75 files changed, 1198 insertions, 607 deletions
diff --git a/include/linux/can.h b/include/linux/can.h
index 9a19bcb3eeaf..1a66cf6112ae 100644
--- a/include/linux/can.h
+++ b/include/linux/can.h
@@ -21,7 +21,7 @@
 /* special address description flags for the CAN_ID */
 #define CAN_EFF_FLAG 0x80000000U /* EFF/SFF is set in the MSB */
 #define CAN_RTR_FLAG 0x40000000U /* remote transmission request */
-#define CAN_ERR_FLAG 0x20000000U /* error frame */
+#define CAN_ERR_FLAG 0x20000000U /* error message frame */
 /* valid bits in CAN ID for frame formats */
 #define CAN_SFF_MASK 0x000007FFU /* standard frame format (SFF) */
@@ -32,32 +32,81 @@
 * Controller Area Network Identifier structure
 *
 * bit 0-28     : CAN identifier (11/29 bit)
- * bit 29       : error frame flag (0 = data frame, 1 = error frame)
+ * bit 29       : error message frame flag (0 = data frame, 1 = error message)
 * bit 30       : remote transmission request flag (1 = rtr frame)
 * bit 31       : frame format flag (0 = standard 11 bit, 1 = extended 29 bit)
 */
 typedef __u32 canid_t;
 /*
- * Controller Area Network Error Frame Mask structure
+ * Controller Area Network Error Message Frame Mask structure
 *
 * bit 0-28     : error class mask (see include/linux/can/error.h)
 * bit 29-31    : set to zero
 */
 typedef __u32 can_err_mask_t;
+/* CAN payload length and DLC definitions according to ISO 11898-1 */
+#define CAN_MAX_DLC 8
+#define CAN_MAX_DLEN 8
+/* CAN FD payload length and DLC definitions according to ISO 11898-7 */
+#define CANFD_MAX_DLC 15
+#define CANFD_MAX_DLEN 64
 /**
 * struct can_frame - basic CAN frame structure
- * @can_id:  the CAN ID of the frame and CAN_*_FLAG flags, see above.
+ * @can_id:  CAN ID of the frame and CAN_*_FLAG flags, see canid_t definition
- * @can_dlc: the data length field of the CAN frame
+ * @can_dlc: frame payload length in byte (0 .. 8) aka data length code
- * @data:    the CAN frame payload.
+ *           N.B. the DLC field from ISO 11898-1 Chapter 8.4.2.3 has a 1:1
+ *           mapping of the 'data length code' to the real payload length
+ * @data:    CAN frame payload (up to 8 byte)
 */
 struct can_frame {
        canid_t can_id;  /* 32 bit CAN_ID + EFF/RTR/ERR flags */
-        __u8    can_dlc; /* data length code: 0 .. 8 */
+        __u8    can_dlc; /* frame payload length in byte (0 .. CAN_MAX_DLEN) */
-        __u8    data[8] __attribute__((aligned(8)));
+        __u8    data[CAN_MAX_DLEN] __attribute__((aligned(8)));
 };
+/*
+ * defined bits for canfd_frame.flags
+ *
+ * As the default for CAN FD should be to support the high data rate in the
+ * payload section of the frame (HDR) and to support up to 64 byte in the
+ * data section (EDL) the bits are only set in the non-default case.
+ * Btw. as long as there's no real implementation for CAN FD network driver
+ * these bits are only preliminary.
+ *
+ * RX: NOHDR/NOEDL - info about received CAN FD frame
+ *     ESI         - bit from originating CAN controller
+ * TX: NOHDR/NOEDL - control per-frame settings if supported by CAN controller
+ *     ESI         - bit is set by local CAN controller
+ */
+#define CANFD_NOHDR 0x01 /* frame without high data rate */
+#define CANFD_NOEDL 0x02 /* frame without extended data length */
+#define CANFD_ESI   0x04 /* error state indicator */
+/**
+ * struct canfd_frame - CAN flexible data rate frame structure
+ * @can_id: CAN ID of the frame and CAN_*_FLAG flags, see canid_t definition
+ * @len:    frame payload length in byte (0 .. CANFD_MAX_DLEN)
+ * @flags:  additional flags for CAN FD
+ * @__res0: reserved / padding
+ * @__res1: reserved / padding
+ * @data:   CAN FD frame payload (up to CANFD_MAX_DLEN byte)
+ */
+struct canfd_frame {
+        canid_t can_id;  /* 32 bit CAN_ID + EFF/RTR/ERR flags */
+        __u8    len;     /* frame payload length in byte */
+        __u8    flags;   /* additional flags for CAN FD */
+        __u8    __res0;  /* reserved / padding */
+        __u8    __res1;  /* reserved / padding */
+        __u8    data[CANFD_MAX_DLEN] __attribute__((aligned(8)));
+};
+#define CAN_MTU         (sizeof(struct can_frame))
+#define CANFD_MTU       (sizeof(struct canfd_frame))
 /* particular protocols of the protocol family PF_CAN */
 #define CAN_RAW         1 /* RAW sockets */
 #define CAN_BCM         2 /* Broadcast Manager */
@@ -97,7 +146,7 @@ struct sockaddr_can {
 *          <received_can_id> & mask == can_id & mask
 *
 * The filter can be inverted (CAN_INV_FILTER bit set in can_id) or it can
- * filter for error frames (CAN_ERR_FLAG bit set in mask).
+ * filter for error message frames (CAN_ERR_FLAG bit set in mask).
 */
 struct can_filter {
        canid_t can_id;
diff --git a/include/linux/can/core.h b/include/linux/can/core.h
index 0ccc1cd28b95..78c6c52073ad 100644
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -17,10 +17,10 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
-#define CAN_VERSION "20090105"
+#define CAN_VERSION "20120528"
 /* increment this number each time you change some user-space interface */
-#define CAN_ABI_VERSION "8"
+#define CAN_ABI_VERSION "9"
 #define CAN_VERSION_STRING "rev " CAN_VERSION " abi " CAN_ABI_VERSION
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index 5d2efe7e3f1b..ee5a771fb20d 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -61,23 +61,40 @@ struct can_priv {
 * To be used in the CAN netdriver receive path to ensure conformance with
 * ISO 11898-1 Chapter 8.4.2.3 (DLC field)
 */
-#define get_can_dlc(i)  (min_t(__u8, (i), 8))
+#define get_can_dlc(i)          (min_t(__u8, (i), CAN_MAX_DLC))
+#define get_canfd_dlc(i)        (min_t(__u8, (i), CANFD_MAX_DLC))
 /* Drop a given socketbuffer if it does not contain a valid CAN frame. */
 static inline int can_dropped_invalid_skb(struct net_device *dev,
                                          struct sk_buff *skb)
 {
-        const struct can_frame *cf = (struct can_frame *)skb->data;
+        const struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
-        if (unlikely(skb->len != sizeof(*cf) || cf->can_dlc > 8)) {
+        if (skb->protocol == htons(ETH_P_CAN)) {
-                kfree_skb(skb);
+                if (unlikely(skb->len != CAN_MTU ||
-                dev->stats.tx_dropped++;
+                             cfd->len > CAN_MAX_DLEN))
-                return 1;
+                        goto inval_skb;
-        }
+        } else if (skb->protocol == htons(ETH_P_CANFD)) {
+                if (unlikely(skb->len != CANFD_MTU ||
+                             cfd->len > CANFD_MAX_DLEN))
+                        goto inval_skb;
+        } else
+                goto inval_skb;
        return 0;
+inval_skb:
+        kfree_skb(skb);
+        dev->stats.tx_dropped++;
+        return 1;
 }
+/* get data length from can_dlc with sanitized can_dlc */
+u8 can_dlc2len(u8 can_dlc);
+/* map the sanitized data length to an appropriate data length code */
+u8 can_len2dlc(u8 len);
 struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max);
 void free_candev(struct net_device *dev);
diff --git a/include/linux/can/error.h b/include/linux/can/error.h
index 63e855ea6b84..7b7148bded71 100644
--- a/include/linux/can/error.h
+++ b/include/linux/can/error.h
@@ -1,7 +1,7 @@
 /*
 * linux/can/error.h
 *
- * Definitions of the CAN error frame to be filtered and passed to the user.
+ * Definitions of the CAN error messages to be filtered and passed to the user.
 *
 * Author: Oliver Hartkopp <oliver.hartkopp@volkswagen.de>
 * Copyright (c) 2002-2007 Volkswagen Group Electronic Research
@@ -12,7 +12,7 @@
 #ifndef CAN_ERROR_H
 #define CAN_ERROR_H
-#define CAN_ERR_DLC 8 /* dlc for error frames */
+#define CAN_ERR_DLC 8 /* dlc for error message frames */
 /* error class (mask) in can_id */
 #define CAN_ERR_TX_TIMEOUT   0x00000001U /* TX timeout (by netdevice driver) */
diff --git a/include/linux/can/raw.h b/include/linux/can/raw.h
index 781f3a3701be..a814062b0719 100644
--- a/include/linux/can/raw.h
+++ b/include/linux/can/raw.h
@@ -23,7 +23,8 @@ enum {
        CAN_RAW_FILTER = 1,     /* set 0 .. n can_filter(s)          */
        CAN_RAW_ERR_FILTER,     /* set filter for error frames       */
        CAN_RAW_LOOPBACK,       /* local loopback (default:on)       */
-        CAN_RAW_RECV_OWN_MSGS   /* receive my own msgs (default:off) */
+        CAN_RAW_RECV_OWN_MSGS,  /* receive my own msgs (default:off) */
+        CAN_RAW_FD_FRAMES,      /* allow CAN FD frames (default:off) */
 };
 #endif
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index e17fa7140588..21eff418091b 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -137,6 +137,35 @@ struct ethtool_eeprom {
 };
 /**
+ * struct ethtool_eee - Energy Efficient Ethernet information
+ * @cmd: ETHTOOL_{G,S}EEE
+ * @supported: Mask of %SUPPORTED_* flags for the speed/duplex combinations
+ *      for which there is EEE support.
+ * @advertised: Mask of %ADVERTISED_* flags for the speed/duplex combinations
+ *      advertised as eee capable.
+ * @lp_advertised: Mask of %ADVERTISED_* flags for the speed/duplex
+ *      combinations advertised by the link partner as eee capable.
+ * @eee_active: Result of the eee auto negotiation.
+ * @eee_enabled: EEE configured mode (enabled/disabled).
+ * @tx_lpi_enabled: Whether the interface should assert its tx lpi, given
+ *      that eee was negotiated.
+ * @tx_lpi_timer: Time in microseconds the interface delays prior to asserting
+ *      its tx lpi (after reaching 'idle' state). Effective only when eee
+ *      was negotiated and tx_lpi_enabled was set.
+ */
+struct ethtool_eee {
+        __u32   cmd;
+        __u32   supported;
+        __u32   advertised;
+        __u32   lp_advertised;
+        __u32   eee_active;
+        __u32   eee_enabled;
+        __u32   tx_lpi_enabled;
+        __u32   tx_lpi_timer;
+        __u32   reserved[2];
+};
+/**
 * struct ethtool_modinfo - plugin module eeprom information
 * @cmd: %ETHTOOL_GMODULEINFO
 * @type: Standard the module information conforms to %ETH_MODULE_SFF_xxxx
@@ -945,6 +974,8 @@ static inline u32 ethtool_rxfh_indir_default(u32 index, u32 n_rx_rings)
 * @get_module_info: Get the size and type of the eeprom contained within
 *      a plug-in module.
 * @get_module_eeprom: Get the eeprom information from the plug-in module
+ * @get_eee: Get Energy-Efficient (EEE) supported and status.
+ * @set_eee: Set EEE status (enable/disable) as well as LPI timers.
 *
 * All operations are optional (i.e. the function pointer may be set
 * to %NULL) and callers must take this into account.  Callers must
@@ -1011,6 +1042,8 @@ struct ethtool_ops {
                                   struct ethtool_modinfo *);
        int     (*get_module_eeprom)(struct net_device *,
                                     struct ethtool_eeprom *, u8 *);
+        int     (*get_eee)(struct net_device *, struct ethtool_eee *);
+        int     (*set_eee)(struct net_device *, struct ethtool_eee *);
 };
@@ -1089,6 +1122,8 @@ struct ethtool_ops {
 #define ETHTOOL_GET_TS_INFO     0x00000041 /* Get time stamping and PHC info */
 #define ETHTOOL_GMODULEINFO     0x00000042 /* Get plug-in module information */
 #define ETHTOOL_GMODULEEEPROM   0x00000043 /* Get plug-in module eeprom */
+#define ETHTOOL_GEEE            0x00000044 /* Get EEE settings */
+#define ETHTOOL_SEEE            0x00000045 /* Set EEE settings */
 /* compatibility with older code */
 #define SPARC_ETH_GSET          ETHTOOL_GSET
@@ -1118,6 +1153,10 @@ struct ethtool_ops {
 #define SUPPORTED_10000baseR_FEC        (1 << 20)
 #define SUPPORTED_20000baseMLD2_Full    (1 << 21)
 #define SUPPORTED_20000baseKR2_Full     (1 << 22)
+#define SUPPORTED_40000baseKR4_Full     (1 << 23)
+#define SUPPORTED_40000baseCR4_Full     (1 << 24)
+#define SUPPORTED_40000baseSR4_Full     (1 << 25)
+#define SUPPORTED_40000baseLR4_Full     (1 << 26)
 /* Indicates what features are advertised by the interface. */
 #define ADVERTISED_10baseT_Half         (1 << 0)
@@ -1143,6 +1182,10 @@ struct ethtool_ops {
 #define ADVERTISED_10000baseR_FEC       (1 << 20)
 #define ADVERTISED_20000baseMLD2_Full   (1 << 21)
 #define ADVERTISED_20000baseKR2_Full    (1 << 22)
+#define ADVERTISED_40000baseKR4_Full    (1 << 23)
+#define ADVERTISED_40000baseCR4_Full    (1 << 24)
+#define ADVERTISED_40000baseSR4_Full    (1 << 25)
+#define ADVERTISED_40000baseLR4_Full    (1 << 26)
 /* The following are all involved in forcing a particular link
 * mode for the device for setting things.  When getting the
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index 56d907a2c804..167ce5b363d2 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -105,7 +105,8 @@
 #define ETH_P_WAN_PPP   0x0007          /* Dummy type for WAN PPP frames*/
 #define ETH_P_PPP_MP    0x0008          /* Dummy type for PPP MP frames */
 #define ETH_P_LOCALTALK 0x0009          /* Localtalk pseudo type        */
-#define ETH_P_CAN       0x000C          /* Controller Area Network      */
+#define ETH_P_CAN       0x000C          /* CAN: Controller Area Network */
+#define ETH_P_CANFD     0x000D          /* CANFD: CAN flexible data rate*/
 #define ETH_P_PPPTALK   0x0010          /* Dummy type for Atalk over PPP*/
 #define ETH_P_TR_802_2  0x0011          /* 802.2 frames                 */
 #define ETH_P_MOBITEX   0x0015          /* Mobitex (kaz@cafe.net)       */
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 8185f57a9c7f..99efd60fa8c9 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -60,9 +60,11 @@ struct team_port {
                unsigned int mtu;
        } orig;
-        struct rcu_head rcu;
+        long mode_priv[0];
 };
+extern bool team_port_enabled(struct team_port *port);
 struct team_mode_ops {
        int (*init)(struct team *team);
        void (*exit)(struct team *team);
@@ -73,6 +75,8 @@ struct team_mode_ops {
        int (*port_enter)(struct team *team, struct team_port *port);
        void (*port_leave)(struct team *team, struct team_port *port);
        void (*port_change_mac)(struct team *team, struct team_port *port);
+        void (*port_enabled)(struct team *team, struct team_port *port);
+        void (*port_disabled)(struct team *team, struct team_port *port);
 };
 enum team_option_type {
@@ -82,6 +86,11 @@ enum team_option_type {
        TEAM_OPTION_TYPE_BOOL,
 };
+struct team_option_inst_info {
+        u32 array_index;
+        struct team_port *port; /* != NULL if per-port */
+};
 struct team_gsetter_ctx {
        union {
                u32 u32_val;
@@ -92,23 +101,28 @@ struct team_gsetter_ctx {
                } bin_val;
                bool bool_val;
        } data;
-        struct team_port *port;
+        struct team_option_inst_info *info;
 };
 struct team_option {
        struct list_head list;
        const char *name;
        bool per_port;
+        unsigned int array_size; /* != 0 means the option is array */
        enum team_option_type type;
+        int (*init)(struct team *team, struct team_option_inst_info *info);
        int (*getter)(struct team *team, struct team_gsetter_ctx *ctx);
        int (*setter)(struct team *team, struct team_gsetter_ctx *ctx);
 };
+extern void team_option_inst_set_change(struct team_option_inst_info *opt_inst_info);
+extern void team_options_change_check(struct team *team);
 struct team_mode {
-        struct list_head list;
        const char *kind;
        struct module *owner;
        size_t priv_size;
+        size_t port_priv_size;
        const struct team_mode_ops *ops;
 };
@@ -178,8 +192,8 @@ extern int team_options_register(struct team *team,
 extern void team_options_unregister(struct team *team,
                                    const struct team_option *option,
                                    size_t option_count);
-extern int team_mode_register(struct team_mode *mode);
+extern int team_mode_register(const struct team_mode *mode);
-extern int team_mode_unregister(struct team_mode *mode);
+extern void team_mode_unregister(const struct team_mode *mode);
 #endif /* __KERNEL__ */
@@ -241,6 +255,7 @@ enum {
        TEAM_ATTR_OPTION_DATA,          /* dynamic */
        TEAM_ATTR_OPTION_REMOVED,       /* flag */
        TEAM_ATTR_OPTION_PORT_IFINDEX,  /* u32 */ /* for per-port options */
+        TEAM_ATTR_OPTION_ARRAY_INDEX,   /* u32 */ /* for array options */
        __TEAM_ATTR_OPTION_MAX,
        TEAM_ATTR_OPTION_MAX = __TEAM_ATTR_OPTION_MAX - 1,
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 597f4a9f3240..67f9ddacb70c 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -38,6 +38,7 @@ enum
        IPV4_DEVCONF_ACCEPT_LOCAL,
        IPV4_DEVCONF_SRC_VMARK,
        IPV4_DEVCONF_PROXY_ARP_PVLAN,
+        IPV4_DEVCONF_ROUTE_LOCALNET,
        __IPV4_DEVCONF_MAX
 };
@@ -131,6 +132,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 #define IN_DEV_PROMOTE_SECONDARIES(in_dev) \
                                        IN_DEV_ORCONF((in_dev), \
                                                      PROMOTE_SECONDARIES)
+#define IN_DEV_ROUTE_LOCALNET(in_dev)   IN_DEV_ORCONF(in_dev, ROUTE_LOCALNET)
 #define IN_DEV_RX_REDIRECTS(in_dev) \
        ((IN_DEV_FORWARD(in_dev) && \
diff --git a/include/linux/ks8851_mll.h b/include/linux/ks8851_mll.h
new file mode 100644
index 000000000000..e9ccfb59ed30
--- /dev/null
+++ b/include/linux/ks8851_mll.h
@@ -0,0 +1,33 @@
+/*
+ * ks8861_mll platform data struct definition
+ * Copyright (c) 2012 BTicino S.p.A.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#ifndef _LINUX_KS8851_MLL_H
+#define _LINUX_KS8851_MLL_H
+#include <linux/if_ether.h>
+/**
+ * struct ks8851_mll_platform_data - Platform data of the KS8851_MLL network driver
+ * @macaddr:    The MAC address of the device, set to all 0:s to use the on in
+ *              the chip.
+ */
+struct ks8851_mll_platform_data {
+        u8 mac_addr[ETH_ALEN];
+};
+#endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d94cb1431519..2c2ecea28a1b 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1046,10 +1046,9 @@ struct net_device {
         */
        char                    name[IFNAMSIZ];
-        struct pm_qos_request   pm_qos_req;
+        /* device name hash chain, please keep it close to name[] */
-        /* device name hash chain */
        struct hlist_node       name_hlist;
        /* snmp alias */
        char                    *ifalias;
@@ -1322,6 +1321,8 @@ struct net_device {
        /* group the device belongs to */
        int group;
+        struct pm_qos_request   pm_qos_req;
 };
 #define to_net_dev(d) container_of(d, struct net_device, dev)
@@ -1626,6 +1627,7 @@ extern int		dev_alloc_name(struct net_device *dev, const char *name);
 extern int              dev_open(struct net_device *dev);
 extern int              dev_close(struct net_device *dev);
 extern void             dev_disable_lro(struct net_device *dev);
+extern int              dev_loopback_xmit(struct sk_buff *newskb);
 extern int              dev_queue_xmit(struct sk_buff *skb);
 extern int              register_netdevice(struct net_device *dev);
 extern void             unregister_netdevice_queue(struct net_device *dev,
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index ff9c84c29b28..c613cf0d7884 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -94,6 +94,16 @@ static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
               a1->all[3] == a2->all[3];
 }
+static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
+                                     union nf_inet_addr *result,
+                                     const union nf_inet_addr *mask)
+{
+        result->all[0] = a1->all[0] & mask->all[0];
+        result->all[1] = a1->all[1] & mask->all[1];
+        result->all[2] = a1->all[2] & mask->all[2];
+        result->all[3] = a1->all[3] & mask->all[3];
+}
 extern void netfilter_init(void);
 /* Largest hook number + 1 */
@@ -383,6 +393,22 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
 extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *) __rcu;
 extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
 extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;
+struct nf_conn;
+struct nlattr;
+struct nfq_ct_hook {
+        size_t (*build_size)(const struct nf_conn *ct);
+        int (*build)(struct sk_buff *skb, struct nf_conn *ct);
+        int (*parse)(const struct nlattr *attr, struct nf_conn *ct);
+};
+extern struct nfq_ct_hook __rcu *nfq_ct_hook;
+struct nfq_ct_nat_hook {
+        void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
+                           u32 ctinfo, int off);
+};
+extern struct nfq_ct_nat_hook __rcu *nfq_ct_nat_hook;
 #else
 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
 #endif
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index 1697036336b6..874ae8f2706b 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -10,6 +10,7 @@ header-y += nfnetlink.h
 header-y += nfnetlink_acct.h
 header-y += nfnetlink_compat.h
 header-y += nfnetlink_conntrack.h
+header-y += nfnetlink_cthelper.h
 header-y += nfnetlink_cttimeout.h
 header-y += nfnetlink_log.h
 header-y += nfnetlink_queue.h
diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h
index 0ce91d56a5f2..0dfc8b7210a3 100644
--- a/include/linux/netfilter/nf_conntrack_sip.h
+++ b/include/linux/netfilter/nf_conntrack_sip.h
@@ -2,6 +2,8 @@
 #define __NF_CONNTRACK_SIP_H__
 #ifdef __KERNEL__
+#include <net/netfilter/nf_conntrack_expect.h>
 #define SIP_PORT        5060
 #define SIP_TIMEOUT     3600
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index a1048c1587d1..18341cdb2443 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -50,7 +50,8 @@ struct nfgenmsg {
 #define NFNL_SUBSYS_IPSET               6
 #define NFNL_SUBSYS_ACCT                7
 #define NFNL_SUBSYS_CTNETLINK_TIMEOUT   8
-#define NFNL_SUBSYS_COUNT               9
+#define NFNL_SUBSYS_CTHELPER            9
+#define NFNL_SUBSYS_COUNT               10
 #ifdef __KERNEL__
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h
index e58e4b93c108..768883370080 100644
--- a/include/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/linux/netfilter/nfnetlink_conntrack.h
@@ -191,6 +191,7 @@ enum ctattr_expect_nat {
 enum ctattr_help {
        CTA_HELP_UNSPEC,
        CTA_HELP_NAME,
+        CTA_HELP_INFO,
        __CTA_HELP_MAX
 };
 #define CTA_HELP_MAX (__CTA_HELP_MAX - 1)
diff --git a/include/linux/netfilter/nfnetlink_cthelper.h b/include/linux/netfilter/nfnetlink_cthelper.h
new file mode 100644
index 000000000000..33659f6fad3e
--- /dev/null
+++ b/include/linux/netfilter/nfnetlink_cthelper.h
@@ -0,0 +1,55 @@
+#ifndef _NFNL_CTHELPER_H_
+#define _NFNL_CTHELPER_H_
+#define NFCT_HELPER_STATUS_DISABLED     0
+#define NFCT_HELPER_STATUS_ENABLED      1
+enum nfnl_acct_msg_types {
+        NFNL_MSG_CTHELPER_NEW,
+        NFNL_MSG_CTHELPER_GET,
+        NFNL_MSG_CTHELPER_DEL,
+        NFNL_MSG_CTHELPER_MAX
+};
+enum nfnl_cthelper_type {
+        NFCTH_UNSPEC,
+        NFCTH_NAME,
+        NFCTH_TUPLE,
+        NFCTH_QUEUE_NUM,
+        NFCTH_POLICY,
+        NFCTH_PRIV_DATA_LEN,
+        NFCTH_STATUS,
+        __NFCTH_MAX
+};
+#define NFCTH_MAX (__NFCTH_MAX - 1)
+enum nfnl_cthelper_policy_type {
+        NFCTH_POLICY_SET_UNSPEC,
+        NFCTH_POLICY_SET_NUM,
+        NFCTH_POLICY_SET,
+        NFCTH_POLICY_SET1       = NFCTH_POLICY_SET,
+        NFCTH_POLICY_SET2,
+        NFCTH_POLICY_SET3,
+        NFCTH_POLICY_SET4,
+        __NFCTH_POLICY_SET_MAX
+};
+#define NFCTH_POLICY_SET_MAX (__NFCTH_POLICY_SET_MAX - 1)
+enum nfnl_cthelper_pol_type {
+        NFCTH_POLICY_UNSPEC,
+        NFCTH_POLICY_NAME,
+        NFCTH_POLICY_EXPECT_MAX,
+        NFCTH_POLICY_EXPECT_TIMEOUT,
+        __NFCTH_POLICY_MAX
+};
+#define NFCTH_POLICY_MAX (__NFCTH_POLICY_MAX - 1)
+enum nfnl_cthelper_tuple_type {
+        NFCTH_TUPLE_UNSPEC,
+        NFCTH_TUPLE_L3PROTONUM,
+        NFCTH_TUPLE_L4PROTONUM,
+        __NFCTH_TUPLE_MAX,
+};
+#define NFCTH_TUPLE_MAX (__NFCTH_TUPLE_MAX - 1)
+#endif /* _NFNL_CTHELPER_H */
diff --git a/include/linux/netfilter/nfnetlink_queue.h b/include/linux/netfilter/nfnetlink_queue.h
index 24b32e6c009e..e0d8fd8d4d24 100644
--- a/include/linux/netfilter/nfnetlink_queue.h
+++ b/include/linux/netfilter/nfnetlink_queue.h
@@ -42,6 +42,8 @@ enum nfqnl_attr_type {
        NFQA_IFINDEX_PHYSOUTDEV,        /* __u32 ifindex */
        NFQA_HWADDR,                    /* nfqnl_msg_packet_hw */
        NFQA_PAYLOAD,                   /* opaque data payload */
+        NFQA_CT,                        /* nf_conntrack_netlink.h */
+        NFQA_CT_INFO,                   /* enum ip_conntrack_info */
        __NFQA_MAX
 };
@@ -84,8 +86,14 @@ enum nfqnl_attr_config {
        NFQA_CFG_CMD,                   /* nfqnl_msg_config_cmd */
        NFQA_CFG_PARAMS,                /* nfqnl_msg_config_params */
        NFQA_CFG_QUEUE_MAXLEN,          /* __u32 */
+        NFQA_CFG_MASK,                  /* identify which flags to change */
+        NFQA_CFG_FLAGS,                 /* value of these flags (__u32) */
        __NFQA_CFG_MAX
 };
 #define NFQA_CFG_MAX (__NFQA_CFG_MAX-1)
+/* Flags for NFQA_CFG_FLAGS */
+#define NFQA_CFG_F_FAIL_OPEN                    (1 << 0)
+#define NFQA_CFG_F_CONNTRACK                    (1 << 1)
 #endif /* _NFNETLINK_QUEUE_H */
diff --git a/include/linux/netfilter/xt_connlimit.h b/include/linux/netfilter/xt_connlimit.h
index d1366f05d1b2..f1656096121e 100644
--- a/include/linux/netfilter/xt_connlimit.h
+++ b/include/linux/netfilter/xt_connlimit.h
@@ -22,13 +22,8 @@ struct xt_connlimit_info {
 #endif
        };
        unsigned int limit;
-        union {
+        /* revision 1 */
-                /* revision 0 */
+        __u32 flags;
-                unsigned int inverse;
-                /* revision 1 */
-                __u32 flags;
-        };
        /* Used internally by the kernel */
        struct xt_connlimit_data *data __attribute__((aligned(8)));
diff --git a/include/linux/netfilter/xt_recent.h b/include/linux/netfilter/xt_recent.h
index 83318e01425e..6ef36c113e89 100644
--- a/include/linux/netfilter/xt_recent.h
+++ b/include/linux/netfilter/xt_recent.h
@@ -32,4 +32,14 @@ struct xt_recent_mtinfo {
        __u8 side;
 };
+struct xt_recent_mtinfo_v1 {
+        __u32 seconds;
+        __u32 hit_count;
+        __u8 check_set;
+        __u8 invert;
+        char name[XT_RECENT_NAME_LEN];
+        __u8 side;
+        union nf_inet_addr mask;
+};
 #endif /* _LINUX_NETFILTER_XT_RECENT_H */
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index fa0946c549d3..e2b12801378d 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -66,6 +66,7 @@ enum nf_ip_hook_priorities {
        NF_IP_PRI_SECURITY = 50,
        NF_IP_PRI_NAT_SRC = 100,
        NF_IP_PRI_SELINUX_LAST = 225,
+        NF_IP_PRI_CONNTRACK_HELPER = 300,
        NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,
        NF_IP_PRI_LAST = INT_MAX,
 };
diff --git a/include/linux/netfilter_ipv4/Kbuild b/include/linux/netfilter_ipv4/Kbuild
index c61b8fb1a9ef..8ba0c5b72ea9 100644
--- a/include/linux/netfilter_ipv4/Kbuild
+++ b/include/linux/netfilter_ipv4/Kbuild
@@ -5,7 +5,6 @@ header-y += ipt_LOG.h
 header-y += ipt_REJECT.h
 header-y += ipt_TTL.h
 header-y += ipt_ULOG.h
-header-y += ipt_addrtype.h
 header-y += ipt_ah.h
 header-y += ipt_ecn.h
 header-y += ipt_ttl.h
diff --git a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h
deleted file mode 100644
index 0da42237c8da..000000000000
--- a/include/linux/netfilter_ipv4/ipt_addrtype.h
+++ /dev/null
@@ -1,27 +0,0 @@
-#ifndef _IPT_ADDRTYPE_H
-#define _IPT_ADDRTYPE_H
-#include <linux/types.h>
-enum {
-        IPT_ADDRTYPE_INVERT_SOURCE      = 0x0001,
-        IPT_ADDRTYPE_INVERT_DEST        = 0x0002,
-        IPT_ADDRTYPE_LIMIT_IFACE_IN     = 0x0004,
-        IPT_ADDRTYPE_LIMIT_IFACE_OUT    = 0x0008,
-};
-struct ipt_addrtype_info_v1 {
-        __u16   source;         /* source-type mask */
-        __u16   dest;           /* dest-type mask */
-        __u32   flags;
-};
-/* revision 0 */
-struct ipt_addrtype_info {
-        __u16   source;         /* source-type mask */
-        __u16   dest;           /* dest-type mask */
-        __u32   invert_source;
-        __u32   invert_dest;
-};
-#endif
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index 57c025127f1d..7c8a513ce7a3 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -71,6 +71,7 @@ enum nf_ip6_hook_priorities {
        NF_IP6_PRI_SECURITY = 50,
        NF_IP6_PRI_NAT_SRC = 100,
        NF_IP6_PRI_SELINUX_LAST = 225,
+        NF_IP6_PRI_CONNTRACK_HELPER = 300,
        NF_IP6_PRI_LAST = INT_MAX,
 };
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 0f628ffa420c..ed33f0901bc2 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -241,14 +241,6 @@ struct netlink_notify {
 struct nlmsghdr *
 __nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len, int flags);
-#define NLMSG_NEW(skb, pid, seq, type, len, flags) \
-({      if (unlikely(skb_tailroom(skb) < (int)NLMSG_SPACE(len))) \
-                goto nlmsg_failure; \
-        __nlmsg_put(skb, pid, seq, type, len, flags); })
-#define NLMSG_PUT(skb, pid, seq, type, len) \
-        NLMSG_NEW(skb, pid, seq, type, len, 0)
 struct netlink_dump_control {
        int (*dump)(struct sk_buff *skb, struct netlink_callback *);
        int (*done)(struct netlink_callback*);
diff --git a/include/linux/nfc.h b/include/linux/nfc.h
index 0ae9b5857c83..f4e6dd915b1c 100644
--- a/include/linux/nfc.h
+++ b/include/linux/nfc.h
@@ -56,6 +56,10 @@
 *      %NFC_ATTR_PROTOCOLS)
 * @NFC_EVENT_DEVICE_REMOVED: event emitted when a device is removed
 *      (it sends %NFC_ATTR_DEVICE_INDEX)
+ * @NFC_EVENT_TM_ACTIVATED: event emitted when the adapter is activated in
+ *      target mode.
+ * @NFC_EVENT_DEVICE_DEACTIVATED: event emitted when the adapter is deactivated
+ *      from target mode.
 */
 enum nfc_commands {
        NFC_CMD_UNSPEC,
@@ -71,6 +75,8 @@ enum nfc_commands {
        NFC_EVENT_DEVICE_ADDED,
        NFC_EVENT_DEVICE_REMOVED,
        NFC_EVENT_TARGET_LOST,
+        NFC_EVENT_TM_ACTIVATED,
+        NFC_EVENT_TM_DEACTIVATED,
 /* private: internal use only */
        __NFC_CMD_AFTER_LAST
 };
@@ -94,6 +100,8 @@ enum nfc_commands {
 * @NFC_ATTR_TARGET_SENSF_RES: NFC-F targets extra information, max 18 bytes
 * @NFC_ATTR_COMM_MODE: Passive or active mode
 * @NFC_ATTR_RF_MODE: Initiator or target
+ * @NFC_ATTR_IM_PROTOCOLS: Initiator mode protocols to poll for
+ * @NFC_ATTR_TM_PROTOCOLS: Target mode protocols to listen for
 */
 enum nfc_attrs {
        NFC_ATTR_UNSPEC,
@@ -109,6 +117,8 @@ enum nfc_attrs {
        NFC_ATTR_COMM_MODE,
        NFC_ATTR_RF_MODE,
        NFC_ATTR_DEVICE_POWERED,
+        NFC_ATTR_IM_PROTOCOLS,
+        NFC_ATTR_TM_PROTOCOLS,
 /* private: internal use only */
        __NFC_ATTR_AFTER_LAST
 };
@@ -118,6 +128,7 @@ enum nfc_attrs {
 #define NFC_NFCID1_MAXSIZE 10
 #define NFC_SENSB_RES_MAXSIZE 12
 #define NFC_SENSF_RES_MAXSIZE 18
+#define NFC_GB_MAXSIZE        48
 /* NFC protocols */
 #define NFC_PROTO_JEWEL         1
@@ -135,6 +146,7 @@ enum nfc_attrs {
 /* NFC RF modes */
 #define NFC_RF_INITIATOR 0
 #define NFC_RF_TARGET    1
+#define NFC_RF_NONE      2
 /* NFC protocols masks used in bitsets */
 #define NFC_PROTO_JEWEL_MASK    (1 << NFC_PROTO_JEWEL)
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index a6959f72745e..970afdf5a605 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -170,6 +170,8 @@
 *      %NL80211_ATTR_CIPHER_GROUP, %NL80211_ATTR_WPA_VERSIONS,
 *      %NL80211_ATTR_AKM_SUITES, %NL80211_ATTR_PRIVACY,
 *      %NL80211_ATTR_AUTH_TYPE and %NL80211_ATTR_INACTIVITY_TIMEOUT.
+ *      The channel to use can be set on the interface or be given using the
+ *      %NL80211_ATTR_WIPHY_FREQ and %NL80211_ATTR_WIPHY_CHANNEL_TYPE attrs.
 * @NL80211_CMD_NEW_BEACON: old alias for %NL80211_CMD_START_AP
 * @NL80211_CMD_STOP_AP: Stop AP operation on the given interface
 * @NL80211_CMD_DEL_BEACON: old alias for %NL80211_CMD_STOP_AP
@@ -1520,6 +1522,8 @@ enum nl80211_attrs {
 #define NL80211_MAX_NR_CIPHER_SUITES            5
 #define NL80211_MAX_NR_AKM_SUITES               2
+#define NL80211_MIN_REMAIN_ON_CHANNEL_TIME      10
 /**
 * enum nl80211_iftype - (virtual) interface types
 *
@@ -2534,10 +2538,14 @@ enum nl80211_attr_cqm {
 *      configured threshold
 * @NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH: The RSSI is higher than the
 *      configured threshold
+ * @NL80211_CQM_RSSI_BEACON_LOSS_EVENT: The device experienced beacon loss.
+ *      (Note that deauth/disassoc will still follow if the AP is not
+ *      available. This event might get used as roaming event, etc.)
 */
 enum nl80211_cqm_rssi_threshold_event {
        NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
        NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
+        NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
 };
diff --git a/include/linux/nl802154.h b/include/linux/nl802154.h
index 5a3db3aa5f17..fd4f2d1cdf6c 100644
--- a/include/linux/nl802154.h
+++ b/include/linux/nl802154.h
@@ -130,18 +130,8 @@ enum {
 enum {
        __IEEE802154_DEV_INVALID = -1,
-         /* TODO:
+        IEEE802154_DEV_WPAN,
-         * Nowadays three device types supported by this stack at linux-zigbee
+        IEEE802154_DEV_MONITOR,
-         * project: WPAN = 0, MONITOR = 1 and SMAC = 2.
-         *
-         * Since this stack implementation exists many years, it's definitely
-         * bad idea to change the assigned values due to they are already used
-         * by third-party userspace software like: iz-tools, wireshark...
-         *
-         * Currently only monitor device is added and initialized by '1' for
-         * compatibility.
-         */
-        IEEE802154_DEV_MONITOR = 1,
        __IEEE802154_DEV_MAX,
 };
diff --git a/include/linux/phy.h b/include/linux/phy.h
index c291cae8ce32..7eac80a2557b 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -243,6 +243,15 @@ enum phy_state {
        PHY_RESUMING
 };
+/**
+ * struct phy_c45_device_ids - 802.3-c45 Device Identifiers
+ * @devices_in_package: Bit vector of devices present.
+ * @device_ids: The device identifer for each present device.
+ */
+struct phy_c45_device_ids {
+        u32 devices_in_package;
+        u32 device_ids[8];
+};
 /* phy_device: An instance of a PHY
 *
@@ -250,6 +259,8 @@ enum phy_state {
 * bus: Pointer to the bus this PHY is on
 * dev: driver model device structure for this PHY
 * phy_id: UID for this device found during discovery
+ * c45_ids: 802.3-c45 Device Identifers if is_c45.
+ * is_c45:  Set to true if this phy uses clause 45 addressing.
 * state: state of the PHY for management purposes
 * dev_flags: Device-specific flags used by the PHY driver.
 * addr: Bus address of PHY
@@ -285,6 +296,9 @@ struct phy_device {
        u32 phy_id;
+        struct phy_c45_device_ids c45_ids;
+        bool is_c45;
        enum phy_state state;
        u32 dev_flags;
@@ -412,6 +426,12 @@ struct phy_driver {
        /* Clears up any memory if needed */
        void (*remove)(struct phy_device *phydev);
+        /* Returns true if this is a suitable driver for the given
+         * phydev.  If NULL, matching is based on phy_id and
+         * phy_id_mask.
+         */
+        int (*match_phy_device)(struct phy_device *phydev);
        /* Handles ethtool queries for hardware time stamping. */
        int (*ts_info)(struct phy_device *phydev, struct ethtool_ts_info *ti);
@@ -480,7 +500,9 @@ static inline int phy_write(struct phy_device *phydev, u32 regnum, u16 val)
        return mdiobus_write(phydev->bus, phydev->addr, regnum, val);
 }
-struct phy_device* get_phy_device(struct mii_bus *bus, int addr);
+struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
+                bool is_c45, struct phy_c45_device_ids *c45_ids);
+struct phy_device *get_phy_device(struct mii_bus *bus, int addr, bool is_c45);
 int phy_device_register(struct phy_device *phy);
 int phy_init_hw(struct phy_device *phydev);
 struct phy_device * phy_attach(struct net_device *dev,
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 2c1de8982c85..ea60b0854109 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -612,12 +612,6 @@ struct tcamsg {
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
-static __inline__ int rtattr_strcmp(const struct rtattr *rta, const char *str)
-{
-        int len = strlen(str) + 1;
-        return len > rta->rta_len || memcmp(RTA_DATA(rta), str, len);
-}
 extern int rtnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, u32 group, int echo);
 extern int rtnl_unicast(struct sk_buff *skb, struct net *net, u32 pid);
 extern void rtnl_notify(struct sk_buff *skb, struct net *net, u32 pid,
@@ -628,122 +622,6 @@ extern int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst,
                              u32 id, u32 ts, u32 tsage, long expires,
                              u32 error);
-extern void __rta_fill(struct sk_buff *skb, int attrtype, int attrlen, const void *data);
-#define RTA_PUT(skb, attrtype, attrlen, data) \
-({      if (unlikely(skb_tailroom(skb) < (int)RTA_SPACE(attrlen))) \
-                 goto rtattr_failure; \
-        __rta_fill(skb, attrtype, attrlen, data); }) 
-#define RTA_APPEND(skb, attrlen, data) \
-({      if (unlikely(skb_tailroom(skb) < (int)(attrlen))) \
-                goto rtattr_failure; \
-        memcpy(skb_put(skb, attrlen), data, attrlen); })
-#define RTA_PUT_NOHDR(skb, attrlen, data) \
-({      RTA_APPEND(skb, RTA_ALIGN(attrlen), data); \
-        memset(skb_tail_pointer(skb) - (RTA_ALIGN(attrlen) - attrlen), 0, \
-               RTA_ALIGN(attrlen) - attrlen); })
-#define RTA_PUT_U8(skb, attrtype, value) \
-({      u8 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u8), &_tmp); })
-#define RTA_PUT_U16(skb, attrtype, value) \
-({      u16 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u16), &_tmp); })
-#define RTA_PUT_U32(skb, attrtype, value) \
-({      u32 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u32), &_tmp); })
-#define RTA_PUT_U64(skb, attrtype, value) \
-({      u64 _tmp = (value); \
-        RTA_PUT(skb, attrtype, sizeof(u64), &_tmp); })
-#define RTA_PUT_SECS(skb, attrtype, value) \
-        RTA_PUT_U64(skb, attrtype, (value) / HZ)
-#define RTA_PUT_MSECS(skb, attrtype, value) \
-        RTA_PUT_U64(skb, attrtype, jiffies_to_msecs(value))
-#define RTA_PUT_STRING(skb, attrtype, value) \
-        RTA_PUT(skb, attrtype, strlen(value) + 1, value)
-#define RTA_PUT_FLAG(skb, attrtype) \
-        RTA_PUT(skb, attrtype, 0, NULL);
-#define RTA_NEST(skb, type) \
-({      struct rtattr *__start = (struct rtattr *)skb_tail_pointer(skb); \
-        RTA_PUT(skb, type, 0, NULL); \
-        __start;  })
-#define RTA_NEST_END(skb, start) \
-({      (start)->rta_len = skb_tail_pointer(skb) - (unsigned char *)(start); \
-        (skb)->len; })
-#define RTA_NEST_COMPAT(skb, type, attrlen, data) \
-({      struct rtattr *__start = (struct rtattr *)skb_tail_pointer(skb); \
-        RTA_PUT(skb, type, attrlen, data); \
-        RTA_NEST(skb, type); \
-        __start; })
-#define RTA_NEST_COMPAT_END(skb, start) \
-({      struct rtattr *__nest = (void *)(start) + NLMSG_ALIGN((start)->rta_len); \
-        (start)->rta_len = skb_tail_pointer(skb) - (unsigned char *)(start); \
-        RTA_NEST_END(skb, __nest); \
-        (skb)->len; })
-#define RTA_NEST_CANCEL(skb, start) \
-({      if (start) \
-                skb_trim(skb, (unsigned char *) (start) - (skb)->data); \
-        -1; })
-#define RTA_GET_U8(rta) \
-({      if (!rta || RTA_PAYLOAD(rta) < sizeof(u8)) \
-                goto rtattr_failure; \
-        *(u8 *) RTA_DATA(rta); })
-#define RTA_GET_U16(rta) \
-({      if (!rta || RTA_PAYLOAD(rta) < sizeof(u16)) \
-                goto rtattr_failure; \
-        *(u16 *) RTA_DATA(rta); })
-#define RTA_GET_U32(rta) \
-({      if (!rta || RTA_PAYLOAD(rta) < sizeof(u32)) \
-                goto rtattr_failure; \
-        *(u32 *) RTA_DATA(rta); })
-#define RTA_GET_U64(rta) \
-({      u64 _tmp; \
-        if (!rta || RTA_PAYLOAD(rta) < sizeof(u64)) \
-                goto rtattr_failure; \
-        memcpy(&_tmp, RTA_DATA(rta), sizeof(_tmp)); \
-        _tmp; })
-#define RTA_GET_FLAG(rta) (!!(rta))
-#define RTA_GET_SECS(rta) ((unsigned long) RTA_GET_U64(rta) * HZ)
-#define RTA_GET_MSECS(rta) (msecs_to_jiffies((unsigned long) RTA_GET_U64(rta)))
-                
-static inline struct rtattr *
-__rta_reserve(struct sk_buff *skb, int attrtype, int attrlen)
-{
-        struct rtattr *rta;
-        int size = RTA_LENGTH(attrlen);
-        rta = (struct rtattr*)skb_put(skb, RTA_ALIGN(size));
-        rta->rta_type = attrtype;
-        rta->rta_len = size;
-        memset(RTA_DATA(rta) + attrlen, 0, RTA_ALIGN(size) - size);
-        return rta;
-}
-#define __RTA_PUT(skb, attrtype, attrlen) \
-({      if (unlikely(skb_tailroom(skb) < (int)RTA_SPACE(attrlen))) \
-                goto rtattr_failure; \
-        __rta_reserve(skb, attrtype, attrlen); })
 extern void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change);
 /* RTNL is used as a global lock for all changes to network configuration  */
@@ -794,13 +672,6 @@ extern void __rtnl_unlock(void);
        } \
 } while(0)
-static inline u32 rtm_get_table(struct rtattr **rta, u8 table)
-{
-        return RTA_GET_U32(rta[RTA_TABLE-1]);
-rtattr_failure:
-        return table;
-}
 extern int ndo_dflt_fdb_dump(struct sk_buff *skb,
                             struct netlink_callback *cb,
                             struct net_device *dev,
diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
index db4bae78bda9..6793fac5eab5 100644
--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -18,6 +18,7 @@ enum {
        SK_MEMINFO_FWD_ALLOC,
        SK_MEMINFO_WMEM_QUEUED,
        SK_MEMINFO_OPTMEM,
+        SK_MEMINFO_BACKLOG,
        SK_MEMINFO_VARS,
 };
diff --git a/include/linux/spi/at86rf230.h b/include/linux/spi/at86rf230.h
new file mode 100644
index 000000000000..b2b1afbb3202
--- /dev/null
+++ b/include/linux/spi/at86rf230.h
@@ -0,0 +1,31 @@
+/*
+ * AT86RF230/RF231 driver
+ *
+ * Copyright (C) 2009-2012 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dmitry.baryshkov@siemens.com>
+ */
+#ifndef AT86RF230_H
+#define AT86RF230_H
+struct at86rf230_platform_data {
+        int rstn;
+        int slp_tr;
+        int dig2;
+};
+#endif
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index bc14bd738ade..bb674c02f306 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -243,6 +243,7 @@ struct ssb_bus_ops {
 #define SSB_DEV_MINI_MACPHY     0x823
 #define SSB_DEV_ARM_1176        0x824
 #define SSB_DEV_ARM_7TDMI       0x825
+#define SSB_DEV_ARM_CM3         0x82A
 /* Vendor-ID values */
 #define SSB_VENDOR_BROADCOM     0x4243
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 5f359dbfcdce..7d3bcedc062a 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -506,8 +506,9 @@ struct tcp_timewait_sock {
        u32                       tw_rcv_wnd;
        u32                       tw_ts_recent;
        long                      tw_ts_recent_stamp;
+        struct inet_peer          *tw_peer;
 #ifdef CONFIG_TCP_MD5SIG
-        struct tcp_md5sig_key   *tw_md5_key;
+        struct tcp_md5sig_key     *tw_md5_key;
 #endif
        /* Few sockets in timewait have cookies; in that case, then this
         * object holds a reference to them (tw_cookie_values->kref).
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 76f439647c4b..f87cf622317f 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -66,9 +66,8 @@ struct usbnet {
 #               define EVENT_STS_SPLIT  3
 #               define EVENT_LINK_RESET 4
 #               define EVENT_RX_PAUSED  5
-#               define EVENT_DEV_WAKING 6
+#               define EVENT_DEV_ASLEEP 6
-#               define EVENT_DEV_ASLEEP 7
+#               define EVENT_DEV_OPEN   7
-#               define EVENT_DEV_OPEN   8
 };
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 2ee33da36a7a..b5f8988e4283 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -14,10 +14,11 @@ extern struct sock *unix_get_socket(struct file *filp);
 extern struct sock *unix_peer_get(struct sock *);
 #define UNIX_HASH_SIZE  256
+#define UNIX_HASH_BITS  8
 extern unsigned int unix_tot_inflight;
 extern spinlock_t unix_table_lock;
-extern struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1];
+extern struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
 struct unix_address {
        atomic_t        refcnt;
diff --git a/include/net/bluetooth/a2mp.h b/include/net/bluetooth/a2mp.h
new file mode 100644
index 000000000000..6a76e0a0705e
--- /dev/null
+++ b/include/net/bluetooth/a2mp.h
@@ -0,0 +1,126 @@
+/*
+   Copyright (c) 2010,2011 Code Aurora Forum.  All rights reserved.
+   Copyright (c) 2011,2012 Intel Corp.
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 and
+   only version 2 as published by the Free Software Foundation.
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+*/
+#ifndef __A2MP_H
+#define __A2MP_H
+#include <net/bluetooth/l2cap.h>
+#define A2MP_FEAT_EXT   0x8000
+struct amp_mgr {
+        struct l2cap_conn       *l2cap_conn;
+        struct l2cap_chan       *a2mp_chan;
+        struct kref             kref;
+        __u8                    ident;
+        __u8                    handle;
+        unsigned long           flags;
+};
+struct a2mp_cmd {
+        __u8    code;
+        __u8    ident;
+        __le16  len;
+        __u8    data[0];
+} __packed;
+/* A2MP command codes */
+#define A2MP_COMMAND_REJ         0x01
+struct a2mp_cmd_rej {
+        __le16  reason;
+        __u8    data[0];
+} __packed;
+#define A2MP_DISCOVER_REQ        0x02
+struct a2mp_discov_req {
+        __le16  mtu;
+        __le16  ext_feat;
+} __packed;
+struct a2mp_cl {
+        __u8    id;
+        __u8    type;
+        __u8    status;
+} __packed;
+#define A2MP_DISCOVER_RSP        0x03
+struct a2mp_discov_rsp {
+        __le16     mtu;
+        __le16     ext_feat;
+        struct a2mp_cl cl[0];
+} __packed;
+#define A2MP_CHANGE_NOTIFY       0x04
+#define A2MP_CHANGE_RSP          0x05
+#define A2MP_GETINFO_REQ         0x06
+struct a2mp_info_req {
+        __u8       id;
+} __packed;
+#define A2MP_GETINFO_RSP         0x07
+struct a2mp_info_rsp {
+        __u8    id;
+        __u8    status;
+        __le32  total_bw;
+        __le32  max_bw;
+        __le32  min_latency;
+        __le16  pal_cap;
+        __le16  assoc_size;
+} __packed;
+#define A2MP_GETAMPASSOC_REQ     0x08
+struct a2mp_amp_assoc_req {
+        __u8    id;
+} __packed;
+#define A2MP_GETAMPASSOC_RSP     0x09
+struct a2mp_amp_assoc_rsp {
+        __u8    id;
+        __u8    status;
+        __u8    amp_assoc[0];
+} __packed;
+#define A2MP_CREATEPHYSLINK_REQ  0x0A
+#define A2MP_DISCONNPHYSLINK_REQ 0x0C
+struct a2mp_physlink_req {
+        __u8    local_id;
+        __u8    remote_id;
+        __u8    amp_assoc[0];
+} __packed;
+#define A2MP_CREATEPHYSLINK_RSP  0x0B
+#define A2MP_DISCONNPHYSLINK_RSP 0x0D
+struct a2mp_physlink_rsp {
+        __u8    local_id;
+        __u8    remote_id;
+        __u8    status;
+} __packed;
+/* A2MP response status */
+#define A2MP_STATUS_SUCCESS                     0x00
+#define A2MP_STATUS_INVALID_CTRL_ID             0x01
+#define A2MP_STATUS_UNABLE_START_LINK_CREATION  0x02
+#define A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS     0x02
+#define A2MP_STATUS_COLLISION_OCCURED           0x03
+#define A2MP_STATUS_DISCONN_REQ_RECVD           0x04
+#define A2MP_STATUS_PHYS_LINK_EXISTS            0x05
+#define A2MP_STATUS_SECURITY_VIOLATION          0x06
+void amp_mgr_get(struct amp_mgr *mgr);
+int amp_mgr_put(struct amp_mgr *mgr);
+struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
+                                       struct sk_buff *skb);
+#endif /* __A2MP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 961669b648fd..565d4bee1e49 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -1,4 +1,4 @@
-/* 
+/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated
@@ -12,22 +12,19 @@
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
 */
 #ifndef __BLUETOOTH_H
 #define __BLUETOOTH_H
-#include <asm/types.h>
-#include <asm/byteorder.h>
-#include <linux/list.h>
 #include <linux/poll.h>
 #include <net/sock.h>
@@ -168,8 +165,8 @@ typedef struct {
 #define BDADDR_LE_PUBLIC        0x01
 #define BDADDR_LE_RANDOM        0x02
-#define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0}})
+#define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0} })
-#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff}})
+#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff} })
 /* Copy, swap, convert BD Address */
 static inline int bacmp(bdaddr_t *ba1, bdaddr_t *ba2)
@@ -215,7 +212,7 @@ int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                                struct msghdr *msg, size_t len, int flags);
 int  bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                        struct msghdr *msg, size_t len, int flags);
-uint bt_sock_poll(struct file * file, struct socket *sock, poll_table *wait);
+uint bt_sock_poll(struct file *file, struct socket *sock, poll_table *wait);
 int  bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int  bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo);
@@ -225,12 +222,12 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
 /* Skb helpers */
 struct l2cap_ctrl {
-        unsigned int    sframe  : 1,
+        unsigned int    sframe:1,
-                        poll    : 1,
+                        poll:1,
-                        final   : 1,
+                        final:1,
-                        fcs     : 1,
+                        fcs:1,
-                        sar     : 2,
+                        sar:2,
-                        super   : 2;
+                        super:2;
        __u16           reqseq;
        __u16           txseq;
        __u8            retries;
@@ -249,7 +246,8 @@ static inline struct sk_buff *bt_skb_alloc(unsigned int len, gfp_t how)
 {
        struct sk_buff *skb;
-        if ((skb = alloc_skb(len + BT_SKB_RESERVE, how))) {
+        skb = alloc_skb(len + BT_SKB_RESERVE, how);
+        if (skb) {
                skb_reserve(skb, BT_SKB_RESERVE);
                bt_cb(skb)->incoming  = 0;
        }
@@ -261,7 +259,8 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk,
 {
        struct sk_buff *skb;
-        if ((skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err))) {
+        skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err);
+        if (skb) {
                skb_reserve(skb, BT_SKB_RESERVE);
                bt_cb(skb)->incoming  = 0;
        }
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 3def64ba77fa..2a6b0b8b7120 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -30,6 +30,9 @@
 #define HCI_MAX_EVENT_SIZE      260
 #define HCI_MAX_FRAME_SIZE      (HCI_MAX_ACL_SIZE + 4)
+#define HCI_LINK_KEY_SIZE       16
+#define HCI_AMP_LINK_KEY_SIZE   (2 * HCI_LINK_KEY_SIZE)
 /* HCI dev events */
 #define HCI_DEV_REG                     1
 #define HCI_DEV_UNREG                   2
@@ -56,9 +59,12 @@
 #define HCI_BREDR       0x00
 #define HCI_AMP         0x01
+/* First BR/EDR Controller shall have ID = 0 */
+#define HCI_BREDR_ID    0
 /* HCI device quirks */
 enum {
-        HCI_QUIRK_NO_RESET,
+        HCI_QUIRK_RESET_ON_CLOSE,
        HCI_QUIRK_RAW_DEVICE,
        HCI_QUIRK_FIXUP_BUFFER_SIZE
 };
@@ -133,10 +139,8 @@ enum {
 #define HCIINQUIRY      _IOR('H', 240, int)
 /* HCI timeouts */
-#define HCI_CONNECT_TIMEOUT     (40000) /* 40 seconds */
 #define HCI_DISCONN_TIMEOUT     (2000)  /* 2 seconds */
 #define HCI_PAIRING_TIMEOUT     (60000) /* 60 seconds */
-#define HCI_IDLE_TIMEOUT        (6000)  /* 6 seconds */
 #define HCI_INIT_TIMEOUT        (10000) /* 10 seconds */
 #define HCI_CMD_TIMEOUT         (1000)  /* 1 seconds */
 #define HCI_ACL_TX_TIMEOUT      (45000) /* 45 seconds */
@@ -371,7 +375,7 @@ struct hci_cp_reject_conn_req {
 #define HCI_OP_LINK_KEY_REPLY           0x040b
 struct hci_cp_link_key_reply {
        bdaddr_t bdaddr;
-        __u8     link_key[16];
+        __u8     link_key[HCI_LINK_KEY_SIZE];
 } __packed;
 #define HCI_OP_LINK_KEY_NEG_REPLY       0x040c
@@ -523,6 +527,28 @@ struct hci_cp_io_capability_neg_reply {
        __u8     reason;
 } __packed;
+#define HCI_OP_CREATE_PHY_LINK          0x0435
+struct hci_cp_create_phy_link {
+        __u8     phy_handle;
+        __u8     key_len;
+        __u8     key_type;
+        __u8     key[HCI_AMP_LINK_KEY_SIZE];
+} __packed;
+#define HCI_OP_ACCEPT_PHY_LINK          0x0436
+struct hci_cp_accept_phy_link {
+        __u8     phy_handle;
+        __u8     key_len;
+        __u8     key_type;
+        __u8     key[HCI_AMP_LINK_KEY_SIZE];
+} __packed;
+#define HCI_OP_DISCONN_PHY_LINK 0x0437
+struct hci_cp_disconn_phy_link {
+        __u8     phy_handle;
+        __u8     reason;
+} __packed;
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
        __le16   handle;
@@ -818,6 +844,31 @@ struct hci_rp_read_local_amp_info {
        __le32   be_flush_to;
 } __packed;
+#define HCI_OP_READ_LOCAL_AMP_ASSOC     0x140a
+struct hci_cp_read_local_amp_assoc {
+        __u8     phy_handle;
+        __le16   len_so_far;
+        __le16   max_len;
+} __packed;
+struct hci_rp_read_local_amp_assoc {
+        __u8     status;
+        __u8     phy_handle;
+        __le16   rem_len;
+        __u8     frag[0];
+} __packed;
+#define HCI_OP_WRITE_REMOTE_AMP_ASSOC   0x140b
+struct hci_cp_write_remote_amp_assoc {
+        __u8     phy_handle;
+        __le16   len_so_far;
+        __le16   rem_len;
+        __u8     frag[0];
+} __packed;
+struct hci_rp_write_remote_amp_assoc {
+        __u8     status;
+        __u8     phy_handle;
+} __packed;
 #define HCI_OP_LE_SET_EVENT_MASK        0x2001
 struct hci_cp_le_set_event_mask {
        __u8     mask[8];
@@ -1048,7 +1099,7 @@ struct hci_ev_link_key_req {
 #define HCI_EV_LINK_KEY_NOTIFY          0x18
 struct hci_ev_link_key_notify {
        bdaddr_t bdaddr;
-        __u8     link_key[16];
+        __u8     link_key[HCI_LINK_KEY_SIZE];
        __u8     key_type;
 } __packed;
@@ -1196,6 +1247,39 @@ struct hci_ev_le_meta {
        __u8     subevent;
 } __packed;
+#define HCI_EV_PHY_LINK_COMPLETE        0x40
+struct hci_ev_phy_link_complete {
+        __u8     status;
+        __u8     phy_handle;
+} __packed;
+#define HCI_EV_CHANNEL_SELECTED         0x41
+struct hci_ev_channel_selected {
+        __u8     phy_handle;
+} __packed;
+#define HCI_EV_DISCONN_PHY_LINK_COMPLETE        0x42
+struct hci_ev_disconn_phy_link_complete {
+        __u8     status;
+        __u8     phy_handle;
+        __u8     reason;
+} __packed;
+#define HCI_EV_LOGICAL_LINK_COMPLETE            0x45
+struct hci_ev_logical_link_complete {
+        __u8     status;
+        __le16   handle;
+        __u8     phy_handle;
+        __u8     flow_spec_id;
+} __packed;
+#define HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE    0x46
+struct hci_ev_disconn_logical_link_complete {
+        __u8     status;
+        __le16   handle;
+        __u8     reason;
+} __packed;
 #define HCI_EV_NUM_COMP_BLOCKS          0x48
 struct hci_comp_blocks_info {
        __le16   handle;
@@ -1296,7 +1380,6 @@ struct hci_sco_hdr {
        __u8    dlen;
 } __packed;
-#include <linux/skbuff.h>
 static inline struct hci_event_hdr *hci_event_hdr(const struct sk_buff *skb)
 {
        return (struct hci_event_hdr *) skb->data;
@@ -1313,12 +1396,12 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
 }
 /* Command opcode pack/unpack */
-#define hci_opcode_pack(ogf, ocf)       (__u16) ((ocf & 0x03ff)|(ogf << 10))
+#define hci_opcode_pack(ogf, ocf)       ((__u16) ((ocf & 0x03ff)|(ogf << 10)))
 #define hci_opcode_ogf(op)              (op >> 10)
 #define hci_opcode_ocf(op)              (op & 0x03ff)
 /* ACL handle and flags pack/unpack */
-#define hci_handle_pack(h, f)   (__u16) ((h & 0x0fff)|(f << 12))
+#define hci_handle_pack(h, f)   ((__u16) ((h & 0x0fff)|(f << 12)))
 #define hci_handle(h)           (h & 0x0fff)
 #define hci_flags(h)            (h >> 12)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9fc7728f94e4..20fd57367ddc 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -25,7 +25,6 @@
 #ifndef __HCI_CORE_H
 #define __HCI_CORE_H
-#include <linux/interrupt.h>
 #include <net/bluetooth/hci.h>
 /* HCI priority */
@@ -65,7 +64,7 @@ struct discovery_state {
                DISCOVERY_RESOLVING,
                DISCOVERY_STOPPING,
        } state;
-        struct list_head        all;            /* All devices found during inquiry */
+        struct list_head        all;    /* All devices found during inquiry */
        struct list_head        unknown;        /* Name state not known */
        struct list_head        resolve;        /* Name needs to be resolved */
        __u32                   timestamp;
@@ -105,7 +104,7 @@ struct link_key {
        struct list_head list;
        bdaddr_t bdaddr;
        u8 type;
-        u8 val[16];
+        u8 val[HCI_LINK_KEY_SIZE];
        u8 pin_len;
 };
@@ -333,6 +332,7 @@ struct hci_conn {
        void            *l2cap_data;
        void            *sco_data;
        void            *smp_conn;
+        struct amp_mgr  *amp_mgr;
        struct hci_conn *link;
@@ -360,7 +360,8 @@ extern int l2cap_connect_cfm(struct hci_conn *hcon, u8 status);
 extern int l2cap_disconn_ind(struct hci_conn *hcon);
 extern int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason);
 extern int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt);
-extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags);
+extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb,
+                              u16 flags);
 extern int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
 extern int sco_connect_cfm(struct hci_conn *hcon, __u8 status);
@@ -429,8 +430,8 @@ enum {
 static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
 {
        struct hci_dev *hdev = conn->hdev;
-        return (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
+        return test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
-                                test_bit(HCI_CONN_SSP_ENABLED, &conn->flags));
+               test_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 }
 static inline void hci_conn_hash_init(struct hci_dev *hdev)
@@ -640,6 +641,19 @@ static inline void hci_set_drvdata(struct hci_dev *hdev, void *data)
        dev_set_drvdata(&hdev->dev, data);
 }
+/* hci_dev_list shall be locked */
+static inline uint8_t __hci_num_ctrl(void)
+{
+        uint8_t count = 0;
+        struct list_head *p;
+        list_for_each(p, &hci_dev_list) {
+                count++;
+        }
+        return count;
+}
 struct hci_dev *hci_dev_get(int index);
 struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
@@ -661,7 +675,8 @@ int hci_get_conn_info(struct hci_dev *hdev, void __user *arg);
 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg);
 int hci_inquiry(void __user *arg);
-struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
+struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
+                                         bdaddr_t *bdaddr);
 int hci_blacklist_clear(struct hci_dev *hdev);
 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 1c7d1cd5e679..d80e3f0691b4 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -40,11 +40,11 @@
 #define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
 #define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
 #define L2CAP_DEFAULT_ACK_TO            200
-#define L2CAP_LE_DEFAULT_MTU            23
 #define L2CAP_DEFAULT_MAX_SDU_SIZE      0xFFFF
 #define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
 #define L2CAP_DEFAULT_ACC_LAT           0xFFFFFFFF
 #define L2CAP_BREDR_MAX_PAYLOAD         1019    /* 3-DH5 packet */
+#define L2CAP_LE_MIN_MTU                23
 #define L2CAP_DISC_TIMEOUT              msecs_to_jiffies(100)
 #define L2CAP_DISC_REJ_TIMEOUT          msecs_to_jiffies(5000)
@@ -52,6 +52,8 @@
 #define L2CAP_CONN_TIMEOUT              msecs_to_jiffies(40000)
 #define L2CAP_INFO_TIMEOUT              msecs_to_jiffies(4000)
+#define L2CAP_A2MP_DEFAULT_MTU          670
 /* L2CAP socket address */
 struct sockaddr_l2 {
        sa_family_t     l2_family;
@@ -229,9 +231,14 @@ struct l2cap_conn_rsp {
        __le16     status;
 } __packed;
+/* protocol/service multiplexer (PSM) */
+#define L2CAP_PSM_SDP           0x0001
+#define L2CAP_PSM_RFCOMM        0x0003
 /* channel indentifier */
 #define L2CAP_CID_SIGNALING     0x0001
 #define L2CAP_CID_CONN_LESS     0x0002
+#define L2CAP_CID_A2MP          0x0003
 #define L2CAP_CID_LE_DATA       0x0004
 #define L2CAP_CID_LE_SIGNALING  0x0005
 #define L2CAP_CID_SMP           0x0006
@@ -271,6 +278,9 @@ struct l2cap_conf_rsp {
 #define L2CAP_CONF_PENDING      0x0004
 #define L2CAP_CONF_EFS_REJECT   0x0005
+/* configuration req/rsp continuation flag */
+#define L2CAP_CONF_FLAG_CONTINUATION    0x0001
 struct l2cap_conf_opt {
        __u8       type;
        __u8       len;
@@ -419,11 +429,6 @@ struct l2cap_seq_list {
 #define L2CAP_SEQ_LIST_CLEAR    0xFFFF
 #define L2CAP_SEQ_LIST_TAIL     0x8000
-struct srej_list {
-        __u16   tx_seq;
-        struct list_head list;
-};
 struct l2cap_chan {
        struct sock *sk;
@@ -475,14 +480,12 @@ struct l2cap_chan {
        __u16           expected_ack_seq;
        __u16           expected_tx_seq;
        __u16           buffer_seq;
-        __u16           buffer_seq_srej;
        __u16           srej_save_reqseq;
        __u16           last_acked_seq;
        __u16           frames_sent;
        __u16           unacked_frames;
        __u8            retry_count;
        __u16           srej_queue_next;
-        __u8            num_acked;
        __u16           sdu_len;
        struct sk_buff  *sdu;
        struct sk_buff  *sdu_last_frag;
@@ -515,7 +518,6 @@ struct l2cap_chan {
        struct sk_buff_head     srej_q;
        struct l2cap_seq_list   srej_list;
        struct l2cap_seq_list   retrans_list;
-        struct list_head        srej_l;
        struct list_head        list;
        struct list_head        global_l;
@@ -528,10 +530,14 @@ struct l2cap_chan {
 struct l2cap_ops {
        char                    *name;
-        struct l2cap_chan       *(*new_connection) (void *data);
+        struct l2cap_chan       *(*new_connection) (struct l2cap_chan *chan);
-        int                     (*recv) (void *data, struct sk_buff *skb);
+        int                     (*recv) (struct l2cap_chan * chan,
-        void                    (*close) (void *data);
+                                         struct sk_buff *skb);
-        void                    (*state_change) (void *data, int state);
+        void                    (*teardown) (struct l2cap_chan *chan, int err);
+        void                    (*close) (struct l2cap_chan *chan);
+        void                    (*state_change) (struct l2cap_chan *chan,
+                                                 int state);
+        void                    (*ready) (struct l2cap_chan *chan);
        struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
                                               unsigned long len, int nb);
 };
@@ -575,6 +581,7 @@ struct l2cap_conn {
 #define L2CAP_CHAN_RAW                  1
 #define L2CAP_CHAN_CONN_LESS            2
 #define L2CAP_CHAN_CONN_ORIENTED        3
+#define L2CAP_CHAN_CONN_FIX_A2MP        4
 /* ----- L2CAP socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
@@ -597,6 +604,7 @@ enum {
        CONF_EWS_RECV,
        CONF_LOC_CONF_PEND,
        CONF_REM_CONF_PEND,
+        CONF_NOT_COMPLETE,
 };
 #define L2CAP_CONF_MAX_CONF_REQ 2
@@ -713,11 +721,7 @@ static inline bool l2cap_clear_timer(struct l2cap_chan *chan,
 #define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
 #define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
-#define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
-                msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
 #define __clear_retrans_timer(c) l2cap_clear_timer(c, &c->retrans_timer)
-#define __set_monitor_timer(c) l2cap_set_timer(c, &c->monitor_timer, \
-                msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
 #define __clear_monitor_timer(c) l2cap_clear_timer(c, &c->monitor_timer)
 #define __set_ack_timer(c) l2cap_set_timer(c, &chan->ack_timer, \
                msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
@@ -736,173 +740,17 @@ static inline __u16 __next_seq(struct l2cap_chan *chan, __u16 seq)
        return (seq + 1) % (chan->tx_win_max + 1);
 }
-static inline int l2cap_tx_window_full(struct l2cap_chan *ch)
+static inline struct l2cap_chan *l2cap_chan_no_new_connection(struct l2cap_chan *chan)
-{
-        int sub;
-        sub = (ch->next_tx_seq - ch->expected_ack_seq) % 64;
-        if (sub < 0)
-                sub += 64;
-        return sub == ch->remote_tx_win;
-}
-static inline __u16 __get_reqseq(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_REQSEQ) >>
-                                                L2CAP_EXT_CTRL_REQSEQ_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
-}
-static inline __u32 __set_reqseq(struct l2cap_chan *chan, __u32 reqseq)
 {
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+        return NULL;
-                return (reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT) &
-                                                        L2CAP_EXT_CTRL_REQSEQ;
-        else
-                return (reqseq << L2CAP_CTRL_REQSEQ_SHIFT) & L2CAP_CTRL_REQSEQ;
 }
-static inline __u16 __get_txseq(struct l2cap_chan *chan, __u32 ctrl)
+static inline void l2cap_chan_no_teardown(struct l2cap_chan *chan, int err)
 {
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_TXSEQ) >>
-                                                L2CAP_EXT_CTRL_TXSEQ_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
 }
-static inline __u32 __set_txseq(struct l2cap_chan *chan, __u32 txseq)
+static inline void l2cap_chan_no_ready(struct l2cap_chan *chan)
 {
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT) &
-                                                        L2CAP_EXT_CTRL_TXSEQ;
-        else
-                return (txseq << L2CAP_CTRL_TXSEQ_SHIFT) & L2CAP_CTRL_TXSEQ;
-}
-static inline bool __is_sframe(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_FRAME_TYPE;
-        else
-                return ctrl & L2CAP_CTRL_FRAME_TYPE;
-}
-static inline __u32 __set_sframe(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_FRAME_TYPE;
-        else
-                return L2CAP_CTRL_FRAME_TYPE;
-}
-static inline __u8 __get_ctrl_sar(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
-}
-static inline __u32 __set_ctrl_sar(struct l2cap_chan *chan, __u32 sar)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (sar << L2CAP_EXT_CTRL_SAR_SHIFT) & L2CAP_EXT_CTRL_SAR;
-        else
-                return (sar << L2CAP_CTRL_SAR_SHIFT) & L2CAP_CTRL_SAR;
-}
-static inline bool __is_sar_start(struct l2cap_chan *chan, __u32 ctrl)
-{
-        return __get_ctrl_sar(chan, ctrl) == L2CAP_SAR_START;
-}
-static inline __u32 __get_sar_mask(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_SAR;
-        else
-                return L2CAP_CTRL_SAR;
-}
-static inline __u8 __get_ctrl_super(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_SUPERVISE) >>
-                                                L2CAP_EXT_CTRL_SUPER_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
-}
-static inline __u32 __set_ctrl_super(struct l2cap_chan *chan, __u32 super)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (super << L2CAP_EXT_CTRL_SUPER_SHIFT) &
-                                                L2CAP_EXT_CTRL_SUPERVISE;
-        else
-                return (super << L2CAP_CTRL_SUPER_SHIFT) &
-                                                        L2CAP_CTRL_SUPERVISE;
-}
-static inline __u32 __set_ctrl_final(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_FINAL;
-        else
-                return L2CAP_CTRL_FINAL;
-}
-static inline bool __is_ctrl_final(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_FINAL;
-        else
-                return ctrl & L2CAP_CTRL_FINAL;
-}
-static inline __u32 __set_ctrl_poll(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_POLL;
-        else
-                return L2CAP_CTRL_POLL;
-}
-static inline bool __is_ctrl_poll(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_POLL;
-        else
-                return ctrl & L2CAP_CTRL_POLL;
-}
-static inline __u32 __get_control(struct l2cap_chan *chan, void *p)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return get_unaligned_le32(p);
-        else
-                return get_unaligned_le16(p);
-}
-static inline void __put_control(struct l2cap_chan *chan, __u32 control,
-                                                                void *p)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return put_unaligned_le32(control, p);
-        else
-                return put_unaligned_le16(control, p);
-}
-static inline __u8 __ctrl_size(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_HDR_SIZE - L2CAP_HDR_SIZE;
-        else
-                return L2CAP_ENH_HDR_SIZE - L2CAP_HDR_SIZE;
 }
 extern bool disable_ertm;
@@ -926,5 +774,8 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
 void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
 int l2cap_chan_check_security(struct l2cap_chan *chan);
 void l2cap_chan_set_defaults(struct l2cap_chan *chan);
+int l2cap_ertm_init(struct l2cap_chan *chan);
+void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
+void l2cap_chan_del(struct l2cap_chan *chan, int err);
 #endif /* __L2CAP_H */
diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
index 439dadc8102f..bcb9cc3ce98b 100644
--- a/include/net/caif/caif_hsi.h
+++ b/include/net/caif/caif_hsi.h
@@ -93,25 +93,25 @@ struct cfhsi_desc {
 #endif
 /* Structure implemented by the CAIF HSI driver. */
-struct cfhsi_drv {
+struct cfhsi_cb_ops {
-        void (*tx_done_cb) (struct cfhsi_drv *drv);
+        void (*tx_done_cb) (struct cfhsi_cb_ops *drv);
-        void (*rx_done_cb) (struct cfhsi_drv *drv);
+        void (*rx_done_cb) (struct cfhsi_cb_ops *drv);
-        void (*wake_up_cb) (struct cfhsi_drv *drv);
+        void (*wake_up_cb) (struct cfhsi_cb_ops *drv);
-        void (*wake_down_cb) (struct cfhsi_drv *drv);
+        void (*wake_down_cb) (struct cfhsi_cb_ops *drv);
 };
 /* Structure implemented by HSI device. */
-struct cfhsi_dev {
+struct cfhsi_ops {
-        int (*cfhsi_up) (struct cfhsi_dev *dev);
+        int (*cfhsi_up) (struct cfhsi_ops *dev);
-        int (*cfhsi_down) (struct cfhsi_dev *dev);
+        int (*cfhsi_down) (struct cfhsi_ops *dev);
-        int (*cfhsi_tx) (u8 *ptr, int len, struct cfhsi_dev *dev);
+        int (*cfhsi_tx) (u8 *ptr, int len, struct cfhsi_ops *dev);
-        int (*cfhsi_rx) (u8 *ptr, int len, struct cfhsi_dev *dev);
+        int (*cfhsi_rx) (u8 *ptr, int len, struct cfhsi_ops *dev);
-        int (*cfhsi_wake_up) (struct cfhsi_dev *dev);
+        int (*cfhsi_wake_up) (struct cfhsi_ops *dev);
-        int (*cfhsi_wake_down) (struct cfhsi_dev *dev);
+        int (*cfhsi_wake_down) (struct cfhsi_ops *dev);
-        int (*cfhsi_get_peer_wake) (struct cfhsi_dev *dev, bool *status);
+        int (*cfhsi_get_peer_wake) (struct cfhsi_ops *dev, bool *status);
-        int (*cfhsi_fifo_occupancy)(struct cfhsi_dev *dev, size_t *occupancy);
+        int (*cfhsi_fifo_occupancy) (struct cfhsi_ops *dev, size_t *occupancy);
-        int (*cfhsi_rx_cancel)(struct cfhsi_dev *dev);
+        int (*cfhsi_rx_cancel)(struct cfhsi_ops *dev);
-        struct cfhsi_drv *drv;
+        struct cfhsi_cb_ops *cb_ops;
 };
 /* Structure holds status of received CAIF frames processing */
@@ -132,17 +132,26 @@ enum {
        CFHSI_PRIO_LAST,
 };
+struct cfhsi_config {
+        u32 inactivity_timeout;
+        u32 aggregation_timeout;
+        u32 head_align;
+        u32 tail_align;
+        u32 q_high_mark;
+        u32 q_low_mark;
+};
 /* Structure implemented by CAIF HSI drivers. */
 struct cfhsi {
        struct caif_dev_common cfdev;
        struct net_device *ndev;
        struct platform_device *pdev;
        struct sk_buff_head qhead[CFHSI_PRIO_LAST];
-        struct cfhsi_drv drv;
+        struct cfhsi_cb_ops cb_ops;
-        struct cfhsi_dev *dev;
+        struct cfhsi_ops *ops;
        int tx_state;
        struct cfhsi_rx_state rx_state;
-        unsigned long inactivity_timeout;
+        struct cfhsi_config cfg;
        int rx_len;
        u8 *rx_ptr;
        u8 *tx_buf;
@@ -150,8 +159,6 @@ struct cfhsi {
        u8 *rx_flip_buf;
        spinlock_t lock;
        int flow_off_sent;
-        u32 q_low_mark;
-        u32 q_high_mark;
        struct list_head list;
        struct work_struct wake_up_work;
        struct work_struct wake_down_work;
@@ -164,13 +171,31 @@ struct cfhsi {
        struct timer_list rx_slowpath_timer;
        /* TX aggregation */
-        unsigned long aggregation_timeout;
        int aggregation_len;
        struct timer_list aggregation_timer;
        unsigned long bits;
 };
 extern struct platform_driver cfhsi_driver;
+/**
+ * enum ifla_caif_hsi - CAIF HSI NetlinkRT parameters.
+ * @IFLA_CAIF_HSI_INACTIVITY_TOUT: Inactivity timeout before
+ *                      taking the HSI wakeline down, in milliseconds.
+ * When using RT Netlink to create, destroy or configure a CAIF HSI interface,
+ * enum ifla_caif_hsi is used to specify the configuration attributes.
+ */
+enum ifla_caif_hsi {
+        __IFLA_CAIF_HSI_UNSPEC,
+        __IFLA_CAIF_HSI_INACTIVITY_TOUT,
+        __IFLA_CAIF_HSI_AGGREGATION_TOUT,
+        __IFLA_CAIF_HSI_HEAD_ALIGN,
+        __IFLA_CAIF_HSI_TAIL_ALIGN,
+        __IFLA_CAIF_HSI_QHIGH_WATERMARK,
+        __IFLA_CAIF_HSI_QLOW_WATERMARK,
+        __IFLA_CAIF_HSI_MAX
+};
+extern struct cfhsi_ops *cfhsi_get_ops(void);
 #endif          /* CAIF_HSI_H_ */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 0289d4ce7070..7319f25250b6 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -404,6 +404,8 @@ struct cfg80211_beacon_data {
 *
 * Used to configure an AP interface.
 *
+ * @channel: the channel to start the AP on
+ * @channel_type: the channel type to use
 * @beacon: beacon data
 * @beacon_interval: beacon interval
 * @dtim_period: DTIM period
@@ -417,6 +419,9 @@ struct cfg80211_beacon_data {
 * @inactivity_timeout: time in seconds to determine station's inactivity.
 */
 struct cfg80211_ap_settings {
+        struct ieee80211_channel *channel;
+        enum nl80211_channel_type channel_type;
        struct cfg80211_beacon_data beacon;
        int beacon_interval, dtim_period;
@@ -826,6 +831,8 @@ struct mesh_config {
 /**
 * struct mesh_setup - 802.11s mesh setup configuration
+ * @channel: the channel to start the mesh network on
+ * @channel_type: the channel type to use
 * @mesh_id: the mesh ID
 * @mesh_id_len: length of the mesh ID, at least 1 and at most 32 bytes
 * @sync_method: which synchronization method to use
@@ -840,6 +847,8 @@ struct mesh_config {
 * These parameters are fixed when the mesh is created.
 */
 struct mesh_setup {
+        struct ieee80211_channel *channel;
+        enum nl80211_channel_type channel_type;
        const u8 *mesh_id;
        u8 mesh_id_len;
        u8 sync_method;
@@ -1411,11 +1420,14 @@ struct cfg80211_gtk_rekey_data {
 *
 * @set_txq_params: Set TX queue parameters
 *
- * @set_channel: Set channel for a given wireless interface. Some devices
+ * @libertas_set_mesh_channel: Only for backward compatibility for libertas,
- *      may support multi-channel operation (by channel hopping) so cfg80211
+ *      as it doesn't implement join_mesh and needs to set the channel to
- *      doesn't verify much. Note, however, that the passed netdev may be
+ *      join the mesh instead.
- *      %NULL as well if the user requested changing the channel for the
+ *
- *      device itself, or for a monitor interface.
+ * @set_monitor_channel: Set the monitor mode channel for the device. If other
+ *      interfaces are active this callback should reject the configuration.
+ *      If no interfaces are active or the device is down, the channel should
+ *      be stored for when a monitor interface becomes active.
 * @get_channel: Get the current operating channel, should return %NULL if
 *      there's no single defined operating channel if for example the
 *      device implements channel hopping for multi-channel virtual interfaces.
@@ -1605,9 +1617,13 @@ struct cfg80211_ops {
        int     (*set_txq_params)(struct wiphy *wiphy, struct net_device *dev,
                                  struct ieee80211_txq_params *params);
-        int     (*set_channel)(struct wiphy *wiphy, struct net_device *dev,
+        int     (*libertas_set_mesh_channel)(struct wiphy *wiphy,
-                               struct ieee80211_channel *chan,
+                                             struct net_device *dev,
-                               enum nl80211_channel_type channel_type);
+                                             struct ieee80211_channel *chan);
+        int     (*set_monitor_channel)(struct wiphy *wiphy,
+                                       struct ieee80211_channel *chan,
+                                       enum nl80211_channel_type channel_type);
        int     (*scan)(struct wiphy *wiphy, struct net_device *dev,
                        struct cfg80211_scan_request *request);
@@ -2263,7 +2279,10 @@ struct cfg80211_cached_keys;
 * @netdev: (private) Used to reference back to the netdev
 * @current_bss: (private) Used by the internal configuration code
 * @channel: (private) Used by the internal configuration code to track
- *      user-set AP, monitor and WDS channels for wireless extensions
+ *      the user-set AP, monitor and WDS channel
+ * @preset_chan: (private) Used by the internal configuration code to
+ *      track the channel to be used for AP later
+ * @preset_chantype: (private) the corresponding channel type
 * @bssid: (private) Used by the internal configuration code
 * @ssid: (private) Used by the internal configuration code
 * @ssid_len: (private) Used by the internal configuration code
@@ -2313,7 +2332,8 @@ struct wireless_dev {
        spinlock_t event_lock;
        struct cfg80211_internal_bss *current_bss; /* associated / joined */
-        struct ieee80211_channel *channel;
+        struct ieee80211_channel *preset_chan;
+        enum nl80211_channel_type preset_chantype;
        bool ps;
        int ps_timeout;
@@ -3359,11 +3379,14 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
                                 const u8 *frame, size_t len,
                                 int freq, int sig_dbm, gfp_t gfp);
-/*
+/**
 * cfg80211_can_beacon_sec_chan - test if ht40 on extension channel can be used
 * @wiphy: the wiphy
 * @chan: main channel
 * @channel_type: HT mode
+ *
+ * This function returns true if there is no secondary channel or the secondary
+ * channel can be used for beaconing (i.e. is not a radar channel etc.)
 */
 bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
                                  struct ieee80211_channel *chan,
diff --git a/include/net/dst.h b/include/net/dst.h
index 8197eadca819..f0bf3b8d5911 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -48,8 +48,8 @@ struct dst_entry {
 #else
        void                    *__pad1;
 #endif
-        int                     (*input)(struct sk_buff*);
+        int                     (*input)(struct sk_buff *);
-        int                     (*output)(struct sk_buff*);
+        int                     (*output)(struct sk_buff *);
        int                     flags;
 #define DST_HOST                0x0001
@@ -241,7 +241,7 @@ dst_metric_locked(const struct dst_entry *dst, int metric)
        return dst_metric(dst, RTAX_LOCK) & (1<<metric);
 }
-static inline void dst_hold(struct dst_entry * dst)
+static inline void dst_hold(struct dst_entry *dst)
 {
        /*
         * If your kernel compilation stops here, please check
@@ -264,8 +264,7 @@ static inline void dst_use_noref(struct dst_entry *dst, unsigned long time)
        dst->lastuse = time;
 }
-static inline
+static inline struct dst_entry *dst_clone(struct dst_entry *dst)
-struct dst_entry * dst_clone(struct dst_entry * dst)
 {
        if (dst)
                atomic_inc(&dst->__refcnt);
@@ -371,12 +370,12 @@ static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
 }
 extern int dst_discard(struct sk_buff *skb);
-extern void *dst_alloc(struct dst_ops * ops, struct net_device *dev,
+extern void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
                       int initial_ref, int initial_obsolete, int flags);
-extern void __dst_free(struct dst_entry * dst);
+extern void __dst_free(struct dst_entry *dst);
-extern struct dst_entry *dst_destroy(struct dst_entry * dst);
+extern struct dst_entry *dst_destroy(struct dst_entry *dst);
-static inline void dst_free(struct dst_entry * dst)
+static inline void dst_free(struct dst_entry *dst)
 {
        if (dst->obsolete > 1)
                return;
diff --git a/include/net/flow.h b/include/net/flow.h
index 6c469dbdb917..bd524f598561 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -22,6 +22,7 @@ struct flowi_common {
 #define FLOWI_FLAG_ANYSRC               0x01
 #define FLOWI_FLAG_PRECOW_METRICS       0x02
 #define FLOWI_FLAG_CAN_SLEEP            0x04
+#define FLOWI_FLAG_RT_NOCACHE           0x08
        __u32   flowic_secid;
 };
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 7d83f90f203f..af3c743a40e4 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -43,7 +43,7 @@ struct inet_connection_sock_af_ops {
        struct sock *(*syn_recv_sock)(struct sock *sk, struct sk_buff *skb,
                                      struct request_sock *req,
                                      struct dst_entry *dst);
-        struct inet_peer *(*get_peer)(struct sock *sk, bool *release_it);
+        struct inet_peer *(*get_peer)(struct sock *sk);
        u16         net_header_len;
        u16         net_frag_header_len;
        u16         sockaddr_len;
@@ -251,7 +251,8 @@ extern int inet_csk_get_port(struct sock *sk, unsigned short snum);
 extern struct dst_entry* inet_csk_route_req(struct sock *sk,
                                            struct flowi4 *fl4,
-                                            const struct request_sock *req);
+                                            const struct request_sock *req,
+                                            bool nocache);
 extern struct dst_entry* inet_csk_route_child_sock(struct sock *sk,
                                                   struct sock *newsk,
                                                   const struct request_sock *req);
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 808fc5f76b03..54be0287eb98 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -379,10 +379,10 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo,
                                             const __be16 sport,
                                             const __be16 dport)
 {
-        struct sock *sk;
+        struct sock *sk = skb_steal_sock(skb);
        const struct iphdr *iph = ip_hdr(skb);
-        if (unlikely(sk = skb_steal_sock(skb)))
+        if (sk)
                return sk;
        else
                return __inet_lookup(dev_net(skb_dst(skb)->dev), hashinfo,
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 2040bff945d4..c27c8f10ebdc 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -65,6 +65,69 @@ struct inet_peer {
        atomic_t                refcnt;
 };
+struct inet_peer_base {
+        struct inet_peer __rcu  *root;
+        seqlock_t               lock;
+        u32                     flush_seq;
+        int                     total;
+};
+#define INETPEER_BASE_BIT       0x1UL
+static inline struct inet_peer *inetpeer_ptr(unsigned long val)
+{
+        BUG_ON(val & INETPEER_BASE_BIT);
+        return (struct inet_peer *) val;
+}
+static inline struct inet_peer_base *inetpeer_base_ptr(unsigned long val)
+{
+        if (!(val & INETPEER_BASE_BIT))
+                return NULL;
+        val &= ~INETPEER_BASE_BIT;
+        return (struct inet_peer_base *) val;
+}
+static inline bool inetpeer_ptr_is_peer(unsigned long val)
+{
+        return !(val & INETPEER_BASE_BIT);
+}
+static inline void __inetpeer_ptr_set_peer(unsigned long *val, struct inet_peer *peer)
+{
+        /* This implicitly clears INETPEER_BASE_BIT */
+        *val = (unsigned long) peer;
+}
+static inline bool inetpeer_ptr_set_peer(unsigned long *ptr, struct inet_peer *peer)
+{
+        unsigned long val = (unsigned long) peer;
+        unsigned long orig = *ptr;
+        if (!(orig & INETPEER_BASE_BIT) ||
+            cmpxchg(ptr, orig, val) != orig)
+                return false;
+        return true;
+}
+static inline void inetpeer_init_ptr(unsigned long *ptr, struct inet_peer_base *base)
+{
+        *ptr = (unsigned long) base | INETPEER_BASE_BIT;
+}
+static inline void inetpeer_transfer_peer(unsigned long *to, unsigned long *from)
+{
+        unsigned long val = *from;
+        *to = val;
+        if (inetpeer_ptr_is_peer(val)) {
+                struct inet_peer *peer = inetpeer_ptr(val);
+                atomic_inc(&peer->refcnt);
+        }
+}
+extern void inet_peer_base_init(struct inet_peer_base *);
 void                    inet_initpeers(void) __init;
 #define INETPEER_METRICS_NEW    (~(u32) 0)
@@ -75,31 +138,38 @@ static inline bool inet_metrics_new(const struct inet_peer *p)
 }
 /* can be called with or without local BH being disabled */
-struct inet_peer        *inet_getpeer(const struct inetpeer_addr *daddr, int create);
+struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+                               const struct inetpeer_addr *daddr,
+                               int create);
-static inline struct inet_peer *inet_getpeer_v4(__be32 v4daddr, int create)
+static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base,
+                                                __be32 v4daddr,
+                                                int create)
 {
        struct inetpeer_addr daddr;
        daddr.addr.a4 = v4daddr;
        daddr.family = AF_INET;
-        return inet_getpeer(&daddr, create);
+        return inet_getpeer(base, &daddr, create);
 }
-static inline struct inet_peer *inet_getpeer_v6(const struct in6_addr *v6daddr, int create)
+static inline struct inet_peer *inet_getpeer_v6(struct inet_peer_base *base,
+                                                const struct in6_addr *v6daddr,
+                                                int create)
 {
        struct inetpeer_addr daddr;
        *(struct in6_addr *)daddr.addr.a6 = *v6daddr;
        daddr.family = AF_INET6;
-        return inet_getpeer(&daddr, create);
+        return inet_getpeer(base, &daddr, create);
 }
 /* can be called from BH context or outside */
 extern void inet_putpeer(struct inet_peer *p);
 extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
-extern void inetpeer_invalidate_tree(int family);
+extern void inetpeer_invalidate_tree(struct inet_peer_base *);
+extern void inetpeer_invalidate_family(int family);
 /*
 * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
diff --git a/include/net/ip.h b/include/net/ip.h
index 83e0619f59d0..ec5cfde85e9a 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -158,8 +158,9 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
        return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
 }
-void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
+void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
-                   const struct ip_reply_arg *arg, unsigned int len);
+                           __be32 saddr, const struct ip_reply_arg *arg,
+                           unsigned int len);
 struct ipv4_config {
        int     log_martians;
@@ -210,6 +211,9 @@ extern int inet_peer_threshold;
 extern int inet_peer_minttl;
 extern int inet_peer_maxttl;
+/* From ip_input.c */
+extern int sysctl_ip_early_demux;
 /* From ip_output.c */
 extern int sysctl_ip_dynaddr;
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 0ae759a6c76e..a192f7807659 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -107,7 +107,7 @@ struct rt6_info {
        u32                             rt6i_peer_genid;
        struct inet6_dev                *rt6i_idev;
-        struct inet_peer                *rt6i_peer;
+        unsigned long                   _rt6i_peer;
 #ifdef CONFIG_XFRM
        u32                             rt6i_flow_cache_genid;
@@ -118,6 +118,36 @@ struct rt6_info {
        u8                              rt6i_protocol;
 };
+static inline struct inet_peer *rt6_peer_ptr(struct rt6_info *rt)
+{
+        return inetpeer_ptr(rt->_rt6i_peer);
+}
+static inline bool rt6_has_peer(struct rt6_info *rt)
+{
+        return inetpeer_ptr_is_peer(rt->_rt6i_peer);
+}
+static inline void __rt6_set_peer(struct rt6_info *rt, struct inet_peer *peer)
+{
+        __inetpeer_ptr_set_peer(&rt->_rt6i_peer, peer);
+}
+static inline bool rt6_set_peer(struct rt6_info *rt, struct inet_peer *peer)
+{
+        return inetpeer_ptr_set_peer(&rt->_rt6i_peer, peer);
+}
+static inline void rt6_init_peer(struct rt6_info *rt, struct inet_peer_base *base)
+{
+        inetpeer_init_ptr(&rt->_rt6i_peer, base);
+}
+static inline void rt6_transfer_peer(struct rt6_info *rt, struct rt6_info *ort)
+{
+        inetpeer_transfer_peer(&rt->_rt6i_peer, &ort->_rt6i_peer);
+}
 static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
 {
        return ((struct rt6_info *)dst)->rt6i_idev;
@@ -207,6 +237,7 @@ struct fib6_table {
        u32                     tb6_id;
        rwlock_t                tb6_lock;
        struct fib6_node        tb6_root;
+        struct inet_peer_base   tb6_peers;
 };
 #define RT6_TABLE_UNSPEC        RT_TABLE_UNSPEC
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 37c1a1ed82c1..58cb3fc34879 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -53,16 +53,25 @@ static inline unsigned int rt6_flags2srcprefs(int flags)
        return (flags >> 3) & 7;
 }
-extern void                     rt6_bind_peer(struct rt6_info *rt,
+extern void rt6_bind_peer(struct rt6_info *rt, int create);
-                                              int create);
+static inline struct inet_peer *__rt6_get_peer(struct rt6_info *rt, int create)
+{
+        if (rt6_has_peer(rt))
+                return rt6_peer_ptr(rt);
+        rt6_bind_peer(rt, create);
+        return (rt6_has_peer(rt) ? rt6_peer_ptr(rt) : NULL);
+}
 static inline struct inet_peer *rt6_get_peer(struct rt6_info *rt)
 {
-        if (rt->rt6i_peer)
+        return __rt6_get_peer(rt, 0);
-                return rt->rt6i_peer;
+}
-        rt6_bind_peer(rt, 0);
+static inline struct inet_peer *rt6_get_peer_create(struct rt6_info *rt)
-        return rt->rt6i_peer;
+{
+        return __rt6_get_peer(rt, 1);
 }
 extern void                     ip6_route_input(struct sk_buff *skb);
@@ -131,10 +140,10 @@ extern void			rt6_redirect(const struct in6_addr *dest,
                                             u8 *lladdr,
                                             int on_link);
-extern void                     rt6_pmtu_discovery(const struct in6_addr *daddr,
+extern void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
-                                                   const struct in6_addr *saddr,
+                            int oif, u32 mark);
-                                                   struct net_device *dev,
+extern void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk,
-                                                   u32 pmtu);
+                               __be32 mtu);
 struct netlink_callback;
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 78df0866cc38..9e6c26d4ba4c 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -19,6 +19,7 @@
 #include <net/flow.h>
 #include <linux/seq_file.h>
 #include <net/fib_rules.h>
+#include <net/inetpeer.h>
 struct fib_config {
        u8                      fc_dst_len;
@@ -157,11 +158,12 @@ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
                                         FIB_RES_SADDR(net, res))
 struct fib_table {
-        struct hlist_node tb_hlist;
+        struct hlist_node       tb_hlist;
-        u32             tb_id;
+        u32                     tb_id;
-        int             tb_default;
+        int                     tb_default;
-        int             tb_num_default;
+        int                     tb_num_default;
-        unsigned long   tb_data[0];
+        struct inet_peer_base   tb_peers;
+        unsigned long           tb_data[0];
 };
 extern int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp,
@@ -228,9 +230,10 @@ extern struct fib_table *fib_get_table(struct net *net, u32 id);
 /* Exported by fib_frontend.c */
 extern const struct nla_policy rtm_ipv4_policy[];
 extern void             ip_fib_init(void);
+extern __be32 fib_compute_spec_dst(struct sk_buff *skb);
 extern int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
                               u8 tos, int oif, struct net_device *dev,
-                               __be32 *spec_dst, u32 *itag);
+                               u32 *itag);
 extern void fib_select_default(struct fib_result *res);
 /* Exported by fib_semantics.c */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 95e39b6a02ec..6914f9978aea 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1297,6 +1297,10 @@ enum ieee80211_hw_flags {
 *      reports, by default it is set to _MCS, _GI and _BW but doesn't
 *      include _FMT. Use %IEEE80211_RADIOTAP_MCS_HAVE_* values, only
 *      adding _BW is supported today.
+ *
+ * @netdev_features: netdev features to be set in each netdev created
+ *      from this HW. Note only HW checksum features are currently
+ *      compatible with mac80211. Other feature bits will be rejected.
 */
 struct ieee80211_hw {
        struct ieee80211_conf conf;
@@ -1319,6 +1323,7 @@ struct ieee80211_hw {
        u8 max_tx_aggregation_subframes;
        u8 offchannel_tx_hw_queue;
        u8 radiotap_mcs_details;
+        netdev_features_t netdev_features;
 };
 /**
@@ -2183,7 +2188,10 @@ enum ieee80211_rate_control_changed {
 *      offload. Frames to transmit on the off-channel channel are transmitted
 *      normally except for the %IEEE80211_TX_CTL_TX_OFFCHAN flag. When the
 *      duration (which will always be non-zero) expires, the driver must call
- *      ieee80211_remain_on_channel_expired(). This callback may sleep.
+ *      ieee80211_remain_on_channel_expired().
+ *      Note that this callback may be called while the device is in IDLE and
+ *      must be accepted in this case.
+ *      This callback may sleep.
 * @cancel_remain_on_channel: Requests that an ongoing off-channel period is
 *      aborted before it expires. This callback may sleep.
 *
@@ -3557,16 +3565,6 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
                               gfp_t gfp);
 /**
- * ieee80211_get_operstate - get the operstate of the vif
- *
- * @vif: &struct ieee80211_vif pointer from the add_interface callback.
- *
- * The driver might need to know the operstate of the net_device
- * (specifically, whether the link is IF_OPER_UP after resume)
- */
-unsigned char ieee80211_get_operstate(struct ieee80211_vif *vif);
-/**
 * ieee80211_chswitch_done - Complete channel switch process
 * @vif: &struct ieee80211_vif pointer from the add_interface callback.
 * @success: make the channel switch successful or not
@@ -3845,4 +3843,28 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif,
 */
 int ieee80211_ave_rssi(struct ieee80211_vif *vif);
+/* Extra debugging macros */
+#ifdef CONFIG_MAC80211_HT_DEBUG
+#define ht_vdbg(fmt, ...)                       \
+        pr_debug(fmt, ##__VA_ARGS__)
+#else
+#define ht_vdbg(fmt, ...)                       \
+do {                                            \
+        if (0)                                  \
+                pr_debug(fmt, ##__VA_ARGS__);   \
+} while (0)
+#endif
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+#define ibss_vdbg(fmt, ...)                     \
+        pr_debug(fmt, ##__VA_ARGS__)
+#else
+#define ibss_vdbg(fmt, ...)                     \
+do {                                            \
+        if (0)                                  \
+                pr_debug(fmt, ##__VA_ARGS__);   \
+} while (0)
+#endif
 #endif /* MAC80211_H */
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index c9f8ab5cc687..d0d11df9cba1 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -21,6 +21,14 @@
 #include <net/af_ieee802154.h>
+/* General MAC frame format:
+ *  2 bytes: Frame Control
+ *  1 byte:  Sequence Number
+ * 20 bytes: Addressing fields
+ * 14 bytes: Auxiliary Security Header
+ */
+#define MAC802154_FRAME_HARD_HEADER_LEN         (2 + 1 + 20 + 14)
 /* The following flags are used to indicate changed address settings from
 * the stack to the hardware.
 */
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index cce7f6a798bf..f1494feba79f 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -39,36 +39,6 @@ union nf_conntrack_expect_proto {
        /* insert expect proto private data here */
 };
-/* Add protocol helper include file here */
-#include <linux/netfilter/nf_conntrack_ftp.h>
-#include <linux/netfilter/nf_conntrack_pptp.h>
-#include <linux/netfilter/nf_conntrack_h323.h>
-#include <linux/netfilter/nf_conntrack_sane.h>
-#include <linux/netfilter/nf_conntrack_sip.h>
-/* per conntrack: application helper private data */
-union nf_conntrack_help {
-        /* insert conntrack helper private data (master) here */
-#if defined(CONFIG_NF_CONNTRACK_FTP) || defined(CONFIG_NF_CONNTRACK_FTP_MODULE)
-        struct nf_ct_ftp_master ct_ftp_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_PPTP) || \
-    defined(CONFIG_NF_CONNTRACK_PPTP_MODULE)
-        struct nf_ct_pptp_master ct_pptp_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_H323) || \
-    defined(CONFIG_NF_CONNTRACK_H323_MODULE)
-        struct nf_ct_h323_master ct_h323_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_SANE) || \
-    defined(CONFIG_NF_CONNTRACK_SANE_MODULE)
-        struct nf_ct_sane_master ct_sane_info;
-#endif
-#if defined(CONFIG_NF_CONNTRACK_SIP) || defined(CONFIG_NF_CONNTRACK_SIP_MODULE)
-        struct nf_ct_sip_master ct_sip_info;
-#endif
-};
 #include <linux/types.h>
 #include <linux/skbuff.h>
 #include <linux/timer.h>
@@ -89,12 +59,13 @@ struct nf_conn_help {
        /* Helper. if any */
        struct nf_conntrack_helper __rcu *helper;
-        union nf_conntrack_help help;
        struct hlist_head expectations;
        /* Current number of expected connections */
        u8 expecting[NF_CT_MAX_EXPECT_CLASSES];
+        /* private helper information. */
+        char data[];
 };
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index aced085132e7..d8f5b9f52169 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -28,8 +28,8 @@ extern unsigned int nf_conntrack_in(struct net *net,
 extern int nf_conntrack_init(struct net *net);
 extern void nf_conntrack_cleanup(struct net *net);
-extern int nf_conntrack_proto_init(void);
+extern int nf_conntrack_proto_init(struct net *net);
-extern void nf_conntrack_proto_fini(void);
+extern void nf_conntrack_proto_fini(struct net *net);
 extern bool
 nf_ct_get_tuple(const struct sk_buff *skb,
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index 4619caadd9d1..983f00263243 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -59,10 +59,12 @@ static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
        return nf_ct_net(exp->master);
 }
+#define NF_CT_EXP_POLICY_NAME_LEN       16
 struct nf_conntrack_expect_policy {
        unsigned int    max_expected;
        unsigned int    timeout;
-        const char      *name;
+        char            name[NF_CT_EXP_POLICY_NAME_LEN];
 };
 #define NF_CT_EXPECT_CLASS_DEFAULT      0
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index 96755c3798a5..8b4d1fc29096 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -80,10 +80,13 @@ static inline void nf_ct_ext_free(struct nf_conn *ct)
 }
 /* Add this type, returns pointer to data or NULL. */
-void *
+void *__nf_ct_ext_add_length(struct nf_conn *ct, enum nf_ct_ext_id id,
-__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp);
+                             size_t var_alloc_len, gfp_t gfp);
 #define nf_ct_ext_add(ct, id, gfp) \
-        ((id##_TYPE *)__nf_ct_ext_add((ct), (id), (gfp)))
+        ((id##_TYPE *)__nf_ct_ext_add_length((ct), (id), 0, (gfp)))
+#define nf_ct_ext_add_length(ct, id, len, gfp) \
+        ((id##_TYPE *)__nf_ct_ext_add_length((ct), (id), (len), (gfp)))
 #define NF_CT_EXT_F_PREALLOC    0x0001
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index 1d1889409b9e..9aad956d1008 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -11,18 +11,27 @@
 #define _NF_CONNTRACK_HELPER_H
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_extend.h>
+#include <net/netfilter/nf_conntrack_expect.h>
 struct module;
+enum nf_ct_helper_flags {
+        NF_CT_HELPER_F_USERSPACE        = (1 << 0),
+        NF_CT_HELPER_F_CONFIGURED       = (1 << 1),
+};
 #define NF_CT_HELPER_NAME_LEN   16
 struct nf_conntrack_helper {
        struct hlist_node hnode;        /* Internal use. */
-        const char *name;               /* name of the module */
+        char name[NF_CT_HELPER_NAME_LEN]; /* name of the module */
        struct module *me;              /* pointer to self */
        const struct nf_conntrack_expect_policy *expect_policy;
+        /* length of internal data, ie. sizeof(struct nf_ct_*_master) */
+        size_t data_len;
        /* Tuple of things we will help (compared against server response) */
        struct nf_conntrack_tuple tuple;
@@ -35,8 +44,12 @@ struct nf_conntrack_helper {
        void (*destroy)(struct nf_conn *ct);
+        int (*from_nlattr)(struct nlattr *attr, struct nf_conn *ct);
        int (*to_nlattr)(struct sk_buff *skb, const struct nf_conn *ct);
        unsigned int expect_class_max;
+        unsigned int flags;
+        unsigned int queue_num;         /* For user-space helpers. */
 };
 extern struct nf_conntrack_helper *
@@ -48,7 +61,7 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum);
 extern int nf_conntrack_helper_register(struct nf_conntrack_helper *);
 extern void nf_conntrack_helper_unregister(struct nf_conntrack_helper *);
-extern struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp);
+extern struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, struct nf_conntrack_helper *helper, gfp_t gfp);
 extern int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
                                     gfp_t flags);
@@ -60,6 +73,15 @@ static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
        return nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
 }
+static inline void *nfct_help_data(const struct nf_conn *ct)
+{
+        struct nf_conn_help *help;
+        help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
+        return (void *)help->data;
+}
 extern int nf_conntrack_helper_init(struct net *net);
 extern void nf_conntrack_helper_fini(struct net *net);
@@ -82,4 +104,7 @@ nf_ct_helper_expectfn_find_by_name(const char *name);
 struct nf_ct_helper_expectfn *
 nf_ct_helper_expectfn_find_by_symbol(const void *symbol);
+extern struct hlist_head *nf_ct_helper_hash;
+extern unsigned int nf_ct_helper_hsize;
 #endif /*_NF_CONNTRACK_HELPER_H*/
diff --git a/include/net/netfilter/nf_conntrack_l3proto.h b/include/net/netfilter/nf_conntrack_l3proto.h
index 9699c028b74b..6f7c13f4ac03 100644
--- a/include/net/netfilter/nf_conntrack_l3proto.h
+++ b/include/net/netfilter/nf_conntrack_l3proto.h
@@ -64,11 +64,12 @@ struct nf_conntrack_l3proto {
        size_t nla_size;
 #ifdef CONFIG_SYSCTL
-        struct ctl_table_header *ctl_table_header;
        const char              *ctl_table_path;
-        struct ctl_table        *ctl_table;
 #endif /* CONFIG_SYSCTL */
+        /* Init l3proto pernet data */
+        int (*init_net)(struct net *net);
        /* Module (if any) which this is connected to. */
        struct module *me;
 };
@@ -76,8 +77,10 @@ struct nf_conntrack_l3proto {
 extern struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX];
 /* Protocol registration. */
-extern int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto);
+extern int nf_conntrack_l3proto_register(struct net *net,
-extern void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto);
+                                         struct nf_conntrack_l3proto *proto);
+extern void nf_conntrack_l3proto_unregister(struct net *net,
+                                            struct nf_conntrack_l3proto *proto);
 extern struct nf_conntrack_l3proto *nf_ct_l3proto_find_get(u_int16_t l3proto);
 extern void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p);
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index 3b572bb20aa2..81c52b5205f2 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -12,6 +12,7 @@
 #include <linux/netlink.h>
 #include <net/netlink.h>
 #include <net/netfilter/nf_conntrack.h>
+#include <net/netns/generic.h>
 struct seq_file;
@@ -86,23 +87,18 @@ struct nf_conntrack_l4proto {
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
        struct {
                size_t obj_size;
-                int (*nlattr_to_obj)(struct nlattr *tb[], void *data);
+                int (*nlattr_to_obj)(struct nlattr *tb[],
+                                     struct net *net, void *data);
                int (*obj_to_nlattr)(struct sk_buff *skb, const void *data);
                unsigned int nlattr_max;
                const struct nla_policy *nla_policy;
        } ctnl_timeout;
 #endif
+        int     *net_id;
+        /* Init l4proto pernet data */
+        int (*init_net)(struct net *net);
-#ifdef CONFIG_SYSCTL
-        struct ctl_table_header **ctl_table_header;
-        struct ctl_table        *ctl_table;
-        unsigned int            *ctl_table_users;
-#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
-        struct ctl_table_header *ctl_compat_table_header;
-        struct ctl_table        *ctl_compat_table;
-#endif
-#endif
        /* Protocol name */
        const char *name;
@@ -123,8 +119,10 @@ nf_ct_l4proto_find_get(u_int16_t l3proto, u_int8_t l4proto);
 extern void nf_ct_l4proto_put(struct nf_conntrack_l4proto *p);
 /* Protocol registration. */
-extern int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *proto);
+extern int nf_conntrack_l4proto_register(struct net *net,
-extern void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *proto);
+                                         struct nf_conntrack_l4proto *proto);
+extern void nf_conntrack_l4proto_unregister(struct net *net,
+                                            struct nf_conntrack_l4proto *proto);
 /* Generic netlink helpers */
 extern int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
diff --git a/include/net/netfilter/nf_nat_helper.h b/include/net/netfilter/nf_nat_helper.h
index 02bb6c29dc3d..7d8fb7b46c44 100644
--- a/include/net/netfilter/nf_nat_helper.h
+++ b/include/net/netfilter/nf_nat_helper.h
@@ -54,4 +54,8 @@ extern void nf_nat_follow_master(struct nf_conn *ct,
 extern s16 nf_nat_get_offset(const struct nf_conn *ct,
                             enum ip_conntrack_dir dir,
                             u32 seq);
+extern void nf_nat_tcp_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
+                                  u32 dir, int off);
 #endif
diff --git a/include/net/netfilter/nfnetlink_queue.h b/include/net/netfilter/nfnetlink_queue.h
new file mode 100644
index 000000000000..86267a529514
--- /dev/null
+++ b/include/net/netfilter/nfnetlink_queue.h
@@ -0,0 +1,43 @@
+#ifndef _NET_NFNL_QUEUE_H_
+#define _NET_NFNL_QUEUE_H_
+#include <linux/netfilter/nf_conntrack_common.h>
+struct nf_conn;
+#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
+struct nf_conn *nfqnl_ct_get(struct sk_buff *entskb, size_t *size,
+                             enum ip_conntrack_info *ctinfo);
+struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb,
+                               const struct nlattr *attr,
+                               enum ip_conntrack_info *ctinfo);
+int nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct,
+                 enum ip_conntrack_info ctinfo);
+void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
+                         enum ip_conntrack_info ctinfo, int diff);
+#else
+inline struct nf_conn *
+nfqnl_ct_get(struct sk_buff *entskb, size_t *size, enum ip_conntrack_info *ctinfo)
+{
+        return NULL;
+}
+inline struct nf_conn *nfqnl_ct_parse(const struct sk_buff *skb,
+                                      const struct nlattr *attr,
+                                      enum ip_conntrack_info *ctinfo)
+{
+        return NULL;
+}
+inline int
+nfqnl_ct_put(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info ctinfo)
+{
+        return 0;
+}
+inline void nfqnl_ct_seq_adjust(struct sk_buff *skb, struct nf_conn *ct,
+                                enum ip_conntrack_info ctinfo, int diff)
+{
+}
+#endif /* NF_CONNTRACK */
+#endif
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index a053a19870cf..3aecdc7a84fb 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -4,10 +4,64 @@
 #include <linux/list.h>
 #include <linux/list_nulls.h>
 #include <linux/atomic.h>
+#include <linux/netfilter/nf_conntrack_tcp.h>
 struct ctl_table_header;
 struct nf_conntrack_ecache;
+struct nf_proto_net {
+#ifdef CONFIG_SYSCTL
+        struct ctl_table_header *ctl_table_header;
+        struct ctl_table        *ctl_table;
+#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
+        struct ctl_table_header *ctl_compat_header;
+        struct ctl_table        *ctl_compat_table;
+#endif
+#endif
+        unsigned int            users;
+};
+struct nf_generic_net {
+        struct nf_proto_net pn;
+        unsigned int timeout;
+};
+struct nf_tcp_net {
+        struct nf_proto_net pn;
+        unsigned int timeouts[TCP_CONNTRACK_TIMEOUT_MAX];
+        unsigned int tcp_loose;
+        unsigned int tcp_be_liberal;
+        unsigned int tcp_max_retrans;
+};
+enum udp_conntrack {
+        UDP_CT_UNREPLIED,
+        UDP_CT_REPLIED,
+        UDP_CT_MAX
+};
+struct nf_udp_net {
+        struct nf_proto_net pn;
+        unsigned int timeouts[UDP_CT_MAX];
+};
+struct nf_icmp_net {
+        struct nf_proto_net pn;
+        unsigned int timeout;
+};
+struct nf_ip_net {
+        struct nf_generic_net   generic;
+        struct nf_tcp_net       tcp;
+        struct nf_udp_net       udp;
+        struct nf_icmp_net      icmp;
+        struct nf_icmp_net      icmpv6;
+#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
+        struct ctl_table_header *ctl_table_header;
+        struct ctl_table        *ctl_table;
+#endif
+};
 struct netns_ct {
        atomic_t                count;
        unsigned int            expect_count;
@@ -28,6 +82,7 @@ struct netns_ct {
        unsigned int            sysctl_log_invalid; /* Log invalid packets */
        int                     sysctl_auto_assign_helper;
        bool                    auto_assign_helper_warned;
+        struct nf_ip_net        nf_ct_proto;
 #ifdef CONFIG_SYSCTL
        struct ctl_table_header *sysctl_header;
        struct ctl_table_header *acct_sysctl_header;
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index bbd023a1c9b9..227f0cd9d3f6 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -30,7 +30,7 @@ struct netns_ipv4 {
        struct sock             **icmp_sk;
        struct sock             *tcp_sock;
+        struct inet_peer_base   *peers;
        struct netns_frags      frags;
 #ifdef CONFIG_NETFILTER
        struct xt_table         *iptable_filter;
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index b42be53587ba..df0a5456a3fd 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -33,6 +33,7 @@ struct netns_ipv6 {
        struct netns_sysctl_ipv6 sysctl;
        struct ipv6_devconf     *devconf_all;
        struct ipv6_devconf     *devconf_dflt;
+        struct inet_peer_base   *peers;
        struct netns_frags      frags;
 #ifdef CONFIG_NETFILTER
        struct xt_table         *ip6table_filter;
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 4467c9460857..e30e6a869714 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -31,7 +31,8 @@ struct nfc_hci_ops {
        void (*close) (struct nfc_hci_dev *hdev);
        int (*hci_ready) (struct nfc_hci_dev *hdev);
        int (*xmit) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
-        int (*start_poll) (struct nfc_hci_dev *hdev, u32 protocols);
+        int (*start_poll) (struct nfc_hci_dev *hdev,
+                           u32 im_protocols, u32 tm_protocols);
        int (*target_from_gate) (struct nfc_hci_dev *hdev, u8 gate,
                                 struct nfc_target *target);
        int (*complete_target_discovered) (struct nfc_hci_dev *hdev, u8 gate,
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index b7ca4a2a1d72..180964b954ab 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -53,7 +53,8 @@ struct nfc_target;
 struct nfc_ops {
        int (*dev_up)(struct nfc_dev *dev);
        int (*dev_down)(struct nfc_dev *dev);
-        int (*start_poll)(struct nfc_dev *dev, u32 protocols);
+        int (*start_poll)(struct nfc_dev *dev,
+                          u32 im_protocols, u32 tm_protocols);
        void (*stop_poll)(struct nfc_dev *dev);
        int (*dep_link_up)(struct nfc_dev *dev, struct nfc_target *target,
                           u8 comm_mode, u8 *gb, size_t gb_len);
@@ -62,9 +63,10 @@ struct nfc_ops {
                               u32 protocol);
        void (*deactivate_target)(struct nfc_dev *dev,
                                  struct nfc_target *target);
-        int (*data_exchange)(struct nfc_dev *dev, struct nfc_target *target,
+        int (*im_transceive)(struct nfc_dev *dev, struct nfc_target *target,
                             struct sk_buff *skb, data_exchange_cb_t cb,
                             void *cb_context);
+        int (*tm_send)(struct nfc_dev *dev, struct sk_buff *skb);
        int (*check_presence)(struct nfc_dev *dev, struct nfc_target *target);
 };
@@ -99,10 +101,10 @@ struct nfc_dev {
        int targets_generation;
        struct device dev;
        bool dev_up;
+        u8 rf_mode;
        bool polling;
        struct nfc_target *active_target;
        bool dep_link_up;
-        u32 dep_rf_mode;
        struct nfc_genl_data genl_data;
        u32 supported_protocols;
@@ -188,6 +190,7 @@ struct sk_buff *nfc_alloc_recv_skb(unsigned int size, gfp_t gfp);
 int nfc_set_remote_general_bytes(struct nfc_dev *dev,
                                 u8 *gt, u8 gt_len);
+u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, size_t *gb_len);
 int nfc_targets_found(struct nfc_dev *dev,
                      struct nfc_target *targets, int ntargets);
@@ -196,4 +199,9 @@ int nfc_target_lost(struct nfc_dev *dev, u32 target_idx);
 int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx,
                       u8 comm_mode, u8 rf_mode);
+int nfc_tm_activated(struct nfc_dev *dev, u32 protocol, u8 comm_mode,
+                     u8 *gb, size_t gb_len);
+int nfc_tm_deactivated(struct nfc_dev *dev);
+int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb);
 #endif /* __NET_NFC_H */
diff --git a/include/net/nfc/shdlc.h b/include/net/nfc/shdlc.h
index ab06afd462da..35e930d2f638 100644
--- a/include/net/nfc/shdlc.h
+++ b/include/net/nfc/shdlc.h
@@ -27,7 +27,8 @@ struct nfc_shdlc_ops {
        void (*close) (struct nfc_shdlc *shdlc);
        int (*hci_ready) (struct nfc_shdlc *shdlc);
        int (*xmit) (struct nfc_shdlc *shdlc, struct sk_buff *skb);
-        int (*start_poll) (struct nfc_shdlc *shdlc, u32 protocols);
+        int (*start_poll) (struct nfc_shdlc *shdlc,
+                           u32 im_protocols, u32 tm_protocols);
        int (*target_from_gate) (struct nfc_shdlc *shdlc, u8 gate,
                                 struct nfc_target *target);
        int (*complete_target_discovered) (struct nfc_shdlc *shdlc, u8 gate,
diff --git a/include/net/protocol.h b/include/net/protocol.h
index 875f4895b033..057f2d315567 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -29,11 +29,15 @@
 #include <linux/ipv6.h>
 #endif
-#define MAX_INET_PROTOS 256             /* Must be a power of 2         */
+/* This is one larger than the largest protocol value that can be
+ * found in an ipv4 or ipv6 header.  Since in both cases the protocol
+ * value is presented in a __u8, this is defined to be 256.
+ */
+#define MAX_INET_PROTOS         256
 /* This is used to register protocols. */
 struct net_protocol {
+        void                    (*early_demux)(struct sk_buff *skb);
        int                     (*handler)(struct sk_buff *skb);
        void                    (*err_handler)(struct sk_buff *skb, u32 info);
        int                     (*gso_send_check)(struct sk_buff *skb);
diff --git a/include/net/route.h b/include/net/route.h
index 98705468ac03..211e2665139b 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -65,12 +65,45 @@ struct rtable {
        __be32                  rt_gateway;
        /* Miscellaneous cached information */
-        __be32                  rt_spec_dst; /* RFC1122 specific destination */
        u32                     rt_peer_genid;
-        struct inet_peer        *peer; /* long-living peer info */
+        unsigned long           _peer; /* long-living peer info */
        struct fib_info         *fi; /* for client ref to shared metrics */
 };
+static inline struct inet_peer *rt_peer_ptr(struct rtable *rt)
+{
+        return inetpeer_ptr(rt->_peer);
+}
+static inline bool rt_has_peer(struct rtable *rt)
+{
+        return inetpeer_ptr_is_peer(rt->_peer);
+}
+static inline void __rt_set_peer(struct rtable *rt, struct inet_peer *peer)
+{
+        __inetpeer_ptr_set_peer(&rt->_peer, peer);
+}
+static inline bool rt_set_peer(struct rtable *rt, struct inet_peer *peer)
+{
+        return inetpeer_ptr_set_peer(&rt->_peer, peer);
+}
+static inline void rt_init_peer(struct rtable *rt, struct inet_peer_base *base)
+{
+        inetpeer_init_ptr(&rt->_peer, base);
+}
+static inline void rt_transfer_peer(struct rtable *rt, struct rtable *ort)
+{
+        rt->_peer = ort->_peer;
+        if (rt_has_peer(ort)) {
+                struct inet_peer *peer = rt_peer_ptr(ort);
+                atomic_inc(&peer->refcnt);
+        }
+}
 static inline bool rt_is_input_route(const struct rtable *rt)
 {
        return rt->rt_route_iif != 0;
@@ -181,9 +214,10 @@ static inline int ip_route_input_noref(struct sk_buff *skb, __be32 dst, __be32 s
        return ip_route_input_common(skb, dst, src, tos, devin, true);
 }
-extern unsigned short   ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
+extern void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
-                                          unsigned short new_mtu, struct net_device *dev);
+                             int oif, u32 mark, u8 protocol, int flow_flags);
-extern void             ip_rt_send_redirect(struct sk_buff *skb);
+extern void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu);
+extern void ip_rt_send_redirect(struct sk_buff *skb);
 extern unsigned int             inet_addr_type(struct net *net, __be32 addr);
 extern unsigned int             inet_dev_addr_type(struct net *net, const struct net_device *dev, __be32 addr);
@@ -296,13 +330,23 @@ static inline struct rtable *ip_route_newports(struct flowi4 *fl4, struct rtable
 extern void rt_bind_peer(struct rtable *rt, __be32 daddr, int create);
+static inline struct inet_peer *__rt_get_peer(struct rtable *rt, __be32 daddr, int create)
+{
+        if (rt_has_peer(rt))
+                return rt_peer_ptr(rt);
+        rt_bind_peer(rt, daddr, create);
+        return (rt_has_peer(rt) ? rt_peer_ptr(rt) : NULL);
+}
 static inline struct inet_peer *rt_get_peer(struct rtable *rt, __be32 daddr)
 {
-        if (rt->peer)
+        return __rt_get_peer(rt, daddr, 0);
-                return rt->peer;
+}
-        rt_bind_peer(rt, daddr, 0);
+static inline struct inet_peer *rt_get_peer_create(struct rtable *rt, __be32 daddr)
-        return rt->peer;
+{
+        return __rt_get_peer(rt, daddr, 1);
 }
 static inline int inet_iif(const struct sk_buff *skb)
diff --git a/include/net/sock.h b/include/net/sock.h
index 4a4521699563..dcb54a0793ec 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -198,6 +198,7 @@ struct cg_proto;
  *     @sk_lock:       synchronizer
  *     @sk_rcvbuf: size of receive buffer in bytes
  *     @sk_wq: sock wait queue and async head
+  *     @sk_rx_dst: receive input route used by early tcp demux
  *     @sk_dst_cache: destination cache
  *     @sk_dst_lock: destination cache lock
  *     @sk_policy: flow policy
@@ -317,6 +318,7 @@ struct sock {
        struct xfrm_policy      *sk_policy[2];
 #endif
        unsigned long           sk_flags;
+        struct dst_entry        *sk_rx_dst;
        struct dst_entry        *sk_dst_cache;
        spinlock_t              sk_dst_lock;
        atomic_t                sk_wmem_alloc;
@@ -1426,6 +1428,7 @@ extern struct sk_buff		*sock_rmalloc(struct sock *sk,
                                              gfp_t priority);
 extern void                     sock_wfree(struct sk_buff *skb);
 extern void                     sock_rfree(struct sk_buff *skb);
+extern void                     sock_edemux(struct sk_buff *skb);
 extern int                      sock_setsockopt(struct socket *sock, int level,
                                                int op, char __user *optval,
@@ -2152,7 +2155,7 @@ static inline void sk_change_net(struct sock *sk, struct net *net)
 static inline struct sock *skb_steal_sock(struct sk_buff *skb)
 {
-        if (unlikely(skb->sk)) {
+        if (skb->sk) {
                struct sock *sk = skb->sk;
                skb->destructor = NULL;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e79aa48d9fc1..53fb7d814170 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -325,10 +325,10 @@ extern void tcp_v4_err(struct sk_buff *skb, u32);
 extern void tcp_shutdown (struct sock *sk, int how);
+extern void tcp_v4_early_demux(struct sk_buff *skb);
 extern int tcp_v4_rcv(struct sk_buff *skb);
-extern struct inet_peer *tcp_v4_get_peer(struct sock *sk, bool *release_it);
+extern struct inet_peer *tcp_v4_get_peer(struct sock *sk);
-extern void *tcp_v4_tw_get_peer(struct sock *sk);
 extern int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
 extern int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                       size_t size);
diff --git a/include/net/timewait_sock.h b/include/net/timewait_sock.h
index 8d6689cb2c66..68f0ecad6c6e 100644
--- a/include/net/timewait_sock.h
+++ b/include/net/timewait_sock.h
@@ -22,7 +22,6 @@ struct timewait_sock_ops {
        int             (*twsk_unique)(struct sock *sk,
                                       struct sock *sktw, void *twp);
        void            (*twsk_destructor)(struct sock *sk);
-        void            *(*twsk_getpeer)(struct sock *sk);
 };
 static inline int twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
@@ -41,11 +40,4 @@ static inline void twsk_destructor(struct sock *sk)
                sk->sk_prot->twsk_prot->twsk_destructor(sk);
 }
-static inline void *twsk_getpeer(struct sock *sk)
-{
-        if (sk->sk_prot->twsk_prot->twsk_getpeer)
-                return sk->sk_prot->twsk_prot->twsk_getpeer(sk);
-        return NULL;
-}
 #endif /* _TIMEWAIT_SOCK_H */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index e0a55df5bde8..17acbc92476d 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1682,13 +1682,11 @@ static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
 {
-        if ((m->m | m->v) &&
+        int ret = 0;
-            nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m))
-                goto nla_put_failure;
-        return 0;
-nla_put_failure:
+        if (m->m | m->v)
-        return -1;
+                ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
+        return ret;
 }
 #endif  /* _NET_XFRM_H */