49 files changed, 1478 insertions, 289 deletions

diff --git a/include/net/6lowpan.h b/include/net/6lowpan.h
new file mode 100644
index 000000000000..f7d372b7d4ff
--- /dev/null
+++ b/include/net/6lowpan.h
@@ -0,0 +1,434 @@
+/*
+ * Copyright 2011, Siemens AG
+ * written by Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ */
+
+/*
+ * Based on patches from Jon Smirl <jonsmirl@gmail.com>
+ * Copyright (c) 2011 Jon Smirl <jonsmirl@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/* Jon's code is based on 6lowpan implementation for Contiki which is:
+ * Copyright (c) 2008, Swedish Institute of Computer Science.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef __6LOWPAN_H__
+#define __6LOWPAN_H__
+
+#include <net/ipv6.h>
+
+#define UIP_802154_SHORTADDR_LEN        2  /* compressed ipv6 address length */
+#define UIP_IPH_LEN                     40 /* ipv6 fixed header size */
+#define UIP_PROTO_UDP                   17 /* ipv6 next header value for UDP */
+#define UIP_FRAGH_LEN                   8  /* ipv6 fragment header size */
+
+/*
+ * ipv6 address based on mac
+ * second bit-flip (Universe/Local) is done according RFC2464
+ */
+#define is_addr_mac_addr_based(a, m) \
+        ((((a)->s6_addr[8])  == (((m)[0]) ^ 0x02)) &&   \
+         (((a)->s6_addr[9])  == (m)[1]) &&              \
+         (((a)->s6_addr[10]) == (m)[2]) &&              \
+         (((a)->s6_addr[11]) == (m)[3]) &&              \
+         (((a)->s6_addr[12]) == (m)[4]) &&              \
+         (((a)->s6_addr[13]) == (m)[5]) &&              \
+         (((a)->s6_addr[14]) == (m)[6]) &&              \
+         (((a)->s6_addr[15]) == (m)[7]))
+
+/* ipv6 address is unspecified */
+#define is_addr_unspecified(a)          \
+        ((((a)->s6_addr32[0]) == 0) &&  \
+         (((a)->s6_addr32[1]) == 0) &&  \
+         (((a)->s6_addr32[2]) == 0) &&  \
+         (((a)->s6_addr32[3]) == 0))
+
+/* compare ipv6 addresses prefixes */
+#define ipaddr_prefixcmp(addr1, addr2, length) \
+        (memcmp(addr1, addr2, length >> 3) == 0)
+
+/* local link, i.e. FE80::/10 */
+#define is_addr_link_local(a) (((a)->s6_addr16[0]) == htons(0xFE80))
+
+/*
+ * check whether we can compress the IID to 16 bits,
+ * it's possible for unicast adresses with first 49 bits are zero only.
+ */
+#define lowpan_is_iid_16_bit_compressable(a)    \
+        ((((a)->s6_addr16[4]) == 0) &&          \
+         (((a)->s6_addr[10]) == 0) &&           \
+         (((a)->s6_addr[11]) == 0xff) &&        \
+         (((a)->s6_addr[12]) == 0xfe) &&        \
+         (((a)->s6_addr[13]) == 0))
+
+/* multicast address */
+#define is_addr_mcast(a) (((a)->s6_addr[0]) == 0xFF)
+
+/* check whether the 112-bit gid of the multicast address is mappable to: */
+
+/* 9 bits, for FF02::1 (all nodes) and FF02::2 (all routers) addresses only. */
+#define lowpan_is_mcast_addr_compressable(a)    \
+        ((((a)->s6_addr16[1]) == 0) &&          \
+         (((a)->s6_addr16[2]) == 0) &&          \
+         (((a)->s6_addr16[3]) == 0) &&          \
+         (((a)->s6_addr16[4]) == 0) &&          \
+         (((a)->s6_addr16[5]) == 0) &&          \
+         (((a)->s6_addr16[6]) == 0) &&          \
+         (((a)->s6_addr[14])  == 0) &&          \
+         ((((a)->s6_addr[15]) == 1) || (((a)->s6_addr[15]) == 2)))
+
+/* 48 bits, FFXX::00XX:XXXX:XXXX */
+#define lowpan_is_mcast_addr_compressable48(a)  \
+        ((((a)->s6_addr16[1]) == 0) &&          \
+         (((a)->s6_addr16[2]) == 0) &&          \
+         (((a)->s6_addr16[3]) == 0) &&          \
+         (((a)->s6_addr16[4]) == 0) &&          \
+         (((a)->s6_addr[10]) == 0))
+
+/* 32 bits, FFXX::00XX:XXXX */
+#define lowpan_is_mcast_addr_compressable32(a)  \
+        ((((a)->s6_addr16[1]) == 0) &&          \
+         (((a)->s6_addr16[2]) == 0) &&          \
+         (((a)->s6_addr16[3]) == 0) &&          \
+         (((a)->s6_addr16[4]) == 0) &&          \
+         (((a)->s6_addr16[5]) == 0) &&          \
+         (((a)->s6_addr[12]) == 0))
+
+/* 8 bits, FF02::00XX */
+#define lowpan_is_mcast_addr_compressable8(a)   \
+        ((((a)->s6_addr[1])  == 2) &&           \
+         (((a)->s6_addr16[1]) == 0) &&          \
+         (((a)->s6_addr16[2]) == 0) &&          \
+         (((a)->s6_addr16[3]) == 0) &&          \
+         (((a)->s6_addr16[4]) == 0) &&          \
+         (((a)->s6_addr16[5]) == 0) &&          \
+         (((a)->s6_addr16[6]) == 0) &&          \
+         (((a)->s6_addr[14]) == 0))
+
+#define lowpan_is_addr_broadcast(a)     \
+        ((((a)[0]) == 0xFF) &&  \
+         (((a)[1]) == 0xFF) &&  \
+         (((a)[2]) == 0xFF) &&  \
+         (((a)[3]) == 0xFF) &&  \
+         (((a)[4]) == 0xFF) &&  \
+         (((a)[5]) == 0xFF) &&  \
+         (((a)[6]) == 0xFF) &&  \
+         (((a)[7]) == 0xFF))
+
+#define LOWPAN_DISPATCH_IPV6    0x41 /* 01000001 = 65 */
+#define LOWPAN_DISPATCH_HC1     0x42 /* 01000010 = 66 */
+#define LOWPAN_DISPATCH_IPHC    0x60 /* 011xxxxx = ... */
+#define LOWPAN_DISPATCH_FRAG1   0xc0 /* 11000xxx */
+#define LOWPAN_DISPATCH_FRAGN   0xe0 /* 11100xxx */
+
+#define LOWPAN_DISPATCH_MASK    0xf8 /* 11111000 */
+
+#define LOWPAN_FRAG_TIMEOUT     (HZ * 60)       /* time-out 60 sec */
+
+#define LOWPAN_FRAG1_HEAD_SIZE  0x4
+#define LOWPAN_FRAGN_HEAD_SIZE  0x5
+
+/*
+ * According IEEE802.15.4 standard:
+ *   - MTU is 127 octets
+ *   - maximum MHR size is 37 octets
+ *   - MFR size is 2 octets
+ *
+ * so minimal payload size that we may guarantee is:
+ *   MTU - MHR - MFR = 88 octets
+ */
+#define LOWPAN_FRAG_SIZE        88
+
+/*
+ * Values of fields within the IPHC encoding first byte
+ * (C stands for compressed and I for inline)
+ */
+#define LOWPAN_IPHC_TF          0x18
+
+#define LOWPAN_IPHC_FL_C        0x10
+#define LOWPAN_IPHC_TC_C        0x08
+#define LOWPAN_IPHC_NH_C        0x04
+#define LOWPAN_IPHC_TTL_1       0x01
+#define LOWPAN_IPHC_TTL_64      0x02
+#define LOWPAN_IPHC_TTL_255     0x03
+#define LOWPAN_IPHC_TTL_I       0x00
+
+
+/* Values of fields within the IPHC encoding second byte */
+#define LOWPAN_IPHC_CID         0x80
+
+#define LOWPAN_IPHC_ADDR_00     0x00
+#define LOWPAN_IPHC_ADDR_01     0x01
+#define LOWPAN_IPHC_ADDR_02     0x02
+#define LOWPAN_IPHC_ADDR_03     0x03
+
+#define LOWPAN_IPHC_SAC         0x40
+#define LOWPAN_IPHC_SAM         0x30
+
+#define LOWPAN_IPHC_SAM_BIT     4
+
+#define LOWPAN_IPHC_M           0x08
+#define LOWPAN_IPHC_DAC         0x04
+#define LOWPAN_IPHC_DAM_00      0x00
+#define LOWPAN_IPHC_DAM_01      0x01
+#define LOWPAN_IPHC_DAM_10      0x02
+#define LOWPAN_IPHC_DAM_11      0x03
+
+#define LOWPAN_IPHC_DAM_BIT     0
+/*
+ * LOWPAN_UDP encoding (works together with IPHC)
+ */
+#define LOWPAN_NHC_UDP_MASK             0xF8
+#define LOWPAN_NHC_UDP_ID               0xF0
+#define LOWPAN_NHC_UDP_CHECKSUMC        0x04
+#define LOWPAN_NHC_UDP_CHECKSUMI        0x00
+
+#define LOWPAN_NHC_UDP_4BIT_PORT        0xF0B0
+#define LOWPAN_NHC_UDP_4BIT_MASK        0xFFF0
+#define LOWPAN_NHC_UDP_8BIT_PORT        0xF000
+#define LOWPAN_NHC_UDP_8BIT_MASK        0xFF00
+
+/* values for port compression, _with checksum_ ie bit 5 set to 0 */
+#define LOWPAN_NHC_UDP_CS_P_00  0xF0 /* all inline */
+#define LOWPAN_NHC_UDP_CS_P_01  0xF1 /* source 16bit inline,
+                                        dest = 0xF0 + 8 bit inline */
+#define LOWPAN_NHC_UDP_CS_P_10  0xF2 /* source = 0xF0 + 8bit inline,
+                                        dest = 16 bit inline */
+#define LOWPAN_NHC_UDP_CS_P_11  0xF3 /* source & dest = 0xF0B + 4bit inline */
+#define LOWPAN_NHC_UDP_CS_C     0x04 /* checksum elided */
+
+#ifdef DEBUG
+/* print data in line */
+static inline void raw_dump_inline(const char *caller, char *msg,
+                                   unsigned char *buf, int len)
+{
+        if (msg)
+                pr_debug("%s():%s: ", caller, msg);
+
+        print_hex_dump_debug("", DUMP_PREFIX_NONE, 16, 1, buf, len, false);
+}
+
+/* print data in a table format:
+ *
+ * addr: xx xx xx xx xx xx
+ * addr: xx xx xx xx xx xx
+ * ...
+ */
+static inline void raw_dump_table(const char *caller, char *msg,
+                                  unsigned char *buf, int len)
+{
+        if (msg)
+                pr_debug("%s():%s:\n", caller, msg);
+
+        print_hex_dump_debug("\t", DUMP_PREFIX_OFFSET, 16, 1, buf, len, false);
+}
+#else
+static inline void raw_dump_table(const char *caller, char *msg,
+                                  unsigned char *buf, int len) { }
+static inline void raw_dump_inline(const char *caller, char *msg,
+                                   unsigned char *buf, int len) { }
+#endif
+
+static inline int lowpan_fetch_skb_u8(struct sk_buff *skb, u8 *val)
+{
+        if (unlikely(!pskb_may_pull(skb, 1)))
+                return -EINVAL;
+
+        *val = skb->data[0];
+        skb_pull(skb, 1);
+
+        return 0;
+}
+
+static inline int lowpan_fetch_skb_u16(struct sk_buff *skb, u16 *val)
+{
+        if (unlikely(!pskb_may_pull(skb, 2)))
+                return -EINVAL;
+
+        *val = (skb->data[0] << 8) | skb->data[1];
+        skb_pull(skb, 2);
+
+        return 0;
+}
+
+static inline bool lowpan_fetch_skb(struct sk_buff *skb,
+                void *data, const unsigned int len)
+{
+        if (unlikely(!pskb_may_pull(skb, len)))
+                return true;
+
+        skb_copy_from_linear_data(skb, data, len);
+        skb_pull(skb, len);
+
+        return false;
+}
+
+static inline void lowpan_push_hc_data(u8 **hc_ptr, const void *data,
+                                       const size_t len)
+{
+        memcpy(*hc_ptr, data, len);
+        *hc_ptr += len;
+}
+
+static inline u8 lowpan_addr_mode_size(const u8 addr_mode)
+{
+        static const u8 addr_sizes[] = {
+                [LOWPAN_IPHC_ADDR_00] = 16,
+                [LOWPAN_IPHC_ADDR_01] = 8,
+                [LOWPAN_IPHC_ADDR_02] = 2,
+                [LOWPAN_IPHC_ADDR_03] = 0,
+        };
+        return addr_sizes[addr_mode];
+}
+
+static inline u8 lowpan_next_hdr_size(const u8 h_enc, u16 *uncomp_header)
+{
+        u8 ret = 1;
+
+        if ((h_enc & LOWPAN_NHC_UDP_MASK) == LOWPAN_NHC_UDP_ID) {
+                *uncomp_header += sizeof(struct udphdr);
+
+                switch (h_enc & LOWPAN_NHC_UDP_CS_P_11) {
+                case LOWPAN_NHC_UDP_CS_P_00:
+                        ret += 4;
+                        break;
+                case LOWPAN_NHC_UDP_CS_P_01:
+                case LOWPAN_NHC_UDP_CS_P_10:
+                        ret += 3;
+                        break;
+                case LOWPAN_NHC_UDP_CS_P_11:
+                        ret++;
+                        break;
+                default:
+                        break;
+                }
+
+                if (!(h_enc & LOWPAN_NHC_UDP_CS_C))
+                        ret += 2;
+        }
+
+        return ret;
+}
+
+/**
+ *      lowpan_uncompress_size - returns skb->len size with uncompressed header
+ *      @skb: sk_buff with 6lowpan header inside
+ *      @datagram_offset: optional to get the datagram_offset value
+ *
+ *      Returns the skb->len with uncompressed header
+ */
+static inline u16
+lowpan_uncompress_size(const struct sk_buff *skb, u16 *dgram_offset)
+{
+        u16 ret = 2, uncomp_header = sizeof(struct ipv6hdr);
+        u8 iphc0, iphc1, h_enc;
+
+        iphc0 = skb_network_header(skb)[0];
+        iphc1 = skb_network_header(skb)[1];
+
+        switch ((iphc0 & LOWPAN_IPHC_TF) >> 3) {
+        case 0:
+                ret += 4;
+                break;
+        case 1:
+                ret += 3;
+                break;
+        case 2:
+                ret++;
+                break;
+        default:
+                break;
+        }
+
+        if (!(iphc0 & LOWPAN_IPHC_NH_C))
+                ret++;
+
+        if (!(iphc0 & 0x03))
+                ret++;
+
+        ret += lowpan_addr_mode_size((iphc1 & LOWPAN_IPHC_SAM) >>
+                                     LOWPAN_IPHC_SAM_BIT);
+
+        if (iphc1 & LOWPAN_IPHC_M) {
+                switch ((iphc1 & LOWPAN_IPHC_DAM_11) >>
+                        LOWPAN_IPHC_DAM_BIT) {
+                case LOWPAN_IPHC_DAM_00:
+                        ret += 16;
+                        break;
+                case LOWPAN_IPHC_DAM_01:
+                        ret += 6;
+                        break;
+                case LOWPAN_IPHC_DAM_10:
+                        ret += 4;
+                        break;
+                case LOWPAN_IPHC_DAM_11:
+                        ret++;
+                        break;
+                default:
+                        break;
+                }
+        } else {
+                ret += lowpan_addr_mode_size((iphc1 & LOWPAN_IPHC_DAM_11) >>
+                                             LOWPAN_IPHC_DAM_BIT);
+        }
+
+        if (iphc0 & LOWPAN_IPHC_NH_C) {
+                h_enc = skb_network_header(skb)[ret];
+                ret += lowpan_next_hdr_size(h_enc, &uncomp_header);
+        }
+
+        if (dgram_offset)
+                *dgram_offset = uncomp_header;
+
+        return skb->len + uncomp_header - ret;
+}
+
+typedef int (*skb_delivery_cb)(struct sk_buff *skb, struct net_device *dev);
+
+int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
+                const u8 *saddr, const u8 saddr_type, const u8 saddr_len,
+                const u8 *daddr, const u8 daddr_type, const u8 daddr_len,
+                u8 iphc0, u8 iphc1, skb_delivery_cb skb_deliver);
+int lowpan_header_compress(struct sk_buff *skb, struct net_device *dev,
+                        unsigned short type, const void *_daddr,
+                        const void *_saddr, unsigned int len);
+
+#endif /* __6LOWPAN_H__ */
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 788d8378e587..3ee4c92afd1b 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -89,7 +89,7 @@ struct tc_action_ops {
         struct module           *owner;
         int     (*act)(struct sk_buff *, const struct tc_action *, struct tcf_result *);
         int     (*dump)(struct sk_buff *, struct tc_action *, int, int);
-        int     (*cleanup)(struct tc_action *, int bind);
+        void    (*cleanup)(struct tc_action *, int bind);
         int     (*lookup)(struct tc_action *, u32);
         int     (*init)(struct net *net, struct nlattr *nla,
                         struct nlattr *est, struct tc_action *act, int ovr,
@@ -98,20 +98,18 @@ struct tc_action_ops {
 };
 
 int tcf_hash_search(struct tc_action *a, u32 index);
-void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo);
-int tcf_hash_release(struct tcf_common *p, int bind,
-                     struct tcf_hashinfo *hinfo);
+void tcf_hash_destroy(struct tc_action *a);
+int tcf_hash_release(struct tc_action *a, int bind);
 u32 tcf_hash_new_index(struct tcf_hashinfo *hinfo);
-struct tcf_common *tcf_hash_check(u32 index, struct tc_action *a,
-                                  int bind);
-struct tcf_common *tcf_hash_create(u32 index, struct nlattr *est,
-                                   struct tc_action *a, int size,
-                                   int bind);
-void tcf_hash_insert(struct tcf_common *p, struct tcf_hashinfo *hinfo);
+int tcf_hash_check(u32 index, struct tc_action *a, int bind);
+int tcf_hash_create(u32 index, struct nlattr *est, struct tc_action *a,
+                    int size, int bind);
+void tcf_hash_cleanup(struct tc_action *a, struct nlattr *est);
+void tcf_hash_insert(struct tc_action *a);
 
-int tcf_register_action(struct tc_action_ops *a);
+int tcf_register_action(struct tc_action_ops *a, unsigned int mask);
 int tcf_unregister_action(struct tc_action_ops *a);
-void tcf_action_destroy(struct list_head *actions, int bind);
+int tcf_action_destroy(struct list_head *actions, int bind);
 int tcf_action_exec(struct sk_buff *skb, const struct list_head *actions,
                     struct tcf_result *res);
 int tcf_action_init(struct net *net, struct nlattr *nla,
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 50e39a8822b4..933a9f22a05f 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -314,7 +314,7 @@ static inline bool ipv6_addr_is_multicast(const struct in6_addr *addr)
 static inline bool ipv6_addr_is_ll_all_nodes(const struct in6_addr *addr)
 {
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
-        __u64 *p = (__u64 *)addr;
+        __be64 *p = (__be64 *)addr;
         return ((p[0] ^ cpu_to_be64(0xff02000000000000UL)) | (p[1] ^ cpu_to_be64(1))) == 0UL;
 #else
         return ((addr->s6_addr32[0] ^ htonl(0xff020000)) |
@@ -326,7 +326,7 @@ static inline bool ipv6_addr_is_ll_all_nodes(const struct in6_addr *addr)
 static inline bool ipv6_addr_is_ll_all_routers(const struct in6_addr *addr)
 {
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
-        __u64 *p = (__u64 *)addr;
+        __be64 *p = (__be64 *)addr;
         return ((p[0] ^ cpu_to_be64(0xff02000000000000UL)) | (p[1] ^ cpu_to_be64(2))) == 0UL;
 #else
         return ((addr->s6_addr32[0] ^ htonl(0xff020000)) |
@@ -343,7 +343,7 @@ static inline bool ipv6_addr_is_isatap(const struct in6_addr *addr)
 static inline bool ipv6_addr_is_solict_mult(const struct in6_addr *addr)
 {
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
-        __u64 *p = (__u64 *)addr;
+        __be64 *p = (__be64 *)addr;
         return ((p[0] ^ cpu_to_be64(0xff02000000000000UL)) |
                 ((p[1] ^ cpu_to_be64(0x00000001ff000000UL)) &
                  cpu_to_be64(0xffffffffff000000UL))) == 0UL;
diff --git a/include/net/af_ieee802154.h b/include/net/af_ieee802154.h
index 75e64c7a2960..f79ae2aa76d6 100644
--- a/include/net/af_ieee802154.h
+++ b/include/net/af_ieee802154.h
@@ -36,7 +36,7 @@ enum {
 /* address length, octets */
 #define IEEE802154_ADDR_LEN     8
 
-struct ieee802154_addr {
+struct ieee802154_addr_sa {
         int addr_type;
         u16 pan_id;
         union {
@@ -51,7 +51,7 @@ struct ieee802154_addr {
 
 struct sockaddr_ieee802154 {
         sa_family_t family; /* AF_IEEE802154 */
-        struct ieee802154_addr addr;
+        struct ieee802154_addr_sa addr;
 };
 
 /* get/setsockopt */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index f4f9ee466791..904777c1cd24 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -65,6 +65,7 @@ struct bt_security {
 #define BT_SECURITY_LOW         1
 #define BT_SECURITY_MEDIUM      2
 #define BT_SECURITY_HIGH        3
+#define BT_SECURITY_FIPS        4
 
 #define BT_DEFER_SETUP  7
 
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 66c1cd87bfe7..be150cf8cd43 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -117,11 +117,18 @@ enum {
         HCI_SERVICE_CACHE,
         HCI_DEBUG_KEYS,
         HCI_DUT_MODE,
+        HCI_FORCE_SC,
+        HCI_FORCE_STATIC_ADDR,
         HCI_UNREGISTER,
         HCI_USER_CHANNEL,
 
         HCI_LE_SCAN,
         HCI_SSP_ENABLED,
+        HCI_SC_ENABLED,
+        HCI_SC_ONLY,
+        HCI_PRIVACY,
+        HCI_RPA_EXPIRED,
+        HCI_RPA_RESOLVING,
         HCI_HS_ENABLED,
         HCI_LE_ENABLED,
         HCI_ADVERTISING,
@@ -133,6 +140,7 @@ enum {
         HCI_FAST_CONNECTABLE,
         HCI_BREDR_ENABLED,
         HCI_6LOWPAN_ENABLED,
+        HCI_LE_SCAN_INTERRUPTED,
 };
 
 /* A mask for the flags that are supposed to remain when a reset happens
@@ -175,6 +183,8 @@ enum {
 #define HCI_CMD_TIMEOUT         msecs_to_jiffies(2000)  /* 2 seconds */
 #define HCI_ACL_TX_TIMEOUT      msecs_to_jiffies(45000) /* 45 seconds */
 #define HCI_AUTO_OFF_TIMEOUT    msecs_to_jiffies(2000)  /* 2 seconds */
+#define HCI_POWER_OFF_TIMEOUT   msecs_to_jiffies(5000)  /* 5 seconds */
+#define HCI_LE_CONN_TIMEOUT     msecs_to_jiffies(20000) /* 20 seconds */
 
 /* HCI data types */
 #define HCI_COMMAND_PKT         0x01
@@ -282,10 +292,14 @@ enum {
 #define LMP_SYNC_TRAIN  0x04
 #define LMP_SYNC_SCAN   0x08
 
+#define LMP_SC          0x01
+#define LMP_PING        0x02
+
 /* Host features */
 #define LMP_HOST_SSP            0x01
 #define LMP_HOST_LE             0x02
 #define LMP_HOST_LE_BREDR       0x04
+#define LMP_HOST_SC             0x08
 
 /* Connection modes */
 #define HCI_CM_ACTIVE   0x0000
@@ -307,6 +321,7 @@ enum {
 #define HCI_LM_TRUSTED  0x0008
 #define HCI_LM_RELIABLE 0x0010
 #define HCI_LM_SECURE   0x0020
+#define HCI_LM_FIPS     0x0040
 
 /* Authentication types */
 #define HCI_AT_NO_BONDING               0x00
@@ -327,17 +342,24 @@ enum {
 #define HCI_LK_LOCAL_UNIT               0x01
 #define HCI_LK_REMOTE_UNIT              0x02
 #define HCI_LK_DEBUG_COMBINATION        0x03
-#define HCI_LK_UNAUTH_COMBINATION       0x04
-#define HCI_LK_AUTH_COMBINATION         0x05
+#define HCI_LK_UNAUTH_COMBINATION_P192  0x04
+#define HCI_LK_AUTH_COMBINATION_P192    0x05
 #define HCI_LK_CHANGED_COMBINATION      0x06
+#define HCI_LK_UNAUTH_COMBINATION_P256  0x07
+#define HCI_LK_AUTH_COMBINATION_P256    0x08
 /* The spec doesn't define types for SMP keys, the _MASTER suffix is implied */
 #define HCI_SMP_STK                     0x80
 #define HCI_SMP_STK_SLAVE               0x81
 #define HCI_SMP_LTK                     0x82
 #define HCI_SMP_LTK_SLAVE               0x83
 
+/* Long Term Key types */
+#define HCI_LTK_UNAUTH                  0x00
+#define HCI_LTK_AUTH                    0x01
+
 /* ---- HCI Error Codes ---- */
 #define HCI_ERROR_AUTH_FAILURE          0x05
+#define HCI_ERROR_MEMORY_EXCEEDED       0x07
 #define HCI_ERROR_CONNECTION_TIMEOUT    0x08
 #define HCI_ERROR_REJ_BAD_ADDR          0x0f
 #define HCI_ERROR_REMOTE_USER_TERM      0x13
@@ -660,6 +682,15 @@ struct hci_rp_set_csb {
 
 #define HCI_OP_START_SYNC_TRAIN         0x0443
 
+#define HCI_OP_REMOTE_OOB_EXT_DATA_REPLY        0x0445
+struct hci_cp_remote_oob_ext_data_reply {
+        bdaddr_t bdaddr;
+        __u8     hash192[16];
+        __u8     randomizer192[16];
+        __u8     hash256[16];
+        __u8     randomizer256[16];
+} __packed;
+
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
         __le16   handle;
@@ -933,6 +964,26 @@ struct hci_rp_write_sync_train_params {
         __le16  sync_train_int;
 } __packed;
 
+#define HCI_OP_READ_SC_SUPPORT          0x0c79
+struct hci_rp_read_sc_support {
+        __u8    status;
+        __u8    support;
+} __packed;
+
+#define HCI_OP_WRITE_SC_SUPPORT         0x0c7a
+struct hci_cp_write_sc_support {
+        __u8    support;
+} __packed;
+
+#define HCI_OP_READ_LOCAL_OOB_EXT_DATA  0x0c7d
+struct hci_rp_read_local_oob_ext_data {
+        __u8     status;
+        __u8     hash192[16];
+        __u8     randomizer192[16];
+        __u8     hash256[16];
+        __u8     randomizer256[16];
+} __packed;
+
 #define HCI_OP_READ_LOCAL_VERSION       0x1001
 struct hci_rp_read_local_version {
         __u8     status;
@@ -1133,6 +1184,9 @@ struct hci_cp_le_set_scan_enable {
         __u8     filter_dup;
 } __packed;
 
+#define HCI_LE_USE_PEER_ADDR            0x00
+#define HCI_LE_USE_WHITELIST            0x01
+
 #define HCI_OP_LE_CREATE_CONN           0x200d
 struct hci_cp_le_create_conn {
         __le16   scan_interval;
@@ -1157,6 +1211,20 @@ struct hci_rp_le_read_white_list_size {
         __u8    size;
 } __packed;
 
+#define HCI_OP_LE_CLEAR_WHITE_LIST      0x2010
+
+#define HCI_OP_LE_ADD_TO_WHITE_LIST     0x2011
+struct hci_cp_le_add_to_white_list {
+        __u8     bdaddr_type;
+        bdaddr_t bdaddr;
+} __packed;
+
+#define HCI_OP_LE_DEL_FROM_WHITE_LIST   0x2012
+struct hci_cp_le_del_from_white_list {
+        __u8     bdaddr_type;
+        bdaddr_t bdaddr;
+} __packed;
+
 #define HCI_OP_LE_CONN_UPDATE           0x2013
 struct hci_cp_le_conn_update {
         __le16   handle;
@@ -1171,7 +1239,7 @@ struct hci_cp_le_conn_update {
 #define HCI_OP_LE_START_ENC             0x2019
 struct hci_cp_le_start_enc {
         __le16  handle;
-        __u8    rand[8];
+        __le64  rand;
         __le16  ediv;
         __u8    ltk[16];
 } __packed;
@@ -1583,7 +1651,7 @@ struct hci_ev_le_conn_complete {
 #define HCI_EV_LE_LTK_REQ               0x05
 struct hci_ev_le_ltk_req {
         __le16  handle;
-        __u8    random[8];
+        __le64  rand;
         __le16  ediv;
 } __packed;
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index f2f0cf5865c4..5f8bc05694ac 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -91,6 +91,13 @@ struct bt_uuid {
         u8 svc_hint;
 };
 
+struct smp_csrk {
+        bdaddr_t bdaddr;
+        u8 bdaddr_type;
+        u8 master;
+        u8 val[16];
+};
+
 struct smp_ltk {
         struct list_head list;
         bdaddr_t bdaddr;
@@ -99,9 +106,17 @@ struct smp_ltk {
         u8 type;
         u8 enc_size;
         __le16 ediv;
-        u8 rand[8];
+        __le64 rand;
         u8 val[16];
-} __packed;
+};
+
+struct smp_irk {
+        struct list_head list;
+        bdaddr_t rpa;
+        bdaddr_t bdaddr;
+        u8 addr_type;
+        u8 val[16];
+};
 
 struct link_key {
         struct list_head list;
@@ -114,12 +129,17 @@ struct link_key {
 struct oob_data {
         struct list_head list;
         bdaddr_t bdaddr;
-        u8 hash[16];
-        u8 randomizer[16];
+        u8 hash192[16];
+        u8 randomizer192[16];
+        u8 hash256[16];
+        u8 randomizer256[16];
 };
 
 #define HCI_MAX_SHORT_NAME_LENGTH       10
 
+/* Default LE RPA expiry time, 15 minutes */
+#define HCI_DEFAULT_RPA_TIMEOUT         (15 * 60)
+
 struct amp_assoc {
         __u16   len;
         __u16   offset;
@@ -141,8 +161,9 @@ struct hci_dev {
         __u8            bus;
         __u8            dev_type;
         bdaddr_t        bdaddr;
+        bdaddr_t        random_addr;
         bdaddr_t        static_addr;
-        __u8            own_addr_type;
+        __u8            adv_addr_type;
         __u8            dev_name[HCI_MAX_NAME_LENGTH];
         __u8            short_name[HCI_MAX_SHORT_NAME_LENGTH];
         __u8            eir[HCI_MAX_EIR_LENGTH];
@@ -167,6 +188,8 @@ struct hci_dev {
         __u16           page_scan_interval;
         __u16           page_scan_window;
         __u8            page_scan_type;
+        __u8            le_adv_channel_map;
+        __u8            le_scan_type;
         __u16           le_scan_interval;
         __u16           le_scan_window;
         __u16           le_conn_min_interval;
@@ -257,19 +280,21 @@ struct hci_dev {
         __u32                   req_status;
         __u32                   req_result;
 
-        struct list_head        mgmt_pending;
+        struct crypto_blkcipher *tfm_aes;
 
         struct discovery_state  discovery;
         struct hci_conn_hash    conn_hash;
-        struct list_head        blacklist;
 
+        struct list_head        mgmt_pending;
+        struct list_head        blacklist;
         struct list_head        uuids;
-
         struct list_head        link_keys;
-
         struct list_head        long_term_keys;
-
+        struct list_head        identity_resolving_keys;
         struct list_head        remote_oob_data;
+        struct list_head        le_white_list;
+        struct list_head        le_conn_params;
+        struct list_head        pend_le_conns;
 
         struct hci_dev_stats    stat;
 
@@ -291,6 +316,11 @@ struct hci_dev {
         __u8                    scan_rsp_data[HCI_MAX_AD_LENGTH];
         __u8                    scan_rsp_data_len;
 
+        __u8                    irk[16];
+        __u32                   rpa_timeout;
+        struct delayed_work     rpa_expired;
+        bdaddr_t                rpa;
+
         int (*open)(struct hci_dev *hdev);
         int (*close)(struct hci_dev *hdev);
         int (*flush)(struct hci_dev *hdev);
@@ -310,6 +340,10 @@ struct hci_conn {
         __u8            dst_type;
         bdaddr_t        src;
         __u8            src_type;
+        bdaddr_t        init_addr;
+        __u8            init_addr_type;
+        bdaddr_t        resp_addr;
+        __u8            resp_addr_type;
         __u16           handle;
         __u16           state;
         __u8            mode;
@@ -332,6 +366,8 @@ struct hci_conn {
         __u8            passkey_entered;
         __u16           disc_timeout;
         __u16           setting;
+        __u16           le_conn_min_interval;
+        __u16           le_conn_max_interval;
         unsigned long   flags;
 
         __u8            remote_cap;
@@ -347,6 +383,7 @@ struct hci_conn {
         struct delayed_work disc_work;
         struct delayed_work auto_accept_work;
         struct delayed_work idle_work;
+        struct delayed_work le_conn_timeout;
 
         struct device   dev;
 
@@ -372,6 +409,22 @@ struct hci_chan {
         __u8            state;
 };
 
+struct hci_conn_params {
+        struct list_head list;
+
+        bdaddr_t addr;
+        u8 addr_type;
+
+        u16 conn_min_interval;
+        u16 conn_max_interval;
+
+        enum {
+                HCI_AUTO_CONN_DISABLED,
+                HCI_AUTO_CONN_ALWAYS,
+                HCI_AUTO_CONN_LINK_LOSS,
+        } auto_connect;
+};
+
 extern struct list_head hci_dev_list;
 extern struct list_head hci_cb_list;
 extern rwlock_t hci_dev_list_lock;
@@ -446,6 +499,8 @@ enum {
         HCI_CONN_LE_SMP_PEND,
         HCI_CONN_MGMT_CONNECTED,
         HCI_CONN_SSP_ENABLED,
+        HCI_CONN_SC_ENABLED,
+        HCI_CONN_AES_CCM,
         HCI_CONN_POWER_SAVE,
         HCI_CONN_REMOTE_OOB,
         HCI_CONN_6LOWPAN,
@@ -458,6 +513,13 @@ static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
                test_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 }
 
+static inline bool hci_conn_sc_enabled(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        return test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
+               test_bit(HCI_CONN_SC_ENABLED, &conn->flags);
+}
+
 static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
@@ -521,6 +583,13 @@ static inline unsigned int hci_conn_num(struct hci_dev *hdev, __u8 type)
         }
 }
 
+static inline unsigned int hci_conn_count(struct hci_dev *hdev)
+{
+        struct hci_conn_hash *c = &hdev->conn_hash;
+
+        return c->acl_num + c->amp_num + c->sco_num + c->le_num;
+}
+
 static inline struct hci_conn *hci_conn_hash_lookup_handle(struct hci_dev *hdev,
                                                                 __u16 handle)
 {
@@ -594,8 +663,10 @@ void hci_chan_del(struct hci_chan *chan);
 void hci_chan_list_flush(struct hci_conn *conn);
 struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle);
 
-struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
-                             __u8 dst_type, __u8 sec_level, __u8 auth_type);
+struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
+                                u8 dst_type, u8 sec_level, u8 auth_type);
+struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
+                                 u8 sec_level, u8 auth_type);
 struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
                                  __u16 setting);
 int hci_conn_check_link_mode(struct hci_conn *conn);
@@ -606,6 +677,8 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
 
 void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
 
+void hci_le_conn_failed(struct hci_conn *conn, u8 status);
+
 /*
  * hci_conn_get() and hci_conn_put() are used to control the life-time of an
  * "hci_conn" object. They do not guarantee that the hci_conn object is running,
@@ -737,31 +810,64 @@ int hci_inquiry(void __user *arg);
 
 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
                                          bdaddr_t *bdaddr, u8 type);
-int hci_blacklist_clear(struct hci_dev *hdev);
 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 
-int hci_uuids_clear(struct hci_dev *hdev);
+struct bdaddr_list *hci_white_list_lookup(struct hci_dev *hdev,
+                                          bdaddr_t *bdaddr, u8 type);
+void hci_white_list_clear(struct hci_dev *hdev);
+int hci_white_list_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
+int hci_white_list_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
+
+struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
+                                               bdaddr_t *addr, u8 addr_type);
+int hci_conn_params_add(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type,
+                        u8 auto_connect, u16 conn_min_interval,
+                        u16 conn_max_interval);
+void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type);
+void hci_conn_params_clear(struct hci_dev *hdev);
+
+struct bdaddr_list *hci_pend_le_conn_lookup(struct hci_dev *hdev,
+                                            bdaddr_t *addr, u8 addr_type);
+void hci_pend_le_conn_add(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type);
+void hci_pend_le_conn_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type);
+void hci_pend_le_conns_clear(struct hci_dev *hdev);
+
+void hci_update_background_scan(struct hci_dev *hdev);
 
-int hci_link_keys_clear(struct hci_dev *hdev);
+void hci_uuids_clear(struct hci_dev *hdev);
+
+void hci_link_keys_clear(struct hci_dev *hdev);
 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                      bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len);
-struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8]);
-int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
-                int new_key, u8 authenticated, u8 tk[16], u8 enc_size,
-                __le16 ediv, u8 rand[8]);
+struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, __le64 rand,
+                             bool master);
+struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                            u8 addr_type, u8 type, u8 authenticated,
+                            u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand);
 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                     u8 addr_type);
-int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr);
-int hci_smp_ltks_clear(struct hci_dev *hdev);
+                                     u8 addr_type, bool master);
+int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type);
+void hci_smp_ltks_clear(struct hci_dev *hdev);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
-int hci_remote_oob_data_clear(struct hci_dev *hdev);
+struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa);
+struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                     u8 addr_type);
+struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                            u8 addr_type, u8 val[16], bdaddr_t *rpa);
+void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type);
+void hci_smp_irks_clear(struct hci_dev *hdev);
+
+void hci_remote_oob_data_clear(struct hci_dev *hdev);
 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
-                                                        bdaddr_t *bdaddr);
-int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
-                                                                u8 *randomizer);
+                                          bdaddr_t *bdaddr);
+int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                            u8 *hash, u8 *randomizer);
+int hci_add_remote_oob_ext_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                u8 *hash192, u8 *randomizer192,
+                                u8 *hash256, u8 *randomizer256);
 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
@@ -803,9 +909,12 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define lmp_csb_slave_capable(dev)  ((dev)->features[2][0] & LMP_CSB_SLAVE)
 #define lmp_sync_train_capable(dev) ((dev)->features[2][0] & LMP_SYNC_TRAIN)
 #define lmp_sync_scan_capable(dev)  ((dev)->features[2][0] & LMP_SYNC_SCAN)
+#define lmp_sc_capable(dev)         ((dev)->features[2][1] & LMP_SC)
+#define lmp_ping_capable(dev)       ((dev)->features[2][1] & LMP_PING)
 
 /* ----- Host capabilities ----- */
 #define lmp_host_ssp_capable(dev)  ((dev)->features[1][0] & LMP_HOST_SSP)
+#define lmp_host_sc_capable(dev)   ((dev)->features[1][0] & LMP_HOST_SC)
 #define lmp_host_le_capable(dev)   (!!((dev)->features[1][0] & LMP_HOST_LE))
 #define lmp_host_le_br_capable(dev) (!!((dev)->features[1][0] & LMP_HOST_LE_BREDR))
 
@@ -1019,6 +1128,26 @@ static inline bool eir_has_data_type(u8 *data, size_t data_len, u8 type)
         return false;
 }
 
+static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type)
+{
+        if (addr_type != 0x01)
+                return false;
+
+        if ((bdaddr->b[5] & 0xc0) == 0x40)
+               return true;
+
+        return false;
+}
+
+static inline struct smp_irk *hci_get_irk(struct hci_dev *hdev,
+                                          bdaddr_t *bdaddr, u8 addr_type)
+{
+        if (!hci_bdaddr_is_rpa(bdaddr, addr_type))
+                return NULL;
+
+        return hci_find_irk_by_rpa(hdev, bdaddr);
+}
+
 int hci_register_cb(struct hci_cb *hcb);
 int hci_unregister_cb(struct hci_cb *hcb);
 
@@ -1040,6 +1169,9 @@ void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
                     const void *param, u8 event);
 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status);
 
+void hci_req_add_le_scan_disable(struct hci_request *req);
+void hci_req_add_le_passive_scan(struct hci_request *req);
+
 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
                                const void *param, u32 timeout);
 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
@@ -1085,6 +1217,7 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered);
 void mgmt_discoverable_timeout(struct hci_dev *hdev);
 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable);
 void mgmt_connectable(struct hci_dev *hdev, u8 connectable);
+void mgmt_advertising(struct hci_dev *hdev, u8 advertising);
 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status);
 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
                        bool persistent);
@@ -1092,7 +1225,8 @@ void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
                            u8 *dev_class);
 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                              u8 link_type, u8 addr_type, u8 reason);
+                              u8 link_type, u8 addr_type, u8 reason,
+                              bool mgmt_connected);
 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
                             u8 link_type, u8 addr_type, u8 status);
 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
@@ -1103,7 +1237,7 @@ void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                       u8 status);
 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                              u8 link_type, u8 addr_type, __le32 value,
+                              u8 link_type, u8 addr_type, u32 value,
                               u8 confirm_hint);
 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                      u8 link_type, u8 addr_type, u8 status);
@@ -1122,11 +1256,13 @@ void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                       u8 addr_type, u8 status);
 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status);
 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
+void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
                                     u8 status);
 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status);
-void mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
-                                             u8 *randomizer, u8 status);
+void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
+                                       u8 *randomizer192, u8 *hash256,
+                                       u8 *randomizer256, u8 status);
 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
                        u8 ssp, u8 *eir, u16 eir_len);
@@ -1135,8 +1271,12 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
 void mgmt_discovering(struct hci_dev *hdev, u8 discovering);
 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
-void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent);
+void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent);
+void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk);
+void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
+                   bool persistent);
 void mgmt_reenable_advertising(struct hci_dev *hdev);
+void mgmt_smp_complete(struct hci_conn *conn, bool complete);
 
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
@@ -1168,9 +1308,14 @@ struct hci_sec_filter {
 
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
                                         u16 latency, u16 to_multiplier);
-void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
+void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
                                                         __u8 ltk[16]);
 
+int hci_update_random_address(struct hci_request *req, bool require_privacy,
+                              u8 *own_addr_type);
+void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                               u8 *bdaddr_type);
+
 #define SCO_AIRMODE_MASK       0x0003
 #define SCO_AIRMODE_CVSD       0x0000
 #define SCO_AIRMODE_TRANSP     0x0003
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index dbc4a89984ca..4abdcb220e3a 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -91,6 +91,7 @@ struct l2cap_conninfo {
 #define L2CAP_LM_TRUSTED        0x0008
 #define L2CAP_LM_RELIABLE       0x0010
 #define L2CAP_LM_SECURE         0x0020
+#define L2CAP_LM_FIPS           0x0040
 
 /* L2CAP command codes */
 #define L2CAP_COMMAND_REJ       0x01
@@ -623,6 +624,9 @@ struct l2cap_conn {
         __u32                   rx_len;
         __u8                    tx_ident;
 
+        struct sk_buff_head     pending_rx;
+        struct work_struct      pending_rx_work;
+
         __u8                    disc_reason;
 
         struct delayed_work     security_timer;
@@ -647,7 +651,7 @@ struct l2cap_user {
 #define L2CAP_CHAN_RAW                  1
 #define L2CAP_CHAN_CONN_LESS            2
 #define L2CAP_CHAN_CONN_ORIENTED        3
-#define L2CAP_CHAN_CONN_FIX_A2MP        4
+#define L2CAP_CHAN_FIXED                4
 
 /* ----- L2CAP socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
@@ -853,7 +857,6 @@ static inline long l2cap_chan_no_get_sndtimeo(struct l2cap_chan *chan)
 }
 
 extern bool disable_ertm;
-extern bool enable_lecoc;
 
 int l2cap_init_sockets(void);
 void l2cap_cleanup_sockets(void);
@@ -878,6 +881,7 @@ int l2cap_ertm_init(struct l2cap_chan *chan);
 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
 void l2cap_chan_del(struct l2cap_chan *chan, int err);
+void l2cap_conn_update_id_addr(struct hci_conn *hcon);
 void l2cap_send_conn_req(struct l2cap_chan *chan);
 void l2cap_move_start(struct l2cap_chan *chan);
 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 518c5c84e39a..d4b571c2f9fd 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -94,6 +94,9 @@ struct mgmt_rp_read_index_list {
 #define MGMT_SETTING_HS                 0x00000100
 #define MGMT_SETTING_LE                 0x00000200
 #define MGMT_SETTING_ADVERTISING        0x00000400
+#define MGMT_SETTING_SECURE_CONN        0x00000800
+#define MGMT_SETTING_DEBUG_KEYS         0x00001000
+#define MGMT_SETTING_PRIVACY            0x00002000
 
 #define MGMT_OP_READ_INFO               0x0004
 #define MGMT_READ_INFO_SIZE             0
@@ -180,11 +183,11 @@ struct mgmt_cp_load_link_keys {
 
 struct mgmt_ltk_info {
         struct mgmt_addr_info addr;
-        __u8    authenticated;
+        __u8    type;
         __u8    master;
         __u8    enc_size;
         __le16  ediv;
-        __u8    rand[8];
+        __le64  rand;
         __u8    val[16];
 } __packed;
 
@@ -294,6 +297,12 @@ struct mgmt_rp_read_local_oob_data {
         __u8    hash[16];
         __u8    randomizer[16];
 } __packed;
+struct mgmt_rp_read_local_oob_ext_data {
+        __u8    hash192[16];
+        __u8    randomizer192[16];
+        __u8    hash256[16];
+        __u8    randomizer256[16];
+} __packed;
 
 #define MGMT_OP_ADD_REMOTE_OOB_DATA     0x0021
 struct mgmt_cp_add_remote_oob_data {
@@ -302,6 +311,14 @@ struct mgmt_cp_add_remote_oob_data {
         __u8    randomizer[16];
 } __packed;
 #define MGMT_ADD_REMOTE_OOB_DATA_SIZE   (MGMT_ADDR_INFO_SIZE + 32)
+struct mgmt_cp_add_remote_oob_ext_data {
+        struct mgmt_addr_info addr;
+        __u8    hash192[16];
+        __u8    randomizer192[16];
+        __u8    hash256[16];
+        __u8    randomizer256[16];
+} __packed;
+#define MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE (MGMT_ADDR_INFO_SIZE + 64)
 
 #define MGMT_OP_REMOVE_REMOTE_OOB_DATA  0x0022
 struct mgmt_cp_remove_remote_oob_data {
@@ -369,6 +386,29 @@ struct mgmt_cp_set_scan_params {
 } __packed;
 #define MGMT_SET_SCAN_PARAMS_SIZE       4
 
+#define MGMT_OP_SET_SECURE_CONN         0x002D
+
+#define MGMT_OP_SET_DEBUG_KEYS          0x002E
+
+#define MGMT_OP_SET_PRIVACY             0x002F
+struct mgmt_cp_set_privacy {
+        __u8 privacy;
+        __u8 irk[16];
+} __packed;
+#define MGMT_SET_PRIVACY_SIZE           17
+
+struct mgmt_irk_info {
+        struct mgmt_addr_info addr;
+        __u8 val[16];
+} __packed;
+
+#define MGMT_OP_LOAD_IRKS               0x0030
+struct mgmt_cp_load_irks {
+        __le16 irk_count;
+        struct mgmt_irk_info irks[0];
+} __packed;
+#define MGMT_LOAD_IRKS_SIZE             2
+
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
         __le16  opcode;
@@ -504,3 +544,22 @@ struct mgmt_ev_passkey_notify {
         __le32  passkey;
         __u8    entered;
 } __packed;
+
+#define MGMT_EV_NEW_IRK                 0x0018
+struct mgmt_ev_new_irk {
+        __u8     store_hint;
+        bdaddr_t rpa;
+        struct mgmt_irk_info irk;
+} __packed;
+
+struct mgmt_csrk_info {
+        struct mgmt_addr_info addr;
+        __u8 master;
+        __u8 val[16];
+} __packed;
+
+#define MGMT_EV_NEW_CSRK                0x0019
+struct mgmt_ev_new_csrk {
+        __u8 store_hint;
+        struct mgmt_csrk_info key;
+} __packed;
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 486213a1aed8..2611cc389d7d 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -238,9 +238,11 @@ int  rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst,
                                                                 u8 channel);
 int  rfcomm_dlc_close(struct rfcomm_dlc *d, int reason);
 int  rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb);
+void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb);
 int  rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig);
 int  rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig);
 void rfcomm_dlc_accept(struct rfcomm_dlc *d);
+struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel);
 
 #define rfcomm_dlc_lock(d)     spin_lock(&d->lock)
 #define rfcomm_dlc_unlock(d)   spin_unlock(&d->lock)
@@ -295,6 +297,7 @@ struct rfcomm_conninfo {
 #define RFCOMM_LM_TRUSTED       0x0008
 #define RFCOMM_LM_RELIABLE      0x0010
 #define RFCOMM_LM_SECURE        0x0020
+#define RFCOMM_LM_FIPS          0x0040
 
 #define rfcomm_pi(sk) ((struct rfcomm_pinfo *) sk)
 
@@ -323,11 +326,16 @@ int  rfcomm_connect_ind(struct rfcomm_session *s, u8 channel,
 #define RFCOMMGETDEVINFO        _IOR('R', 211, int)
 #define RFCOMMSTEALDLC          _IOW('R', 220, int)
 
+/* rfcomm_dev.flags bit definitions */
 #define RFCOMM_REUSE_DLC      0
 #define RFCOMM_RELEASE_ONHUP  1
 #define RFCOMM_HANGUP_NOW     2
 #define RFCOMM_TTY_ATTACHED   3
-#define RFCOMM_TTY_RELEASED   4
+#define RFCOMM_DEFUNCT_BIT4   4   /* don't reuse this bit - userspace visible */
+
+/* rfcomm_dev.status bit definitions */
+#define RFCOMM_DEV_RELEASED   0
+#define RFCOMM_TTY_OWNED      1
 
 struct rfcomm_dev_req {
         s16      dev_id;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index b1f84b05c67e..f3539a15c411 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -151,6 +151,7 @@ enum ieee80211_channel_flags {
  * @dfs_state: current state of this channel. Only relevant if radar is required
  *      on this channel.
  * @dfs_state_entered: timestamp (jiffies) when the dfs state was entered.
+ * @dfs_cac_ms: DFS CAC time in milliseconds, this is valid for DFS channels.
  */
 struct ieee80211_channel {
         enum ieee80211_band band;
@@ -165,6 +166,7 @@ struct ieee80211_channel {
         int orig_mag, orig_mpwr;
         enum nl80211_dfs_state dfs_state;
         unsigned long dfs_state_entered;
+        unsigned int dfs_cac_ms;
 };
 
 /**
@@ -1394,10 +1396,12 @@ struct cfg80211_scan_request {
 /**
  * struct cfg80211_match_set - sets of attributes to match
  *
- * @ssid: SSID to be matched
+ * @ssid: SSID to be matched; may be zero-length for no match (RSSI only)
+ * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
  */
 struct cfg80211_match_set {
         struct cfg80211_ssid ssid;
+        s32 rssi_thold;
 };
 
 /**
@@ -1420,7 +1424,8 @@ struct cfg80211_match_set {
  * @dev: the interface
  * @scan_start: start time of the scheduled scan
  * @channels: channels to scan
- * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
+ * @min_rssi_thold: for drivers only supporting a single threshold, this
+ *      contains the minimum over all matchsets
  */
 struct cfg80211_sched_scan_request {
         struct cfg80211_ssid *ssids;
@@ -1433,7 +1438,7 @@ struct cfg80211_sched_scan_request {
         u32 flags;
         struct cfg80211_match_set *match_sets;
         int n_match_sets;
-        s32 rssi_thold;
+        s32 min_rssi_thold;
 
         /* internal */
         struct wiphy *wiphy;
@@ -1701,8 +1706,14 @@ struct cfg80211_ibss_params {
  *
  * @channel: The channel to use or %NULL if not specified (auto-select based
  *      on scan results)
+ * @channel_hint: The channel of the recommended BSS for initial connection or
+ *      %NULL if not specified
  * @bssid: The AP BSSID or %NULL if not specified (auto-select based on scan
  *      results)
+ * @bssid_hint: The recommended AP BSSID for initial connection to the BSS or
+ *      %NULL if not specified. Unlike the @bssid parameter, the driver is
+ *      allowed to ignore this @bssid_hint if it has knowledge of a better BSS
+ *      to use.
  * @ssid: SSID
  * @ssid_len: Length of ssid in octets
  * @auth_type: Authentication type (algorithm)
@@ -1725,11 +1736,13 @@ struct cfg80211_ibss_params {
  */
 struct cfg80211_connect_params {
         struct ieee80211_channel *channel;
-        u8 *bssid;
-        u8 *ssid;
+        struct ieee80211_channel *channel_hint;
+        const u8 *bssid;
+        const u8 *bssid_hint;
+        const u8 *ssid;
         size_t ssid_len;
         enum nl80211_auth_type auth_type;
-        u8 *ie;
+        const u8 *ie;
         size_t ie_len;
         bool privacy;
         enum nl80211_mfp mfp;
@@ -1768,6 +1781,7 @@ struct cfg80211_bitrate_mask {
                 u32 legacy;
                 u8 ht_mcs[IEEE80211_HT_MCS_MASK_LEN];
                 u16 vht_mcs[NL80211_VHT_NSS_MAX];
+                enum nl80211_txrate_gi gi;
         } control[IEEE80211_NUM_BANDS];
 };
 /**
@@ -2194,7 +2208,12 @@ struct cfg80211_qos_map {
  * @set_cqm_txe_config: Configure connection quality monitor TX error
  *      thresholds.
  * @sched_scan_start: Tell the driver to start a scheduled scan.
- * @sched_scan_stop: Tell the driver to stop an ongoing scheduled scan.
+ * @sched_scan_stop: Tell the driver to stop an ongoing scheduled scan. This
+ *      call must stop the scheduled scan and be ready for starting a new one
+ *      before it returns, i.e. @sched_scan_start may be called immediately
+ *      after that again and should not fail in that case. The driver should
+ *      not call cfg80211_sched_scan_stopped() for a requested stop (when this
+ *      method returns 0.)
  *
  * @mgmt_frame_register: Notify driver that a management frame type was
  *      registered. Note that this callback may not sleep, and cannot run
@@ -2453,7 +2472,8 @@ struct cfg80211_ops {
 
         int     (*tdls_mgmt)(struct wiphy *wiphy, struct net_device *dev,
                              u8 *peer, u8 action_code,  u8 dialog_token,
-                             u16 status_code, const u8 *buf, size_t len);
+                             u16 status_code, u32 peer_capability,
+                             const u8 *buf, size_t len);
         int     (*tdls_oper)(struct wiphy *wiphy, struct net_device *dev,
                              u8 *peer, enum nl80211_tdls_operation oper);
 
@@ -2485,7 +2505,8 @@ struct cfg80211_ops {
 
         int     (*start_radar_detection)(struct wiphy *wiphy,
                                          struct net_device *dev,
-                                         struct cfg80211_chan_def *chandef);
+                                         struct cfg80211_chan_def *chandef,
+                                         u32 cac_time_ms);
         int     (*update_ft_ies)(struct wiphy *wiphy, struct net_device *dev,
                                  struct cfg80211_update_ft_ies_params *ftie);
         int     (*crit_proto_start)(struct wiphy *wiphy,
@@ -2598,9 +2619,12 @@ struct ieee80211_iface_limit {
  *      only in special cases.
  * @radar_detect_widths: bitmap of channel widths supported for radar detection
  *
- * These examples can be expressed as follows:
+ * With this structure the driver can describe which interface
+ * combinations it supports concurrently.
+ *
+ * Examples:
  *
- * Allow #STA <= 1, #AP <= 1, matching BI, channels = 1, 2 total:
+ * 1. Allow #STA <= 1, #AP <= 1, matching BI, channels = 1, 2 total:
  *
  *  struct ieee80211_iface_limit limits1[] = {
  *      { .max = 1, .types = BIT(NL80211_IFTYPE_STATION), },
@@ -2614,7 +2638,7 @@ struct ieee80211_iface_limit {
  *  };
  *
  *
- * Allow #{AP, P2P-GO} <= 8, channels = 1, 8 total:
+ * 2. Allow #{AP, P2P-GO} <= 8, channels = 1, 8 total:
  *
  *  struct ieee80211_iface_limit limits2[] = {
  *      { .max = 8, .types = BIT(NL80211_IFTYPE_AP) |
@@ -2628,7 +2652,8 @@ struct ieee80211_iface_limit {
  *  };
  *
  *
- * Allow #STA <= 1, #{P2P-client,P2P-GO} <= 3 on two channels, 4 total.
+ * 3. Allow #STA <= 1, #{P2P-client,P2P-GO} <= 3 on two channels, 4 total.
+ *
  * This allows for an infrastructure connection and three P2P connections.
  *
  *  struct ieee80211_iface_limit limits3[] = {
@@ -2778,7 +2803,7 @@ struct wiphy_vendor_command {
  * @perm_addr: permanent MAC address of this device
  * @addr_mask: If the device supports multiple MAC addresses by masking,
  *      set this to a mask with variable bits set to 1, e.g. if the last
- *      four bits are variable then set it to 00:...:00:0f. The actual
+ *      four bits are variable then set it to 00-00-00-00-00-0f. The actual
  *      variable bits shall be determined by the interfaces added, with
  *      interfaces not matching the mask being rejected to be brought up.
  * @n_addresses: number of addresses in @addresses.
@@ -2875,6 +2900,11 @@ struct wiphy_vendor_command {
  * @n_vendor_commands: number of vendor commands
  * @vendor_events: array of vendor events supported by the hardware
  * @n_vendor_events: number of vendor events
+ *
+ * @max_ap_assoc_sta: maximum number of associated stations supported in AP mode
+ *      (including P2P GO) or 0 to indicate no such limit is advertised. The
+ *      driver is allowed to advertise a theoretical limit that it can reach in
+ *      some cases, but may not always reach.
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -2990,6 +3020,8 @@ struct wiphy {
         const struct nl80211_vendor_cmd_info *vendor_events;
         int n_vendor_commands, n_vendor_events;
 
+        u16 max_ap_assoc_sta;
+
         char priv[0] __aligned(NETDEV_ALIGN);
 };
 
@@ -3127,8 +3159,8 @@ struct cfg80211_cached_keys;
  * @identifier: (private) Identifier used in nl80211 to identify this
  *      wireless device if it has no netdev
  * @current_bss: (private) Used by the internal configuration code
- * @channel: (private) Used by the internal configuration code to track
- *      the user-set AP, monitor and WDS channel
+ * @chandef: (private) Used by the internal configuration code to track
+ *      the user-set channel definition.
  * @preset_chandef: (private) Used by the internal configuration code to
  *      track the channel to be used for AP later
  * @bssid: (private) Used by the internal configuration code
@@ -3151,6 +3183,7 @@ struct cfg80211_cached_keys;
  * @p2p_started: true if this is a P2P Device that has been started
  * @cac_started: true if DFS channel availability check has been started
  * @cac_start_time: timestamp (jiffies) when the dfs state was entered.
+ * @cac_time_ms: CAC time in ms
  * @ps: powersave mode is enabled
  * @ps_timeout: dynamic powersave timeout
  * @ap_unexpected_nlportid: (private) netlink port ID of application
@@ -3192,9 +3225,7 @@ struct wireless_dev {
 
         struct cfg80211_internal_bss *current_bss; /* associated / joined */
         struct cfg80211_chan_def preset_chandef;
-
-        /* for AP and mesh channel tracking */
-        struct ieee80211_channel *channel;
+        struct cfg80211_chan_def chandef;
 
         bool ibss_fixed;
         bool ibss_dfs_possible;
@@ -3208,6 +3239,7 @@ struct wireless_dev {
 
         bool cac_started;
         unsigned long cac_start_time;
+        unsigned int cac_time_ms;
 
 #ifdef CONFIG_CFG80211_WEXT
         /* wext data */
@@ -3640,7 +3672,7 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
  * cfg80211_inform_bss_width_frame - inform cfg80211 of a received BSS frame
  *
  * @wiphy: the wiphy reporting the BSS
- * @channel: The channel the frame was received on
+ * @rx_channel: The channel the frame was received on
  * @scan_width: width of the control channel
  * @mgmt: the management frame (probe response or beacon)
  * @len: length of the management frame
@@ -3655,18 +3687,18 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
  */
 struct cfg80211_bss * __must_check
 cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
-                                struct ieee80211_channel *channel,
+                                struct ieee80211_channel *rx_channel,
                                 enum nl80211_bss_scan_width scan_width,
                                 struct ieee80211_mgmt *mgmt, size_t len,
                                 s32 signal, gfp_t gfp);
 
 static inline struct cfg80211_bss * __must_check
 cfg80211_inform_bss_frame(struct wiphy *wiphy,
-                          struct ieee80211_channel *channel,
+                          struct ieee80211_channel *rx_channel,
                           struct ieee80211_mgmt *mgmt, size_t len,
                           s32 signal, gfp_t gfp)
 {
-        return cfg80211_inform_bss_width_frame(wiphy, channel,
+        return cfg80211_inform_bss_width_frame(wiphy, rx_channel,
                                                NL80211_BSS_CHAN_WIDTH_20,
                                                mgmt, len, signal, gfp);
 }
@@ -3675,7 +3707,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
  * cfg80211_inform_bss - inform cfg80211 of a new BSS
  *
  * @wiphy: the wiphy reporting the BSS
- * @channel: The channel the frame was received on
+ * @rx_channel: The channel the frame was received on
  * @scan_width: width of the control channel
  * @bssid: the BSSID of the BSS
  * @tsf: the TSF sent by the peer in the beacon/probe response (or 0)
@@ -3694,7 +3726,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
  */
 struct cfg80211_bss * __must_check
 cfg80211_inform_bss_width(struct wiphy *wiphy,
-                          struct ieee80211_channel *channel,
+                          struct ieee80211_channel *rx_channel,
                           enum nl80211_bss_scan_width scan_width,
                           const u8 *bssid, u64 tsf, u16 capability,
                           u16 beacon_interval, const u8 *ie, size_t ielen,
@@ -3702,12 +3734,12 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
 
 static inline struct cfg80211_bss * __must_check
 cfg80211_inform_bss(struct wiphy *wiphy,
-                    struct ieee80211_channel *channel,
+                    struct ieee80211_channel *rx_channel,
                     const u8 *bssid, u64 tsf, u16 capability,
                     u16 beacon_interval, const u8 *ie, size_t ielen,
                     s32 signal, gfp_t gfp)
 {
-        return cfg80211_inform_bss_width(wiphy, channel,
+        return cfg80211_inform_bss_width(wiphy, rx_channel,
                                          NL80211_BSS_CHAN_WIDTH_20,
                                          bssid, tsf, capability,
                                          beacon_interval, ie, ielen, signal,
@@ -3876,6 +3908,7 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
  *
  * @dev: network device
  * @bssid: the BSSID of the IBSS joined
+ * @channel: the channel of the IBSS joined
  * @gfp: allocation flags
  *
  * This function notifies cfg80211 that the device joined an IBSS or
@@ -3885,7 +3918,8 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
  * with the locally generated beacon -- this guarantees that there is
  * always a scan result for this IBSS. cfg80211 will handle the rest.
  */
-void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
+void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
+                          struct ieee80211_channel *channel, gfp_t gfp);
 
 /**
  * cfg80211_notify_new_candidate - notify cfg80211 of a new mesh peer candidate
diff --git a/include/net/checksum.h b/include/net/checksum.h
index 37a0e24adbe7..a28f4e0f6251 100644
--- a/include/net/checksum.h
+++ b/include/net/checksum.h
@@ -69,6 +69,19 @@ static inline __wsum csum_sub(__wsum csum, __wsum addend)
         return csum_add(csum, ~addend);
 }
 
+static inline __sum16 csum16_add(__sum16 csum, __be16 addend)
+{
+        u16 res = (__force u16)csum;
+
+        res += (__force u16)addend;
+        return (__force __sum16)(res + (res < (__force u16)addend));
+}
+
+static inline __sum16 csum16_sub(__sum16 csum, __be16 addend)
+{
+        return csum16_add(csum, ~addend);
+}
+
 static inline __wsum
 csum_block_add(__wsum csum, __wsum csum2, int offset)
 {
@@ -112,9 +125,15 @@ static inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to)
         *sum = csum_fold(csum_partial(diff, sizeof(diff), ~csum_unfold(*sum)));
 }
 
-static inline void csum_replace2(__sum16 *sum, __be16 from, __be16 to)
+/* Implements RFC 1624 (Incremental Internet Checksum)
+ * 3. Discussion states :
+ *     HC' = ~(~HC + ~m + m')
+ *  m : old value of a 16bit field
+ *  m' : new value of a 16bit field
+ */
+static inline void csum_replace2(__sum16 *sum, __be16 old, __be16 new)
 {
-        csum_replace4(sum, (__force __be32)from, (__force __be32)to);
+        *sum = ~csum16_add(csum16_sub(~(*sum), old), new);
 }
 
 struct sk_buff;
diff --git a/include/net/dst.h b/include/net/dst.h
index 77eb53fabfb0..46ed958e0c6e 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -54,10 +54,9 @@ struct dst_entry {
 #define DST_NOHASH              0x0008
 #define DST_NOCACHE             0x0010
 #define DST_NOCOUNT             0x0020
-#define DST_NOPEER              0x0040
-#define DST_FAKE_RTABLE         0x0080
-#define DST_XFRM_TUNNEL         0x0100
-#define DST_XFRM_QUEUE          0x0200
+#define DST_FAKE_RTABLE         0x0040
+#define DST_XFRM_TUNNEL         0x0080
+#define DST_XFRM_QUEUE          0x0100
 
         unsigned short          pending_confirm;
 
@@ -109,9 +108,11 @@ struct dst_entry {
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
 extern const u32 dst_default_metrics[];
 
-#define DST_METRICS_READ_ONLY   0x1UL
+#define DST_METRICS_READ_ONLY           0x1UL
+#define DST_METRICS_FORCE_OVERWRITE     0x2UL
+#define DST_METRICS_FLAGS               0x3UL
 #define __DST_METRICS_PTR(Y)    \
-        ((u32 *)((Y) & ~DST_METRICS_READ_ONLY))
+        ((u32 *)((Y) & ~DST_METRICS_FLAGS))
 #define DST_METRICS_PTR(X)      __DST_METRICS_PTR((X)->_metrics)
 
 static inline bool dst_metrics_read_only(const struct dst_entry *dst)
@@ -119,6 +120,11 @@ static inline bool dst_metrics_read_only(const struct dst_entry *dst)
         return dst->_metrics & DST_METRICS_READ_ONLY;
 }
 
+static inline void dst_metrics_set_force_overwrite(struct dst_entry *dst)
+{
+        dst->_metrics |= DST_METRICS_FORCE_OVERWRITE;
+}
+
 void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old);
 
 static inline void dst_destroy_metrics_generic(struct dst_entry *dst)
diff --git a/include/net/flow.h b/include/net/flow.h
index d23e7fa2042e..64fd24836650 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -218,9 +218,11 @@ struct flow_cache_object *flow_cache_lookup(struct net *net,
                                             const struct flowi *key, u16 family,
                                             u8 dir, flow_resolve_t resolver,
                                             void *ctx);
+int flow_cache_init(struct net *net);
+void flow_cache_fini(struct net *net);
 
-void flow_cache_flush(void);
-void flow_cache_flush_deferred(void);
+void flow_cache_flush(struct net *net);
+void flow_cache_flush_deferred(struct net *net);
 extern atomic_t flow_cache_genid;
 
 #endif
diff --git a/include/net/flowcache.h b/include/net/flowcache.h
new file mode 100644
index 000000000000..c8f665ec6e0d
--- /dev/null
+++ b/include/net/flowcache.h
@@ -0,0 +1,25 @@
+#ifndef _NET_FLOWCACHE_H
+#define _NET_FLOWCACHE_H
+
+#include <linux/interrupt.h>
+#include <linux/types.h>
+#include <linux/timer.h>
+#include <linux/notifier.h>
+
+struct flow_cache_percpu {
+        struct hlist_head               *hash_table;
+        int                             hash_count;
+        u32                             hash_rnd;
+        int                             hash_rnd_recalc;
+        struct tasklet_struct           flush_tasklet;
+};
+
+struct flow_cache {
+        u32                             hash_shift;
+        struct flow_cache_percpu __percpu *percpu;
+        struct notifier_block           hotcpu_notifier;
+        int                             low_watermark;
+        int                             high_watermark;
+        struct timer_list               rnd_timer;
+};
+#endif  /* _NET_FLOWCACHE_H */
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index 8b5b71433297..b0fd9476c538 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -316,6 +316,10 @@ enum ieee80211_radiotap_type {
 #define IEEE80211_RADIOTAP_VHT_FLAG_LDPC_EXTRA_OFDM_SYM         0x10
 #define IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED                  0x20
 
+#define IEEE80211_RADIOTAP_CODING_LDPC_USER0                    0x01
+#define IEEE80211_RADIOTAP_CODING_LDPC_USER1                    0x02
+#define IEEE80211_RADIOTAP_CODING_LDPC_USER2                    0x04
+#define IEEE80211_RADIOTAP_CODING_LDPC_USER3                    0x08
 
 /* helpers */
 static inline int ieee80211_get_radiotap_len(unsigned char *data)
diff --git a/include/net/ieee802154.h b/include/net/ieee802154.h
index ee59f8b188dd..c7ae0ac528dc 100644
--- a/include/net/ieee802154.h
+++ b/include/net/ieee802154.h
@@ -42,22 +42,42 @@
             (((x) << IEEE802154_FC_TYPE_SHIFT) & IEEE802154_FC_TYPE_MASK)); \
         } while (0)
 
-#define IEEE802154_FC_SECEN             (1 << 3)
-#define IEEE802154_FC_FRPEND            (1 << 4)
-#define IEEE802154_FC_ACK_REQ           (1 << 5)
-#define IEEE802154_FC_INTRA_PAN         (1 << 6)
+#define IEEE802154_FC_SECEN_SHIFT       3
+#define IEEE802154_FC_SECEN             (1 << IEEE802154_FC_SECEN_SHIFT)
+#define IEEE802154_FC_FRPEND_SHIFT      4
+#define IEEE802154_FC_FRPEND            (1 << IEEE802154_FC_FRPEND_SHIFT)
+#define IEEE802154_FC_ACK_REQ_SHIFT     5
+#define IEEE802154_FC_ACK_REQ           (1 << IEEE802154_FC_ACK_REQ_SHIFT)
+#define IEEE802154_FC_INTRA_PAN_SHIFT   6
+#define IEEE802154_FC_INTRA_PAN         (1 << IEEE802154_FC_INTRA_PAN_SHIFT)
 
 #define IEEE802154_FC_SAMODE_SHIFT      14
 #define IEEE802154_FC_SAMODE_MASK       (3 << IEEE802154_FC_SAMODE_SHIFT)
 #define IEEE802154_FC_DAMODE_SHIFT      10
 #define IEEE802154_FC_DAMODE_MASK       (3 << IEEE802154_FC_DAMODE_SHIFT)
 
+#define IEEE802154_FC_VERSION_SHIFT     12
+#define IEEE802154_FC_VERSION_MASK      (3 << IEEE802154_FC_VERSION_SHIFT)
+#define IEEE802154_FC_VERSION(x)        ((x & IEEE802154_FC_VERSION_MASK) >> IEEE802154_FC_VERSION_SHIFT)
+
 #define IEEE802154_FC_SAMODE(x)         \
         (((x) & IEEE802154_FC_SAMODE_MASK) >> IEEE802154_FC_SAMODE_SHIFT)
 
 #define IEEE802154_FC_DAMODE(x)         \
         (((x) & IEEE802154_FC_DAMODE_MASK) >> IEEE802154_FC_DAMODE_SHIFT)
 
+#define IEEE802154_SCF_SECLEVEL_MASK            7
+#define IEEE802154_SCF_SECLEVEL_SHIFT           0
+#define IEEE802154_SCF_SECLEVEL(x)              (x & IEEE802154_SCF_SECLEVEL_MASK)
+#define IEEE802154_SCF_KEY_ID_MODE_SHIFT        3
+#define IEEE802154_SCF_KEY_ID_MODE_MASK         (3 << IEEE802154_SCF_KEY_ID_MODE_SHIFT)
+#define IEEE802154_SCF_KEY_ID_MODE(x)           \
+        ((x & IEEE802154_SCF_KEY_ID_MODE_MASK) >> IEEE802154_SCF_KEY_ID_MODE_SHIFT)
+
+#define IEEE802154_SCF_KEY_IMPLICIT             0
+#define IEEE802154_SCF_KEY_INDEX                1
+#define IEEE802154_SCF_KEY_SHORT_INDEX          2
+#define IEEE802154_SCF_KEY_HW_INDEX             3
 
 /* MAC footer size */
 #define IEEE802154_MFR_SIZE     2 /* 2 octets */
diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
index 8196d5d40359..5a719ca892f4 100644
--- a/include/net/ieee802154_netdev.h
+++ b/include/net/ieee802154_netdev.h
@@ -28,6 +28,164 @@
 #define IEEE802154_NETDEVICE_H
 
 #include <net/af_ieee802154.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+
+struct ieee802154_sechdr {
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        u8 level:3,
+           key_id_mode:2,
+           reserved:3;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+        u8 reserved:3,
+           key_id_mode:2,
+           level:3;
+#else
+#error  "Please fix <asm/byteorder.h>"
+#endif
+        u8 key_id;
+        __le32 frame_counter;
+        union {
+                __le32 short_src;
+                __le64 extended_src;
+        };
+};
+
+struct ieee802154_addr {
+        u8 mode;
+        __le16 pan_id;
+        union {
+                __le16 short_addr;
+                __le64 extended_addr;
+        };
+};
+
+struct ieee802154_hdr_fc {
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        u16 type:3,
+            security_enabled:1,
+            frame_pending:1,
+            ack_request:1,
+            intra_pan:1,
+            reserved:3,
+            dest_addr_mode:2,
+            version:2,
+            source_addr_mode:2;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+        u16 reserved:1,
+            intra_pan:1,
+            ack_request:1,
+            frame_pending:1,
+            security_enabled:1,
+            type:3,
+            source_addr_mode:2,
+            version:2,
+            dest_addr_mode:2,
+            reserved2:2;
+#else
+#error  "Please fix <asm/byteorder.h>"
+#endif
+};
+
+struct ieee802154_hdr {
+        struct ieee802154_hdr_fc fc;
+        u8 seq;
+        struct ieee802154_addr source;
+        struct ieee802154_addr dest;
+        struct ieee802154_sechdr sec;
+};
+
+/* pushes hdr onto the skb. fields of hdr->fc that can be calculated from
+ * the contents of hdr will be, and the actual value of those bits in
+ * hdr->fc will be ignored. this includes the INTRA_PAN bit and the frame
+ * version, if SECEN is set.
+ */
+int ieee802154_hdr_push(struct sk_buff *skb, const struct ieee802154_hdr *hdr);
+
+/* pulls the entire 802.15.4 header off of the skb, including the security
+ * header, and performs pan id decompression
+ */
+int ieee802154_hdr_pull(struct sk_buff *skb, struct ieee802154_hdr *hdr);
+
+/* parses the frame control, sequence number of address fields in a given skb
+ * and stores them into hdr, performing pan id decompression and length checks
+ * to be suitable for use in header_ops.parse
+ */
+int ieee802154_hdr_peek_addrs(const struct sk_buff *skb,
+                              struct ieee802154_hdr *hdr);
+
+static inline int ieee802154_hdr_length(struct sk_buff *skb)
+{
+        struct ieee802154_hdr hdr;
+        int len = ieee802154_hdr_pull(skb, &hdr);
+
+        if (len > 0)
+                skb_push(skb, len);
+
+        return len;
+}
+
+static inline bool ieee802154_addr_equal(const struct ieee802154_addr *a1,
+                                         const struct ieee802154_addr *a2)
+{
+        if (a1->pan_id != a2->pan_id || a1->mode != a2->mode)
+                return false;
+
+        if ((a1->mode == IEEE802154_ADDR_LONG &&
+             a1->extended_addr != a2->extended_addr) ||
+            (a1->mode == IEEE802154_ADDR_SHORT &&
+             a1->short_addr != a2->short_addr))
+                return false;
+
+        return true;
+}
+
+static inline __le64 ieee802154_devaddr_from_raw(const void *raw)
+{
+        u64 temp;
+
+        memcpy(&temp, raw, IEEE802154_ADDR_LEN);
+        return (__force __le64)swab64(temp);
+}
+
+static inline void ieee802154_devaddr_to_raw(void *raw, __le64 addr)
+{
+        u64 temp = swab64((__force u64)addr);
+
+        memcpy(raw, &temp, IEEE802154_ADDR_LEN);
+}
+
+static inline void ieee802154_addr_from_sa(struct ieee802154_addr *a,
+                                           const struct ieee802154_addr_sa *sa)
+{
+        a->mode = sa->addr_type;
+        a->pan_id = cpu_to_le16(sa->pan_id);
+
+        switch (a->mode) {
+        case IEEE802154_ADDR_SHORT:
+                a->short_addr = cpu_to_le16(sa->short_addr);
+                break;
+        case IEEE802154_ADDR_LONG:
+                a->extended_addr = ieee802154_devaddr_from_raw(sa->hwaddr);
+                break;
+        }
+}
+
+static inline void ieee802154_addr_to_sa(struct ieee802154_addr_sa *sa,
+                                         const struct ieee802154_addr *a)
+{
+        sa->addr_type = a->mode;
+        sa->pan_id = le16_to_cpu(a->pan_id);
+
+        switch (a->mode) {
+        case IEEE802154_ADDR_SHORT:
+                sa->short_addr = le16_to_cpu(a->short_addr);
+                break;
+        case IEEE802154_ADDR_LONG:
+                ieee802154_devaddr_to_raw(sa->hwaddr, a->extended_addr);
+                break;
+        }
+}
 
 /*
  * A control block of skb passed between the ARPHRD_IEEE802154 device
@@ -35,10 +193,10 @@
  */
 struct ieee802154_mac_cb {
         u8 lqi;
-        struct ieee802154_addr sa;
-        struct ieee802154_addr da;
         u8 flags;
         u8 seq;
+        struct ieee802154_addr source;
+        struct ieee802154_addr dest;
 };
 
 static inline struct ieee802154_mac_cb *mac_cb(struct sk_buff *skb)
@@ -50,23 +208,17 @@ static inline struct ieee802154_mac_cb *mac_cb(struct sk_buff *skb)
 
 #define MAC_CB_FLAG_ACKREQ              (1 << 3)
 #define MAC_CB_FLAG_SECEN               (1 << 4)
-#define MAC_CB_FLAG_INTRAPAN            (1 << 5)
 
-static inline int mac_cb_is_ackreq(struct sk_buff *skb)
+static inline bool mac_cb_is_ackreq(struct sk_buff *skb)
 {
         return mac_cb(skb)->flags & MAC_CB_FLAG_ACKREQ;
 }
 
-static inline int mac_cb_is_secen(struct sk_buff *skb)
+static inline bool mac_cb_is_secen(struct sk_buff *skb)
 {
         return mac_cb(skb)->flags & MAC_CB_FLAG_SECEN;
 }
 
-static inline int mac_cb_is_intrapan(struct sk_buff *skb)
-{
-        return mac_cb(skb)->flags & MAC_CB_FLAG_INTRAPAN;
-}
-
 static inline int mac_cb_type(struct sk_buff *skb)
 {
         return mac_cb(skb)->flags & MAC_CB_FLAG_TYPEMASK;
@@ -77,6 +229,18 @@ static inline int mac_cb_type(struct sk_buff *skb)
 #define IEEE802154_MAC_SCAN_PASSIVE     2
 #define IEEE802154_MAC_SCAN_ORPHAN      3
 
+struct ieee802154_mac_params {
+        s8 transmit_power;
+        u8 min_be;
+        u8 max_be;
+        u8 csma_retries;
+        s8 frame_retries;
+
+        bool lbt;
+        u8 cca_mode;
+        s32 cca_ed_level;
+};
+
 struct wpan_phy;
 /*
  * This should be located at net_device->ml_priv
@@ -92,7 +256,7 @@ struct ieee802154_mlme_ops {
                         u8 channel, u8 page, u8 cap);
         int (*assoc_resp)(struct net_device *dev,
                         struct ieee802154_addr *addr,
-                        u16 short_addr, u8 status);
+                        __le16 short_addr, u8 status);
         int (*disassoc_req)(struct net_device *dev,
                         struct ieee802154_addr *addr,
                         u8 reason);
@@ -103,6 +267,11 @@ struct ieee802154_mlme_ops {
         int (*scan_req)(struct net_device *dev,
                         u8 type, u32 channels, u8 page, u8 duration);
 
+        int (*set_mac_params)(struct net_device *dev,
+                              const struct ieee802154_mac_params *params);
+        void (*get_mac_params)(struct net_device *dev,
+                               struct ieee802154_mac_params *params);
+
         /* The fields below are required. */
 
         struct wpan_phy *(*get_phy)(const struct net_device *dev);
@@ -111,8 +280,8 @@ struct ieee802154_mlme_ops {
          * FIXME: these should become the part of PIB/MIB interface.
          * However we still don't have IB interface of any kind
          */
-        u16 (*get_pan_id)(const struct net_device *dev);
-        u16 (*get_short_addr)(const struct net_device *dev);
+        __le16 (*get_pan_id)(const struct net_device *dev);
+        __le16 (*get_short_addr)(const struct net_device *dev);
         u8 (*get_dsn)(const struct net_device *dev);
 };
 
diff --git a/include/net/ip.h b/include/net/ip.h
index 23be0fd37937..25064c28e059 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -187,6 +187,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
 #define NET_INC_STATS(net, field)       SNMP_INC_STATS((net)->mib.net_statistics, field)
 #define NET_INC_STATS_BH(net, field)    SNMP_INC_STATS_BH((net)->mib.net_statistics, field)
 #define NET_INC_STATS_USER(net, field)  SNMP_INC_STATS_USER((net)->mib.net_statistics, field)
+#define NET_ADD_STATS(net, field, adnd) SNMP_ADD_STATS((net)->mib.net_statistics, field, adnd)
 #define NET_ADD_STATS_BH(net, field, adnd) SNMP_ADD_STATS_BH((net)->mib.net_statistics, field, adnd)
 #define NET_ADD_STATS_USER(net, field, adnd) SNMP_ADD_STATS_USER((net)->mib.net_statistics, field, adnd)
 
@@ -266,7 +267,8 @@ int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
 
 static inline bool ip_sk_accept_pmtu(const struct sock *sk)
 {
-        return inet_sk(sk)->pmtudisc != IP_PMTUDISC_INTERFACE;
+        return inet_sk(sk)->pmtudisc != IP_PMTUDISC_INTERFACE &&
+               inet_sk(sk)->pmtudisc != IP_PMTUDISC_OMIT;
 }
 
 static inline bool ip_sk_use_pmtu(const struct sock *sk)
@@ -274,6 +276,12 @@ static inline bool ip_sk_use_pmtu(const struct sock *sk)
         return inet_sk(sk)->pmtudisc < IP_PMTUDISC_PROBE;
 }
 
+static inline bool ip_sk_local_df(const struct sock *sk)
+{
+        return inet_sk(sk)->pmtudisc < IP_PMTUDISC_DO ||
+               inet_sk(sk)->pmtudisc == IP_PMTUDISC_OMIT;
+}
+
 static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
                                                     bool forwarding)
 {
@@ -489,7 +497,8 @@ int ip_options_rcv_srr(struct sk_buff *skb);
 
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb);
 void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb);
-int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc);
+int ip_cmsg_send(struct net *net, struct msghdr *msg,
+                 struct ipcm_cookie *ipc, bool allow_ipv6);
 int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                   unsigned int optlen);
 int ip_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index aca0c2709fd6..9bcb220bd4ad 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -284,7 +284,8 @@ struct fib6_node *fib6_locate(struct fib6_node *root,
 void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
                     void *arg);
 
-int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info);
+int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info,
+             struct nlattr *mx, int mx_len);
 
 int fib6_del(struct rt6_info *rt, struct nl_info *info);
 
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 017badb1aec7..3c3bb184eb8f 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -51,6 +51,11 @@ static inline unsigned int rt6_flags2srcprefs(int flags)
         return (flags >> 3) & 7;
 }
 
+static inline bool rt6_need_strict(const struct in6_addr *daddr)
+{
+        return ipv6_addr_type(daddr) &
+                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
+}
 
 void ip6_route_input(struct sk_buff *skb);
 
@@ -171,7 +176,14 @@ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
 
 static inline bool ip6_sk_accept_pmtu(const struct sock *sk)
 {
-        return inet6_sk(sk)->pmtudisc != IPV6_PMTUDISC_INTERFACE;
+        return inet6_sk(sk)->pmtudisc != IPV6_PMTUDISC_INTERFACE &&
+               inet6_sk(sk)->pmtudisc != IPV6_PMTUDISC_OMIT;
+}
+
+static inline bool ip6_sk_local_df(const struct sock *sk)
+{
+        return inet6_sk(sk)->pmtudisc < IPV6_PMTUDISC_DO ||
+               inet6_sk(sk)->pmtudisc == IPV6_PMTUDISC_OMIT;
 }
 
 static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 703b1f1456fc..8248e3909fdf 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -66,10 +66,6 @@
  *
  * Secondly, when the hardware handles fragmentation, the frame handed to
  * the driver from mac80211 is the MSDU, not the MPDU.
- *
- * Finally, for received frames, the driver is able to indicate that it has
- * filled a radiotap header and put that in front of the frame; if it does
- * not do so then mac80211 may add this under certain circumstances.
  */
 
 /**
@@ -701,11 +697,11 @@ struct ieee80211_tx_info {
                 } control;
                 struct {
                         struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
-                        int ack_signal;
+                        s32 ack_signal;
                         u8 ampdu_ack_len;
                         u8 ampdu_len;
                         u8 antenna;
-                        /* 21 bytes free */
+                        void *status_driver_data[21 / sizeof(void *)];
                 } status;
                 struct {
                         struct ieee80211_tx_rate driver_rates[
@@ -808,9 +804,6 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  * @RX_FLAG_HT: HT MCS was used and rate_idx is MCS index
  * @RX_FLAG_VHT: VHT MCS was used and rate_index is MCS index
  * @RX_FLAG_40MHZ: HT40 (40 MHz) was used
- * @RX_FLAG_80MHZ: 80 MHz was used
- * @RX_FLAG_80P80MHZ: 80+80 MHz was used
- * @RX_FLAG_160MHZ: 160 MHz was used
  * @RX_FLAG_SHORT_GI: Short guard interval was used
  * @RX_FLAG_NO_SIGNAL_VAL: The signal strength value is not present.
  *      Valid only for data frames (mainly A-MPDU)
@@ -830,6 +823,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  *      on this subframe
  * @RX_FLAG_AMPDU_DELIM_CRC_KNOWN: The delimiter CRC field is known (the CRC
  *      is stored in the @ampdu_delimiter_crc field)
+ * @RX_FLAG_LDPC: LDPC was used
  * @RX_FLAG_STBC_MASK: STBC 2 bit bitmask. 1 - Nss=1, 2 - Nss=2, 3 - Nss=3
  * @RX_FLAG_10MHZ: 10 MHz (half channel) was used
  * @RX_FLAG_5MHZ: 5 MHz (quarter channel) was used
@@ -866,9 +860,7 @@ enum mac80211_rx_flags {
         RX_FLAG_AMPDU_DELIM_CRC_KNOWN   = BIT(20),
         RX_FLAG_MACTIME_END             = BIT(21),
         RX_FLAG_VHT                     = BIT(22),
-        RX_FLAG_80MHZ                   = BIT(23),
-        RX_FLAG_80P80MHZ                = BIT(24),
-        RX_FLAG_160MHZ                  = BIT(25),
+        RX_FLAG_LDPC                    = BIT(23),
         RX_FLAG_STBC_MASK               = BIT(26) | BIT(27),
         RX_FLAG_10MHZ                   = BIT(28),
         RX_FLAG_5MHZ                    = BIT(29),
@@ -878,6 +870,23 @@ enum mac80211_rx_flags {
 #define RX_FLAG_STBC_SHIFT              26
 
 /**
+ * enum mac80211_rx_vht_flags - receive VHT flags
+ *
+ * These flags are used with the @vht_flag member of
+ *      &struct ieee80211_rx_status.
+ * @RX_VHT_FLAG_80MHZ: 80 MHz was used
+ * @RX_VHT_FLAG_80P80MHZ: 80+80 MHz was used
+ * @RX_VHT_FLAG_160MHZ: 160 MHz was used
+ * @RX_VHT_FLAG_BF: packet was beamformed
+ */
+enum mac80211_rx_vht_flags {
+        RX_VHT_FLAG_80MHZ               = BIT(0),
+        RX_VHT_FLAG_80P80MHZ            = BIT(1),
+        RX_VHT_FLAG_160MHZ              = BIT(2),
+        RX_VHT_FLAG_BF                  = BIT(3),
+};
+
+/**
  * struct ieee80211_rx_status - receive status
  *
  * The low-level driver should provide this information (the subset
@@ -902,26 +911,19 @@ enum mac80211_rx_flags {
  *      HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
  * @vht_nss: number of streams (VHT only)
  * @flag: %RX_FLAG_*
+ * @vht_flag: %RX_VHT_FLAG_*
  * @rx_flags: internal RX flags for mac80211
  * @ampdu_reference: A-MPDU reference number, must be a different value for
  *      each A-MPDU but the same for each subframe within one A-MPDU
  * @ampdu_delimiter_crc: A-MPDU delimiter CRC
- * @vendor_radiotap_bitmap: radiotap vendor namespace presence bitmap
- * @vendor_radiotap_len: radiotap vendor namespace length
- * @vendor_radiotap_align: radiotap vendor namespace alignment. Note
- *      that the actual data must be at the start of the SKB data
- *      already.
- * @vendor_radiotap_oui: radiotap vendor namespace OUI
- * @vendor_radiotap_subns: radiotap vendor sub namespace
  */
 struct ieee80211_rx_status {
         u64 mactime;
         u32 device_timestamp;
         u32 ampdu_reference;
         u32 flag;
-        u32 vendor_radiotap_bitmap;
-        u16 vendor_radiotap_len;
         u16 freq;
+        u8 vht_flag;
         u8 rate_idx;
         u8 vht_nss;
         u8 rx_flags;
@@ -931,9 +933,6 @@ struct ieee80211_rx_status {
         u8 chains;
         s8 chain_signal[IEEE80211_MAX_CHAINS];
         u8 ampdu_delimiter_crc;
-        u8 vendor_radiotap_align;
-        u8 vendor_radiotap_oui[3];
-        u8 vendor_radiotap_subns;
 };
 
 /**
@@ -1506,8 +1505,6 @@ struct ieee80211_tx_control {
  * @IEEE80211_HW_CONNECTION_MONITOR:
  *      The hardware performs its own connection monitoring, including
  *      periodic keep-alives to the AP and probing the AP on beacon loss.
- *      When this flag is set, signaling beacon-loss will cause an immediate
- *      change to disassociated state.
  *
  * @IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC:
  *      This device needs to get data from beacon before association (i.e.
@@ -1643,10 +1640,6 @@ enum ieee80211_hw_flags {
  *      the hw can report back.
  * @max_rate_tries: maximum number of tries for each stage
  *
- * @napi_weight: weight used for NAPI polling.  You must specify an
- *      appropriate value here if a napi_poll operation is provided
- *      by your driver.
- *
  * @max_rx_aggregation_subframes: maximum buffer size (number of
  *      sub-frames) to be used for A-MPDU block ack receiver
  *      aggregation.
@@ -1700,7 +1693,6 @@ struct ieee80211_hw {
         int vif_data_size;
         int sta_data_size;
         int chanctx_data_size;
-        int napi_weight;
         u16 queues;
         u16 max_listen_interval;
         s8 max_signal;
@@ -2470,6 +2462,7 @@ enum ieee80211_roc_type {
  *      This process will continue until sched_scan_stop is called.
  *
  * @sched_scan_stop: Tell the hardware to stop an ongoing scheduled scan.
+ *      In this case, ieee80211_sched_scan_stopped() must not be called.
  *
  * @sw_scan_start: Notifier function that is called just before a software scan
  *      is started. Can be NULL, if the driver doesn't need this notification.
@@ -2623,8 +2616,6 @@ enum ieee80211_roc_type {
  *      callback. They must then call ieee80211_chswitch_done() to indicate
  *      completion of the channel switch.
  *
- * @napi_poll: Poll Rx queue for incoming data frames.
- *
  * @set_antenna: Set antenna configuration (tx_ant, rx_ant) on the device.
  *      Parameters are bitmaps of allowed antennas to use for TX/RX. Drivers may
  *      reject TX/RX mask combinations they cannot support by returning -EINVAL
@@ -2750,11 +2741,13 @@ enum ieee80211_roc_type {
  * @channel_switch_beacon: Starts a channel switch to a new channel.
  *      Beacons are modified to include CSA or ECSA IEs before calling this
  *      function. The corresponding count fields in these IEs must be
- *      decremented, and when they reach zero the driver must call
+ *      decremented, and when they reach 1 the driver must call
  *      ieee80211_csa_finish(). Drivers which use ieee80211_beacon_get()
  *      get the csa counter decremented by mac80211, but must check if it is
- *      zero using ieee80211_csa_is_complete() after the beacon has been
+ *      1 using ieee80211_csa_is_complete() after the beacon has been
  *      transmitted and then call ieee80211_csa_finish().
+ *      If the CSA count starts as zero or 1, this function will not be called,
+ *      since there won't be any time to beacon before the switch anyway.
  *
  * @join_ibss: Join an IBSS (on an IBSS interface); this is called after all
  *      information in bss_conf is set up and the beacon can be retrieved. A
@@ -2817,7 +2810,7 @@ struct ieee80211_ops {
                                 struct ieee80211_vif *vif,
                                 struct cfg80211_sched_scan_request *req,
                                 struct ieee80211_sched_scan_ies *ies);
-        void (*sched_scan_stop)(struct ieee80211_hw *hw,
+        int (*sched_scan_stop)(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif);
         void (*sw_scan_start)(struct ieee80211_hw *hw);
         void (*sw_scan_complete)(struct ieee80211_hw *hw);
@@ -2881,7 +2874,6 @@ struct ieee80211_ops {
         void (*flush)(struct ieee80211_hw *hw, u32 queues, bool drop);
         void (*channel_switch)(struct ieee80211_hw *hw,
                                struct ieee80211_channel_switch *ch_switch);
-        int (*napi_poll)(struct ieee80211_hw *hw, int budget);
         int (*set_antenna)(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant);
         int (*get_antenna)(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant);
 
@@ -3163,21 +3155,21 @@ void ieee80211_free_hw(struct ieee80211_hw *hw);
  */
 void ieee80211_restart_hw(struct ieee80211_hw *hw);
 
-/** ieee80211_napi_schedule - schedule NAPI poll
- *
- * Use this function to schedule NAPI polling on a device.
- *
- * @hw: the hardware to start polling
- */
-void ieee80211_napi_schedule(struct ieee80211_hw *hw);
-
-/** ieee80211_napi_complete - complete NAPI polling
- *
- * Use this function to finish NAPI polling on a device.
+/**
+ * ieee80211_napi_add - initialize mac80211 NAPI context
+ * @hw: the hardware to initialize the NAPI context on
+ * @napi: the NAPI context to initialize
+ * @napi_dev: dummy NAPI netdevice, here to not waste the space if the
+ *      driver doesn't use NAPI
+ * @poll: poll function
+ * @weight: default weight
  *
- * @hw: the hardware to stop polling
+ * See also netif_napi_add().
  */
-void ieee80211_napi_complete(struct ieee80211_hw *hw);
+void ieee80211_napi_add(struct ieee80211_hw *hw, struct napi_struct *napi,
+                        struct net_device *napi_dev,
+                        int (*poll)(struct napi_struct *, int),
+                        int weight);
 
 /**
  * ieee80211_rx - receive frame
@@ -3452,13 +3444,13 @@ static inline struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
  * After a channel switch announcement was scheduled and the counter in this
- * announcement hit zero, this function must be called by the driver to
+ * announcement hits 1, this function must be called by the driver to
  * notify mac80211 that the channel can be changed.
  */
 void ieee80211_csa_finish(struct ieee80211_vif *vif);
 
 /**
- * ieee80211_csa_is_complete - find out if counters reached zero
+ * ieee80211_csa_is_complete - find out if counters reached 1
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
  * This function returns whether the channel switch counters reached zero.
@@ -4451,7 +4443,6 @@ struct ieee80211_tx_rate_control {
 };
 
 struct rate_control_ops {
-        struct module *module;
         const char *name;
         void *(*alloc)(struct ieee80211_hw *hw, struct dentry *debugfsdir);
         void (*free)(void *priv);
@@ -4553,8 +4544,8 @@ int rate_control_set_rates(struct ieee80211_hw *hw,
                            struct ieee80211_sta *pubsta,
                            struct ieee80211_sta_rates *rates);
 
-int ieee80211_rate_control_register(struct rate_control_ops *ops);
-void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
+int ieee80211_rate_control_register(const struct rate_control_ops *ops);
+void ieee80211_rate_control_unregister(const struct rate_control_ops *ops);
 
 static inline bool
 conf_is_ht20(struct ieee80211_conf *conf)
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index 807d6b7a943f..a591053cae63 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -20,6 +20,7 @@
 #define NET_MAC802154_H
 
 #include <net/af_ieee802154.h>
+#include <linux/skbuff.h>
 
 /* General MAC frame format:
  *  2 bytes: Frame Control
@@ -50,7 +51,7 @@ struct ieee802154_hw_addr_filt {
                                  * devices across independent networks.
                                  */
         __le16  short_addr;
-        u8      ieee_addr[IEEE802154_ADDR_LEN];
+        __le64  ieee_addr;
         u8      pan_coord;
 };
 
@@ -113,6 +114,32 @@ struct ieee802154_dev {
  *        Set radio for listening on specific address.
  *        Set the device for listening on specified address.
  *        Returns either zero, or negative errno.
+ *
+ * set_txpower:
+ *        Set radio transmit power in dB. Called with pib_lock held.
+ *        Returns either zero, or negative errno.
+ *
+ * set_lbt
+ *        Enables or disables listen before talk on the device. Called with
+ *        pib_lock held.
+ *        Returns either zero, or negative errno.
+ *
+ * set_cca_mode
+ *        Sets the CCA mode used by the device. Called with pib_lock held.
+ *        Returns either zero, or negative errno.
+ *
+ * set_cca_ed_level
+ *        Sets the CCA energy detection threshold in dBm. Called with pib_lock
+ *        held.
+ *        Returns either zero, or negative errno.
+ *
+ * set_csma_params
+ *        Sets the CSMA parameter set for the PHY. Called with pib_lock held.
+ *        Returns either zero, or negative errno.
+ *
+ * set_frame_retries
+ *        Sets the retransmission attempt limit. Called with pib_lock held.
+ *        Returns either zero, or negative errno.
  */
 struct ieee802154_ops {
         struct module   *owner;
@@ -127,8 +154,16 @@ struct ieee802154_ops {
         int             (*set_hw_addr_filt)(struct ieee802154_dev *dev,
                                           struct ieee802154_hw_addr_filt *filt,
                                             unsigned long changed);
-        int             (*ieee_addr)(struct ieee802154_dev *dev,
-                                     u8 addr[IEEE802154_ADDR_LEN]);
+        int             (*ieee_addr)(struct ieee802154_dev *dev, __le64 addr);
+        int             (*set_txpower)(struct ieee802154_dev *dev, int db);
+        int             (*set_lbt)(struct ieee802154_dev *dev, bool on);
+        int             (*set_cca_mode)(struct ieee802154_dev *dev, u8 mode);
+        int             (*set_cca_ed_level)(struct ieee802154_dev *dev,
+                                            s32 level);
+        int             (*set_csma_params)(struct ieee802154_dev *dev,
+                                           u8 min_be, u8 max_be, u8 retries);
+        int             (*set_frame_retries)(struct ieee802154_dev *dev,
+                                             s8 retries);
 };
 
 /* Basic interface to register ieee802154 device */
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 991dcd94cbbf..79387f73f875 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -15,6 +15,7 @@
 #include <net/netns/packet.h>
 #include <net/netns/ipv4.h>
 #include <net/netns/ipv6.h>
+#include <net/netns/ieee802154_6lowpan.h>
 #include <net/netns/sctp.h>
 #include <net/netns/dccp.h>
 #include <net/netns/netfilter.h>
@@ -90,6 +91,9 @@ struct net {
 #if IS_ENABLED(CONFIG_IPV6)
         struct netns_ipv6       ipv6;
 #endif
+#if IS_ENABLED(CONFIG_IEEE802154_6LOWPAN)
+        struct netns_ieee802154_lowpan  ieee802154_lowpan;
+#endif
 #if defined(CONFIG_IP_SCTP) || defined(CONFIG_IP_SCTP_MODULE)
         struct netns_sctp       sctp;
 #endif
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index b2ac6246b7e0..37252f71a380 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -73,10 +73,17 @@ struct nf_conn_help {
 
 struct nf_conn {
         /* Usage count in here is 1 for hash table/destruct timer, 1 per skb,
-           plus 1 for any connection(s) we are `master' for */
+         * plus 1 for any connection(s) we are `master' for
+         *
+         * Hint, SKB address this struct and refcnt via skb->nfct and
+         * helpers nf_conntrack_get() and nf_conntrack_put().
+         * Helper nf_ct_put() equals nf_conntrack_put() by dec refcnt,
+         * beware nf_ct_get() is different and don't inc refcnt.
+         */
         struct nf_conntrack ct_general;
 
-        spinlock_t lock;
+        spinlock_t      lock;
+        u16             cpu;
 
         /* XXX should I move this to the tail ? - Y.K */
         /* These are my tuples; original and reply */
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 15308b8eb5b5..cc0c18827602 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -77,6 +77,13 @@ print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
             const struct nf_conntrack_l3proto *l3proto,
             const struct nf_conntrack_l4proto *proto);
 
-extern spinlock_t nf_conntrack_lock ;
+#ifdef CONFIG_LOCKDEP
+# define CONNTRACK_LOCKS 8
+#else
+# define CONNTRACK_LOCKS 1024
+#endif
+extern spinlock_t nf_conntrack_locks[CONNTRACK_LOCKS];
+
+extern spinlock_t nf_conntrack_expect_lock;
 
 #endif /* _NF_CONNTRACK_CORE_H */
diff --git a/include/net/netfilter/nf_conntrack_labels.h b/include/net/netfilter/nf_conntrack_labels.h
index c985695283b3..dec6336bf850 100644
--- a/include/net/netfilter/nf_conntrack_labels.h
+++ b/include/net/netfilter/nf_conntrack_labels.h
@@ -7,6 +7,8 @@
 
 #include <uapi/linux/netfilter/xt_connlabel.h>
 
+#define NF_CT_LABELS_MAX_SIZE ((XT_CONNLABEL_MAXBIT + 1) / BITS_PER_BYTE)
+
 struct nf_conn_labels {
         u8 words;
         unsigned long bits[];
@@ -29,7 +31,7 @@ static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct)
         u8 words;
 
         words = ACCESS_ONCE(net->ct.label_words);
-        if (words == 0 || WARN_ON_ONCE(words > 8))
+        if (words == 0)
                 return NULL;
 
         cl_ext = nf_ct_ext_add_length(ct, NF_CT_EXT_LABELS,
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index e7e14ffe0f6a..e6bc14d8fa9a 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -3,6 +3,7 @@
 
 #include <linux/list.h>
 #include <linux/netfilter.h>
+#include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netlink.h>
@@ -288,7 +289,8 @@ struct nft_expr_ops {
         int                             (*init)(const struct nft_ctx *ctx,
                                                 const struct nft_expr *expr,
                                                 const struct nlattr * const tb[]);
-        void                            (*destroy)(const struct nft_expr *expr);
+        void                            (*destroy)(const struct nft_ctx *ctx,
+                                                   const struct nft_expr *expr);
         int                             (*dump)(struct sk_buff *skb,
                                                 const struct nft_expr *expr);
         int                             (*validate)(const struct nft_ctx *ctx,
@@ -325,13 +327,15 @@ static inline void *nft_expr_priv(const struct nft_expr *expr)
  *      @handle: rule handle
  *      @genmask: generation mask
  *      @dlen: length of expression data
+ *      @ulen: length of user data (used for comments)
  *      @data: expression data
  */
 struct nft_rule {
         struct list_head                list;
-        u64                             handle:46,
+        u64                             handle:42,
                                         genmask:2,
-                                        dlen:16;
+                                        dlen:12,
+                                        ulen:8;
         unsigned char                   data[]
                 __attribute__((aligned(__alignof__(struct nft_expr))));
 };
@@ -340,19 +344,13 @@ struct nft_rule {
  *      struct nft_rule_trans - nf_tables rule update in transaction
  *
  *      @list: used internally
+ *      @ctx: rule context
  *      @rule: rule that needs to be updated
- *      @chain: chain that this rule belongs to
- *      @table: table for which this chain applies
- *      @nlh: netlink header of the message that contain this update
- *      @family: family expressesed as AF_*
  */
 struct nft_rule_trans {
         struct list_head                list;
+        struct nft_ctx                  ctx;
         struct nft_rule                 *rule;
-        const struct nft_chain          *chain;
-        const struct nft_table          *table;
-        const struct nlmsghdr           *nlh;
-        u8                              family;
 };
 
 static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule)
@@ -370,6 +368,11 @@ static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule)
         return (struct nft_expr *)&rule->data[rule->dlen];
 }
 
+static inline void *nft_userdata(const struct nft_rule *rule)
+{
+        return (void *)&rule->data[rule->dlen];
+}
+
 /*
  * The last pointer isn't really necessary, but the compiler isn't able to
  * determine that the result of nft_expr_last() is always the same since it
@@ -521,6 +524,9 @@ void nft_unregister_chain_type(const struct nf_chain_type *);
 int nft_register_expr(struct nft_expr_type *);
 void nft_unregister_expr(struct nft_expr_type *);
 
+#define nft_dereference(p)                                      \
+        nfnl_dereference(p, NFNL_SUBSYS_NFTABLES)
+
 #define MODULE_ALIAS_NFT_FAMILY(family) \
         MODULE_ALIAS("nft-afinfo-" __stringify(family))
 
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index fbcc7fa536dc..773cce308bc6 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -5,6 +5,7 @@
 #include <linux/list_nulls.h>
 #include <linux/atomic.h>
 #include <linux/netfilter/nf_conntrack_tcp.h>
+#include <linux/seqlock.h>
 
 struct ctl_table_header;
 struct nf_conntrack_ecache;
@@ -62,6 +63,13 @@ struct nf_ip_net {
 #endif
 };
 
+struct ct_pcpu {
+        spinlock_t              lock;
+        struct hlist_nulls_head unconfirmed;
+        struct hlist_nulls_head dying;
+        struct hlist_nulls_head tmpl;
+};
+
 struct netns_ct {
         atomic_t                count;
         unsigned int            expect_count;
@@ -83,12 +91,11 @@ struct netns_ct {
         int                     sysctl_checksum;
 
         unsigned int            htable_size;
+        seqcount_t              generation;
         struct kmem_cache       *nf_conntrack_cachep;
         struct hlist_nulls_head *hash;
         struct hlist_head       *expect_hash;
-        struct hlist_nulls_head unconfirmed;
-        struct hlist_nulls_head dying;
-        struct hlist_nulls_head tmpl;
+        struct ct_pcpu __percpu *pcpu_lists;
         struct ip_conntrack_stat __percpu *stat;
         struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb;
         struct nf_exp_event_notifier __rcu *nf_expect_event_cb;
diff --git a/include/net/netns/ieee802154_6lowpan.h b/include/net/netns/ieee802154_6lowpan.h
new file mode 100644
index 000000000000..079030c853d8
--- /dev/null
+++ b/include/net/netns/ieee802154_6lowpan.h
@@ -0,0 +1,22 @@
+/*
+ * ieee802154 6lowpan in net namespaces
+ */
+
+#include <net/inet_frag.h>
+
+#ifndef __NETNS_IEEE802154_6LOWPAN_H__
+#define __NETNS_IEEE802154_6LOWPAN_H__
+
+struct netns_sysctl_lowpan {
+#ifdef CONFIG_SYSCTL
+        struct ctl_table_header *frags_hdr;
+#endif
+};
+
+struct netns_ieee802154_lowpan {
+        struct netns_sysctl_lowpan sysctl;
+        struct netns_frags      frags;
+        u16                     max_dsize;
+};
+
+#endif
diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
index 1006a265beb3..3492434baf88 100644
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -6,6 +6,7 @@
 #include <linux/workqueue.h>
 #include <linux/xfrm.h>
 #include <net/dst_ops.h>
+#include <net/flowcache.h>
 
 struct ctl_table_header;
 
@@ -58,9 +59,17 @@ struct netns_xfrm {
         struct dst_ops          xfrm6_dst_ops;
 #endif
         spinlock_t xfrm_state_lock;
-        spinlock_t xfrm_policy_sk_bundle_lock;
         rwlock_t xfrm_policy_lock;
         struct mutex xfrm_cfg_mutex;
+
+        /* flow cache part */
+        struct flow_cache       flow_cache_global;
+        atomic_t                flow_cache_genid;
+        struct list_head        flow_cache_gc_list;
+        spinlock_t              flow_cache_gc_lock;
+        struct work_struct      flow_cache_gc_work;
+        struct work_struct      flow_cache_flush_work;
+        struct mutex            flow_flush_sem;
 };
 
 #endif
diff --git a/include/net/nfc/digital.h b/include/net/nfc/digital.h
index 81af21e9bcd4..7655cfe27c34 100644
--- a/include/net/nfc/digital.h
+++ b/include/net/nfc/digital.h
@@ -35,6 +35,7 @@ enum {
         NFC_DIGITAL_RF_TECH_106A = 0,
         NFC_DIGITAL_RF_TECH_212F,
         NFC_DIGITAL_RF_TECH_424F,
+        NFC_DIGITAL_RF_TECH_ISO15693,
 
         NFC_DIGITAL_RF_TECH_LAST,
 };
@@ -50,6 +51,7 @@ enum {
 
         NFC_DIGITAL_FRAMING_NFCA_T1T,
         NFC_DIGITAL_FRAMING_NFCA_T2T,
+        NFC_DIGITAL_FRAMING_NFCA_T4T,
         NFC_DIGITAL_FRAMING_NFCA_NFC_DEP,
 
         NFC_DIGITAL_FRAMING_NFCF,
@@ -57,6 +59,9 @@ enum {
         NFC_DIGITAL_FRAMING_NFCF_NFC_DEP,
         NFC_DIGITAL_FRAMING_NFC_DEP_ACTIVATED,
 
+        NFC_DIGITAL_FRAMING_ISO15693_INVENTORY,
+        NFC_DIGITAL_FRAMING_ISO15693_T5T,
+
         NFC_DIGITAL_FRAMING_LAST,
 };
 
@@ -204,6 +209,8 @@ struct nfc_digital_dev {
         u8 curr_rf_tech;
         u8 curr_nfc_dep_pni;
 
+        u16 target_fsc;
+
         int (*skb_check_crc)(struct sk_buff *skb);
         void (*skb_add_crc)(struct sk_buff *skb);
 };
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index e80894bca1d0..2e8b40c16274 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -111,6 +111,9 @@ struct nfc_target {
         u8 sensf_res[NFC_SENSF_RES_MAXSIZE];
         u8 hci_reader_gate;
         u8 logical_idx;
+        u8 is_iso15693;
+        u8 iso15693_dsfid;
+        u8 iso15693_uid[NFC_ISO15693_UID_MAXSIZE];
 };
 
 /**
diff --git a/include/net/nl802154.h b/include/net/nl802154.h
index 99d2ba1c7e03..b23548e04098 100644
--- a/include/net/nl802154.h
+++ b/include/net/nl802154.h
@@ -52,7 +52,7 @@ int ieee802154_nl_assoc_indic(struct net_device *dev,
  * Note: This is in section 7.3.2 of the IEEE 802.15.4 document.
  */
 int ieee802154_nl_assoc_confirm(struct net_device *dev,
-                u16 short_addr, u8 status);
+                __le16 short_addr, u8 status);
 
 /**
  * ieee802154_nl_disassoc_indic - Notify userland of disassociation.
@@ -111,8 +111,8 @@ int ieee802154_nl_scan_confirm(struct net_device *dev,
  * Note: This API cannot indicate a beacon frame for a coordinator
  *       operating in long addressing mode.
  */
-int ieee802154_nl_beacon_indic(struct net_device *dev, u16 panid,
-                u16 coord_addr);
+int ieee802154_nl_beacon_indic(struct net_device *dev, __le16 panid,
+                __le16 coord_addr);
 
 /**
  * ieee802154_nl_start_confirm - Notify userland of completion of start.
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index b07cdc9fa454..75fc1f5a948d 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -155,6 +155,7 @@ struct ieee80211_reg_rule {
         struct ieee80211_freq_range freq_range;
         struct ieee80211_power_rule power_rule;
         u32 flags;
+        u32 dfs_cac_ms;
 };
 
 struct ieee80211_regdomain {
@@ -172,14 +173,18 @@ struct ieee80211_regdomain {
 #define DBM_TO_MBM(gain) ((gain) * 100)
 #define MBM_TO_DBM(gain) ((gain) / 100)
 
-#define REG_RULE(start, end, bw, gain, eirp, reg_flags) \
-{                                                       \
-        .freq_range.start_freq_khz = MHZ_TO_KHZ(start), \
-        .freq_range.end_freq_khz = MHZ_TO_KHZ(end),     \
-        .freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw), \
-        .power_rule.max_antenna_gain = DBI_TO_MBI(gain),\
-        .power_rule.max_eirp = DBM_TO_MBM(eirp),        \
-        .flags = reg_flags,                             \
+#define REG_RULE_EXT(start, end, bw, gain, eirp, dfs_cac, reg_flags)    \
+{                                                                       \
+        .freq_range.start_freq_khz = MHZ_TO_KHZ(start),                 \
+        .freq_range.end_freq_khz = MHZ_TO_KHZ(end),                     \
+        .freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw),                 \
+        .power_rule.max_antenna_gain = DBI_TO_MBI(gain),                \
+        .power_rule.max_eirp = DBM_TO_MBM(eirp),                        \
+        .flags = reg_flags,                                             \
+        .dfs_cac_ms = dfs_cac,                                          \
 }
 
+#define REG_RULE(start, end, bw, gain, eirp, reg_flags) \
+        REG_RULE_EXT(start, end, bw, gain, eirp, 0, reg_flags)
+
 #endif
diff --git a/include/net/route.h b/include/net/route.h
index 9d1f423d5944..b17cf28f996e 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -191,7 +191,6 @@ unsigned int inet_dev_addr_type(struct net *net, const struct net_device *dev,
 void ip_rt_multicast_event(struct in_device *);
 int ip_rt_ioctl(struct net *, unsigned int cmd, void __user *arg);
 void ip_rt_get_source(u8 *src, struct sk_buff *skb, struct rtable *rt);
-int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb);
 
 struct in_ifaddr;
 void fib_add_ifaddr(struct in_ifaddr *);
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 661e45d38051..72240e5ac2c4 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -140,7 +140,7 @@ struct net_device *rtnl_create_link(struct net *net, char *ifname,
                                     struct nlattr *tb[]);
 int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm);
 
-extern const struct nla_policy ifla_policy[IFLA_MAX+1];
+int rtnl_nla_parse_ifla(struct nlattr **tb, const struct nlattr *head, int len);
 
 #define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)
 
diff --git a/include/net/sock.h b/include/net/sock.h
index b9586a137cad..06a5668f05c9 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -862,9 +862,9 @@ static inline void sock_rps_save_rxhash(struct sock *sk,
                                         const struct sk_buff *skb)
 {
 #ifdef CONFIG_RPS
-        if (unlikely(sk->sk_rxhash != skb->rxhash)) {
+        if (unlikely(sk->sk_rxhash != skb->hash)) {
                 sock_rps_reset_flow(sk);
-                sk->sk_rxhash = skb->rxhash;
+                sk->sk_rxhash = skb->hash;
         }
 #endif
 }
@@ -1621,33 +1621,6 @@ void sk_common_release(struct sock *sk);
 /* Initialise core socket variables */
 void sock_init_data(struct socket *sock, struct sock *sk);
 
-void sk_filter_release_rcu(struct rcu_head *rcu);
-
-/**
- *      sk_filter_release - release a socket filter
- *      @fp: filter to remove
- *
- *      Remove a filter from a socket and release its resources.
- */
-
-static inline void sk_filter_release(struct sk_filter *fp)
-{
-        if (atomic_dec_and_test(&fp->refcnt))
-                call_rcu(&fp->rcu, sk_filter_release_rcu);
-}
-
-static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
-{
-        atomic_sub(sk_filter_size(fp->len), &sk->sk_omem_alloc);
-        sk_filter_release(fp);
-}
-
-static inline void sk_filter_charge(struct sock *sk, struct sk_filter *fp)
-{
-        atomic_inc(&fp->refcnt);
-        atomic_add(sk_filter_size(fp->len), &sk->sk_omem_alloc);
-}
-
 /*
  * Socket reference counting postulates.
  *
@@ -2256,8 +2229,12 @@ void sock_net_set(struct sock *sk, struct net *net)
  */
 static inline void sk_change_net(struct sock *sk, struct net *net)
 {
-        put_net(sock_net(sk));
-        sock_net_set(sk, hold_net(net));
+        struct net *current_net = sock_net(sk);
+
+        if (!net_eq(current_net, net)) {
+                put_net(current_net);
+                sock_net_set(sk, hold_net(net));
+        }
 }
 
 static inline struct sock *skb_steal_sock(struct sk_buff *skb)
diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h
index 9e8710be7a04..fa8f5fac65e9 100644
--- a/include/net/tc_act/tc_csum.h
+++ b/include/net/tc_act/tc_csum.h
@@ -9,7 +9,7 @@ struct tcf_csum {
 
         u32 update_flags;
 };
-#define to_tcf_csum(pc) \
-        container_of(pc,struct tcf_csum,common)
+#define to_tcf_csum(a) \
+        container_of(a->priv,struct tcf_csum,common)
 
 #endif /* __NET_TC_CSUM_H */
diff --git a/include/net/tc_act/tc_defact.h b/include/net/tc_act/tc_defact.h
index 65f024b80958..9763dcbb9bc3 100644
--- a/include/net/tc_act/tc_defact.h
+++ b/include/net/tc_act/tc_defact.h
@@ -8,7 +8,7 @@ struct tcf_defact {
         u32                     tcfd_datalen;
         void                    *tcfd_defdata;
 };
-#define to_defact(pc) \
-        container_of(pc, struct tcf_defact, common)
+#define to_defact(a) \
+        container_of(a->priv, struct tcf_defact, common)
 
 #endif /* __NET_TC_DEF_H */
diff --git a/include/net/tc_act/tc_gact.h b/include/net/tc_act/tc_gact.h
index 9e3f6767b80e..9fc9b578908a 100644
--- a/include/net/tc_act/tc_gact.h
+++ b/include/net/tc_act/tc_gact.h
@@ -11,7 +11,7 @@ struct tcf_gact {
         int                     tcfg_paction;
 #endif
 };
-#define to_gact(pc) \
-        container_of(pc, struct tcf_gact, common)
+#define to_gact(a) \
+        container_of(a->priv, struct tcf_gact, common)
 
 #endif /* __NET_TC_GACT_H */
diff --git a/include/net/tc_act/tc_ipt.h b/include/net/tc_act/tc_ipt.h
index f7d25dfcc4b7..c0f4193f432c 100644
--- a/include/net/tc_act/tc_ipt.h
+++ b/include/net/tc_act/tc_ipt.h
@@ -11,7 +11,7 @@ struct tcf_ipt {
         char                    *tcfi_tname;
         struct xt_entry_target  *tcfi_t;
 };
-#define to_ipt(pc) \
-        container_of(pc, struct tcf_ipt, common)
+#define to_ipt(a) \
+        container_of(a->priv, struct tcf_ipt, common)
 
 #endif /* __NET_TC_IPT_H */
diff --git a/include/net/tc_act/tc_mirred.h b/include/net/tc_act/tc_mirred.h
index cfe2943690ff..4dd77a1c106b 100644
--- a/include/net/tc_act/tc_mirred.h
+++ b/include/net/tc_act/tc_mirred.h
@@ -11,7 +11,7 @@ struct tcf_mirred {
         struct net_device       *tcfm_dev;
         struct list_head        tcfm_list;
 };
-#define to_mirred(pc) \
-        container_of(pc, struct tcf_mirred, common)
+#define to_mirred(a) \
+        container_of(a->priv, struct tcf_mirred, common)
 
 #endif /* __NET_TC_MIR_H */
diff --git a/include/net/tc_act/tc_nat.h b/include/net/tc_act/tc_nat.h
index 4a691f34d703..63d8e9ca9d99 100644
--- a/include/net/tc_act/tc_nat.h
+++ b/include/net/tc_act/tc_nat.h
@@ -13,9 +13,9 @@ struct tcf_nat {
         u32 flags;
 };
 
-static inline struct tcf_nat *to_tcf_nat(struct tcf_common *pc)
+static inline struct tcf_nat *to_tcf_nat(struct tc_action *a)
 {
-        return container_of(pc, struct tcf_nat, common);
+        return container_of(a->priv, struct tcf_nat, common);
 }
 
 #endif /* __NET_TC_NAT_H */
diff --git a/include/net/tc_act/tc_pedit.h b/include/net/tc_act/tc_pedit.h
index e6f6e15956f5..5b80998879c7 100644
--- a/include/net/tc_act/tc_pedit.h
+++ b/include/net/tc_act/tc_pedit.h
@@ -9,7 +9,7 @@ struct tcf_pedit {
         unsigned char           tcfp_flags;
         struct tc_pedit_key     *tcfp_keys;
 };
-#define to_pedit(pc) \
-        container_of(pc, struct tcf_pedit, common)
+#define to_pedit(a) \
+        container_of(a->priv, struct tcf_pedit, common)
 
 #endif /* __NET_TC_PED_H */
diff --git a/include/net/tc_act/tc_skbedit.h b/include/net/tc_act/tc_skbedit.h
index dd5d86fab030..0df9a0db4a8e 100644
--- a/include/net/tc_act/tc_skbedit.h
+++ b/include/net/tc_act/tc_skbedit.h
@@ -29,7 +29,7 @@ struct tcf_skbedit {
         u16                     queue_mapping;
         /* XXX: 16-bit pad here? */
 };
-#define to_skbedit(pc) \
-        container_of(pc, struct tcf_skbedit, common)
+#define to_skbedit(a) \
+        container_of(a->priv, struct tcf_skbedit, common)
 
 #endif /* __NET_TC_SKBEDIT_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 743accec6c76..87d877408188 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -31,6 +31,7 @@
 #include <linux/crypto.h>
 #include <linux/cryptohash.h>
 #include <linux/kref.h>
+#include <linux/ktime.h>
 
 #include <net/inet_connection_sock.h>
 #include <net/inet_timewait_sock.h>
@@ -478,7 +479,6 @@ int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                              struct ip_options *opt);
 #ifdef CONFIG_SYN_COOKIES
-#include <linux/ktime.h>
 
 /* Syncookies use a monotonic timer which increments every 60 seconds.
  * This counter is used both as a hash input and partially encoded into
@@ -620,7 +620,7 @@ static inline void tcp_bound_rto(const struct sock *sk)
 
 static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
 {
-        return (tp->srtt >> 3) + tp->rttvar;
+        return usecs_to_jiffies((tp->srtt_us >> 3) + tp->rttvar_us);
 }
 
 static inline void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)
@@ -657,6 +657,11 @@ static inline u32 tcp_rto_min(struct sock *sk)
         return rto_min;
 }
 
+static inline u32 tcp_rto_min_us(struct sock *sk)
+{
+        return jiffies_to_usecs(tcp_rto_min(sk));
+}
+
 /* Compute the actual receive window we are currently advertising.
  * Rcv_nxt can be after the window if our peer push more data
  * than the offered window.
@@ -779,7 +784,6 @@ enum tcp_ca_event {
 #define TCP_CA_BUF_MAX  (TCP_CA_NAME_MAX*TCP_CA_MAX)
 
 #define TCP_CONG_NON_RESTRICTED 0x1
-#define TCP_CONG_RTT_STAMP      0x2
 
 struct tcp_congestion_ops {
         struct list_head        list;
@@ -792,8 +796,6 @@ struct tcp_congestion_ops {
 
         /* return slow start threshold (required) */
         u32 (*ssthresh)(struct sock *sk);
-        /* lower bound for congestion window (optional) */
-        u32 (*min_cwnd)(const struct sock *sk);
         /* do new cwnd calculation (required) */
         void (*cong_avoid)(struct sock *sk, u32 ack, u32 acked, u32 in_flight);
         /* call before changing ca_state (optional) */
@@ -828,7 +830,6 @@ void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w);
 extern struct tcp_congestion_ops tcp_init_congestion_ops;
 u32 tcp_reno_ssthresh(struct sock *sk);
 void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 acked, u32 in_flight);
-u32 tcp_reno_min_cwnd(const struct sock *sk);
 extern struct tcp_congestion_ops tcp_reno;
 
 static inline void tcp_set_ca_state(struct sock *sk, const u8 ca_state)
diff --git a/include/net/wpan-phy.h b/include/net/wpan-phy.h
index b52bda8d13b1..10ab0fc6d4f7 100644
--- a/include/net/wpan-phy.h
+++ b/include/net/wpan-phy.h
@@ -37,15 +37,22 @@ struct wpan_phy {
         struct mutex pib_lock;
 
         /*
-         * This is a PIB according to 802.15.4-2006.
+         * This is a PIB according to 802.15.4-2011.
          * We do not provide timing-related variables, as they
          * aren't used outside of driver
          */
         u8 current_channel;
         u8 current_page;
         u32 channels_supported[32];
-        u8 transmit_power;
+        s8 transmit_power;
         u8 cca_mode;
+        u8 min_be;
+        u8 max_be;
+        u8 csma_retries;
+        s8 frame_retries;
+
+        bool lbt;
+        s32 cca_ed_level;
 
         struct device dev;
         int idx;
@@ -54,6 +61,14 @@ struct wpan_phy {
                                         const char *name, int type);
         void (*del_iface)(struct wpan_phy *phy, struct net_device *dev);
 
+        int (*set_txpower)(struct wpan_phy *phy, int db);
+        int (*set_lbt)(struct wpan_phy *phy, bool on);
+        int (*set_cca_mode)(struct wpan_phy *phy, u8 cca_mode);
+        int (*set_cca_ed_level)(struct wpan_phy *phy, int level);
+        int (*set_csma_params)(struct wpan_phy *phy, u8 min_be, u8 max_be,
+                               u8 retries);
+        int (*set_frame_retries)(struct wpan_phy *phy, s8 retries);
+
         char priv[0] __attribute__((__aligned__(NETDEV_ALIGN)));
 };
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index fb5654a8ca3c..32682ae47b3f 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -118,11 +118,10 @@
 struct xfrm_state_walk {
         struct list_head        all;
         u8                      state;
-        union {
-                u8              dying;
-                u8              proto;
-        };
+        u8                      dying;
+        u8                      proto;
         u32                     seq;
+        struct xfrm_address_filter *filter;
 };
 
 /* Full description of state of transformer. */
@@ -350,6 +349,16 @@ int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
 void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
 
+struct xfrm_input_afinfo {
+        unsigned int            family;
+        struct module           *owner;
+        int                     (*callback)(struct sk_buff *skb, u8 protocol,
+                                            int err);
+};
+
+int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo);
+int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo);
+
 void xfrm_state_delete_tunnel(struct xfrm_state *x);
 
 struct xfrm_type {
@@ -594,21 +603,33 @@ struct xfrm_mgr {
                                            const struct xfrm_migrate *m,
                                            int num_bundles,
                                            const struct xfrm_kmaddress *k);
+        bool                    (*is_alive)(const struct km_event *c);
 };
 
 int xfrm_register_km(struct xfrm_mgr *km);
 int xfrm_unregister_km(struct xfrm_mgr *km);
 
+struct xfrm_tunnel_skb_cb {
+        union {
+                struct inet_skb_parm h4;
+                struct inet6_skb_parm h6;
+        } header;
+
+        union {
+                struct ip_tunnel *ip4;
+                struct ip6_tnl *ip6;
+        } tunnel;
+};
+
+#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
+
 /*
  * This structure is used for the duration where packets are being
  * transformed by IPsec.  As soon as the packet leaves IPsec the
  * area beyond the generic IP part may be overwritten.
  */
 struct xfrm_skb_cb {
-        union {
-                struct inet_skb_parm h4;
-                struct inet6_skb_parm h6;
-        } header;
+        struct xfrm_tunnel_skb_cb header;
 
         /* Sequence number for replay protection. */
         union {
@@ -630,10 +651,7 @@ struct xfrm_skb_cb {
  * to transmit header information to the mode input/output functions.
  */
 struct xfrm_mode_skb_cb {
-        union {
-                struct inet_skb_parm h4;
-                struct inet6_skb_parm h6;
-        } header;
+        struct xfrm_tunnel_skb_cb header;
 
         /* Copied from header for IPv4, always set to zero and DF for IPv6. */
         __be16 id;
@@ -665,10 +683,7 @@ struct xfrm_mode_skb_cb {
  * related information.
  */
 struct xfrm_spi_skb_cb {
-        union {
-                struct inet_skb_parm h4;
-                struct inet6_skb_parm h6;
-        } header;
+        struct xfrm_tunnel_skb_cb header;
 
         unsigned int daddroff;
         unsigned int family;
@@ -1347,18 +1362,34 @@ struct xfrm_algo_desc {
         struct sadb_alg desc;
 };
 
-/* XFRM tunnel handlers.  */
-struct xfrm_tunnel {
+/* XFRM protocol handlers.  */
+struct xfrm4_protocol {
         int (*handler)(struct sk_buff *skb);
+        int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
+                             int encap_type);
+        int (*cb_handler)(struct sk_buff *skb, int err);
         int (*err_handler)(struct sk_buff *skb, u32 info);
 
-        struct xfrm_tunnel __rcu *next;
+        struct xfrm4_protocol __rcu *next;
+        int priority;
+};
+
+struct xfrm6_protocol {
+        int (*handler)(struct sk_buff *skb);
+        int (*cb_handler)(struct sk_buff *skb, int err);
+        int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                           u8 type, u8 code, int offset, __be32 info);
+
+        struct xfrm6_protocol __rcu *next;
         int priority;
 };
 
-struct xfrm_tunnel_notifier {
+/* XFRM tunnel handlers.  */
+struct xfrm_tunnel {
         int (*handler)(struct sk_buff *skb);
-        struct xfrm_tunnel_notifier __rcu *next;
+        int (*err_handler)(struct sk_buff *skb, u32 info);
+
+        struct xfrm_tunnel __rcu *next;
         int priority;
 };
 
@@ -1375,11 +1406,14 @@ void xfrm4_init(void);
 int xfrm_state_init(struct net *net);
 void xfrm_state_fini(struct net *net);
 void xfrm4_state_init(void);
+void xfrm4_protocol_init(void);
 #ifdef CONFIG_XFRM
 int xfrm6_init(void);
 void xfrm6_fini(void);
 int xfrm6_state_init(void);
 void xfrm6_state_fini(void);
+int xfrm6_protocol_init(void);
+void xfrm6_protocol_fini(void);
 #else
 static inline int xfrm6_init(void)
 {
@@ -1405,7 +1439,8 @@ static inline void xfrm_sysctl_fini(struct net *net)
 }
 #endif
 
-void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
+void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
+                          struct xfrm_address_filter *filter);
 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
                     int (*func)(struct xfrm_state *, int, void*), void *);
 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
@@ -1497,20 +1532,22 @@ int xfrm4_rcv(struct sk_buff *skb);
 
 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
 {
-        return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
+        XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+        XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+        return xfrm_input(skb, nexthdr, spi, 0);
 }
 
 int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
 int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
 int xfrm4_output(struct sk_buff *skb);
 int xfrm4_output_finish(struct sk_buff *skb);
+int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
+int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
+int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
-int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler);
-int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler);
-int xfrm6_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler);
-int xfrm6_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler);
 int xfrm6_extract_header(struct sk_buff *skb);
 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
@@ -1519,6 +1556,9 @@ int xfrm6_rcv(struct sk_buff *skb);
 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                      xfrm_address_t *saddr, u8 proto);
 void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
+int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
+int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
+int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
 __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
@@ -1646,6 +1686,20 @@ static inline int xfrm_aevent_is_on(struct net *net)
         rcu_read_unlock();
         return ret;
 }
+
+static inline int xfrm_acquire_is_on(struct net *net)
+{
+        struct sock *nlsk;
+        int ret = 0;
+
+        rcu_read_lock();
+        nlsk = rcu_dereference(net->xfrm.nlsk);
+        if (nlsk)
+                ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
+        rcu_read_unlock();
+
+        return ret;
+}
 #endif
 
 static inline int aead_len(struct xfrm_algo_aead *alg)
@@ -1748,4 +1802,24 @@ static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
         return ret;
 }
 
+static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
+                                    unsigned int family)
+{
+        bool tunnel = false;
+
+        switch(family) {
+        case AF_INET:
+                if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
+                        tunnel = true;
+                break;
+        case AF_INET6:
+                if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
+                        tunnel = true;
+                break;
+        }
+        if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL))
+                return -EINVAL;
+
+        return 0;
+}
 #endif  /* _NET_XFRM_H */