *   This cmsghdr structure provides information for initializing new
- *   SCTP associations with sendmsg().  The SCTP_INITMSG socket option
- *   uses this same data structure.  This structure is not used for
- *   recvmsg().
- *
- *   cmsg_level    cmsg_type      cmsg_data[]
- *   ------------  ------------   ----------------------
- *   IPPROTO_SCTP  SCTP_INIT      struct sctp_initmsg
- *
- */
-struct sctp_initmsg {
-        __u16 sinit_num_ostreams;
-        __u16 sinit_max_instreams;
-        __u16 sinit_max_attempts;
-        __u16 sinit_max_init_timeo;
-};
-
-/*
- * 5.2.2 SCTP Header Information Structure (SCTP_SNDRCV)
- *
- *   This cmsghdr structure specifies SCTP options for sendmsg() and
- *   describes SCTP header information about a received message through
- *   recvmsg().
- *
- *   cmsg_level    cmsg_type      cmsg_data[]
- *   ------------  ------------   ----------------------
- *   IPPROTO_SCTP  SCTP_SNDRCV    struct sctp_sndrcvinfo
- *
- */
-struct sctp_sndrcvinfo {
-        __u16 sinfo_stream;
-        __u16 sinfo_ssn;
-        __u16 sinfo_flags;
-        __u32 sinfo_ppid;
-        __u32 sinfo_context;
-        __u32 sinfo_timetolive;
-        __u32 sinfo_tsn;
-        __u32 sinfo_cumtsn;
-        sctp_assoc_t sinfo_assoc_id;
-};
-
-/*
- *  sinfo_flags: 16 bits (unsigned integer)
- *
- *   This field may contain any of the following flags and is composed of
- *   a bitwise OR of these values.
- */
-
-enum sctp_sinfo_flags {
-        SCTP_UNORDERED = 1,  /* Send/receive message unordered. */
-        SCTP_ADDR_OVER = 2,  /* Override the primary destination. */
-        SCTP_ABORT=4,        /* Send an ABORT message to the peer. */
-        SCTP_SACK_IMMEDIATELY = 8,      /* SACK should be sent without delay */
-        SCTP_EOF=MSG_FIN,    /* Initiate graceful shutdown process. */  
-};
-
-
-/* These are cmsg_types.  */
-typedef enum sctp_cmsg_type {
-        SCTP_INIT,              /* 5.2.1 SCTP Initiation Structure */
-        SCTP_SNDRCV,            /* 5.2.2 SCTP Header Information Structure */
-} sctp_cmsg_t;
-
-
-/*
- * 5.3.1.1 SCTP_ASSOC_CHANGE
- *
- *   Communication notifications inform the ULP that an SCTP association
- *   has either begun or ended. The identifier for a new association is
- *   provided by this notificaion. The notification information has the
- *   following format:
- *
- */
-struct sctp_assoc_change {
-        __u16 sac_type;
-        __u16 sac_flags;
-        __u32 sac_length;
-        __u16 sac_state;
-        __u16 sac_error;
-        __u16 sac_outbound_streams;
-        __u16 sac_inbound_streams;
-        sctp_assoc_t sac_assoc_id;
-        __u8 sac_info[0];
-};
-
-/*
- *   sac_state: 32 bits (signed integer)
- *
- *   This field holds one of a number of values that communicate the
- *   event that happened to the association.  They include:
- *
- *   Note:  The following state names deviate from the API draft as
- *   the names clash too easily with other kernel symbols.
- */
-enum sctp_sac_state {
-        SCTP_COMM_UP,
-        SCTP_COMM_LOST,
-        SCTP_RESTART,
-        SCTP_SHUTDOWN_COMP,
-        SCTP_CANT_STR_ASSOC,
-};
-
-/*
- * 5.3.1.2 SCTP_PEER_ADDR_CHANGE
- *
- *   When a destination address on a multi-homed peer encounters a change
- *   an interface details event is sent.  The information has the
- *   following structure:
- */
-struct sctp_paddr_change {
-        __u16 spc_type;
-        __u16 spc_flags;
-        __u32 spc_length;
-        struct sockaddr_storage spc_aaddr;
-        int spc_state;
-        int spc_error;
-        sctp_assoc_t spc_assoc_id;
-} __attribute__((packed, aligned(4)));
-
-/*
- *    spc_state:  32 bits (signed integer)
- *
- *   This field holds one of a number of values that communicate the
- *   event that happened to the address.  They include:
- */
-enum sctp_spc_state {
-        SCTP_ADDR_AVAILABLE,
-        SCTP_ADDR_UNREACHABLE,
-        SCTP_ADDR_REMOVED,
-        SCTP_ADDR_ADDED,
-        SCTP_ADDR_MADE_PRIM,
-        SCTP_ADDR_CONFIRMED,
-};
-
-
-/*
- * 5.3.1.3 SCTP_REMOTE_ERROR
- *
- *   A remote peer may send an Operational Error message to its peer.
- *   This message indicates a variety of error conditions on an
- *   association. The entire error TLV as it appears on the wire is
- *   included in a SCTP_REMOTE_ERROR event.  Please refer to the SCTP
- *   specification [SCTP] and any extensions for a list of possible
- *   error formats. SCTP error TLVs have the format:
- */
-struct sctp_remote_error {
-        __u16 sre_type;
-        __u16 sre_flags;
-        __u32 sre_length;
-        __u16 sre_error;
-        sctp_assoc_t sre_assoc_id;
-        __u8 sre_data[0];
-};
-
-
-/*
- * 5.3.1.4 SCTP_SEND_FAILED
- *
- *   If SCTP cannot deliver a message it may return the message as a
- *   notification.
- */
-struct sctp_send_failed {
-        __u16 ssf_type;
-        __u16 ssf_flags;
-        __u32 ssf_length;
-        __u32 ssf_error;
-        struct sctp_sndrcvinfo ssf_info;
-        sctp_assoc_t ssf_assoc_id;
-        __u8 ssf_data[0];
-};
-
-/*
- *   ssf_flags: 16 bits (unsigned integer)
- *
- *   The flag value will take one of the following values
- *
- *   SCTP_DATA_UNSENT  - Indicates that the data was never put on
- *                       the wire.
- *
- *   SCTP_DATA_SENT    - Indicates that the data was put on the wire.
- *                       Note that this does not necessarily mean that the
- *                       data was (or was not) successfully delivered.
- */
-enum sctp_ssf_flags {
-        SCTP_DATA_UNSENT,
-        SCTP_DATA_SENT,
-};
-
-/*
- * 5.3.1.5 SCTP_SHUTDOWN_EVENT
- *
- *   When a peer sends a SHUTDOWN, SCTP delivers this notification to
- *   inform the application that it should cease sending data.
- */
-struct sctp_shutdown_event {
-        __u16 sse_type;
-        __u16 sse_flags;
-        __u32 sse_length;
-        sctp_assoc_t sse_assoc_id;
-};
-
-/*
- * 5.3.1.6 SCTP_ADAPTATION_INDICATION
- *
- *   When a peer sends a Adaptation Layer Indication parameter , SCTP
- *   delivers this notification to inform the application
- *   that of the peers requested adaptation layer.
- */
-struct sctp_adaptation_event {
-        __u16 sai_type;
-        __u16 sai_flags;
-        __u32 sai_length;
-        __u32 sai_adaptation_ind;
-        sctp_assoc_t sai_assoc_id;
-};
-
-/*
- * 5.3.1.7 SCTP_PARTIAL_DELIVERY_EVENT
- *
- *   When a receiver is engaged in a partial delivery of a
- *   message this notification will be used to indicate
- *   various events.
- */
-struct sctp_pdapi_event {
-        __u16 pdapi_type;
-        __u16 pdapi_flags;
-        __u32 pdapi_length;
-        __u32 pdapi_indication;
-        sctp_assoc_t pdapi_assoc_id;
-};
-
-enum { SCTP_PARTIAL_DELIVERY_ABORTED=0, };
-
-struct sctp_authkey_event {
-        __u16 auth_type;
-        __u16 auth_flags;
-        __u32 auth_length;
-        __u16 auth_keynumber;
-        __u16 auth_altkeynumber;
-        __u32 auth_indication;
-        sctp_assoc_t auth_assoc_id;
-};
-
-enum { SCTP_AUTH_NEWKEY = 0, };
-
-/*
- * 6.1.9. SCTP_SENDER_DRY_EVENT
- *
- * When the SCTP stack has no more user data to send or retransmit, this
- * notification is given to the user. Also, at the time when a user app
- * subscribes to this event, if there is no data to be sent or
- * retransmit, the stack will immediately send up this notification.
- */
-struct sctp_sender_dry_event {
-        __u16 sender_dry_type;
-        __u16 sender_dry_flags;
-        __u32 sender_dry_length;
-        sctp_assoc_t sender_dry_assoc_id;
-};
-
-/*
- * Described in Section 7.3
- *   Ancillary Data and Notification Interest Options
- */
-struct sctp_event_subscribe {
-        __u8 sctp_data_io_event;
-        __u8 sctp_association_event;
-        __u8 sctp_address_event;
-        __u8 sctp_send_failure_event;
-        __u8 sctp_peer_error_event;
-        __u8 sctp_shutdown_event;
-        __u8 sctp_partial_delivery_event;
-        __u8 sctp_adaptation_layer_event;
-        __u8 sctp_authentication_event;
-        __u8 sctp_sender_dry_event;
-};
-
-/*
- * 5.3.1 SCTP Notification Structure
- *
- *   The notification structure is defined as the union of all
- *   notification types.
- *
- */
-union sctp_notification {
-        struct {
-                __u16 sn_type;             /* Notification type. */
-                __u16 sn_flags;
-                __u32 sn_length;
-        } sn_header;
-        struct sctp_assoc_change sn_assoc_change;
-        struct sctp_paddr_change sn_paddr_change;
-        struct sctp_remote_error sn_remote_error;
-        struct sctp_send_failed sn_send_failed;
-        struct sctp_shutdown_event sn_shutdown_event;
-        struct sctp_adaptation_event sn_adaptation_event;
-        struct sctp_pdapi_event sn_pdapi_event;
-        struct sctp_authkey_event sn_authkey_event;
-        struct sctp_sender_dry_event sn_sender_dry_event;
-};
-
-/* Section 5.3.1
- * All standard values for sn_type flags are greater than 2^15.
- * Values from 2^15 and down are reserved.
- */
-
-enum sctp_sn_type {
-        SCTP_SN_TYPE_BASE     = (1<<15),
-        SCTP_ASSOC_CHANGE,
-        SCTP_PEER_ADDR_CHANGE,
-        SCTP_SEND_FAILED,
-        SCTP_REMOTE_ERROR,
-        SCTP_SHUTDOWN_EVENT,
-        SCTP_PARTIAL_DELIVERY_EVENT,
-        SCTP_ADAPTATION_INDICATION,
-        SCTP_AUTHENTICATION_EVENT,
-#define SCTP_AUTHENTICATION_INDICATION  SCTP_AUTHENTICATION_EVENT
-        SCTP_SENDER_DRY_EVENT,
-};
-
-/* Notification error codes used to fill up the error fields in some
- * notifications.
- * SCTP_PEER_ADDRESS_CHAGE      : spc_error
- * SCTP_ASSOC_CHANGE            : sac_error
- * These names should be potentially included in the draft 04 of the SCTP
- * sockets API specification.
- */
-typedef enum sctp_sn_error {
-        SCTP_FAILED_THRESHOLD,
-        SCTP_RECEIVED_SACK,
-        SCTP_HEARTBEAT_SUCCESS,
-        SCTP_RESPONSE_TO_USER_REQ,
-        SCTP_INTERNAL_ERROR,
-        SCTP_SHUTDOWN_GUARD_EXPIRES,
-        SCTP_PEER_FAULTY,
-} sctp_sn_error_t;
-
-/*
- * 7.1.1 Retransmission Timeout Parameters (SCTP_RTOINFO)
- *
- *   The protocol parameters used to initialize and bound retransmission
- *   timeout (RTO) are tunable.  See [SCTP] for more information on how
- *   these parameters are used in RTO calculation. 
- */
-struct sctp_rtoinfo {
-        sctp_assoc_t    srto_assoc_id;
-        __u32           srto_initial;
-        __u32           srto_max;
-        __u32           srto_min;
-};
-
-/*
- * 7.1.2 Association Parameters (SCTP_ASSOCINFO)
- *
- *   This option is used to both examine and set various association and
- *   endpoint parameters.
- */
-struct sctp_assocparams {
-        sctp_assoc_t    sasoc_assoc_id;
-        __u16           sasoc_asocmaxrxt;
-        __u16           sasoc_number_peer_destinations;
-        __u32           sasoc_peer_rwnd;
-        __u32           sasoc_local_rwnd;
-        __u32           sasoc_cookie_life;
-};
-
-/*
- * 7.1.9 Set Peer Primary Address (SCTP_SET_PEER_PRIMARY_ADDR)
- *
- *  Requests that the peer mark the enclosed address as the association
- *  primary. The enclosed address must be one of the association's
- *  locally bound addresses. The following structure is used to make a
- *   set primary request:
- */
-struct sctp_setpeerprim {
-        sctp_assoc_t            sspp_assoc_id;
-        struct sockaddr_storage sspp_addr;
-} __attribute__((packed, aligned(4)));
-
-/*
- * 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
- *
- *  Requests that the local SCTP stack use the enclosed peer address as
- *  the association primary. The enclosed address must be one of the
- *  association peer's addresses. The following structure is used to
- *  make a set peer primary request:
- */
-struct sctp_prim {
-        sctp_assoc_t            ssp_assoc_id;
-        struct sockaddr_storage ssp_addr;
-} __attribute__((packed, aligned(4)));
-
-/*
- * 7.1.11 Set Adaptation Layer Indicator (SCTP_ADAPTATION_LAYER)
- *
- * Requests that the local endpoint set the specified Adaptation Layer
- * Indication parameter for all future INIT and INIT-ACK exchanges.
- */
-struct sctp_setadaptation {
-        __u32   ssb_adaptation_ind;
-};
-
-/*
- * 7.1.13 Peer Address Parameters  (SCTP_PEER_ADDR_PARAMS)
- *
- *   Applications can enable or disable heartbeats for any peer address
- *   of an association, modify an address's heartbeat interval, force a
- *   heartbeat to be sent immediately, and adjust the address's maximum
- *   number of retransmissions sent before an address is considered
- *   unreachable. The following structure is used to access and modify an
- *   address's parameters:
- */
-enum  sctp_spp_flags {
-        SPP_HB_ENABLE = 1<<0,           /*Enable heartbeats*/
-        SPP_HB_DISABLE = 1<<1,          /*Disable heartbeats*/
-        SPP_HB = SPP_HB_ENABLE | SPP_HB_DISABLE,
-        SPP_HB_DEMAND = 1<<2,           /*Send heartbeat immediately*/
-        SPP_PMTUD_ENABLE = 1<<3,        /*Enable PMTU discovery*/
-        SPP_PMTUD_DISABLE = 1<<4,       /*Disable PMTU discovery*/
-        SPP_PMTUD = SPP_PMTUD_ENABLE | SPP_PMTUD_DISABLE,
-        SPP_SACKDELAY_ENABLE = 1<<5,    /*Enable SACK*/
-        SPP_SACKDELAY_DISABLE = 1<<6,   /*Disable SACK*/
-        SPP_SACKDELAY = SPP_SACKDELAY_ENABLE | SPP_SACKDELAY_DISABLE,
-        SPP_HB_TIME_IS_ZERO = 1<<7,     /* Set HB delay to 0 */
-};
-
-struct sctp_paddrparams {
-        sctp_assoc_t            spp_assoc_id;
-        struct sockaddr_storage spp_address;
-        __u32                   spp_hbinterval;
-        __u16                   spp_pathmaxrxt;
-        __u32                   spp_pathmtu;
-        __u32                   spp_sackdelay;
-        __u32                   spp_flags;
-} __attribute__((packed, aligned(4)));
-
-/*
- * 7.1.18.  Add a chunk that must be authenticated (SCTP_AUTH_CHUNK)
- *
- * This set option adds a chunk type that the user is requesting to be
- * received only in an authenticated way.  Changes to the list of chunks
- * will only effect future associations on the socket.
- */
-struct sctp_authchunk {
-        __u8            sauth_chunk;
-};
-
-/*
- * 7.1.19.  Get or set the list of supported HMAC Identifiers (SCTP_HMAC_IDENT)
- *
- * This option gets or sets the list of HMAC algorithms that the local
- * endpoint requires the peer to use.
-*/
-struct sctp_hmacalgo {
-        __u32           shmac_num_idents;
-        __u16           shmac_idents[];
-};
-
-/*
- * 7.1.20.  Set a shared key (SCTP_AUTH_KEY)
- *
- * This option will set a shared secret key which is used to build an
- * association shared key.
- */
-struct sctp_authkey {
-        sctp_assoc_t    sca_assoc_id;
-        __u16           sca_keynumber;
-        __u16           sca_keylength;
-        __u8            sca_key[];
-};
-
-/*
- * 7.1.21.  Get or set the active shared key (SCTP_AUTH_ACTIVE_KEY)
- *
- * This option will get or set the active shared key to be used to build
- * the association shared key.
- */
-
-struct sctp_authkeyid {
-        sctp_assoc_t    scact_assoc_id;
-        __u16           scact_keynumber;
-};
-
-
-/*
- * 7.1.23.  Get or set delayed ack timer (SCTP_DELAYED_SACK)
- *
- * This option will effect the way delayed acks are performed.  This
- * option allows you to get or set the delayed ack time, in
- * milliseconds.  It also allows changing the delayed ack frequency.
- * Changing the frequency to 1 disables the delayed sack algorithm.  If
- * the assoc_id is 0, then this sets or gets the endpoints default
- * values.  If the assoc_id field is non-zero, then the set or get
- * effects the specified association for the one to many model (the
- * assoc_id field is ignored by the one to one model).  Note that if
- * sack_delay or sack_freq are 0 when setting this option, then the
- * current values will remain unchanged.
- */
-struct sctp_sack_info {
-        sctp_assoc_t    sack_assoc_id;
-        uint32_t        sack_delay;
-        uint32_t        sack_freq;
-};
-
-struct sctp_assoc_value {
-    sctp_assoc_t            assoc_id;
-    uint32_t                assoc_value;
-};
-
-/*
- * 7.2.2 Peer Address Information
- *
- *   Applications can retrieve information about a specific peer address
- *   of an association, including its reachability state, congestion
- *   window, and retransmission timer values.  This information is
- *   read-only. The following structure is used to access this
- *   information:
- */
-struct sctp_paddrinfo {
-        sctp_assoc_t            spinfo_assoc_id;
-        struct sockaddr_storage spinfo_address;
-        __s32                   spinfo_state;
-        __u32                   spinfo_cwnd;
-        __u32                   spinfo_srtt;
-        __u32                   spinfo_rto;
-        __u32                   spinfo_mtu;
-} __attribute__((packed, aligned(4)));
-
-/* Peer addresses's state. */
-/* UNKNOWN: Peer address passed by the upper layer in sendmsg or connect[x]
- * calls.
- * UNCONFIRMED: Peer address received in INIT/INIT-ACK address parameters.
- *              Not yet confirmed by a heartbeat and not available for data
- *              transfers.
- * ACTIVE : Peer address confirmed, active and available for data transfers.
- * INACTIVE: Peer address inactive and not available for data transfers.
- */
-enum sctp_spinfo_state {
-        SCTP_INACTIVE,
-        SCTP_PF,
-        SCTP_ACTIVE,
-        SCTP_UNCONFIRMED,
-        SCTP_UNKNOWN = 0xffff  /* Value used for transport state unknown */
-};
-
-/*
- * 7.2.1 Association Status (SCTP_STATUS)
- *
- *   Applications can retrieve current status information about an
- *   association, including association state, peer receiver window size,
- *   number of unacked data chunks, and number of data chunks pending
- *   receipt.  This information is read-only.  The following structure is
- *   used to access this information:
- */
-struct sctp_status {
-        sctp_assoc_t            sstat_assoc_id;
-        __s32                   sstat_state;
-        __u32                   sstat_rwnd;
-        __u16                   sstat_unackdata;
-        __u16                   sstat_penddata;
-        __u16                   sstat_instrms;
-        __u16                   sstat_outstrms;
-        __u32                   sstat_fragmentation_point;
-        struct sctp_paddrinfo   sstat_primary;
-};
-
-/*
- * 7.2.3.  Get the list of chunks the peer requires to be authenticated
- *         (SCTP_PEER_AUTH_CHUNKS)
- *
- * This option gets a list of chunks for a specified association that
- * the peer requires to be received authenticated only.
- */
-struct sctp_authchunks {
-        sctp_assoc_t    gauth_assoc_id;
-        __u32           gauth_number_of_chunks;
-        uint8_t         gauth_chunks[];
-};
-
-/*
- * 8.2.6. Get the Current Identifiers of Associations
- *        (SCTP_GET_ASSOC_ID_LIST)
- *
- * This option gets the current list of SCTP association identifiers of
- * the SCTP associations handled by a one-to-many style socket.
- */
-struct sctp_assoc_ids {
-        __u32           gaids_number_of_ids;
-        sctp_assoc_t    gaids_assoc_id[];
-};
-
-/*
- * 8.3, 8.5 get all peer/local addresses in an association.
- * This parameter struct is used by SCTP_GET_PEER_ADDRS and 
- * SCTP_GET_LOCAL_ADDRS socket options used internally to implement
- * sctp_getpaddrs() and sctp_getladdrs() API. 
- */
-struct sctp_getaddrs_old {
-        sctp_assoc_t            assoc_id;
-        int                     addr_num;
-        struct sockaddr         __user *addrs;
-};
-struct sctp_getaddrs {
-        sctp_assoc_t            assoc_id; /*input*/
-        __u32                   addr_num; /*output*/
-        __u8                    addrs[0]; /*output, variable size*/
-};
-
-/* A socket user request obtained via SCTP_GET_ASSOC_STATS that retrieves
- * association stats. All stats are counts except sas_maxrto and
- * sas_obs_rto_ipaddr. maxrto is the max observed rto + transport since
- * the last call. Will return 0 when RTO was not update since last call
- */
-struct sctp_assoc_stats {
-        sctp_assoc_t    sas_assoc_id;    /* Input */
-                                         /* Transport of observed max RTO */
-        struct sockaddr_storage sas_obs_rto_ipaddr;
-        __u64           sas_maxrto;      /* Maximum Observed RTO for period */
-        __u64           sas_isacks;      /* SACKs received */
-        __u64           sas_osacks;      /* SACKs sent */
-        __u64           sas_opackets;    /* Packets sent */
-        __u64           sas_ipackets;    /* Packets received */
-        __u64           sas_rtxchunks;   /* Retransmitted Chunks */
-        __u64           sas_outofseqtsns;/* TSN received > next expected */
-        __u64           sas_idupchunks;  /* Dups received (ordered+unordered) */
-        __u64           sas_gapcnt;      /* Gap Acknowledgements Received */
-        __u64           sas_ouodchunks;  /* Unordered data chunks sent */
-        __u64           sas_iuodchunks;  /* Unordered data chunks received */
-        __u64           sas_oodchunks;   /* Ordered data chunks sent */
-        __u64           sas_iodchunks;   /* Ordered data chunks received */
-        __u64           sas_octrlchunks; /* Control chunks sent */
-        __u64           sas_ictrlchunks; /* Control chunks received */
-};
-
-/* These are bit fields for msghdr->msg_flags.  See section 5.1.  */
-/* On user space Linux, these live in <bits/socket.h> as an enum.  */
-enum sctp_msg_flags {
-        MSG_NOTIFICATION = 0x8000,
-#define MSG_NOTIFICATION MSG_NOTIFICATION
-};
-
-/*
- * 8.1 sctp_bindx()
- *
- * The flags parameter is formed from the bitwise OR of zero or more of the
- * following currently defined flags:
- */
-#define SCTP_BINDX_ADD_ADDR 0x01
-#define SCTP_BINDX_REM_ADDR 0x02
-
-/* This is the structure that is passed as an argument(optval) to
- * getsockopt(SCTP_SOCKOPT_PEELOFF).
- */
-typedef struct {
-        sctp_assoc_t associd;
-        int sd;
-} sctp_peeloff_arg_t;
-
-/*
- *  Peer Address Thresholds socket option
- */
-struct sctp_paddrthlds {
-        sctp_assoc_t spt_assoc_id;
-        struct sockaddr_storage spt_address;
-        __u16 spt_pathmaxrxt;
-        __u16 spt_pathpfthld;
-};
-#endif /* __net_sctp_user_h__ */
diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
index c2e542b27a5a..6ca975bebd37 100644
--- a/include/net/secure_seq.h
+++ b/include/net/secure_seq.h
@@ -3,6 +3,7 @@
 
 #include <linux/types.h>
 
+extern void net_secret_init(void);
 extern __u32 secure_ip_id(__be32 daddr);
 extern __u32 secure_ipv6_id(const __be32 daddr[4]);
 extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
diff --git a/include/net/sock.h b/include/net/sock.h
index 14f6e9d19dc7..5c97b0fc5623 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -667,6 +667,7 @@ enum sock_flags {
                      * user-space instead.
                      */
         SOCK_FILTER_LOCKED, /* Filter cannot be changed anymore */
+        SOCK_SELECT_ERR_QUEUE, /* Wake select on error queue */
 };
 
 static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
@@ -2158,10 +2159,9 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
  * @sk:         socket sending this packet
  * @tx_flags:   filled with instructions for time stamping
  *
- * Currently only depends on SOCK_TIMESTAMPING* flags. Returns error code if
- * parameters are invalid.
+ * Currently only depends on SOCK_TIMESTAMPING* flags.
  */
-extern int sock_tx_timestamp(struct sock *sk, __u8 *tx_flags);
+extern void sock_tx_timestamp(struct sock *sk, __u8 *tx_flags);
 
 /**
  * sk_eat_skb - Release a skb if it is no longer needed
diff --git a/include/net/tcp.h b/include/net/tcp.h
index cf0694d4ad60..5bba80fbd1d9 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -179,7 +179,6 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCPOPT_SACK             5       /* SACK Block */
 #define TCPOPT_TIMESTAMP        8       /* Better RTT estimations/PAWS */
 #define TCPOPT_MD5SIG           19      /* MD5 Signature (RFC2385) */
-#define TCPOPT_COOKIE           253     /* Cookie extension (experimental) */
 #define TCPOPT_EXP              254     /* Experimental */
 /* Magic number to be after the option value for sharing TCP
  * experimental options. See draft-ietf-tcpm-experimental-options-00.txt
@@ -273,7 +272,6 @@ extern int sysctl_tcp_app_win;
 extern int sysctl_tcp_adv_win_scale;
 extern int sysctl_tcp_tw_reuse;
 extern int sysctl_tcp_frto;
-extern int sysctl_tcp_frto_response;
 extern int sysctl_tcp_low_latency;
 extern int sysctl_tcp_dma_copybreak;
 extern int sysctl_tcp_nometrics_save;
@@ -284,7 +282,6 @@ extern int sysctl_tcp_base_mss;
 extern int sysctl_tcp_workaround_signed_windows;
 extern int sysctl_tcp_slow_start_after_idle;
 extern int sysctl_tcp_max_ssthresh;
-extern int sysctl_tcp_cookie_size;
 extern int sysctl_tcp_thin_linear_timeouts;
 extern int sysctl_tcp_thin_dupack;
 extern int sysctl_tcp_early_retrans;
@@ -373,6 +370,7 @@ extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 extern int tcp_sendpage(struct sock *sk, struct page *page, int offset,
                         size_t size, int flags);
 extern void tcp_release_cb(struct sock *sk);
+extern void tcp_wfree(struct sk_buff *skb);
 extern void tcp_write_timer_handler(struct sock *sk);
 extern void tcp_delack_timer_handler(struct sock *sk);
 extern int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg);
@@ -425,8 +423,6 @@ extern struct sock * tcp_check_req(struct sock *sk,struct sk_buff *skb,
                                    bool fastopen);
 extern int tcp_child_process(struct sock *parent, struct sock *child,
                              struct sk_buff *skb);
-extern bool tcp_use_frto(struct sock *sk);
-extern void tcp_enter_frto(struct sock *sk);
 extern void tcp_enter_loss(struct sock *sk, int how);
 extern void tcp_clear_retrans(struct tcp_sock *tp);
 extern void tcp_update_metrics(struct sock *sk);
@@ -454,7 +450,7 @@ extern void tcp_syn_ack_timeout(struct sock *sk, struct request_sock *req);
 extern int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        size_t len, int nonblock, int flags, int *addr_len);
 extern void tcp_parse_options(const struct sk_buff *skb,
-                              struct tcp_options_received *opt_rx, const u8 **hvpp,
+                              struct tcp_options_received *opt_rx,
                               int estab, struct tcp_fastopen_cookie *foc);
 extern const u8 *tcp_parse_md5sig_option(const struct tcphdr *th);
 
@@ -476,7 +472,6 @@ extern int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr,
 extern int tcp_connect(struct sock *sk);
 extern struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                                         struct request_sock *req,
-                                        struct request_values *rvp,
                                         struct tcp_fastopen_cookie *foc);
 extern int tcp_disconnect(struct sock *sk, int flags);
 
@@ -543,6 +538,8 @@ extern bool tcp_syn_flood_action(struct sock *sk,
 extern void tcp_push_one(struct sock *, unsigned int mss_now);
 extern void tcp_send_ack(struct sock *sk);
 extern void tcp_send_delayed_ack(struct sock *sk);
+extern void tcp_send_loss_probe(struct sock *sk);
+extern bool tcp_schedule_loss_probe(struct sock *sk);
 
 /* tcp_input.c */
 extern void tcp_cwnd_application_limited(struct sock *sk);
@@ -756,7 +753,6 @@ enum tcp_ca_event {
         CA_EVENT_TX_START,      /* first transmit when no packets in flight */
         CA_EVENT_CWND_RESTART,  /* congestion window restart */
         CA_EVENT_COMPLETE_CWR,  /* end of congestion recovery */
-        CA_EVENT_FRTO,          /* fast recovery timeout */
         CA_EVENT_LOSS,          /* loss timeout */
         CA_EVENT_FAST_ACK,      /* in sequence ack */
         CA_EVENT_SLOW_ACK,      /* other ack */
@@ -873,8 +869,8 @@ static inline void tcp_enable_fack(struct tcp_sock *tp)
 static inline void tcp_enable_early_retrans(struct tcp_sock *tp)
 {
         tp->do_early_retrans = sysctl_tcp_early_retrans &&
-                !sysctl_tcp_thin_dupack && sysctl_tcp_reordering == 3;
-        tp->early_retrans_delayed = 0;
+                sysctl_tcp_early_retrans < 4 && !sysctl_tcp_thin_dupack &&
+                sysctl_tcp_reordering == 3;
 }
 
 static inline void tcp_disable_early_retrans(struct tcp_sock *tp)
@@ -1030,50 +1026,7 @@ static inline void tcp_prequeue_init(struct tcp_sock *tp)
 #endif
 }
 
-/* Packet is added to VJ-style prequeue for processing in process
- * context, if a reader task is waiting. Apparently, this exciting
- * idea (VJ's mail "Re: query about TCP header on tcp-ip" of 07 Sep 93)
- * failed somewhere. Latency? Burstiness? Well, at least now we will
- * see, why it failed. 8)8)                               --ANK
- *
- * NOTE: is this not too big to inline?
- */
-static inline bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        if (sysctl_tcp_low_latency || !tp->ucopy.task)
-                return false;
-
-        if (skb->len <= tcp_hdrlen(skb) &&
-            skb_queue_len(&tp->ucopy.prequeue) == 0)
-                return false;
-
-        __skb_queue_tail(&tp->ucopy.prequeue, skb);
-        tp->ucopy.memory += skb->truesize;
-        if (tp->ucopy.memory > sk->sk_rcvbuf) {
-                struct sk_buff *skb1;
-
-                BUG_ON(sock_owned_by_user(sk));
-
-                while ((skb1 = __skb_dequeue(&tp->ucopy.prequeue)) != NULL) {
-                        sk_backlog_rcv(sk, skb1);
-                        NET_INC_STATS_BH(sock_net(sk),
-                                         LINUX_MIB_TCPPREQUEUEDROPPED);
-                }
-
-                tp->ucopy.memory = 0;
-        } else if (skb_queue_len(&tp->ucopy.prequeue) == 1) {
-                wake_up_interruptible_sync_poll(sk_sleep(sk),
-                                           POLLIN | POLLRDNORM | POLLRDBAND);
-                if (!inet_csk_ack_scheduled(sk))
-                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-                                                  (3 * tcp_rto_min(sk)) / 4,
-                                                  TCP_RTO_MAX);
-        }
-        return true;
-}
-
+extern bool tcp_prequeue(struct sock *sk, struct sk_buff *skb);
 
 #undef STATE_TRACE
 
@@ -1630,91 +1583,6 @@ struct tcp_request_sock_ops {
 #endif
 };
 
-/* Using SHA1 for now, define some constants.
- */
-#define COOKIE_DIGEST_WORDS (SHA_DIGEST_WORDS)
-#define COOKIE_MESSAGE_WORDS (SHA_MESSAGE_BYTES / 4)
-#define COOKIE_WORKSPACE_WORDS (COOKIE_DIGEST_WORDS + COOKIE_MESSAGE_WORDS)
-
-extern int tcp_cookie_generator(u32 *bakery);
-
-/**
- *      struct tcp_cookie_values - each socket needs extra space for the
- *      cookies, together with (optional) space for any SYN data.
- *
- *      A tcp_sock contains a pointer to the current value, and this is
- *      cloned to the tcp_timewait_sock.
- *
- * @cookie_pair:        variable data from the option exchange.
- *
- * @cookie_desired:     user specified tcpct_cookie_desired.  Zero
- *                      indicates default (sysctl_tcp_cookie_size).
- *                      After cookie sent, remembers size of cookie.
- *                      Range 0, TCP_COOKIE_MIN to TCP_COOKIE_MAX.
- *
- * @s_data_desired:     user specified tcpct_s_data_desired.  When the
- *                      constant payload is specified (@s_data_constant),
- *                      holds its length instead.
- *                      Range 0 to TCP_MSS_DESIRED.
- *
- * @s_data_payload:     constant data that is to be included in the
- *                      payload of SYN or SYNACK segments when the
- *                      cookie option is present.
- */
-struct tcp_cookie_values {
-        struct kref     kref;
-        u8              cookie_pair[TCP_COOKIE_PAIR_SIZE];
-        u8              cookie_pair_size;
-        u8              cookie_desired;
-        u16             s_data_desired:11,
-                        s_data_constant:1,
-                        s_data_in:1,
-                        s_data_out:1,
-                        s_data_unused:2;
-        u8              s_data_payload[0];
-};
-
-static inline void tcp_cookie_values_release(struct kref *kref)
-{
-        kfree(container_of(kref, struct tcp_cookie_values, kref));
-}
-
-/* The length of constant payload data.  Note that s_data_desired is
- * overloaded, depending on s_data_constant: either the length of constant
- * data (returned here) or the limit on variable data.
- */
-static inline int tcp_s_data_size(const struct tcp_sock *tp)
-{
-        return (tp->cookie_values != NULL && tp->cookie_values->s_data_constant)
-                ? tp->cookie_values->s_data_desired
-                : 0;
-}
-
-/**
- *      struct tcp_extend_values - tcp_ipv?.c to tcp_output.c workspace.
- *
- *      As tcp_request_sock has already been extended in other places, the
- *      only remaining method is to pass stack values along as function
- *      parameters.  These parameters are not needed after sending SYNACK.
- *
- * @cookie_bakery:      cryptographic secret and message workspace.
- *
- * @cookie_plus:        bytes in authenticator/cookie option, copied from
- *                      struct tcp_options_received (above).
- */
-struct tcp_extend_values {
-        struct request_values           rv;
-        u32                             cookie_bakery[COOKIE_WORKSPACE_WORDS];
-        u8                              cookie_plus:6,
-                                        cookie_out_never:1,
-                                        cookie_in_always:1;
-};
-
-static inline struct tcp_extend_values *tcp_xv(struct request_values *rvp)
-{
-        return (struct tcp_extend_values *)rvp;
-}
-
 extern void tcp_v4_init(void);
 extern void tcp_init(void);
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 24c8886fd969..ae16531d0d35 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -162,6 +162,7 @@ struct xfrm_state {
                 xfrm_address_t  saddr;
                 int             header_len;
                 int             trailer_len;
+                u32             extra_flags;
         } props;
 
         struct xfrm_lifetime_cfg lft;