111 files changed, 2178 insertions, 849 deletions
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index c57e064666e4..7f1c0f00db9b 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -192,6 +192,7 @@ header-y += in_route.h
 header-y += sock_diag.h
 header-y += inet_diag.h
 header-y += unix_diag.h
+header-y += packet_diag.h
 header-y += inotify.h
 header-y += input.h
 header-y += ioctl.h
@@ -359,6 +360,7 @@ header-y += sysctl.h
 header-y += sysinfo.h
 header-y += taskstats.h
 header-y += tcp.h
+header-y += tcp_metrics.h
 header-y += telephony.h
 header-y += termios.h
 header-y += time.h
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index d323a4b4143c..6ba45d2b99db 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -100,6 +100,7 @@
 #define  BCMA_CC_CHIPST_4706_SFLASH_TYPE        BIT(2) /* 0: 8b-p/ST-s flash, 1: 16b-p/Atmal-s flash */
 #define  BCMA_CC_CHIPST_4706_MIPS_BENDIAN       BIT(3) /* 0: little, 1: big endian */
 #define  BCMA_CC_CHIPST_4706_PCIE1_DISABLE      BIT(5) /* PCIE1 enable strap pin */
+#define  BCMA_CC_CHIPST_5357_NAND_BOOT          BIT(4) /* NAND boot, valid for CC rev 38 and/or BCM5357 */
 #define BCMA_CC_JCMD                    0x0030          /* Rev >= 10 only */
 #define  BCMA_CC_JCMD_START             0x80000000
 #define  BCMA_CC_JCMD_BUSY              0x80000000
@@ -266,6 +267,29 @@
 #define  BCMA_CC_SROM_CONTROL_SIZE_16K  0x00000004
 #define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT        1
 #define  BCMA_CC_SROM_CONTROL_PRESENT   0x00000001
+/* Block 0x140 - 0x190 registers are chipset specific */
+#define BCMA_CC_4706_FLASHSCFG          0x18C           /* Flash struct configuration */
+#define  BCMA_CC_4706_FLASHSCFG_MASK    0x000000ff
+#define  BCMA_CC_4706_FLASHSCFG_SF1     0x00000001      /* 2nd serial flash present */
+#define  BCMA_CC_4706_FLASHSCFG_PF1     0x00000002      /* 2nd parallel flash present */
+#define  BCMA_CC_4706_FLASHSCFG_SF1_TYPE        0x00000004      /* 2nd serial flash type : 0 : ST, 1 : Atmel */
+#define  BCMA_CC_4706_FLASHSCFG_NF1     0x00000008      /* 2nd NAND flash present */
+#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_MASK      0x000000f0
+#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_4MB       0x00000010      /* 4MB */
+#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_8MB       0x00000020      /* 8MB */
+#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_16MB      0x00000030      /* 16MB */
+#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_32MB      0x00000040      /* 32MB */
+#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_64MB      0x00000050      /* 64MB */
+#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_128MB     0x00000060      /* 128MB */
+#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_256MB     0x00000070      /* 256MB */
+/* NAND flash registers for BCM4706 (corerev = 31) */
+#define BCMA_CC_NFLASH_CTL              0x01A0
+#define  BCMA_CC_NFLASH_CTL_ERR         0x08000000
+#define BCMA_CC_NFLASH_CONF             0x01A4
+#define BCMA_CC_NFLASH_COL_ADDR         0x01A8
+#define BCMA_CC_NFLASH_ROW_ADDR         0x01AC
+#define BCMA_CC_NFLASH_DATA             0x01B0
+#define BCMA_CC_NFLASH_WAITCNT0         0x01B4
 /* 0x1E0 is defined as shared BCMA_CLKCTLST */
 #define BCMA_CC_HW_WORKAROUND           0x01E4 /* Hardware workaround (rev >= 20) */
 #define BCMA_CC_UART0_DATA              0x0300
@@ -325,6 +349,60 @@
 #define BCMA_CC_PLLCTL_ADDR             0x0660
 #define BCMA_CC_PLLCTL_DATA             0x0664
 #define BCMA_CC_SPROM                   0x0800 /* SPROM beginning */
+/* NAND flash MLC controller registers (corerev >= 38) */
+#define BCMA_CC_NAND_REVISION           0x0C00
+#define BCMA_CC_NAND_CMD_START          0x0C04
+#define BCMA_CC_NAND_CMD_ADDR_X         0x0C08
+#define BCMA_CC_NAND_CMD_ADDR           0x0C0C
+#define BCMA_CC_NAND_CMD_END_ADDR       0x0C10
+#define BCMA_CC_NAND_CS_NAND_SELECT     0x0C14
+#define BCMA_CC_NAND_CS_NAND_XOR        0x0C18
+#define BCMA_CC_NAND_SPARE_RD0          0x0C20
+#define BCMA_CC_NAND_SPARE_RD4          0x0C24
+#define BCMA_CC_NAND_SPARE_RD8          0x0C28
+#define BCMA_CC_NAND_SPARE_RD12         0x0C2C
+#define BCMA_CC_NAND_SPARE_WR0          0x0C30
+#define BCMA_CC_NAND_SPARE_WR4          0x0C34
+#define BCMA_CC_NAND_SPARE_WR8          0x0C38
+#define BCMA_CC_NAND_SPARE_WR12         0x0C3C
+#define BCMA_CC_NAND_ACC_CONTROL        0x0C40
+#define BCMA_CC_NAND_CONFIG             0x0C48
+#define BCMA_CC_NAND_TIMING_1           0x0C50
+#define BCMA_CC_NAND_TIMING_2           0x0C54
+#define BCMA_CC_NAND_SEMAPHORE          0x0C58
+#define BCMA_CC_NAND_DEVID              0x0C60
+#define BCMA_CC_NAND_DEVID_X            0x0C64
+#define BCMA_CC_NAND_BLOCK_LOCK_STATUS  0x0C68
+#define BCMA_CC_NAND_INTFC_STATUS       0x0C6C
+#define BCMA_CC_NAND_ECC_CORR_ADDR_X    0x0C70
+#define BCMA_CC_NAND_ECC_CORR_ADDR      0x0C74
+#define BCMA_CC_NAND_ECC_UNC_ADDR_X     0x0C78
+#define BCMA_CC_NAND_ECC_UNC_ADDR       0x0C7C
+#define BCMA_CC_NAND_READ_ERROR_COUNT   0x0C80
+#define BCMA_CC_NAND_CORR_STAT_THRESHOLD        0x0C84
+#define BCMA_CC_NAND_READ_ADDR_X        0x0C90
+#define BCMA_CC_NAND_READ_ADDR          0x0C94
+#define BCMA_CC_NAND_PAGE_PROGRAM_ADDR_X        0x0C98
+#define BCMA_CC_NAND_PAGE_PROGRAM_ADDR  0x0C9C
+#define BCMA_CC_NAND_COPY_BACK_ADDR_X   0x0CA0
+#define BCMA_CC_NAND_COPY_BACK_ADDR     0x0CA4
+#define BCMA_CC_NAND_BLOCK_ERASE_ADDR_X 0x0CA8
+#define BCMA_CC_NAND_BLOCK_ERASE_ADDR   0x0CAC
+#define BCMA_CC_NAND_INV_READ_ADDR_X    0x0CB0
+#define BCMA_CC_NAND_INV_READ_ADDR      0x0CB4
+#define BCMA_CC_NAND_BLK_WR_PROTECT     0x0CC0
+#define BCMA_CC_NAND_ACC_CONTROL_CS1    0x0CD0
+#define BCMA_CC_NAND_CONFIG_CS1         0x0CD4
+#define BCMA_CC_NAND_TIMING_1_CS1       0x0CD8
+#define BCMA_CC_NAND_TIMING_2_CS1       0x0CDC
+#define BCMA_CC_NAND_SPARE_RD16         0x0D30
+#define BCMA_CC_NAND_SPARE_RD20         0x0D34
+#define BCMA_CC_NAND_SPARE_RD24         0x0D38
+#define BCMA_CC_NAND_SPARE_RD28         0x0D3C
+#define BCMA_CC_NAND_CACHE_ADDR         0x0D40
+#define BCMA_CC_NAND_CACHE_DATA         0x0D44
+#define BCMA_CC_NAND_CTRL_CONFIG        0x0D48
+#define BCMA_CC_NAND_CTRL_STATUS        0x0D4C
 /* Divider allocation in 4716/47162/5356 */
 #define BCMA_CC_PMU5_MAINPLL_CPU        1
@@ -415,6 +493,13 @@
 /* 4313 Chip specific ChipControl register bits */
 #define BCMA_CCTRL_4313_12MA_LED_DRIVE          0x00000007      /* 12 mA drive strengh for later 4313 */
+/* BCM5357 ChipControl register bits */
+#define BCMA_CHIPCTL_5357_EXTPA                 BIT(14)
+#define BCMA_CHIPCTL_5357_ANT_MUX_2O3           BIT(15)
+#define BCMA_CHIPCTL_5357_NFLASH                BIT(16)
+#define BCMA_CHIPCTL_5357_I2S_PINS_ENABLE       BIT(18)
+#define BCMA_CHIPCTL_5357_I2CSPI_PINS_ENABLE    BIT(19)
 /* Data for the PMU, if available.
 * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
 */
@@ -430,6 +515,26 @@ struct bcma_pflash {
        u32 window_size;
 };
+#ifdef CONFIG_BCMA_SFLASH
+struct bcma_sflash {
+        bool present;
+        u32 window;
+        u32 blocksize;
+        u16 numblocks;
+        u32 size;
+};
+#endif
+#ifdef CONFIG_BCMA_NFLASH
+struct mtd_info;
+struct bcma_nflash {
+        bool present;
+        struct mtd_info *mtd;
+};
+#endif
 struct bcma_serial_port {
        void *regs;
        unsigned long clockspeed;
@@ -450,6 +555,12 @@ struct bcma_drv_cc {
        struct bcma_chipcommon_pmu pmu;
 #ifdef CONFIG_BCMA_DRIVER_MIPS
        struct bcma_pflash pflash;
+#ifdef CONFIG_BCMA_SFLASH
+        struct bcma_sflash sflash;
+#endif
+#ifdef CONFIG_BCMA_NFLASH
+        struct bcma_nflash nflash;
+#endif
        int nr_serial_ports;
        struct bcma_serial_port serial_ports[4];
diff --git a/include/linux/bcma/bcma_regs.h b/include/linux/bcma/bcma_regs.h
index 5a71d5719640..6c9cb93ae3de 100644
--- a/include/linux/bcma/bcma_regs.h
+++ b/include/linux/bcma/bcma_regs.h
@@ -11,11 +11,13 @@
 #define  BCMA_CLKCTLST_HAVEHTREQ        0x00000010 /* HT available request */
 #define  BCMA_CLKCTLST_HWCROFF          0x00000020 /* Force HW clock request off */
 #define  BCMA_CLKCTLST_EXTRESREQ        0x00000700 /* Mask of external resource requests */
+#define  BCMA_CLKCTLST_EXTRESREQ_SHIFT  8
 #define  BCMA_CLKCTLST_HAVEALP          0x00010000 /* ALP available */
 #define  BCMA_CLKCTLST_HAVEHT           0x00020000 /* HT available */
 #define  BCMA_CLKCTLST_BP_ON_ALP        0x00040000 /* RO: running on ALP clock */
 #define  BCMA_CLKCTLST_BP_ON_HT         0x00080000 /* RO: running on HT clock */
 #define  BCMA_CLKCTLST_EXTRESST         0x07000000 /* Mask of external resource status */
+#define  BCMA_CLKCTLST_EXTRESST_SHIFT   24
 /* Is there any BCM4328 on BCMA bus? */
 #define  BCMA_CLKCTLST_4328A0_HAVEHT    0x00010000 /* 4328a0 has reversed bits */
 #define  BCMA_CLKCTLST_4328A0_HAVEALP   0x00020000 /* 4328a0 has reversed bits */
@@ -83,4 +85,6 @@
                                                         * (2 ZettaBytes), high 32 bits
                                                         */
+#define BCMA_SFLASH                     0x1c000000
 #endif /* LINUX_BCMA_REGS_H_ */
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index d426336d92d9..b006ba0a9f42 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -151,6 +151,17 @@ static inline void eth_broadcast_addr(u8 *addr)
 }
 /**
+ * eth_zero_addr - Assign zero address
+ * @addr: Pointer to a six-byte array containing the Ethernet address
+ *
+ * Assign the zero address to the given address array.
+ */
+static inline void eth_zero_addr(u8 *addr)
+{
+        memset(addr, 0x00, ETH_ALEN);
+}
+/**
 * eth_hw_addr_random - Generate software assigned random Ethernet and
 * set device flag
 * @dev: pointer to net_device structure
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index 21eff418091b..fcb4f8e60c1c 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -45,8 +45,10 @@ struct ethtool_cmd {
                                 * bits) in Mbps. Please use
                                 * ethtool_cmd_speed()/_set() to
                                 * access it */
-        __u8    eth_tp_mdix;
+        __u8    eth_tp_mdix;    /* twisted pair MDI-X status */
-        __u8    reserved2;
+        __u8    eth_tp_mdix_ctrl; /* twisted pair MDI-X control, when set,
+                                   * link should be renegotiated if necessary
+                                   */
        __u32   lp_advertising; /* Features the link partner advertises */
        __u32   reserved[2];
 };
@@ -1229,10 +1231,13 @@ struct ethtool_ops {
 #define AUTONEG_DISABLE         0x00
 #define AUTONEG_ENABLE          0x01
-/* Mode MDI or MDI-X */
+/* MDI or MDI-X status/control - if MDI/MDI_X/AUTO is set then
-#define ETH_TP_MDI_INVALID      0x00
+ * the driver is required to renegotiate link
-#define ETH_TP_MDI              0x01
+ */
-#define ETH_TP_MDI_X            0x02
+#define ETH_TP_MDI_INVALID      0x00 /* status: unknown; control: unsupported */
+#define ETH_TP_MDI              0x01 /* status: MDI;     control: force MDI */
+#define ETH_TP_MDI_X            0x02 /* status: MDI-X;   control: force MDI-X */
+#define ETH_TP_MDI_AUTO         0x03 /*                  control: auto-select */
 /* Wake-On-Lan options. */
 #define WAKE_PHY                (1 << 0)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 82b01357af8b..2ded090e10f4 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -74,6 +74,9 @@ struct sock_fprog {	/* Required for SO_ATTACH_FILTER. */
 #define         BPF_LSH         0x60
 #define         BPF_RSH         0x70
 #define         BPF_NEG         0x80
+#define         BPF_MOD         0x90
+#define         BPF_XOR         0xa0
 #define         BPF_JA          0x00
 #define         BPF_JEQ         0x10
 #define         BPF_JGT         0x20
@@ -196,10 +199,14 @@ enum {
        BPF_S_ALU_MUL_K,
        BPF_S_ALU_MUL_X,
        BPF_S_ALU_DIV_X,
+        BPF_S_ALU_MOD_K,
+        BPF_S_ALU_MOD_X,
        BPF_S_ALU_AND_K,
        BPF_S_ALU_AND_X,
        BPF_S_ALU_OR_K,
        BPF_S_ALU_OR_X,
+        BPF_S_ALU_XOR_K,
+        BPF_S_ALU_XOR_X,
        BPF_S_ALU_LSH_K,
        BPF_S_ALU_LSH_X,
        BPF_S_ALU_RSH_K,
diff --git a/include/linux/hash.h b/include/linux/hash.h
index b80506bdd733..24df9e70406f 100644
--- a/include/linux/hash.h
+++ b/include/linux/hash.h
@@ -67,4 +67,14 @@ static inline unsigned long hash_ptr(const void *ptr, unsigned int bits)
 {
        return hash_long((unsigned long)ptr, bits);
 }
+static inline u32 hash32_ptr(const void *ptr)
+{
+        unsigned long val = (unsigned long)ptr;
+#if BITS_PER_LONG == 64
+        val ^= (val >> 32);
+#endif
+        return (u32)val;
+}
 #endif /* _LINUX_HASH_H */
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index e02fc682bb68..2385119f8bb0 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1935,36 +1935,6 @@ static inline bool ieee80211_is_public_action(struct ieee80211_hdr *hdr,
 }
 /**
- * ieee80211_fhss_chan_to_freq - get channel frequency
- * @channel: the FHSS channel
- *
- * Convert IEEE802.11 FHSS channel to frequency (MHz)
- * Ref IEEE 802.11-2007 section 14.6
- */
-static inline int ieee80211_fhss_chan_to_freq(int channel)
-{
-        if ((channel > 1) && (channel < 96))
-                return channel + 2400;
-        else
-                return -1;
-}
-/**
- * ieee80211_freq_to_fhss_chan - get channel
- * @freq: the channels frequency
- *
- * Convert frequency (MHz) to IEEE802.11 FHSS channel
- * Ref IEEE 802.11-2007 section 14.6
- */
-static inline int ieee80211_freq_to_fhss_chan(int freq)
-{
-        if ((freq > 2401) && (freq < 2496))
-                return freq - 2400;
-        else
-                return -1;
-}
-/**
 * ieee80211_dsss_chan_to_freq - get channel center frequency
 * @channel: the DSSS channel
 *
@@ -2000,56 +1970,6 @@ static inline int ieee80211_freq_to_dsss_chan(int freq)
                return -1;
 }
-/* Convert IEEE802.11 HR DSSS channel to frequency (MHz) and back
- * Ref IEEE 802.11-2007 section 18.4.6.2
- *
- * The channels and frequencies are the same as those defined for DSSS
- */
-#define ieee80211_hr_chan_to_freq(chan) ieee80211_dsss_chan_to_freq(chan)
-#define ieee80211_freq_to_hr_chan(freq) ieee80211_freq_to_dsss_chan(freq)
-/* Convert IEEE802.11 ERP channel to frequency (MHz) and back
- * Ref IEEE 802.11-2007 section 19.4.2
- */
-#define ieee80211_erp_chan_to_freq(chan) ieee80211_hr_chan_to_freq(chan)
-#define ieee80211_freq_to_erp_chan(freq) ieee80211_freq_to_hr_chan(freq)
-/**
- * ieee80211_ofdm_chan_to_freq - get channel center frequency
- * @s_freq: starting frequency == (dotChannelStartingFactor/2) MHz
- * @channel: the OFDM channel
- *
- * Convert IEEE802.11 OFDM channel to center frequency (MHz)
- * Ref IEEE 802.11-2007 section 17.3.8.3.2
- */
-static inline int ieee80211_ofdm_chan_to_freq(int s_freq, int channel)
-{
-        if ((channel > 0) && (channel <= 200) &&
-            (s_freq >= 4000))
-                return s_freq + (channel * 5);
-        else
-                return -1;
-}
-/**
- * ieee80211_freq_to_ofdm_channel - get channel
- * @s_freq: starting frequency == (dotChannelStartingFactor/2) MHz
- * @freq: the frequency
- *
- * Convert frequency (MHz) to IEEE802.11 OFDM channel
- * Ref IEEE 802.11-2007 section 17.3.8.3.2
- *
- * This routine selects the channel with the closest center frequency.
- */
-static inline int ieee80211_freq_to_ofdm_chan(int s_freq, int freq)
-{
-        if ((freq > (s_freq + 2)) && (freq <= (s_freq + 1202)) &&
-            (s_freq >= 4000))
-                return (freq + 2 - s_freq) / 5;
-        else
-                return -1;
-}
 /**
 * ieee80211_tu_to_usec - convert time units (TU) to microseconds
 * @tu: the TUs
diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
index f0e69c6e8208..9adcc29f084a 100644
--- a/include/linux/if_arp.h
+++ b/include/linux/if_arp.h
@@ -92,6 +92,7 @@
 #define ARPHRD_PHONET   820             /* PhoNet media type            */
 #define ARPHRD_PHONET_PIPE 821          /* PhoNet pipe header           */
 #define ARPHRD_CAIF     822             /* CAIF media type              */
+#define ARPHRD_IP6GRE   823             /* GRE over IPv6                */
 #define ARPHRD_VOID       0xFFFF        /* Void type, nothing is known */
 #define ARPHRD_NONE       0xFFFE        /* zero header length */
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index ac173bd2ab65..e4dad4ddf085 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -272,6 +272,22 @@ enum macvlan_mode {
 #define MACVLAN_FLAG_NOPROMISC  1
+/* VXLAN section */
+enum {
+        IFLA_VXLAN_UNSPEC,
+        IFLA_VXLAN_ID,
+        IFLA_VXLAN_GROUP,
+        IFLA_VXLAN_LINK,
+        IFLA_VXLAN_LOCAL,
+        IFLA_VXLAN_TTL,
+        IFLA_VXLAN_TOS,
+        IFLA_VXLAN_LEARNING,
+        IFLA_VXLAN_AGEING,
+        IFLA_VXLAN_LIMIT,
+        __IFLA_VXLAN_MAX
+};
+#define IFLA_VXLAN_MAX  (__IFLA_VXLAN_MAX - 1)
 /* SR-IOV virtual function management section */
 enum {
@@ -398,4 +414,22 @@ struct ifla_port_vsi {
        __u8 pad[3];
 };
+/* IPoIB section */
+enum {
+        IFLA_IPOIB_UNSPEC,
+        IFLA_IPOIB_PKEY,
+        IFLA_IPOIB_MODE,
+        IFLA_IPOIB_UMCAST,
+        __IFLA_IPOIB_MAX
+};
+enum {
+        IPOIB_MODE_DATAGRAM  = 0, /* using unreliable datagram QPs */
+        IPOIB_MODE_CONNECTED = 1, /* using connected QPs */
+};
+#define IFLA_IPOIB_MAX (__IFLA_IPOIB_MAX - 1)
 #endif /* _LINUX_IF_LINK_H */
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index aa2e167e1ef4..6d88a7f57680 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -67,6 +67,9 @@ struct team_port {
        struct netpoll *np;
 #endif
+        s32 priority; /* lower number ~ higher priority */
+        u16 queue_id;
+        struct list_head qom_list; /* node in queue override mapping list */
        long mode_priv[0];
 };
@@ -105,7 +108,7 @@ struct team_mode_ops {
        bool (*transmit)(struct team *team, struct sk_buff *skb);
        int (*port_enter)(struct team *team, struct team_port *port);
        void (*port_leave)(struct team *team, struct team_port *port);
-        void (*port_change_mac)(struct team *team, struct team_port *port);
+        void (*port_change_dev_addr)(struct team *team, struct team_port *port);
        void (*port_enabled)(struct team *team, struct team_port *port);
        void (*port_disabled)(struct team *team, struct team_port *port);
 };
@@ -115,6 +118,7 @@ enum team_option_type {
        TEAM_OPTION_TYPE_STRING,
        TEAM_OPTION_TYPE_BINARY,
        TEAM_OPTION_TYPE_BOOL,
+        TEAM_OPTION_TYPE_S32,
 };
 struct team_option_inst_info {
@@ -131,6 +135,7 @@ struct team_gsetter_ctx {
                        u32 len;
                } bin_val;
                bool bool_val;
+                s32 s32_val;
        } data;
        struct team_option_inst_info *info;
 };
@@ -182,6 +187,8 @@ struct team {
        const struct team_mode *mode;
        struct team_mode_ops ops;
+        bool queue_override_enabled;
+        struct list_head *qom_lists; /* array of queue override mapping lists */
        long mode_priv[TEAM_MODE_PRIV_LONGS];
 };
@@ -231,7 +238,7 @@ static inline struct team_port *team_get_port_by_index_rcu(struct team *team,
        return NULL;
 }
-extern int team_port_set_team_mac(struct team_port *port);
+extern int team_port_set_team_dev_addr(struct team_port *port);
 extern int team_options_register(struct team *team,
                                 const struct team_option *option,
                                 size_t option_count);
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index 5efff60b6f56..8c5035ac3142 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -75,6 +75,9 @@ enum {
        IFLA_GRE_TTL,
        IFLA_GRE_TOS,
        IFLA_GRE_PMTUDISC,
+        IFLA_GRE_ENCAP_LIMIT,
+        IFLA_GRE_FLOWINFO,
+        IFLA_GRE_FLAGS,
        __IFLA_GRE_MAX,
 };
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index a810987cb80e..e6ff12dd717b 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -74,8 +74,6 @@ static inline struct vlan_ethhdr *vlan_eth_hdr(const struct sk_buff *skb)
 /* found in socket.c */
 extern void vlan_ioctl_set(int (*hook)(struct net *, void __user *));
-struct vlan_info;
 static inline int is_vlan_dev(struct net_device *dev)
 {
        return dev->priv_flags & IFF_802_1Q_VLAN;
@@ -101,6 +99,8 @@ extern int vlan_vids_add_by_dev(struct net_device *dev,
                                const struct net_device *by_dev);
 extern void vlan_vids_del_by_dev(struct net_device *dev,
                                 const struct net_device *by_dev);
+extern bool vlan_uses_dev(const struct net_device *dev);
 #else
 static inline struct net_device *
 __vlan_find_dev_deep(struct net_device *real_dev, u16 vlan_id)
@@ -151,6 +151,11 @@ static inline void vlan_vids_del_by_dev(struct net_device *dev,
                                        const struct net_device *by_dev)
 {
 }
+static inline bool vlan_uses_dev(const struct net_device *dev)
+{
+        return false;
+}
 #endif
 /**
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 67f9ddacb70c..d032780d0ce5 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -104,9 +104,14 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 #define IN_DEV_ANDCONF(in_dev, attr) \
        (IPV4_DEVCONF_ALL(dev_net(in_dev->dev), attr) && \
         IN_DEV_CONF_GET((in_dev), attr))
-#define IN_DEV_ORCONF(in_dev, attr) \
-        (IPV4_DEVCONF_ALL(dev_net(in_dev->dev), attr) || \
+#define IN_DEV_NET_ORCONF(in_dev, net, attr) \
+        (IPV4_DEVCONF_ALL(net, attr) || \
         IN_DEV_CONF_GET((in_dev), attr))
+#define IN_DEV_ORCONF(in_dev, attr) \
+        IN_DEV_NET_ORCONF(in_dev, dev_net(in_dev->dev), attr)
 #define IN_DEV_MAXCONF(in_dev, attr) \
        (max(IPV4_DEVCONF_ALL(dev_net(in_dev->dev), attr), \
             IN_DEV_CONF_GET((in_dev), attr)))
@@ -133,6 +138,8 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
                                        IN_DEV_ORCONF((in_dev), \
                                                      PROMOTE_SECONDARIES)
 #define IN_DEV_ROUTE_LOCALNET(in_dev)   IN_DEV_ORCONF(in_dev, ROUTE_LOCALNET)
+#define IN_DEV_NET_ROUTE_LOCALNET(in_dev, net)  \
+        IN_DEV_NET_ORCONF(in_dev, net, ROUTE_LOCALNET)
 #define IN_DEV_RX_REDIRECTS(in_dev) \
        ((IN_DEV_FORWARD(in_dev) && \
diff --git a/include/linux/ip6_tunnel.h b/include/linux/ip6_tunnel.h
index bf22b0317902..48af63c9a48d 100644
--- a/include/linux/ip6_tunnel.h
+++ b/include/linux/ip6_tunnel.h
@@ -31,4 +31,21 @@ struct ip6_tnl_parm {
        struct in6_addr raddr;  /* remote tunnel end-point address */
 };
+struct ip6_tnl_parm2 {
+        char name[IFNAMSIZ];    /* name of tunnel device */
+        int link;               /* ifindex of underlying L2 interface */
+        __u8 proto;             /* tunnel protocol */
+        __u8 encap_limit;       /* encapsulation limit for tunnel */
+        __u8 hop_limit;         /* hop limit for tunnel */
+        __be32 flowinfo;        /* traffic class and flowlabel for tunnel */
+        __u32 flags;            /* tunnel flags */
+        struct in6_addr laddr;  /* local tunnel end-point address */
+        struct in6_addr raddr;  /* remote tunnel end-point address */
+        __be16                  i_flags;
+        __be16                  o_flags;
+        __be32                  i_key;
+        __be32                  o_key;
+};
 #endif
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 879db26ec401..0b94e91ed685 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -256,6 +256,7 @@ struct inet6_skb_parm {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
        __u16                   dsthao;
 #endif
+        __u16                   frag_max_size;
 #define IP6SKB_XFRM_TRANSFORMED 1
 #define IP6SKB_FORWARDED        2
diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
index 82680541576d..05e3c2c7a8cf 100644
--- a/include/linux/jiffies.h
+++ b/include/linux/jiffies.h
@@ -312,7 +312,13 @@ extern void jiffies_to_timespec(const unsigned long jiffies,
 extern unsigned long timeval_to_jiffies(const struct timeval *value);
 extern void jiffies_to_timeval(const unsigned long jiffies,
                               struct timeval *value);
 extern clock_t jiffies_to_clock_t(unsigned long x);
+static inline clock_t jiffies_delta_to_clock_t(long delta)
+{
+        return jiffies_to_clock_t(max(0L, delta));
+}
 extern unsigned long clock_t_to_jiffies(unsigned long x);
 extern u64 jiffies_64_to_clock_t(u64 x);
 extern u64 nsec_to_clock_t(u64 x);
diff --git a/include/linux/mdio.h b/include/linux/mdio.h
index 7cccafe50e7b..6c406845f7e2 100644
--- a/include/linux/mdio.h
+++ b/include/linux/mdio.h
@@ -377,5 +377,88 @@ static inline void mdio45_ethtool_gset(const struct mdio_if_info *mdio,
 extern int mdio_mii_ioctl(const struct mdio_if_info *mdio,
                          struct mii_ioctl_data *mii_data, int cmd);
+/**
+ * mmd_eee_cap_to_ethtool_sup_t
+ * @eee_cap: value of the MMD EEE Capability register
+ *
+ * A small helper function that translates MMD EEE Capability (3.20) bits
+ * to ethtool supported settings.
+ */
+static inline u32 mmd_eee_cap_to_ethtool_sup_t(u16 eee_cap)
+{
+        u32 supported = 0;
+        if (eee_cap & MDIO_EEE_100TX)
+                supported |= SUPPORTED_100baseT_Full;
+        if (eee_cap & MDIO_EEE_1000T)
+                supported |= SUPPORTED_1000baseT_Full;
+        if (eee_cap & MDIO_EEE_10GT)
+                supported |= SUPPORTED_10000baseT_Full;
+        if (eee_cap & MDIO_EEE_1000KX)
+                supported |= SUPPORTED_1000baseKX_Full;
+        if (eee_cap & MDIO_EEE_10GKX4)
+                supported |= SUPPORTED_10000baseKX4_Full;
+        if (eee_cap & MDIO_EEE_10GKR)
+                supported |= SUPPORTED_10000baseKR_Full;
+        return supported;
+}
+/**
+ * mmd_eee_adv_to_ethtool_adv_t
+ * @eee_adv: value of the MMD EEE Advertisement/Link Partner Ability registers
+ *
+ * A small helper function that translates the MMD EEE Advertisment (7.60)
+ * and MMD EEE Link Partner Ability (7.61) bits to ethtool advertisement
+ * settings.
+ */
+static inline u32 mmd_eee_adv_to_ethtool_adv_t(u16 eee_adv)
+{
+        u32 adv = 0;
+        if (eee_adv & MDIO_EEE_100TX)
+                adv |= ADVERTISED_100baseT_Full;
+        if (eee_adv & MDIO_EEE_1000T)
+                adv |= ADVERTISED_1000baseT_Full;
+        if (eee_adv & MDIO_EEE_10GT)
+                adv |= ADVERTISED_10000baseT_Full;
+        if (eee_adv & MDIO_EEE_1000KX)
+                adv |= ADVERTISED_1000baseKX_Full;
+        if (eee_adv & MDIO_EEE_10GKX4)
+                adv |= ADVERTISED_10000baseKX4_Full;
+        if (eee_adv & MDIO_EEE_10GKR)
+                adv |= ADVERTISED_10000baseKR_Full;
+        return adv;
+}
+/**
+ * ethtool_adv_to_mmd_eee_adv_t
+ * @adv: the ethtool advertisement settings
+ *
+ * A small helper function that translates ethtool advertisement settings
+ * to EEE advertisements for the MMD EEE Advertisement (7.60) and
+ * MMD EEE Link Partner Ability (7.61) registers.
+ */
+static inline u16 ethtool_adv_to_mmd_eee_adv_t(u32 adv)
+{
+        u16 reg = 0;
+        if (adv & ADVERTISED_100baseT_Full)
+                reg |= MDIO_EEE_100TX;
+        if (adv & ADVERTISED_1000baseT_Full)
+                reg |= MDIO_EEE_1000T;
+        if (adv & ADVERTISED_10000baseT_Full)
+                reg |= MDIO_EEE_10GT;
+        if (adv & ADVERTISED_1000baseKX_Full)
+                reg |= MDIO_EEE_1000KX;
+        if (adv & ADVERTISED_10000baseKX4_Full)
+                reg |= MDIO_EEE_10GKX4;
+        if (adv & ADVERTISED_10000baseKR_Full)
+                reg |= MDIO_EEE_10GKR;
+        return reg;
+}
 #endif /* __KERNEL__ */
 #endif /* __LINUX_MDIO_H__ */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5f49cc0a107e..01646aa53b0e 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -338,18 +338,16 @@ struct napi_struct {
        unsigned long           state;
        int                     weight;
+        unsigned int            gro_count;
        int                     (*poll)(struct napi_struct *, int);
 #ifdef CONFIG_NETPOLL
        spinlock_t              poll_lock;
        int                     poll_owner;
 #endif
-        unsigned int            gro_count;
        struct net_device       *dev;
-        struct list_head        dev_list;
        struct sk_buff          *gro_list;
        struct sk_buff          *skb;
+        struct list_head        dev_list;
 };
 enum {
@@ -906,11 +904,12 @@ struct netdev_fcoe_hbainfo {
 *      feature set might be less than what was returned by ndo_fix_features()).
 *      Must return >0 or -errno if it changed dev->features itself.
 *
- * int (*ndo_fdb_add)(struct ndmsg *ndm, struct net_device *dev,
+ * int (*ndo_fdb_add)(struct ndmsg *ndm, struct nlattr *tb[],
- *                    unsigned char *addr, u16 flags)
+ *                    struct net_device *dev,
+ *                    const unsigned char *addr, u16 flags)
 *      Adds an FDB entry to dev for addr.
 * int (*ndo_fdb_del)(struct ndmsg *ndm, struct net_device *dev,
- *                    unsigned char *addr)
+ *                    const unsigned char *addr)
 *      Deletes the FDB entry from dev coresponding to addr.
 * int (*ndo_fdb_dump)(struct sk_buff *skb, struct netlink_callback *cb,
 *                     struct net_device *dev, int idx)
@@ -1016,12 +1015,13 @@ struct net_device_ops {
        void                    (*ndo_neigh_destroy)(struct neighbour *n);
        int                     (*ndo_fdb_add)(struct ndmsg *ndm,
+                                               struct nlattr *tb[],
                                               struct net_device *dev,
-                                               unsigned char *addr,
+                                               const unsigned char *addr,
                                               u16 flags);
        int                     (*ndo_fdb_del)(struct ndmsg *ndm,
                                               struct net_device *dev,
-                                               unsigned char *addr);
+                                               const unsigned char *addr);
        int                     (*ndo_fdb_dump)(struct sk_buff *skb,
                                                struct netlink_callback *cb,
                                                struct net_device *dev,
@@ -1322,6 +1322,8 @@ struct net_device {
        /* phy device may attach itself for hardware timestamping */
        struct phy_device *phydev;
+        struct lock_class_key *qdisc_tx_busylock;
        /* group the device belongs to */
        int group;
@@ -1401,6 +1403,9 @@ static inline void netdev_for_each_tx_queue(struct net_device *dev,
                f(dev, &dev->_tx[i], arg);
 }
+extern struct netdev_queue *netdev_pick_tx(struct net_device *dev,
+                                           struct sk_buff *skb);
 /*
 * Net namespace inlines
 */
@@ -1553,7 +1558,7 @@ struct packet_type {
 #define NETDEV_PRE_TYPE_CHANGE  0x000E
 #define NETDEV_POST_TYPE_CHANGE 0x000F
 #define NETDEV_POST_INIT        0x0010
-#define NETDEV_UNREGISTER_BATCH 0x0011
+#define NETDEV_UNREGISTER_FINAL 0x0011
 #define NETDEV_RELEASE          0x0012
 #define NETDEV_NOTIFY_PEERS     0x0013
 #define NETDEV_JOIN             0x0014
@@ -2227,6 +2232,7 @@ static inline void dev_hold(struct net_device *dev)
 * kind of lower layer not just hardware media.
 */
+extern void linkwatch_init_dev(struct net_device *dev);
 extern void linkwatch_fire_event(struct net_device *dev);
 extern void linkwatch_forget_dev(struct net_device *dev);
@@ -2249,8 +2255,6 @@ extern void netif_carrier_on(struct net_device *dev);
 extern void netif_carrier_off(struct net_device *dev);
-extern void netif_notify_peers(struct net_device *dev);
 /**
 *      netif_dormant_on - mark device as dormant.
 *      @dev: network device
@@ -2560,9 +2564,9 @@ extern void __hw_addr_flush(struct netdev_hw_addr_list *list);
 extern void __hw_addr_init(struct netdev_hw_addr_list *list);
 /* Functions used for device addresses handling */
-extern int dev_addr_add(struct net_device *dev, unsigned char *addr,
+extern int dev_addr_add(struct net_device *dev, const unsigned char *addr,
                        unsigned char addr_type);
-extern int dev_addr_del(struct net_device *dev, unsigned char *addr,
+extern int dev_addr_del(struct net_device *dev, const unsigned char *addr,
                        unsigned char addr_type);
 extern int dev_addr_add_multiple(struct net_device *to_dev,
                                 struct net_device *from_dev,
@@ -2574,20 +2578,20 @@ extern void dev_addr_flush(struct net_device *dev);
 extern int dev_addr_init(struct net_device *dev);
 /* Functions used for unicast addresses handling */
-extern int dev_uc_add(struct net_device *dev, unsigned char *addr);
+extern int dev_uc_add(struct net_device *dev, const unsigned char *addr);
-extern int dev_uc_add_excl(struct net_device *dev, unsigned char *addr);
+extern int dev_uc_add_excl(struct net_device *dev, const unsigned char *addr);
-extern int dev_uc_del(struct net_device *dev, unsigned char *addr);
+extern int dev_uc_del(struct net_device *dev, const unsigned char *addr);
 extern int dev_uc_sync(struct net_device *to, struct net_device *from);
 extern void dev_uc_unsync(struct net_device *to, struct net_device *from);
 extern void dev_uc_flush(struct net_device *dev);
 extern void dev_uc_init(struct net_device *dev);
 /* Functions used for multicast addresses handling */
-extern int dev_mc_add(struct net_device *dev, unsigned char *addr);
+extern int dev_mc_add(struct net_device *dev, const unsigned char *addr);
-extern int dev_mc_add_global(struct net_device *dev, unsigned char *addr);
+extern int dev_mc_add_global(struct net_device *dev, const unsigned char *addr);
-extern int dev_mc_add_excl(struct net_device *dev, unsigned char *addr);
+extern int dev_mc_add_excl(struct net_device *dev, const unsigned char *addr);
-extern int dev_mc_del(struct net_device *dev, unsigned char *addr);
+extern int dev_mc_del(struct net_device *dev, const unsigned char *addr);
-extern int dev_mc_del_global(struct net_device *dev, unsigned char *addr);
+extern int dev_mc_del_global(struct net_device *dev, const unsigned char *addr);
 extern int dev_mc_sync(struct net_device *to, struct net_device *from);
 extern void dev_mc_unsync(struct net_device *to, struct net_device *from);
 extern void dev_mc_flush(struct net_device *dev);
@@ -2599,8 +2603,7 @@ extern void		__dev_set_rx_mode(struct net_device *dev);
 extern int              dev_set_promiscuity(struct net_device *dev, int inc);
 extern int              dev_set_allmulti(struct net_device *dev, int inc);
 extern void             netdev_state_change(struct net_device *dev);
-extern int              netdev_bonding_change(struct net_device *dev,
+extern void             netdev_notify_peers(struct net_device *dev);
-                                              unsigned long event);
 extern void             netdev_features_change(struct net_device *dev);
 /* Load a device via the kmod */
 extern void             dev_load(struct net *net, const char *name);
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index c613cf0d7884..1dcf2a38e51f 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -342,7 +342,7 @@ extern int nf_register_afinfo(const struct nf_afinfo *afinfo);
 extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
 #include <net/flow.h>
-extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
+extern void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
 static inline void
 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
@@ -350,13 +350,11 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
 #ifdef CONFIG_NF_NAT_NEEDED
        void (*decodefn)(struct sk_buff *, struct flowi *);
-        if (family == AF_INET) {
+        rcu_read_lock();
-                rcu_read_lock();
+        decodefn = rcu_dereference(nf_nat_decode_session_hook);
-                decodefn = rcu_dereference(ip_nat_decode_session);
+        if (decodefn)
-                if (decodefn)
+                decodefn(skb, fl);
-                        decodefn(skb, fl);
+        rcu_read_unlock();
-                rcu_read_unlock();
-        }
 #endif
 }
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index 2edc64cab739..528697b3c152 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -190,6 +190,7 @@ enum ip_set_dim {
         * If changed, new revision of iptables match/target is required.
         */
        IPSET_DIM_MAX = 6,
+        IPSET_BIT_RETURN_NOMATCH = 7,
 };
 /* Option flags for kernel operations */
@@ -198,6 +199,7 @@ enum ip_set_kopt {
        IPSET_DIM_ONE_SRC = (1 << IPSET_DIM_ONE),
        IPSET_DIM_TWO_SRC = (1 << IPSET_DIM_TWO),
        IPSET_DIM_THREE_SRC = (1 << IPSET_DIM_THREE),
+        IPSET_RETURN_NOMATCH = (1 << IPSET_BIT_RETURN_NOMATCH),
 };
 #ifdef __KERNEL__
@@ -206,9 +208,15 @@ enum ip_set_kopt {
 #include <linux/netlink.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter/x_tables.h>
+#include <linux/stringify.h>
 #include <linux/vmalloc.h>
 #include <net/netlink.h>
+#define _IP_SET_MODULE_DESC(a, b, c)            \
+        MODULE_DESCRIPTION(a " type of IP sets, revisions " b "-" c)
+#define IP_SET_MODULE_DESC(a, b, c)             \
+        _IP_SET_MODULE_DESC(a, __stringify(b), __stringify(c))
 /* Set features */
 enum ip_set_feature {
        IPSET_TYPE_IP_FLAG = 0,
@@ -223,6 +231,8 @@ enum ip_set_feature {
        IPSET_TYPE_NAME = (1 << IPSET_TYPE_NAME_FLAG),
        IPSET_TYPE_IFACE_FLAG = 5,
        IPSET_TYPE_IFACE = (1 << IPSET_TYPE_IFACE_FLAG),
+        IPSET_TYPE_NOMATCH_FLAG = 6,
+        IPSET_TYPE_NOMATCH = (1 << IPSET_TYPE_NOMATCH_FLAG),
        /* Strictly speaking not a feature, but a flag for dumping:
         * this settype must be dumped last */
        IPSET_DUMP_LAST_FLAG = 7,
@@ -249,7 +259,7 @@ struct ip_set_type_variant {
         *              returns negative error code,
         *                      zero for no match/success to add/delete
         *                      positive for matching element */
-        int (*kadt)(struct ip_set *set, const struct sk_buff * skb,
+        int (*kadt)(struct ip_set *set, const struct sk_buff *skb,
                    const struct xt_action_param *par,
                    enum ipset_adt adt, const struct ip_set_adt_opt *opt);
@@ -424,7 +434,8 @@ static inline int nla_put_ipaddr4(struct sk_buff *skb, int type, __be32 ipaddr)
        return ret;
 }
-static inline int nla_put_ipaddr6(struct sk_buff *skb, int type, const struct in6_addr *ipaddrptr)
+static inline int nla_put_ipaddr6(struct sk_buff *skb, int type,
+                                  const struct in6_addr *ipaddrptr)
 {
        struct nlattr *__nested = ipset_nest_start(skb, type);
        int ret;
diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
index b114d35aea5e..ef9acd3c8450 100644
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ b/include/linux/netfilter/ipset/ip_set_ahash.h
@@ -137,50 +137,59 @@ htable_bits(u32 hashsize)
 #endif
 #define SET_HOST_MASK(family)   (family == AF_INET ? 32 : 128)
+#ifdef IP_SET_HASH_WITH_MULTI
+#define NETS_LENGTH(family)     (SET_HOST_MASK(family) + 1)
+#else
+#define NETS_LENGTH(family)     SET_HOST_MASK(family)
+#endif
 /* Network cidr size book keeping when the hash stores different
 * sized networks */
 static void
-add_cidr(struct ip_set_hash *h, u8 cidr, u8 host_mask)
+add_cidr(struct ip_set_hash *h, u8 cidr, u8 nets_length)
 {
-        u8 i;
+        int i, j;
-        ++h->nets[cidr-1].nets;
-        pr_debug("add_cidr added %u: %u\n", cidr, h->nets[cidr-1].nets);
-        if (h->nets[cidr-1].nets > 1)
+        /* Add in increasing prefix order, so larger cidr first */
-                return;
+        for (i = 0, j = -1; i < nets_length && h->nets[i].nets; i++) {
+                if (j != -1)
-        /* New cidr size */
+                        continue;
-        for (i = 0; i < host_mask && h->nets[i].cidr; i++) {
+                else if (h->nets[i].cidr < cidr)
-                /* Add in increasing prefix order, so larger cidr first */
+                        j = i;
-                if (h->nets[i].cidr < cidr)
+                else if (h->nets[i].cidr == cidr) {
-                        swap(h->nets[i].cidr, cidr);
+                        h->nets[i].nets++;
+                        return;
+                }
+        }
+        if (j != -1) {
+                for (; i > j; i--) {
+                        h->nets[i].cidr = h->nets[i - 1].cidr;
+                        h->nets[i].nets = h->nets[i - 1].nets;
+                }
        }
-        if (i < host_mask)
+        h->nets[i].cidr = cidr;
-                h->nets[i].cidr = cidr;
+        h->nets[i].nets = 1;
 }
 static void
-del_cidr(struct ip_set_hash *h, u8 cidr, u8 host_mask)
+del_cidr(struct ip_set_hash *h, u8 cidr, u8 nets_length)
 {
-        u8 i;
+        u8 i, j;
-        --h->nets[cidr-1].nets;
-        pr_debug("del_cidr deleted %u: %u\n", cidr, h->nets[cidr-1].nets);
+        for (i = 0; i < nets_length - 1 && h->nets[i].cidr != cidr; i++)
+                ;
+        h->nets[i].nets--;
-        if (h->nets[cidr-1].nets != 0)
+        if (h->nets[i].nets != 0)
                return;
-        /* All entries with this cidr size deleted, so cleanup h->cidr[] */
+        for (j = i; j < nets_length - 1 && h->nets[j].nets; j++) {
-        for (i = 0; i < host_mask - 1 && h->nets[i].cidr; i++) {
+                h->nets[j].cidr = h->nets[j + 1].cidr;
-                if (h->nets[i].cidr == cidr)
+                h->nets[j].nets = h->nets[j + 1].nets;
-                        h->nets[i].cidr = cidr = h->nets[i+1].cidr;
        }
-        h->nets[i - 1].cidr = 0;
 }
+#else
+#define NETS_LENGTH(family)             0
 #endif
 /* Destroy the hashtable part of the set */
@@ -202,14 +211,14 @@ ahash_destroy(struct htable *t)
 /* Calculate the actual memory size of the set data */
 static size_t
-ahash_memsize(const struct ip_set_hash *h, size_t dsize, u8 host_mask)
+ahash_memsize(const struct ip_set_hash *h, size_t dsize, u8 nets_length)
 {
        u32 i;
        struct htable *t = h->table;
        size_t memsize = sizeof(*h)
                         + sizeof(*t)
 #ifdef IP_SET_HASH_WITH_NETS
-                         + sizeof(struct ip_set_hash_nets) * host_mask
+                         + sizeof(struct ip_set_hash_nets) * nets_length
 #endif
                         + jhash_size(t->htable_bits) * sizeof(struct hbucket);
@@ -238,7 +247,7 @@ ip_set_hash_flush(struct ip_set *set)
        }
 #ifdef IP_SET_HASH_WITH_NETS
        memset(h->nets, 0, sizeof(struct ip_set_hash_nets)
-                           * SET_HOST_MASK(set->family));
+                           * NETS_LENGTH(set->family));
 #endif
        h->elements = 0;
 }
@@ -271,9 +280,6 @@ ip_set_hash_destroy(struct ip_set *set)
 (jhash2((u32 *)(data), HKEY_DATALEN/sizeof(u32), initval)       \
        & jhash_mask(htable_bits))
-#define CONCAT(a, b, c)         a##b##c
-#define TOKEN(a, b, c)          CONCAT(a, b, c)
 /* Type/family dependent function prototypes */
 #define type_pf_data_equal      TOKEN(TYPE, PF, _data_equal)
@@ -478,7 +484,7 @@ type_pf_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
        }
 #ifdef IP_SET_HASH_WITH_NETS
-        add_cidr(h, CIDR(d->cidr), HOST_MASK);
+        add_cidr(h, CIDR(d->cidr), NETS_LENGTH(set->family));
 #endif
        h->elements++;
 out:
@@ -513,7 +519,7 @@ type_pf_del(struct ip_set *set, void *value, u32 timeout, u32 flags)
                n->pos--;
                h->elements--;
 #ifdef IP_SET_HASH_WITH_NETS
-                del_cidr(h, CIDR(d->cidr), HOST_MASK);
+                del_cidr(h, CIDR(d->cidr), NETS_LENGTH(set->family));
 #endif
                if (n->pos + AHASH_INIT_SIZE < n->size) {
                        void *tmp = kzalloc((n->size - AHASH_INIT_SIZE)
@@ -546,10 +552,10 @@ type_pf_test_cidrs(struct ip_set *set, struct type_pf_elem *d, u32 timeout)
        const struct type_pf_elem *data;
        int i, j = 0;
        u32 key, multi = 0;
-        u8 host_mask = SET_HOST_MASK(set->family);
+        u8 nets_length = NETS_LENGTH(set->family);
        pr_debug("test by nets\n");
-        for (; j < host_mask && h->nets[j].cidr && !multi; j++) {
+        for (; j < nets_length && h->nets[j].nets && !multi; j++) {
                type_pf_data_netmask(d, h->nets[j].cidr);
                key = HKEY(d, h->initval, t->htable_bits);
                n = hbucket(t, key);
@@ -604,7 +610,7 @@ type_pf_head(struct ip_set *set, struct sk_buff *skb)
        memsize = ahash_memsize(h, with_timeout(h->timeout)
                                        ? sizeof(struct type_pf_telem)
                                        : sizeof(struct type_pf_elem),
-                                set->family == AF_INET ? 32 : 128);
+                                NETS_LENGTH(set->family));
        read_unlock_bh(&set->lock);
        nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
@@ -690,7 +696,7 @@ nla_put_failure:
 }
 static int
-type_pf_kadt(struct ip_set *set, const struct sk_buff * skb,
+type_pf_kadt(struct ip_set *set, const struct sk_buff *skb,
             const struct xt_action_param *par,
             enum ipset_adt adt, const struct ip_set_adt_opt *opt);
 static int
@@ -783,7 +789,7 @@ type_pf_elem_tadd(struct hbucket *n, const struct type_pf_elem *value,
 /* Delete expired elements from the hashtable */
 static void
-type_pf_expire(struct ip_set_hash *h)
+type_pf_expire(struct ip_set_hash *h, u8 nets_length)
 {
        struct htable *t = h->table;
        struct hbucket *n;
@@ -798,7 +804,7 @@ type_pf_expire(struct ip_set_hash *h)
                        if (type_pf_data_expired(data)) {
                                pr_debug("expired %u/%u\n", i, j);
 #ifdef IP_SET_HASH_WITH_NETS
-                                del_cidr(h, CIDR(data->cidr), HOST_MASK);
+                                del_cidr(h, CIDR(data->cidr), nets_length);
 #endif
                                if (j != n->pos - 1)
                                        /* Not last one */
@@ -839,7 +845,7 @@ type_pf_tresize(struct ip_set *set, bool retried)
        if (!retried) {
                i = h->elements;
                write_lock_bh(&set->lock);
-                type_pf_expire(set->data);
+                type_pf_expire(set->data, NETS_LENGTH(set->family));
                write_unlock_bh(&set->lock);
                if (h->elements <  i)
                        return 0;
@@ -904,7 +910,7 @@ type_pf_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
        if (h->elements >= h->maxelem)
                /* FIXME: when set is full, we slow down here */
-                type_pf_expire(h);
+                type_pf_expire(h, NETS_LENGTH(set->family));
        if (h->elements >= h->maxelem) {
                if (net_ratelimit())
                        pr_warning("Set %s is full, maxelem %u reached\n",
@@ -933,8 +939,8 @@ type_pf_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
        if (j != AHASH_MAX(h) + 1) {
                data = ahash_tdata(n, j);
 #ifdef IP_SET_HASH_WITH_NETS
-                del_cidr(h, CIDR(data->cidr), HOST_MASK);
+                del_cidr(h, CIDR(data->cidr), NETS_LENGTH(set->family));
-                add_cidr(h, CIDR(d->cidr), HOST_MASK);
+                add_cidr(h, CIDR(d->cidr), NETS_LENGTH(set->family));
 #endif
                type_pf_data_copy(data, d);
                type_pf_data_timeout_set(data, timeout);
@@ -952,7 +958,7 @@ type_pf_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
        }
 #ifdef IP_SET_HASH_WITH_NETS
-        add_cidr(h, CIDR(d->cidr), HOST_MASK);
+        add_cidr(h, CIDR(d->cidr), NETS_LENGTH(set->family));
 #endif
        h->elements++;
 out:
@@ -986,7 +992,7 @@ type_pf_tdel(struct ip_set *set, void *value, u32 timeout, u32 flags)
                n->pos--;
                h->elements--;
 #ifdef IP_SET_HASH_WITH_NETS
-                del_cidr(h, CIDR(d->cidr), HOST_MASK);
+                del_cidr(h, CIDR(d->cidr), NETS_LENGTH(set->family));
 #endif
                if (n->pos + AHASH_INIT_SIZE < n->size) {
                        void *tmp = kzalloc((n->size - AHASH_INIT_SIZE)
@@ -1016,9 +1022,9 @@ type_pf_ttest_cidrs(struct ip_set *set, struct type_pf_elem *d, u32 timeout)
        struct hbucket *n;
        int i, j = 0;
        u32 key, multi = 0;
-        u8 host_mask = SET_HOST_MASK(set->family);
+        u8 nets_length = NETS_LENGTH(set->family);
-        for (; j < host_mask && h->nets[j].cidr && !multi; j++) {
+        for (; j < nets_length && h->nets[j].nets && !multi; j++) {
                type_pf_data_netmask(d, h->nets[j].cidr);
                key = HKEY(d, h->initval, t->htable_bits);
                n = hbucket(t, key);
@@ -1147,7 +1153,7 @@ type_pf_gc(unsigned long ul_set)
        pr_debug("called\n");
        write_lock_bh(&set->lock);
-        type_pf_expire(h);
+        type_pf_expire(h, NETS_LENGTH(set->family));
        write_unlock_bh(&set->lock);
        h->gc.expires = jiffies + IPSET_GC_PERIOD(h->timeout) * HZ;
diff --git a/include/linux/netfilter/nf_conntrack_amanda.h b/include/linux/netfilter/nf_conntrack_amanda.h
index 0bb5a6976bf3..4b59a1584959 100644
--- a/include/linux/netfilter/nf_conntrack_amanda.h
+++ b/include/linux/netfilter/nf_conntrack_amanda.h
@@ -4,6 +4,7 @@
 extern unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
                                          enum ip_conntrack_info ctinfo,
+                                          unsigned int protoff,
                                          unsigned int matchoff,
                                          unsigned int matchlen,
                                          struct nf_conntrack_expect *exp);
diff --git a/include/linux/netfilter/nf_conntrack_ftp.h b/include/linux/netfilter/nf_conntrack_ftp.h
index 3e3aa08980c3..8faf3f792d13 100644
--- a/include/linux/netfilter/nf_conntrack_ftp.h
+++ b/include/linux/netfilter/nf_conntrack_ftp.h
@@ -18,13 +18,17 @@ enum nf_ct_ftp_type {
 #define FTP_PORT        21
+#define NF_CT_FTP_SEQ_PICKUP    (1 << 0)
 #define NUM_SEQ_TO_REMEMBER 2
 /* This structure exists only once per master */
 struct nf_ct_ftp_master {
        /* Valid seq positions for cmd matching after newline */
        u_int32_t seq_aft_nl[IP_CT_DIR_MAX][NUM_SEQ_TO_REMEMBER];
        /* 0 means seq_match_aft_nl not set */
-        int seq_aft_nl_num[IP_CT_DIR_MAX];
+        u_int16_t seq_aft_nl_num[IP_CT_DIR_MAX];
+        /* pickup sequence tracking, useful for conntrackd */
+        u_int16_t flags[IP_CT_DIR_MAX];
 };
 struct nf_conntrack_expect;
@@ -34,6 +38,7 @@ struct nf_conntrack_expect;
 extern unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
                                       enum ip_conntrack_info ctinfo,
                                       enum nf_ct_ftp_type type,
+                                       unsigned int protoff,
                                       unsigned int matchoff,
                                       unsigned int matchlen,
                                       struct nf_conntrack_expect *exp);
diff --git a/include/linux/netfilter/nf_conntrack_h323.h b/include/linux/netfilter/nf_conntrack_h323.h
index 26f9226ea72b..f381020eee92 100644
--- a/include/linux/netfilter/nf_conntrack_h323.h
+++ b/include/linux/netfilter/nf_conntrack_h323.h
@@ -36,12 +36,12 @@ extern void nf_conntrack_h245_expect(struct nf_conn *new,
                                     struct nf_conntrack_expect *this);
 extern void nf_conntrack_q931_expect(struct nf_conn *new,
                                     struct nf_conntrack_expect *this);
-extern int (*set_h245_addr_hook) (struct sk_buff *skb,
+extern int (*set_h245_addr_hook) (struct sk_buff *skb, unsigned int protoff,
                                  unsigned char **data, int dataoff,
                                  H245_TransportAddress *taddr,
                                  union nf_inet_addr *addr,
                                  __be16 port);
-extern int (*set_h225_addr_hook) (struct sk_buff *skb,
+extern int (*set_h225_addr_hook) (struct sk_buff *skb, unsigned int protoff,
                                  unsigned char **data, int dataoff,
                                  TransportAddress *taddr,
                                  union nf_inet_addr *addr,
@@ -49,40 +49,45 @@ extern int (*set_h225_addr_hook) (struct sk_buff *skb,
 extern int (*set_sig_addr_hook) (struct sk_buff *skb,
                                 struct nf_conn *ct,
                                 enum ip_conntrack_info ctinfo,
-                                 unsigned char **data,
+                                 unsigned int protoff, unsigned char **data,
                                 TransportAddress *taddr, int count);
 extern int (*set_ras_addr_hook) (struct sk_buff *skb,
                                 struct nf_conn *ct,
                                 enum ip_conntrack_info ctinfo,
-                                 unsigned char **data,
+                                 unsigned int protoff, unsigned char **data,
                                 TransportAddress *taddr, int count);
 extern int (*nat_rtp_rtcp_hook) (struct sk_buff *skb,
                                 struct nf_conn *ct,
                                 enum ip_conntrack_info ctinfo,
-                                 unsigned char **data, int dataoff,
+                                 unsigned int protoff, unsigned char **data,
+                                 int dataoff,
                                 H245_TransportAddress *taddr,
                                 __be16 port, __be16 rtp_port,
                                 struct nf_conntrack_expect *rtp_exp,
                                 struct nf_conntrack_expect *rtcp_exp);
 extern int (*nat_t120_hook) (struct sk_buff *skb, struct nf_conn *ct,
                             enum ip_conntrack_info ctinfo,
+                             unsigned int protoff,
                             unsigned char **data, int dataoff,
                             H245_TransportAddress *taddr, __be16 port,
                             struct nf_conntrack_expect *exp);
 extern int (*nat_h245_hook) (struct sk_buff *skb, struct nf_conn *ct,
                             enum ip_conntrack_info ctinfo,
+                             unsigned int protoff,
                             unsigned char **data, int dataoff,
                             TransportAddress *taddr, __be16 port,
                             struct nf_conntrack_expect *exp);
 extern int (*nat_callforwarding_hook) (struct sk_buff *skb,
                                       struct nf_conn *ct,
                                       enum ip_conntrack_info ctinfo,
+                                       unsigned int protoff,
                                       unsigned char **data, int dataoff,
                                       TransportAddress *taddr,
                                       __be16 port,
                                       struct nf_conntrack_expect *exp);
 extern int (*nat_q931_hook) (struct sk_buff *skb, struct nf_conn *ct,
                             enum ip_conntrack_info ctinfo,
+                             unsigned int protoff,
                             unsigned char **data, TransportAddress *taddr,
                             int idx, __be16 port,
                             struct nf_conntrack_expect *exp);
diff --git a/include/linux/netfilter/nf_conntrack_irc.h b/include/linux/netfilter/nf_conntrack_irc.h
index 36282bf71b63..4bb9bae67176 100644
--- a/include/linux/netfilter/nf_conntrack_irc.h
+++ b/include/linux/netfilter/nf_conntrack_irc.h
@@ -7,6 +7,7 @@
 extern unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
                                       enum ip_conntrack_info ctinfo,
+                                       unsigned int protoff,
                                       unsigned int matchoff,
                                       unsigned int matchlen,
                                       struct nf_conntrack_expect *exp);
diff --git a/include/linux/netfilter/nf_conntrack_pptp.h b/include/linux/netfilter/nf_conntrack_pptp.h
index 3bbde0c3a8a6..2ab2830316b7 100644
--- a/include/linux/netfilter/nf_conntrack_pptp.h
+++ b/include/linux/netfilter/nf_conntrack_pptp.h
@@ -303,12 +303,14 @@ struct nf_conntrack_expect;
 extern int
 (*nf_nat_pptp_hook_outbound)(struct sk_buff *skb,
                             struct nf_conn *ct, enum ip_conntrack_info ctinfo,
+                             unsigned int protoff,
                             struct PptpControlHeader *ctlh,
                             union pptp_ctrl_union *pptpReq);
 extern int
 (*nf_nat_pptp_hook_inbound)(struct sk_buff *skb,
                            struct nf_conn *ct, enum ip_conntrack_info ctinfo,
+                            unsigned int protoff,
                            struct PptpControlHeader *ctlh,
                            union pptp_ctrl_union *pptpReq);
diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h
index 89f2a627f3f0..387bdd02945d 100644
--- a/include/linux/netfilter/nf_conntrack_sip.h
+++ b/include/linux/netfilter/nf_conntrack_sip.h
@@ -37,10 +37,12 @@ struct sdp_media_type {
 struct sip_handler {
        const char      *method;
        unsigned int    len;
-        int             (*request)(struct sk_buff *skb, unsigned int dataoff,
+        int             (*request)(struct sk_buff *skb, unsigned int protoff,
+                                   unsigned int dataoff,
                                   const char **dptr, unsigned int *datalen,
                                   unsigned int cseq);
-        int             (*response)(struct sk_buff *skb, unsigned int dataoff,
+        int             (*response)(struct sk_buff *skb, unsigned int protoff,
+                                    unsigned int dataoff,
                                    const char **dptr, unsigned int *datalen,
                                    unsigned int cseq, unsigned int code);
 };
@@ -97,19 +99,20 @@ enum sip_header_types {
 enum sdp_header_types {
        SDP_HDR_UNSPEC,
        SDP_HDR_VERSION,
-        SDP_HDR_OWNER_IP4,
+        SDP_HDR_OWNER,
-        SDP_HDR_CONNECTION_IP4,
+        SDP_HDR_CONNECTION,
-        SDP_HDR_OWNER_IP6,
-        SDP_HDR_CONNECTION_IP6,
        SDP_HDR_MEDIA,
 };
 extern unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb,
+                                       unsigned int protoff,
                                       unsigned int dataoff,
                                       const char **dptr,
                                       unsigned int *datalen);
-extern void (*nf_nat_sip_seq_adjust_hook)(struct sk_buff *skb, s16 off);
+extern void (*nf_nat_sip_seq_adjust_hook)(struct sk_buff *skb,
+                                          unsigned int protoff, s16 off);
 extern unsigned int (*nf_nat_sip_expect_hook)(struct sk_buff *skb,
+                                              unsigned int protoff,
                                              unsigned int dataoff,
                                              const char **dptr,
                                              unsigned int *datalen,
@@ -117,6 +120,7 @@ extern unsigned int (*nf_nat_sip_expect_hook)(struct sk_buff *skb,
                                              unsigned int matchoff,
                                              unsigned int matchlen);
 extern unsigned int (*nf_nat_sdp_addr_hook)(struct sk_buff *skb,
+                                            unsigned int protoff,
                                            unsigned int dataoff,
                                            const char **dptr,
                                            unsigned int *datalen,
@@ -125,6 +129,7 @@ extern unsigned int (*nf_nat_sdp_addr_hook)(struct sk_buff *skb,
                                            enum sdp_header_types term,
                                            const union nf_inet_addr *addr);
 extern unsigned int (*nf_nat_sdp_port_hook)(struct sk_buff *skb,
+                                            unsigned int protoff,
                                            unsigned int dataoff,
                                            const char **dptr,
                                            unsigned int *datalen,
@@ -132,12 +137,14 @@ extern unsigned int (*nf_nat_sdp_port_hook)(struct sk_buff *skb,
                                            unsigned int matchlen,
                                            u_int16_t port);
 extern unsigned int (*nf_nat_sdp_session_hook)(struct sk_buff *skb,
+                                               unsigned int protoff,
                                               unsigned int dataoff,
                                               const char **dptr,
                                               unsigned int *datalen,
                                               unsigned int sdpoff,
                                               const union nf_inet_addr *addr);
 extern unsigned int (*nf_nat_sdp_media_hook)(struct sk_buff *skb,
+                                             unsigned int protoff,
                                             unsigned int dataoff,
                                             const char **dptr,
                                             unsigned int *datalen,
diff --git a/include/linux/netfilter/nf_nat.h b/include/linux/netfilter/nf_nat.h
index 8df2d13730b2..bf0cc373ffb6 100644
--- a/include/linux/netfilter/nf_nat.h
+++ b/include/linux/netfilter/nf_nat.h
@@ -22,4 +22,12 @@ struct nf_nat_ipv4_multi_range_compat {
        struct nf_nat_ipv4_range        range[1];
 };
+struct nf_nat_range {
+        unsigned int                    flags;
+        union nf_inet_addr              min_addr;
+        union nf_inet_addr              max_addr;
+        union nf_conntrack_man_proto    min_proto;
+        union nf_conntrack_man_proto    max_proto;
+};
 #endif /* _NETFILTER_NF_NAT_H */
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h
index f649f7423ca2..43bfe3e1685b 100644
--- a/include/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/linux/netfilter/nfnetlink_conntrack.h
@@ -142,9 +142,13 @@ enum ctattr_tstamp {
 enum ctattr_nat {
        CTA_NAT_UNSPEC,
-        CTA_NAT_MINIP,
+        CTA_NAT_V4_MINIP,
-        CTA_NAT_MAXIP,
+#define CTA_NAT_MINIP CTA_NAT_V4_MINIP
+        CTA_NAT_V4_MAXIP,
+#define CTA_NAT_MAXIP CTA_NAT_V4_MAXIP
        CTA_NAT_PROTO,
+        CTA_NAT_V6_MINIP,
+        CTA_NAT_V6_MAXIP,
        __CTA_NAT_MAX
 };
 #define CTA_NAT_MAX (__CTA_NAT_MAX - 1)
diff --git a/include/linux/netfilter/nfnetlink_queue.h b/include/linux/netfilter/nfnetlink_queue.h
index 3b1c1360aedf..70ec8c2bc11a 100644
--- a/include/linux/netfilter/nfnetlink_queue.h
+++ b/include/linux/netfilter/nfnetlink_queue.h
@@ -44,6 +44,7 @@ enum nfqnl_attr_type {
        NFQA_PAYLOAD,                   /* opaque data payload */
        NFQA_CT,                        /* nf_conntrack_netlink.h */
        NFQA_CT_INFO,                   /* enum ip_conntrack_info */
+        NFQA_CAP_LEN,                   /* __u32 length of captured packet */
        __NFQA_MAX
 };
diff --git a/include/linux/netfilter/xt_time.h b/include/linux/netfilter/xt_time.h
index 7c37fac576c4..095886019396 100644
--- a/include/linux/netfilter/xt_time.h
+++ b/include/linux/netfilter/xt_time.h
@@ -17,6 +17,9 @@ enum {
        /* Match against local time (instead of UTC) */
        XT_TIME_LOCAL_TZ = 1 << 0,
+        /* treat timestart > timestop (e.g. 23:00-01:00) as single period */
+        XT_TIME_CONTIGUOUS = 1 << 1,
        /* Shortcuts */
        XT_TIME_ALL_MONTHDAYS = 0xFFFFFFFE,
        XT_TIME_ALL_WEEKDAYS  = 0xFE,
@@ -24,4 +27,6 @@ enum {
        XT_TIME_MAX_DAYTIME   = 24 * 60 * 60 - 1,
 };
+#define XT_TIME_ALL_FLAGS (XT_TIME_LOCAL_TZ|XT_TIME_CONTIGUOUS)
 #endif /* _XT_TIME_H */
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index e2b12801378d..b962dfc695ae 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -79,7 +79,6 @@ enum nf_ip_hook_priorities {
 #ifdef __KERNEL__
 extern int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type);
-extern int ip_xfrm_me_harder(struct sk_buff *skb);
 extern __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
                                   unsigned int dataoff, u_int8_t protocol);
 #endif /*__KERNEL__*/
diff --git a/include/linux/netfilter_ipv6/Kbuild b/include/linux/netfilter_ipv6/Kbuild
index bd095bc075e9..b88c0058bf73 100644
--- a/include/linux/netfilter_ipv6/Kbuild
+++ b/include/linux/netfilter_ipv6/Kbuild
@@ -1,6 +1,7 @@
 header-y += ip6_tables.h
 header-y += ip6t_HL.h
 header-y += ip6t_LOG.h
+header-y += ip6t_NPT.h
 header-y += ip6t_REJECT.h
 header-y += ip6t_ah.h
 header-y += ip6t_frag.h
diff --git a/include/linux/netfilter_ipv6/ip6t_NPT.h b/include/linux/netfilter_ipv6/ip6t_NPT.h
new file mode 100644
index 000000000000..f763355481b5
--- /dev/null
+++ b/include/linux/netfilter_ipv6/ip6t_NPT.h
@@ -0,0 +1,16 @@
+#ifndef __NETFILTER_IP6T_NPT
+#define __NETFILTER_IP6T_NPT
+#include <linux/types.h>
+#include <linux/netfilter.h>
+struct ip6t_npt_tginfo {
+        union nf_inet_addr      src_pfx;
+        union nf_inet_addr      dst_pfx;
+        __u8                    src_pfx_len;
+        __u8                    dst_pfx_len;
+        /* Used internally by the kernel */
+        __sum16                 adjustment;
+};
+#endif /* __NETFILTER_IP6T_NPT */
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index c9fdde2bc73f..f80c56ac4d82 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -153,6 +153,8 @@ struct nlattr {
 #include <linux/capability.h>
 #include <linux/skbuff.h>
+#include <linux/export.h>
+#include <net/scm.h>
 struct net;
@@ -162,8 +164,8 @@ static inline struct nlmsghdr *nlmsg_hdr(const struct sk_buff *skb)
 }
 struct netlink_skb_parms {
-        struct ucred            creds;          /* Skb credentials      */
+        struct scm_creds        creds;          /* Skb credentials      */
-        __u32                   pid;
+        __u32                   portid;
        __u32                   dst_group;
        struct sock             *ssk;
 };
@@ -175,17 +177,27 @@ struct netlink_skb_parms {
 extern void netlink_table_grab(void);
 extern void netlink_table_ungrab(void);
+#define NL_CFG_F_NONROOT_RECV   (1 << 0)
+#define NL_CFG_F_NONROOT_SEND   (1 << 1)
 /* optional Netlink kernel configuration parameters */
 struct netlink_kernel_cfg {
        unsigned int    groups;
+        unsigned int    flags;
        void            (*input)(struct sk_buff *skb);
        struct mutex    *cb_mutex;
        void            (*bind)(int group);
 };
-extern struct sock *netlink_kernel_create(struct net *net, int unit,
+extern struct sock *__netlink_kernel_create(struct net *net, int unit,
-                                          struct module *module,
+                                            struct module *module,
-                                          struct netlink_kernel_cfg *cfg);
+                                            struct netlink_kernel_cfg *cfg);
+static inline struct sock *
+netlink_kernel_create(struct net *net, int unit, struct netlink_kernel_cfg *cfg)
+{
+        return __netlink_kernel_create(net, unit, THIS_MODULE, cfg);
+}
 extern void netlink_kernel_release(struct sock *sk);
 extern int __netlink_change_ngroups(struct sock *sk, unsigned int groups);
 extern int netlink_change_ngroups(struct sock *sk, unsigned int groups);
@@ -193,14 +205,14 @@ extern void __netlink_clear_multicast_users(struct sock *sk, unsigned int group)
 extern void netlink_clear_multicast_users(struct sock *sk, unsigned int group);
 extern void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err);
 extern int netlink_has_listeners(struct sock *sk, unsigned int group);
-extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 pid, int nonblock);
+extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, int nonblock);
-extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 pid,
+extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid,
                             __u32 group, gfp_t allocation);
 extern int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb,
-        __u32 pid, __u32 group, gfp_t allocation,
+        __u32 portid, __u32 group, gfp_t allocation,
        int (*filter)(struct sock *dsk, struct sk_buff *skb, void *data),
        void *filter_data);
-extern int netlink_set_err(struct sock *ssk, __u32 pid, __u32 group, int code);
+extern int netlink_set_err(struct sock *ssk, __u32 portid, __u32 group, int code);
 extern int netlink_register_notifier(struct notifier_block *nb);
 extern int netlink_unregister_notifier(struct notifier_block *nb);
@@ -241,12 +253,12 @@ struct netlink_callback {
 struct netlink_notify {
        struct net *net;
-        int pid;
+        int portid;
        int protocol;
 };
 struct nlmsghdr *
-__nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len, int flags);
+__nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags);
 struct netlink_dump_control {
        int (*dump)(struct sk_buff *skb, struct netlink_callback *);
@@ -259,11 +271,6 @@ extern int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
                              const struct nlmsghdr *nlh,
                              struct netlink_dump_control *control);
-#define NL_NONROOT_RECV 0x1
-#define NL_NONROOT_SEND 0x2
-extern void netlink_set_nonroot(int protocol, unsigned flag);
 #endif /* __KERNEL__ */
 #endif  /* __LINUX_NETLINK_H */
diff --git a/include/linux/nfc.h b/include/linux/nfc.h
index 6189f27e305b..d908d17da56d 100644
--- a/include/linux/nfc.h
+++ b/include/linux/nfc.h
@@ -183,4 +183,15 @@ struct sockaddr_nfc_llcp {
 #define NFC_HEADER_SIZE 1
+/**
+ * Pseudo-header info for raw socket packets
+ * First byte is the adapter index
+ * Second byte contains flags
+ *  - 0x01 - Direction (0=RX, 1=TX)
+ *  - 0x02-0x80 - Reserved
+ **/
+#define NFC_LLCP_RAW_HEADER_SIZE        2
+#define NFC_LLCP_DIRECTION_RX           0x00
+#define NFC_LLCP_DIRECTION_TX           0x01
 #endif /*__LINUX_NFC_H */
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 2f3878806403..7df9b500c804 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -565,6 +565,19 @@
 *      %NL80211_ATTR_IFINDEX is now on %NL80211_ATTR_WIPHY_FREQ with
 *      %NL80211_ATTR_WIPHY_CHANNEL_TYPE.
 *
+ * @NL80211_CMD_START_P2P_DEVICE: Start the given P2P Device, identified by
+ *      its %NL80211_ATTR_WDEV identifier. It must have been created with
+ *      %NL80211_CMD_NEW_INTERFACE previously. After it has been started, the
+ *      P2P Device can be used for P2P operations, e.g. remain-on-channel and
+ *      public action frame TX.
+ * @NL80211_CMD_STOP_P2P_DEVICE: Stop the given P2P Device, identified by
+ *      its %NL80211_ATTR_WDEV identifier.
+ *
+ * @NL80211_CMD_CONN_FAILED: connection request to an AP failed; used to
+ *      notify userspace that AP has rejected the connection request from a
+ *      station, due to particular reason. %NL80211_ATTR_CONN_FAILED_REASON
+ *      is used for this.
+ *
 * @NL80211_CMD_MAX: highest used command number
 * @__NL80211_CMD_AFTER_LAST: internal use
 */
@@ -708,6 +721,11 @@ enum nl80211_commands {
        NL80211_CMD_CH_SWITCH_NOTIFY,
+        NL80211_CMD_START_P2P_DEVICE,
+        NL80211_CMD_STOP_P2P_DEVICE,
+        NL80211_CMD_CONN_FAILED,
        /* add new commands above here */
        /* used to define NL80211_CMD_MAX below */
@@ -1251,6 +1269,10 @@ enum nl80211_commands {
 *      was used to provide the hint. For the different types of
 *      allowed user regulatory hints see nl80211_user_reg_hint_type.
 *
+ * @NL80211_ATTR_CONN_FAILED_REASON: The reason for which AP has rejected
+ *      the connection request from a station. nl80211_connect_failed_reason
+ *      enum has different reasons of connection failure.
+ *
 * @NL80211_ATTR_MAX: highest attribute number currently defined
 * @__NL80211_ATTR_AFTER_LAST: internal use
 */
@@ -1506,6 +1528,8 @@ enum nl80211_attrs {
        NL80211_ATTR_USER_REG_HINT_TYPE,
+        NL80211_ATTR_CONN_FAILED_REASON,
        /* add attributes here, update the policy in nl80211.c */
        __NL80211_ATTR_AFTER_LAST,
@@ -1575,6 +1599,10 @@ enum nl80211_attrs {
 * @NL80211_IFTYPE_MESH_POINT: mesh point
 * @NL80211_IFTYPE_P2P_CLIENT: P2P client
 * @NL80211_IFTYPE_P2P_GO: P2P group owner
+ * @NL80211_IFTYPE_P2P_DEVICE: P2P device interface type, this is not a netdev
+ *      and therefore can't be created in the normal ways, use the
+ *      %NL80211_CMD_START_P2P_DEVICE and %NL80211_CMD_STOP_P2P_DEVICE
+ *      commands to create and destroy one
 * @NL80211_IFTYPE_MAX: highest interface type number currently defined
 * @NUM_NL80211_IFTYPES: number of defined interface types
 *
@@ -1593,6 +1621,7 @@ enum nl80211_iftype {
        NL80211_IFTYPE_MESH_POINT,
        NL80211_IFTYPE_P2P_CLIENT,
        NL80211_IFTYPE_P2P_GO,
+        NL80211_IFTYPE_P2P_DEVICE,
        /* keep last */
        NUM_NL80211_IFTYPES,
@@ -2994,12 +3023,18 @@ enum nl80211_ap_sme_features {
 * @NL80211_FEATURE_CELL_BASE_REG_HINTS: This driver has been tested
 *      to work properly to suppport receiving regulatory hints from
 *      cellular base stations.
+ * @NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL: If this is set, an active
+ *      P2P Device (%NL80211_IFTYPE_P2P_DEVICE) requires its own channel
+ *      in the interface combinations, even when it's only used for scan
+ *      and remain-on-channel. This could be due to, for example, the
+ *      remain-on-channel implementation requiring a channel context.
 */
 enum nl80211_feature_flags {
-        NL80211_FEATURE_SK_TX_STATUS    = 1 << 0,
+        NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
-        NL80211_FEATURE_HT_IBSS         = 1 << 1,
+        NL80211_FEATURE_HT_IBSS                         = 1 << 1,
-        NL80211_FEATURE_INACTIVITY_TIMER = 1 << 2,
+        NL80211_FEATURE_INACTIVITY_TIMER                = 1 << 2,
-        NL80211_FEATURE_CELL_BASE_REG_HINTS = 1 << 3,
+        NL80211_FEATURE_CELL_BASE_REG_HINTS             = 1 << 3,
+        NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL        = 1 << 4,
 };
 /**
@@ -3023,4 +3058,15 @@ enum nl80211_probe_resp_offload_support_attr {
        NL80211_PROBE_RESP_OFFLOAD_SUPPORT_80211U =     1<<3,
 };
+/**
+ * enum nl80211_connect_failed_reason - connection request failed reasons
+ * @NL80211_CONN_FAIL_MAX_CLIENTS: Maximum number of clients that can be
+ *      handled by the AP is reached.
+ * @NL80211_CONN_FAIL_BLOCKED_CLIENT: Client's MAC is in the AP's blocklist.
+ */
+enum nl80211_connect_failed_reason {
+        NL80211_CONN_FAIL_MAX_CLIENTS,
+        NL80211_CONN_FAIL_BLOCKED_CLIENT,
+};
 #endif /* __LINUX_NL80211_H */
diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h
index 912c27a0f7ee..6ef49b803efb 100644
--- a/include/linux/of_mdio.h
+++ b/include/linux/of_mdio.h
@@ -12,6 +12,7 @@
 #include <linux/phy.h>
 #include <linux/of.h>
+#ifdef CONFIG_OF
 extern int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np);
 extern struct phy_device *of_phy_find_device(struct device_node *phy_np);
 extern struct phy_device *of_phy_connect(struct net_device *dev,
@@ -24,4 +25,36 @@ extern struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
 extern struct mii_bus *of_mdio_find_bus(struct device_node *mdio_np);
+#else /* CONFIG_OF */
+int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
+{
+        return -ENOSYS;
+}
+struct phy_device *of_phy_find_device(struct device_node *phy_np)
+{
+        return NULL;
+}
+struct phy_device *of_phy_connect(struct net_device *dev,
+                                         struct device_node *phy_np,
+                                         void (*hndlr)(struct net_device *),
+                                         u32 flags, phy_interface_t iface)
+{
+        return NULL;
+}
+struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
+                                         void (*hndlr)(struct net_device *),
+                                         phy_interface_t iface)
+{
+        return NULL;
+}
+struct mii_bus *of_mdio_find_bus(struct device_node *mdio_np)
+{
+        return NULL;
+}
+#endif /* CONFIG_OF */
 #endif /* __LINUX_OF_MDIO_H */
diff --git a/include/linux/packet_diag.h b/include/linux/packet_diag.h
new file mode 100644
index 000000000000..93f5fa94a431
--- /dev/null
+++ b/include/linux/packet_diag.h
@@ -0,0 +1,72 @@
+#ifndef __PACKET_DIAG_H__
+#define __PACKET_DIAG_H__
+#include <linux/types.h>
+struct packet_diag_req {
+        __u8    sdiag_family;
+        __u8    sdiag_protocol;
+        __u16   pad;
+        __u32   pdiag_ino;
+        __u32   pdiag_show;
+        __u32   pdiag_cookie[2];
+};
+#define PACKET_SHOW_INFO        0x00000001 /* Basic packet_sk information */
+#define PACKET_SHOW_MCLIST      0x00000002 /* A set of packet_diag_mclist-s */
+#define PACKET_SHOW_RING_CFG    0x00000004 /* Rings configuration parameters */
+#define PACKET_SHOW_FANOUT      0x00000008
+struct packet_diag_msg {
+        __u8    pdiag_family;
+        __u8    pdiag_type;
+        __u16   pdiag_num;
+        __u32   pdiag_ino;
+        __u32   pdiag_cookie[2];
+};
+enum {
+        PACKET_DIAG_INFO,
+        PACKET_DIAG_MCLIST,
+        PACKET_DIAG_RX_RING,
+        PACKET_DIAG_TX_RING,
+        PACKET_DIAG_FANOUT,
+        PACKET_DIAG_MAX,
+};
+struct packet_diag_info {
+        __u32   pdi_index;
+        __u32   pdi_version;
+        __u32   pdi_reserve;
+        __u32   pdi_copy_thresh;
+        __u32   pdi_tstamp;
+        __u32   pdi_flags;
+#define PDI_RUNNING     0x1
+#define PDI_AUXDATA     0x2
+#define PDI_ORIGDEV     0x4
+#define PDI_VNETHDR     0x8
+#define PDI_LOSS        0x10
+};
+struct packet_diag_mclist {
+        __u32   pdmc_index;
+        __u32   pdmc_count;
+        __u16   pdmc_type;
+        __u16   pdmc_alen;
+        __u8    pdmc_addr[MAX_ADDR_LEN];
+};
+struct packet_diag_ring {
+        __u32   pdr_block_size;
+        __u32   pdr_block_nr;
+        __u32   pdr_frame_size;
+        __u32   pdr_frame_nr;
+        __u32   pdr_retire_tmo;
+        __u32   pdr_sizeof_priv;
+        __u32   pdr_features;
+};
+#endif
diff --git a/include/linux/pps_kernel.h b/include/linux/pps_kernel.h
index 94048547f29a..0cc45ae1afd5 100644
--- a/include/linux/pps_kernel.h
+++ b/include/linux/pps_kernel.h
@@ -116,5 +116,14 @@ static inline void pps_get_ts(struct pps_event_time *ts)
 #endif /* CONFIG_NTP_PPS */
+/* Subtract known time delay from PPS event time(s) */
+static inline void pps_sub_ts(struct pps_event_time *ts, struct timespec delta)
+{
+        ts->ts_real = timespec_sub(ts->ts_real, delta);
+#ifdef CONFIG_NTP_PPS
+        ts->ts_raw = timespec_sub(ts->ts_raw, delta);
+#endif
+}
 #endif /* LINUX_PPS_KERNEL_H */
diff --git a/include/linux/ptp_clock_kernel.h b/include/linux/ptp_clock_kernel.h
index 945704c2ed65..f2dc6d8fc680 100644
--- a/include/linux/ptp_clock_kernel.h
+++ b/include/linux/ptp_clock_kernel.h
@@ -21,6 +21,8 @@
 #ifndef _PTP_CLOCK_KERNEL_H_
 #define _PTP_CLOCK_KERNEL_H_
+#include <linux/device.h>
+#include <linux/pps_kernel.h>
 #include <linux/ptp_clock.h>
@@ -40,7 +42,9 @@ struct ptp_clock_request {
 * struct ptp_clock_info - decribes a PTP hardware clock
 *
 * @owner:     The clock driver should set to THIS_MODULE.
- * @name:      A short name to identify the clock.
+ * @name:      A short "friendly name" to identify the clock and to
+ *             help distinguish PHY based devices from MAC based ones.
+ *             The string is not meant to be a unique id.
 * @max_adj:   The maximum possible frequency adjustment, in parts per billon.
 * @n_alarm:   The number of programmable alarms.
 * @n_ext_ts:  The number of external time stamp channels.
@@ -92,10 +96,12 @@ struct ptp_clock;
 /**
 * ptp_clock_register() - register a PTP hardware clock driver
 *
- * @info:  Structure describing the new clock.
+ * @info:   Structure describing the new clock.
+ * @parent: Pointer to the parent device of the new clock.
 */
-extern struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info);
+extern struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
+                                            struct device *parent);
 /**
 * ptp_clock_unregister() - unregister a PTP hardware clock driver
@@ -110,6 +116,7 @@ enum ptp_clock_events {
        PTP_CLOCK_ALARM,
        PTP_CLOCK_EXTTS,
        PTP_CLOCK_PPS,
+        PTP_CLOCK_PPSUSR,
 };
 /**
@@ -117,13 +124,17 @@ enum ptp_clock_events {
 *
 * @type:  One of the ptp_clock_events enumeration values.
 * @index: Identifies the source of the event.
- * @timestamp: When the event occured.
+ * @timestamp: When the event occurred (%PTP_CLOCK_EXTTS only).
+ * @pps_times: When the event occurred (%PTP_CLOCK_PPSUSR only).
 */
 struct ptp_clock_event {
        int type;
        int index;
-        u64 timestamp;
+        union {
+                u64 timestamp;
+                struct pps_event_time pps_times;
+        };
 };
 /**
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index 6fdf02737e9d..0ec590bb3611 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -354,6 +354,37 @@ static inline bool rfkill_blocked(struct rfkill *rfkill)
 }
 #endif /* RFKILL || RFKILL_MODULE */
+#ifdef CONFIG_RFKILL_LEDS
+/**
+ * rfkill_get_led_trigger_name - Get the LED trigger name for the button's LED.
+ * This function might return a NULL pointer if registering of the
+ * LED trigger failed. Use this as "default_trigger" for the LED.
+ */
+const char *rfkill_get_led_trigger_name(struct rfkill *rfkill);
+/**
+ * rfkill_set_led_trigger_name -- set the LED trigger name
+ * @rfkill: rfkill struct
+ * @name: LED trigger name
+ *
+ * This function sets the LED trigger name of the radio LED
+ * trigger that rfkill creates. It is optional, but if called
+ * must be called before rfkill_register() to be effective.
+ */
+void rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name);
+#else
+static inline const char *rfkill_get_led_trigger_name(struct rfkill *rfkill)
+{
+        return NULL;
+}
+static inline void
+rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name)
+{
+}
+#endif
 #endif /* __KERNEL__ */
 #endif /* RFKILL_H */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index d23ca6245d54..9c5612f0374b 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1526,6 +1526,9 @@ struct task_struct {
         * cache last used pipe for splice
         */
        struct pipe_inode_info *splice_pipe;
+        struct page_frag task_frag;
 #ifdef  CONFIG_TASK_DELAY_ACCT
        struct task_delay_info *delays;
 #endif
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 7632c87da2c9..b33a3a1f205e 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -846,13 +846,16 @@ static inline int skb_shared(const struct sk_buff *skb)
 *
 *      NULL is returned on a memory allocation failure.
 */
-static inline struct sk_buff *skb_share_check(struct sk_buff *skb,
+static inline struct sk_buff *skb_share_check(struct sk_buff *skb, gfp_t pri)
-                                              gfp_t pri)
 {
        might_sleep_if(pri & __GFP_WAIT);
        if (skb_shared(skb)) {
                struct sk_buff *nskb = skb_clone(skb, pri);
-                kfree_skb(skb);
+                if (likely(nskb))
+                        consume_skb(skb);
+                else
+                        kfree_skb(skb);
                skb = nskb;
        }
        return skb;
diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index 00bc189cb395..fdfba235f9f1 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -18,7 +18,14 @@
 enum
 {
        IPSTATS_MIB_NUM = 0,
+/* frequently written fields in fast path, kept in same cache line */
        IPSTATS_MIB_INPKTS,                     /* InReceives */
+        IPSTATS_MIB_INOCTETS,                   /* InOctets */
+        IPSTATS_MIB_INDELIVERS,                 /* InDelivers */
+        IPSTATS_MIB_OUTFORWDATAGRAMS,           /* OutForwDatagrams */
+        IPSTATS_MIB_OUTPKTS,                    /* OutRequests */
+        IPSTATS_MIB_OUTOCTETS,                  /* OutOctets */
+/* other fields */
        IPSTATS_MIB_INHDRERRORS,                /* InHdrErrors */
        IPSTATS_MIB_INTOOBIGERRORS,             /* InTooBigErrors */
        IPSTATS_MIB_INNOROUTES,                 /* InNoRoutes */
@@ -26,9 +33,6 @@ enum
        IPSTATS_MIB_INUNKNOWNPROTOS,            /* InUnknownProtos */
        IPSTATS_MIB_INTRUNCATEDPKTS,            /* InTruncatedPkts */
        IPSTATS_MIB_INDISCARDS,                 /* InDiscards */
-        IPSTATS_MIB_INDELIVERS,                 /* InDelivers */
-        IPSTATS_MIB_OUTFORWDATAGRAMS,           /* OutForwDatagrams */
-        IPSTATS_MIB_OUTPKTS,                    /* OutRequests */
        IPSTATS_MIB_OUTDISCARDS,                /* OutDiscards */
        IPSTATS_MIB_OUTNOROUTES,                /* OutNoRoutes */
        IPSTATS_MIB_REASMTIMEOUT,               /* ReasmTimeout */
@@ -42,8 +46,6 @@ enum
        IPSTATS_MIB_OUTMCASTPKTS,               /* OutMcastPkts */
        IPSTATS_MIB_INBCASTPKTS,                /* InBcastPkts */
        IPSTATS_MIB_OUTBCASTPKTS,               /* OutBcastPkts */
-        IPSTATS_MIB_INOCTETS,                   /* InOctets */
-        IPSTATS_MIB_OUTOCTETS,                  /* OutOctets */
        IPSTATS_MIB_INMCASTOCTETS,              /* InMcastOctets */
        IPSTATS_MIB_OUTMCASTOCTETS,             /* OutMcastOctets */
        IPSTATS_MIB_INBCASTOCTETS,              /* InBcastOctets */
@@ -239,6 +241,10 @@ enum
        LINUX_MIB_TCPCHALLENGEACK,              /* TCPChallengeACK */
        LINUX_MIB_TCPSYNCHALLENGE,              /* TCPSYNChallenge */
        LINUX_MIB_TCPFASTOPENACTIVE,            /* TCPFastOpenActive */
+        LINUX_MIB_TCPFASTOPENPASSIVE,           /* TCPFastOpenPassive*/
+        LINUX_MIB_TCPFASTOPENPASSIVEFAIL,       /* TCPFastOpenPassiveFail */
+        LINUX_MIB_TCPFASTOPENLISTENOVERFLOW,    /* TCPFastOpenListenOverflow */
+        LINUX_MIB_TCPFASTOPENCOOKIEREQD,        /* TCPFastOpenCookieReqd */
        __LINUX_MIB_MAX
 };
diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
index 1a6b0045b06b..c2b02a5c86ae 100644
--- a/include/linux/ssb/ssb_driver_chipcommon.h
+++ b/include/linux/ssb/ssb_driver_chipcommon.h
@@ -504,7 +504,9 @@
 #define SSB_CHIPCO_FLASHCTL_ST_SE       0x02D8          /* Sector Erase */
 #define SSB_CHIPCO_FLASHCTL_ST_BE       0x00C7          /* Bulk Erase */
 #define SSB_CHIPCO_FLASHCTL_ST_DP       0x00B9          /* Deep Power-down */
-#define SSB_CHIPCO_FLASHCTL_ST_RSIG     0x03AB          /* Read Electronic Signature */
+#define SSB_CHIPCO_FLASHCTL_ST_RES      0x03AB          /* Read Electronic Signature */
+#define SSB_CHIPCO_FLASHCTL_ST_CSA      0x1000          /* Keep chip select asserted */
+#define SSB_CHIPCO_FLASHCTL_ST_SSE      0x0220          /* Sub-sector Erase */
 /* Status register bits for ST flashes */
 #define SSB_CHIPCO_FLASHSTA_ST_WIP      0x01            /* Write In Progress */
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index b69bdb1e08b6..a1547ea3920d 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -76,7 +76,6 @@
 /* Platfrom data for platform device structure's platform_data field */
 struct stmmac_mdio_bus_data {
-        int bus_id;
        int (*phy_reset)(void *priv);
        unsigned int phy_mask;
        int *irqs;
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index eb125a4c30b3..67c789ae719c 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -110,6 +110,7 @@ enum {
 #define TCP_REPAIR_QUEUE        20
 #define TCP_QUEUE_SEQ           21
 #define TCP_REPAIR_OPTIONS      22
+#define TCP_FASTOPEN            23      /* Enable FastOpen on listeners */
 struct tcp_repair_opt {
        __u32   opt_code;
@@ -246,6 +247,7 @@ static inline unsigned int tcp_optlen(const struct sk_buff *skb)
 /* TCP Fast Open */
 #define TCP_FASTOPEN_COOKIE_MIN 4       /* Min Fast Open Cookie size in bytes */
 #define TCP_FASTOPEN_COOKIE_MAX 16      /* Max Fast Open Cookie size in bytes */
+#define TCP_FASTOPEN_COOKIE_SIZE 8      /* the size employed by this impl. */
 /* TCP Fast Open Cookie as stored in memory */
 struct tcp_fastopen_cookie {
@@ -312,9 +314,14 @@ struct tcp_request_sock {
        /* Only used by TCP MD5 Signature so far. */
        const struct tcp_request_sock_ops *af_specific;
 #endif
+        struct sock                     *listener; /* needed for TFO */
        u32                             rcv_isn;
        u32                             snt_isn;
        u32                             snt_synack; /* synack sent time */
+        u32                             rcv_nxt; /* the ack # by SYNACK. For
+                                                  * FastOpen it's the seq#
+                                                  * after data-in-SYN.
+                                                  */
 };
 static inline struct tcp_request_sock *tcp_rsk(const struct request_sock *req)
@@ -505,14 +512,18 @@ struct tcp_sock {
        struct tcp_md5sig_info  __rcu *md5sig_info;
 #endif
-/* TCP fastopen related information */
-        struct tcp_fastopen_request *fastopen_req;
        /* When the cookie options are generated and exchanged, then this
         * object holds a reference to them (cookie_values->kref).  Also
         * contains related tcp_cookie_transactions fields.
         */
        struct tcp_cookie_values  *cookie_values;
+/* TCP fastopen related information */
+        struct tcp_fastopen_request *fastopen_req;
+        /* fastopen_rsk points to request_sock that resulted in this big
+         * socket. Used to retransmit SYNACKs etc.
+         */
+        struct request_sock *fastopen_rsk;
 };
 enum tsq_flags {
@@ -552,6 +563,38 @@ static inline struct tcp_timewait_sock *tcp_twsk(const struct sock *sk)
        return (struct tcp_timewait_sock *)sk;
 }
+static inline bool tcp_passive_fastopen(const struct sock *sk)
+{
+        return (sk->sk_state == TCP_SYN_RECV &&
+                tcp_sk(sk)->fastopen_rsk != NULL);
+}
+static inline bool fastopen_cookie_present(struct tcp_fastopen_cookie *foc)
+{
+        return foc->len != -1;
+}
+extern void tcp_sock_destruct(struct sock *sk);
+static inline int fastopen_init_queue(struct sock *sk, int backlog)
+{
+        struct request_sock_queue *queue =
+            &inet_csk(sk)->icsk_accept_queue;
+        if (queue->fastopenq == NULL) {
+                queue->fastopenq = kzalloc(
+                    sizeof(struct fastopen_queue),
+                    sk->sk_allocation);
+                if (queue->fastopenq == NULL)
+                        return -ENOMEM;
+                sk->sk_destruct = tcp_sock_destruct;
+                spin_lock_init(&queue->fastopenq->lock);
+        }
+        queue->fastopenq->max_qlen = backlog;
+        return 0;
+}
 #endif  /* __KERNEL__ */
 #endif  /* _LINUX_TCP_H */
diff --git a/include/linux/tcp_metrics.h b/include/linux/tcp_metrics.h
new file mode 100644
index 000000000000..cb5157b55f32
--- /dev/null
+++ b/include/linux/tcp_metrics.h
@@ -0,0 +1,54 @@
+/* tcp_metrics.h - TCP Metrics Interface */
+#ifndef _LINUX_TCP_METRICS_H
+#define _LINUX_TCP_METRICS_H
+#include <linux/types.h>
+/* NETLINK_GENERIC related info
+ */
+#define TCP_METRICS_GENL_NAME           "tcp_metrics"
+#define TCP_METRICS_GENL_VERSION        0x1
+enum tcp_metric_index {
+        TCP_METRIC_RTT,
+        TCP_METRIC_RTTVAR,
+        TCP_METRIC_SSTHRESH,
+        TCP_METRIC_CWND,
+        TCP_METRIC_REORDERING,
+        /* Always last.  */
+        __TCP_METRIC_MAX,
+};
+#define TCP_METRIC_MAX  (__TCP_METRIC_MAX - 1)
+enum {
+        TCP_METRICS_ATTR_UNSPEC,
+        TCP_METRICS_ATTR_ADDR_IPV4,             /* u32 */
+        TCP_METRICS_ATTR_ADDR_IPV6,             /* binary */
+        TCP_METRICS_ATTR_AGE,                   /* msecs */
+        TCP_METRICS_ATTR_TW_TSVAL,              /* u32, raw, rcv tsval */
+        TCP_METRICS_ATTR_TW_TS_STAMP,           /* s32, sec age */
+        TCP_METRICS_ATTR_VALS,                  /* nested +1, u32 */
+        TCP_METRICS_ATTR_FOPEN_MSS,             /* u16 */
+        TCP_METRICS_ATTR_FOPEN_SYN_DROPS,       /* u16, count of drops */
+        TCP_METRICS_ATTR_FOPEN_SYN_DROP_TS,     /* msecs age */
+        TCP_METRICS_ATTR_FOPEN_COOKIE,          /* binary */
+        __TCP_METRICS_ATTR_MAX,
+};
+#define TCP_METRICS_ATTR_MAX    (__TCP_METRICS_ATTR_MAX - 1)
+enum {
+        TCP_METRICS_CMD_UNSPEC,
+        TCP_METRICS_CMD_GET,
+        TCP_METRICS_CMD_DEL,
+        __TCP_METRICS_CMD_MAX,
+};
+#define TCP_METRICS_CMD_MAX     (__TCP_METRICS_CMD_MAX - 1)
+#endif /* _LINUX_TCP_METRICS_H */
diff --git a/include/linux/tipc_config.h b/include/linux/tipc_config.h
index c98928420100..0b1e3f218a36 100644
--- a/include/linux/tipc_config.h
+++ b/include/linux/tipc_config.h
@@ -89,8 +89,8 @@
 #define  TIPC_CMD_GET_REMOTE_MNG    0x4003    /* tx none, rx unsigned */
 #define  TIPC_CMD_GET_MAX_PORTS     0x4004    /* tx none, rx unsigned */
-#define  TIPC_CMD_GET_MAX_PUBL      0x4005    /* tx none, rx unsigned */
+#define  TIPC_CMD_GET_MAX_PUBL      0x4005    /* obsoleted */
-#define  TIPC_CMD_GET_MAX_SUBSCR    0x4006    /* tx none, rx unsigned */
+#define  TIPC_CMD_GET_MAX_SUBSCR    0x4006    /* obsoleted */
 #define  TIPC_CMD_GET_MAX_ZONES     0x4007    /* obsoleted */
 #define  TIPC_CMD_GET_MAX_CLUSTERS  0x4008    /* obsoleted */
 #define  TIPC_CMD_GET_MAX_NODES     0x4009    /* obsoleted */
@@ -115,8 +115,8 @@
 #define  TIPC_CMD_SET_NODE_ADDR     0x8001    /* tx net_addr, rx none */
 #define  TIPC_CMD_SET_REMOTE_MNG    0x8003    /* tx unsigned, rx none */
 #define  TIPC_CMD_SET_MAX_PORTS     0x8004    /* tx unsigned, rx none */
-#define  TIPC_CMD_SET_MAX_PUBL      0x8005    /* tx unsigned, rx none */
+#define  TIPC_CMD_SET_MAX_PUBL      0x8005    /* obsoleted */
-#define  TIPC_CMD_SET_MAX_SUBSCR    0x8006    /* tx unsigned, rx none */
+#define  TIPC_CMD_SET_MAX_SUBSCR    0x8006    /* obsoleted */
 #define  TIPC_CMD_SET_MAX_ZONES     0x8007    /* obsoleted */
 #define  TIPC_CMD_SET_MAX_CLUSTERS  0x8008    /* obsoleted */
 #define  TIPC_CMD_SET_MAX_NODES     0x8009    /* obsoleted */
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 089a09d001d1..9e63e76b20e7 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -78,7 +78,7 @@ extern struct inet6_ifaddr      *ipv6_get_ifaddr(struct net *net,
                                                 int strict);
 extern int                      ipv6_dev_get_saddr(struct net *net,
-                                               struct net_device *dev,
+                                               const struct net_device *dev,
                                               const struct in6_addr *daddr,
                                               unsigned int srcprefs,
                                               struct in6_addr *saddr);
diff --git a/include/net/arp.h b/include/net/arp.h
index 7f7df93f37cd..b630dae03411 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -3,6 +3,7 @@
 #define _ARP_H
 #include <linux/if_arp.h>
+#include <linux/hash.h>
 #include <net/neighbour.h>
@@ -10,7 +11,7 @@ extern struct neigh_table arp_tbl;
 static inline u32 arp_hashfn(u32 key, const struct net_device *dev, u32 hash_rnd)
 {
-        u32 val = key ^ dev->ifindex;
+        u32 val = key ^ hash32_ptr(dev);
        return val * hash_rnd;
 }
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 565d4bee1e49..ede036977ae8 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -27,6 +27,7 @@
 #include <linux/poll.h>
 #include <net/sock.h>
+#include <linux/seq_file.h>
 #ifndef AF_BLUETOOTH
 #define AF_BLUETOOTH    31
@@ -202,6 +203,10 @@ enum {
 struct bt_sock_list {
        struct hlist_head head;
        rwlock_t          lock;
+#ifdef CONFIG_PROC_FS
+        struct file_operations   fops;
+        int (* custom_seq_show)(struct seq_file *, void *);
+#endif
 };
 int  bt_sock_register(int proto, const struct net_proto_family *ops);
@@ -292,6 +297,11 @@ extern void hci_sock_cleanup(void);
 extern int bt_sysfs_init(void);
 extern void bt_sysfs_cleanup(void);
+extern int  bt_procfs_init(struct module* module, struct net *net, const char *name,
+                           struct bt_sock_list* sk_list,
+                           int (* seq_show)(struct seq_file *, void *));
+extern void bt_procfs_cleanup(struct net *net, const char *name);
 extern struct dentry *bt_debugfs;
 int l2cap_init(void);
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index ccd723e0f783..76b2b6bdcf36 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -62,6 +62,15 @@
 /* First BR/EDR Controller shall have ID = 0 */
 #define HCI_BREDR_ID    0
+/* AMP controller status */
+#define AMP_CTRL_POWERED_DOWN                   0x00
+#define AMP_CTRL_BLUETOOTH_ONLY                 0x01
+#define AMP_CTRL_NO_CAPACITY                    0x02
+#define AMP_CTRL_LOW_CAPACITY                   0x03
+#define AMP_CTRL_MEDIUM_CAPACITY                0x04
+#define AMP_CTRL_HIGH_CAPACITY                  0x05
+#define AMP_CTRL_FULL_CAPACITY                  0x06
 /* HCI device quirks */
 enum {
        HCI_QUIRK_RESET_ON_CLOSE,
@@ -293,8 +302,11 @@ enum {
 /* ---- HCI Error Codes ---- */
 #define HCI_ERROR_AUTH_FAILURE          0x05
+#define HCI_ERROR_CONNECTION_TIMEOUT    0x08
 #define HCI_ERROR_REJ_BAD_ADDR          0x0f
 #define HCI_ERROR_REMOTE_USER_TERM      0x13
+#define HCI_ERROR_REMOTE_LOW_RESOURCES  0x14
+#define HCI_ERROR_REMOTE_POWER_OFF      0x15
 #define HCI_ERROR_LOCAL_HOST_TERM       0x16
 #define HCI_ERROR_PAIRING_NOT_ALLOWED   0x18
@@ -1237,6 +1249,24 @@ struct hci_ev_simple_pair_complete {
        bdaddr_t bdaddr;
 } __packed;
+#define HCI_EV_USER_PASSKEY_NOTIFY      0x3b
+struct hci_ev_user_passkey_notify {
+        bdaddr_t        bdaddr;
+        __le32          passkey;
+} __packed;
+#define HCI_KEYPRESS_STARTED            0
+#define HCI_KEYPRESS_ENTERED            1
+#define HCI_KEYPRESS_ERASED             2
+#define HCI_KEYPRESS_CLEARED            3
+#define HCI_KEYPRESS_COMPLETED          4
+#define HCI_EV_KEYPRESS_NOTIFY          0x3c
+struct hci_ev_keypress_notify {
+        bdaddr_t        bdaddr;
+        __u8            type;
+} __packed;
 #define HCI_EV_REMOTE_HOST_FEATURES     0x3d
 struct hci_ev_remote_host_features {
        bdaddr_t bdaddr;
@@ -1295,6 +1325,8 @@ struct hci_ev_num_comp_blocks {
 } __packed;
 /* Low energy meta events */
+#define LE_CONN_ROLE_MASTER     0x00
 #define HCI_EV_LE_CONN_COMPLETE         0x01
 struct hci_ev_le_conn_complete {
        __u8     status;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 475b8c04ba52..e7d454609881 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -115,12 +115,6 @@ struct oob_data {
        u8 randomizer[16];
 };
-struct adv_entry {
-        struct list_head list;
-        bdaddr_t bdaddr;
-        u8 bdaddr_type;
-};
 struct le_scan_params {
        u8 type;
        u16 interval;
@@ -309,6 +303,8 @@ struct hci_conn {
        __u8            pin_length;
        __u8            enc_key_size;
        __u8            io_capability;
+        __u32           passkey_notify;
+        __u8            passkey_entered;
        __u16           disc_timeout;
        unsigned long   flags;
@@ -356,16 +352,16 @@ extern rwlock_t hci_cb_list_lock;
 /* ----- HCI interface to upper protocols ----- */
 extern int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
-extern int l2cap_connect_cfm(struct hci_conn *hcon, u8 status);
+extern void l2cap_connect_cfm(struct hci_conn *hcon, u8 status);
 extern int l2cap_disconn_ind(struct hci_conn *hcon);
-extern int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason);
+extern void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason);
 extern int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt);
 extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb,
                              u16 flags);
 extern int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
-extern int sco_connect_cfm(struct hci_conn *hcon, __u8 status);
+extern void sco_connect_cfm(struct hci_conn *hcon, __u8 status);
-extern int sco_disconn_cfm(struct hci_conn *hcon, __u8 reason);
+extern void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason);
 extern int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb);
 /* ----- Inquiry cache ----- */
@@ -434,15 +430,6 @@ static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
               test_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 }
-static inline void hci_conn_hash_init(struct hci_dev *hdev)
-{
-        struct hci_conn_hash *h = &hdev->conn_hash;
-        INIT_LIST_HEAD(&h->list);
-        h->acl_num = 0;
-        h->sco_num = 0;
-        h->le_num = 0;
-}
 static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
 {
        struct hci_conn_hash *h = &hdev->conn_hash;
@@ -557,9 +544,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_state(struct hci_dev *hdev,
        return NULL;
 }
-void hci_acl_connect(struct hci_conn *conn);
 void hci_acl_disconn(struct hci_conn *conn, __u8 reason);
-void hci_add_sco(struct hci_conn *conn, __u16 handle);
 void hci_setup_sync(struct hci_conn *conn, __u16 handle);
 void hci_sco_setup(struct hci_conn *conn, __u8 status);
@@ -569,7 +554,7 @@ void hci_conn_hash_flush(struct hci_dev *hdev);
 void hci_conn_check_pending(struct hci_dev *hdev);
 struct hci_chan *hci_chan_create(struct hci_conn *conn);
-int hci_chan_del(struct hci_chan *chan);
+void hci_chan_del(struct hci_chan *chan);
 void hci_chan_list_flush(struct hci_conn *conn);
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
@@ -587,8 +572,7 @@ void hci_conn_put_device(struct hci_conn *conn);
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
-        BT_DBG("hcon %p refcnt %d -> %d", conn, atomic_read(&conn->refcnt),
+        BT_DBG("hcon %p orig refcnt %d", conn, atomic_read(&conn->refcnt));
-               atomic_read(&conn->refcnt) + 1);
        atomic_inc(&conn->refcnt);
        cancel_delayed_work(&conn->disc_work);
@@ -596,8 +580,7 @@ static inline void hci_conn_hold(struct hci_conn *conn)
 static inline void hci_conn_put(struct hci_conn *conn)
 {
-        BT_DBG("hcon %p refcnt %d -> %d", conn, atomic_read(&conn->refcnt),
+        BT_DBG("hcon %p orig refcnt %d", conn, atomic_read(&conn->refcnt));
-               atomic_read(&conn->refcnt) - 1);
        if (atomic_dec_and_test(&conn->refcnt)) {
                unsigned long timeo;
@@ -622,11 +605,17 @@ static inline void hci_conn_put(struct hci_conn *conn)
 /* ----- HCI Devices ----- */
 static inline void hci_dev_put(struct hci_dev *d)
 {
+        BT_DBG("%s orig refcnt %d", d->name,
+               atomic_read(&d->dev.kobj.kref.refcount));
        put_device(&d->dev);
 }
 static inline struct hci_dev *hci_dev_hold(struct hci_dev *d)
 {
+        BT_DBG("%s orig refcnt %d", d->name,
+               atomic_read(&d->dev.kobj.kref.refcount));
        get_device(&d->dev);
        return d;
 }
@@ -1012,7 +1001,7 @@ int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                          u8 addr_type, u32 flags, u8 *name, u8 name_len,
                          u8 *dev_class);
 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                             u8 link_type, u8 addr_type);
+                             u8 link_type, u8 addr_type, u8 reason);
 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
                           u8 link_type, u8 addr_type, u8 status);
 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
@@ -1035,6 +1024,9 @@ int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                     u8 link_type, u8 addr_type, u8 status);
 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                         u8 link_type, u8 addr_type, u8 status);
+int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                             u8 link_type, u8 addr_type, u32 passkey,
+                             u8 entered);
 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                     u8 addr_type, u8 status);
 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status);
@@ -1056,7 +1048,7 @@ int mgmt_discovering(struct hci_dev *hdev, u8 discovering);
 int mgmt_interleaved_discovery(struct hci_dev *hdev);
 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
+bool mgmt_valid_hdev(struct hci_dev *hdev);
 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent);
 /* HCI info for socket */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index a7679f8913d2..7ed8e356425a 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -433,11 +433,10 @@ struct l2cap_chan {
        struct sock *sk;
        struct l2cap_conn       *conn;
+        struct kref     kref;
        __u8            state;
-        atomic_t        refcnt;
        __le16          psm;
        __u16           dcid;
        __u16           scid;
@@ -671,20 +670,8 @@ enum {
        L2CAP_EV_RECV_FRAME,
 };
-static inline void l2cap_chan_hold(struct l2cap_chan *c)
+void l2cap_chan_hold(struct l2cap_chan *c);
-{
+void l2cap_chan_put(struct l2cap_chan *c);
-        BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
-        atomic_inc(&c->refcnt);
-}
-static inline void l2cap_chan_put(struct l2cap_chan *c)
-{
-        BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
-        if (atomic_dec_and_test(&c->refcnt))
-                kfree(c);
-}
 static inline void l2cap_chan_lock(struct l2cap_chan *chan)
 {
@@ -771,7 +758,6 @@ int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
 struct l2cap_chan *l2cap_chan_create(void);
 void l2cap_chan_close(struct l2cap_chan *chan, int reason);
-void l2cap_chan_destroy(struct l2cap_chan *chan);
 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
                       bdaddr_t *dst, u8 dst_type);
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 4348ee8bda69..22980a7c3873 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -405,7 +405,16 @@ struct mgmt_ev_device_connected {
        __u8    eir[0];
 } __packed;
+#define MGMT_DEV_DISCONN_UNKNOWN        0x00
+#define MGMT_DEV_DISCONN_TIMEOUT        0x01
+#define MGMT_DEV_DISCONN_LOCAL_HOST     0x02
+#define MGMT_DEV_DISCONN_REMOTE         0x03
 #define MGMT_EV_DEVICE_DISCONNECTED     0x000C
+struct mgmt_ev_device_disconnected {
+        struct mgmt_addr_info addr;
+        __u8    reason;
+} __packed;
 #define MGMT_EV_CONNECT_FAILED          0x000D
 struct mgmt_ev_connect_failed {
@@ -469,3 +478,10 @@ struct mgmt_ev_device_unblocked {
 struct mgmt_ev_device_unpaired {
        struct mgmt_addr_info addr;
 } __packed;
+#define MGMT_EV_PASSKEY_NOTIFY          0x0017
+struct mgmt_ev_passkey_notify {
+        struct mgmt_addr_info addr;
+        __le32  passkey;
+        __u8    entered;
+} __packed;
diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
index 8b27927b2a55..f8ba07f3e5fa 100644
--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -108,8 +108,8 @@ struct smp_cmd_security_req {
 #define SMP_CONFIRM_FAILED              0x04
 #define SMP_PAIRING_NOTSUPP             0x05
 #define SMP_ENC_KEY_SIZE                0x06
-#define SMP_CMD_NOTSUPP         0x07
+#define SMP_CMD_NOTSUPP                 0x07
-#define SMP_UNSPECIFIED         0x08
+#define SMP_UNSPECIFIED                 0x08
 #define SMP_REPEATED_ATTEMPTS           0x09
 #define SMP_MIN_ENC_KEY_SIZE            7
@@ -123,8 +123,8 @@ struct smp_chan {
        struct l2cap_conn *conn;
        u8              preq[7]; /* SMP Pairing Request */
        u8              prsp[7]; /* SMP Pairing Response */
-        u8              prnd[16]; /* SMP Pairing Random (local) */
+        u8              prnd[16]; /* SMP Pairing Random (local) */
-        u8              rrnd[16]; /* SMP Pairing Random (remote) */
+        u8              rrnd[16]; /* SMP Pairing Random (remote) */
        u8              pcnf[16]; /* SMP Pairing Confirm */
        u8              tk[16]; /* SMP Temporary Key */
        u8              enc_key_size;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 3d254e10ff30..1b4989082244 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -245,6 +245,7 @@ struct ieee80211_sta_vht_cap {
 *      rates" IE, i.e. CCK rates first, then OFDM.
 * @n_bitrates: Number of bitrates in @bitrates
 * @ht_cap: HT capabilities in this band
+ * @vht_cap: VHT capabilities in this band
 */
 struct ieee80211_supported_band {
        struct ieee80211_channel *channels;
@@ -1439,7 +1440,8 @@ struct cfg80211_gtk_rekey_data {
 * @add_virtual_intf: create a new virtual interface with the given name,
 *      must set the struct wireless_dev's iftype. Beware: You must create
 *      the new netdev in the wiphy's network namespace! Returns the struct
- *      wireless_dev, or an ERR_PTR.
+ *      wireless_dev, or an ERR_PTR. For P2P device wdevs, the driver must
+ *      also set the address member in the wdev.
 *
 * @del_virtual_intf: remove the virtual interface
 *
@@ -1578,9 +1580,7 @@ struct cfg80211_gtk_rekey_data {
 * @set_cqm_txe_config: Configure connection quality monitor TX error
 *      thresholds.
 * @sched_scan_start: Tell the driver to start a scheduled scan.
- * @sched_scan_stop: Tell the driver to stop an ongoing scheduled
+ * @sched_scan_stop: Tell the driver to stop an ongoing scheduled scan.
- *      scan.  The driver_initiated flag specifies whether the driver
- *      itself has informed that the scan has stopped.
 *
 * @mgmt_frame_register: Notify driver that a management frame type was
 *      registered. Note that this callback may not sleep, and cannot run
@@ -1618,6 +1618,9 @@ struct cfg80211_gtk_rekey_data {
 * @get_channel: Get the current operating channel for the virtual interface.
 *      For monitor interfaces, it should return %NULL unless there's a single
 *      current monitoring channel.
+ *
+ * @start_p2p_device: Start the given P2P device.
+ * @stop_p2p_device: Stop the given P2P device.
 */
 struct cfg80211_ops {
        int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -1625,7 +1628,7 @@ struct cfg80211_ops {
        void    (*set_wakeup)(struct wiphy *wiphy, bool enabled);
        struct wireless_dev * (*add_virtual_intf)(struct wiphy *wiphy,
-                                                  char *name,
+                                                  const char *name,
                                                  enum nl80211_iftype type,
                                                  u32 *flags,
                                                  struct vif_params *params);
@@ -1834,6 +1837,11 @@ struct cfg80211_ops {
                (*get_channel)(struct wiphy *wiphy,
                               struct wireless_dev *wdev,
                               enum nl80211_channel_type *type);
+        int     (*start_p2p_device)(struct wiphy *wiphy,
+                                    struct wireless_dev *wdev);
+        void    (*stop_p2p_device)(struct wiphy *wiphy,
+                                   struct wireless_dev *wdev);
 };
 /*
@@ -2397,6 +2405,8 @@ struct cfg80211_cached_keys;
 * @cleanup_work: work struct used for cleanup that can't be done directly
 * @beacon_interval: beacon interval used on this device for transmitting
 *      beacons, 0 when not valid
+ * @address: The address for this device, valid only if @netdev is %NULL
+ * @p2p_started: true if this is a P2P Device that has been started
 */
 struct wireless_dev {
        struct wiphy *wiphy;
@@ -2415,7 +2425,9 @@ struct wireless_dev {
        struct work_struct cleanup_work;
-        bool use_4addr;
+        bool use_4addr, p2p_started;
+        u8 address[ETH_ALEN] __aligned(sizeof(u16));
        /* currently used for IBSS and SME - might be rearranged later */
        u8 ssid[IEEE80211_MAX_SSID_LEN];
@@ -2445,7 +2457,7 @@ struct wireless_dev {
        int beacon_interval;
-        u32 ap_unexpected_nlpid;
+        u32 ap_unexpected_nlportid;
 #ifdef CONFIG_CFG80211_WEXT
        /* wext data */
@@ -2463,6 +2475,13 @@ struct wireless_dev {
 #endif
 };
+static inline u8 *wdev_address(struct wireless_dev *wdev)
+{
+        if (wdev->netdev)
+                return wdev->netdev->dev_addr;
+        return wdev->address;
+}
 /**
 * wdev_priv - return wiphy priv from wireless_dev
 *
@@ -3342,6 +3361,25 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp);
 /**
+ * cfg80211_conn_failed - connection request failed notification
+ *
+ * @dev: the netdev
+ * @mac_addr: the station's address
+ * @reason: the reason for connection failure
+ * @gfp: allocation flags
+ *
+ * Whenever a station tries to connect to an AP and if the station
+ * could not connect to the AP as the AP has rejected the connection
+ * for some reasons, this function is called.
+ *
+ * The reason for connection failure can be any of the value from
+ * nl80211_connect_failed_reason enum
+ */
+void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
+                          enum nl80211_connect_failed_reason reason,
+                          gfp_t gfp);
+/**
 * cfg80211_rx_mgmt - notification of received, unprocessed management frame
 * @wdev: wireless device receiving the frame
 * @freq: Frequency on which the frame was received in MHz
@@ -3530,6 +3568,22 @@ void cfg80211_ch_switch_notify(struct net_device *dev, int freq,
 */
 u32 cfg80211_calculate_bitrate(struct rate_info *rate);
+/**
+ * cfg80211_unregister_wdev - remove the given wdev
+ * @wdev: struct wireless_dev to remove
+ *
+ * Call this function only for wdevs that have no netdev assigned,
+ * e.g. P2P Devices. It removes the device from the list so that
+ * it can no longer be used. It is necessary to call this function
+ * even when cfg80211 requests the removal of the interface by
+ * calling the del_virtual_intf() callback. The function must also
+ * be called when the driver wishes to unregister the wdev, e.g.
+ * when the device is unbound from the driver.
+ *
+ * Requires the RTNL to be held.
+ */
+void cfg80211_unregister_wdev(struct wireless_dev *wdev);
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/checksum.h b/include/net/checksum.h
index ba55d8b8c87c..600d1d705bb8 100644
--- a/include/net/checksum.h
+++ b/include/net/checksum.h
@@ -109,6 +109,9 @@ static inline void csum_replace2(__sum16 *sum, __be16 from, __be16 to)
 struct sk_buff;
 extern void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
                                     __be32 from, __be32 to, int pseudohdr);
+extern void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
+                                      const __be32 *from, const __be32 *to,
+                                      int pseudohdr);
 static inline void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb,
                                            __be16 from, __be16 to,
diff --git a/include/net/dst.h b/include/net/dst.h
index 621e3513ef5e..9a7881066fb3 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -396,11 +396,15 @@ static inline void dst_confirm(struct dst_entry *dst)
 static inline int dst_neigh_output(struct dst_entry *dst, struct neighbour *n,
                                   struct sk_buff *skb)
 {
-        struct hh_cache *hh;
+        const struct hh_cache *hh;
+        if (dst->pending_confirm) {
+                unsigned long now = jiffies;
-        if (unlikely(dst->pending_confirm)) {
-                n->confirmed = jiffies;
                dst->pending_confirm = 0;
+                /* avoid dirtying neighbour */
+                if (n->confirmed != now)
+                        n->confirmed = now;
        }
        hh = &n->hh;
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 48905cd3884c..bdfbe68c1c3b 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -65,7 +65,7 @@ struct genl_family {
 /**
 * struct genl_info - receiving information
 * @snd_seq: sending sequence number
- * @snd_pid: netlink pid of sender
+ * @snd_portid: netlink portid of sender
 * @nlhdr: netlink message header
 * @genlhdr: generic netlink message header
 * @userhdr: user specific header
@@ -75,7 +75,7 @@ struct genl_family {
 */
 struct genl_info {
        u32                     snd_seq;
-        u32                     snd_pid;
+        u32                     snd_portid;
        struct nlmsghdr *       nlhdr;
        struct genlmsghdr *     genlhdr;
        void *                  userhdr;
@@ -130,10 +130,10 @@ extern int genl_register_mc_group(struct genl_family *family,
                                  struct genl_multicast_group *grp);
 extern void genl_unregister_mc_group(struct genl_family *family,
                                     struct genl_multicast_group *grp);
-extern void genl_notify(struct sk_buff *skb, struct net *net, u32 pid,
+extern void genl_notify(struct sk_buff *skb, struct net *net, u32 portid,
                        u32 group, struct nlmsghdr *nlh, gfp_t flags);
-void *genlmsg_put(struct sk_buff *skb, u32 pid, u32 seq,
+void *genlmsg_put(struct sk_buff *skb, u32 portid, u32 seq,
                                struct genl_family *family, int flags, u8 cmd);
 /**
@@ -183,7 +183,7 @@ static inline void *genlmsg_put_reply(struct sk_buff *skb,
                                      struct genl_family *family,
                                      int flags, u8 cmd)
 {
-        return genlmsg_put(skb, info->snd_pid, info->snd_seq, family,
+        return genlmsg_put(skb, info->snd_portid, info->snd_seq, family,
                           flags, cmd);
 }
@@ -212,49 +212,49 @@ static inline void genlmsg_cancel(struct sk_buff *skb, void *hdr)
 * genlmsg_multicast_netns - multicast a netlink message to a specific netns
 * @net: the net namespace
 * @skb: netlink message as socket buffer
- * @pid: own netlink pid to avoid sending to yourself
+ * @portid: own netlink portid to avoid sending to yourself
 * @group: multicast group id
 * @flags: allocation flags
 */
 static inline int genlmsg_multicast_netns(struct net *net, struct sk_buff *skb,
-                                          u32 pid, unsigned int group, gfp_t flags)
+                                          u32 portid, unsigned int group, gfp_t flags)
 {
-        return nlmsg_multicast(net->genl_sock, skb, pid, group, flags);
+        return nlmsg_multicast(net->genl_sock, skb, portid, group, flags);
 }
 /**
 * genlmsg_multicast - multicast a netlink message to the default netns
 * @skb: netlink message as socket buffer
- * @pid: own netlink pid to avoid sending to yourself
+ * @portid: own netlink portid to avoid sending to yourself
 * @group: multicast group id
 * @flags: allocation flags
 */
-static inline int genlmsg_multicast(struct sk_buff *skb, u32 pid,
+static inline int genlmsg_multicast(struct sk_buff *skb, u32 portid,
                                    unsigned int group, gfp_t flags)
 {
-        return genlmsg_multicast_netns(&init_net, skb, pid, group, flags);
+        return genlmsg_multicast_netns(&init_net, skb, portid, group, flags);
 }
 /**
 * genlmsg_multicast_allns - multicast a netlink message to all net namespaces
 * @skb: netlink message as socket buffer
- * @pid: own netlink pid to avoid sending to yourself
+ * @portid: own netlink portid to avoid sending to yourself
 * @group: multicast group id
 * @flags: allocation flags
 *
 * This function must hold the RTNL or rcu_read_lock().
 */
-int genlmsg_multicast_allns(struct sk_buff *skb, u32 pid,
+int genlmsg_multicast_allns(struct sk_buff *skb, u32 portid,
                            unsigned int group, gfp_t flags);
 /**
 * genlmsg_unicast - unicast a netlink message
 * @skb: netlink message as socket buffer
- * @pid: netlink pid of the destination socket
+ * @portid: netlink portid of the destination socket
 */
-static inline int genlmsg_unicast(struct net *net, struct sk_buff *skb, u32 pid)
+static inline int genlmsg_unicast(struct net *net, struct sk_buff *skb, u32 portid)
 {
-        return nlmsg_unicast(net->genl_sock, skb, pid);
+        return nlmsg_unicast(net->genl_sock, skb, portid);
 }
 /**
@@ -264,7 +264,7 @@ static inline int genlmsg_unicast(struct net *net, struct sk_buff *skb, u32 pid)
 */
 static inline int genlmsg_reply(struct sk_buff *skb, struct genl_info *info)
 {
-        return genlmsg_unicast(genl_info_net(info), skb, info->snd_pid);
+        return genlmsg_unicast(genl_info_net(info), skb, info->snd_portid);
 }
 /**
diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
new file mode 100644
index 000000000000..4fd8a4b4b7ee
--- /dev/null
+++ b/include/net/gro_cells.h
@@ -0,0 +1,103 @@
+#ifndef _NET_GRO_CELLS_H
+#define _NET_GRO_CELLS_H
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/netdevice.h>
+struct gro_cell {
+        struct sk_buff_head     napi_skbs;
+        struct napi_struct      napi;
+} ____cacheline_aligned_in_smp;
+struct gro_cells {
+        unsigned int            gro_cells_mask;
+        struct gro_cell         *cells;
+};
+static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *skb)
+{
+        unsigned long flags;
+        struct gro_cell *cell = gcells->cells;
+        struct net_device *dev = skb->dev;
+        if (!cell || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) {
+                netif_rx(skb);
+                return;
+        }
+        if (skb_rx_queue_recorded(skb))
+                cell += skb_get_rx_queue(skb) & gcells->gro_cells_mask;
+        if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) {
+                atomic_long_inc(&dev->rx_dropped);
+                kfree_skb(skb);
+                return;
+        }
+        spin_lock_irqsave(&cell->napi_skbs.lock, flags);
+        __skb_queue_tail(&cell->napi_skbs, skb);
+        if (skb_queue_len(&cell->napi_skbs) == 1)
+                napi_schedule(&cell->napi);
+        spin_unlock_irqrestore(&cell->napi_skbs.lock, flags);
+}
+static inline int gro_cell_poll(struct napi_struct *napi, int budget)
+{
+        struct gro_cell *cell = container_of(napi, struct gro_cell, napi);
+        struct sk_buff *skb;
+        int work_done = 0;
+        while (work_done < budget) {
+                skb = skb_dequeue(&cell->napi_skbs);
+                if (!skb)
+                        break;
+                napi_gro_receive(napi, skb);
+                work_done++;
+        }
+        if (work_done < budget)
+                napi_complete(napi);
+        return work_done;
+}
+static inline int gro_cells_init(struct gro_cells *gcells, struct net_device *dev)
+{
+        int i;
+        gcells->gro_cells_mask = roundup_pow_of_two(netif_get_num_default_rss_queues()) - 1;
+        gcells->cells = kcalloc(sizeof(struct gro_cell),
+                                gcells->gro_cells_mask + 1,
+                                GFP_KERNEL);
+        if (!gcells->cells)
+                return -ENOMEM;
+        for (i = 0; i <= gcells->gro_cells_mask; i++) {
+                struct gro_cell *cell = gcells->cells + i;
+                skb_queue_head_init(&cell->napi_skbs);
+                netif_napi_add(dev, &cell->napi, gro_cell_poll, 64);
+                napi_enable(&cell->napi);
+        }
+        return 0;
+}
+static inline void gro_cells_destroy(struct gro_cells *gcells)
+{
+        struct gro_cell *cell = gcells->cells;
+        int i;
+        if (!cell)
+                return;
+        for (i = 0; i <= gcells->gro_cells_mask; i++,cell++) {
+                netif_napi_del(&cell->napi);
+                skb_queue_purge(&cell->napi_skbs);
+        }
+        kfree(gcells->cells);
+        gcells->cells = NULL;
+}
+#endif
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index 71392545d0a1..7f0df133d119 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -183,6 +183,9 @@ struct ieee80211_radiotap_header {
 *     Contains a bitmap of known fields/flags, the flags, and
 *     the MCS index.
 *
+ * IEEE80211_RADIOTAP_AMPDU_STATUS      u32, u16, u8, u8        unitless
+ *
+ *      Contains the AMPDU information for the subframe.
 */
 enum ieee80211_radiotap_type {
        IEEE80211_RADIOTAP_TSFT = 0,
@@ -205,6 +208,7 @@ enum ieee80211_radiotap_type {
        IEEE80211_RADIOTAP_DATA_RETRIES = 17,
        IEEE80211_RADIOTAP_MCS = 19,
+        IEEE80211_RADIOTAP_AMPDU_STATUS = 20,
        /* valid in every it_present bitmap, even vendor namespaces */
        IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE = 29,
@@ -270,6 +274,13 @@ enum ieee80211_radiotap_type {
 #define IEEE80211_RADIOTAP_MCS_FMT_GF           0x08
 #define IEEE80211_RADIOTAP_MCS_FEC_LDPC         0x10
+/* For IEEE80211_RADIOTAP_AMPDU_STATUS */
+#define IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN         0x0001
+#define IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN             0x0002
+#define IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN             0x0004
+#define IEEE80211_RADIOTAP_AMPDU_IS_LAST                0x0008
+#define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR          0x0010
+#define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN        0x0020
 /* helpers */
 static inline int ieee80211_get_radiotap_len(unsigned char *data)
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index 2fa14691869c..aab73757bc4d 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -15,6 +15,8 @@ enum {
        INET_ECN_MASK = 3,
 };
+extern int sysctl_tunnel_ecn_log;
 static inline int INET_ECN_is_ce(__u8 dsfield)
 {
        return (dsfield & INET_ECN_MASK) == INET_ECN_CE;
@@ -145,4 +147,78 @@ static inline int INET_ECN_set_ce(struct sk_buff *skb)
        return 0;
 }
+/*
+ * RFC 6080 4.2
+ *  To decapsulate the inner header at the tunnel egress, a compliant
+ *  tunnel egress MUST set the outgoing ECN field to the codepoint at the
+ *  intersection of the appropriate arriving inner header (row) and outer
+ *  header (column) in Figure 4
+ *
+ *      +---------+------------------------------------------------+
+ *      |Arriving |            Arriving Outer Header               |
+ *      |   Inner +---------+------------+------------+------------+
+ *      |  Header | Not-ECT | ECT(0)     | ECT(1)     |     CE     |
+ *      +---------+---------+------------+------------+------------+
+ *      | Not-ECT | Not-ECT |Not-ECT(!!!)|Not-ECT(!!!)| <drop>(!!!)|
+ *      |  ECT(0) |  ECT(0) | ECT(0)     | ECT(1)     |     CE     |
+ *      |  ECT(1) |  ECT(1) | ECT(1) (!) | ECT(1)     |     CE     |
+ *      |    CE   |      CE |     CE     |     CE(!!!)|     CE     |
+ *      +---------+---------+------------+------------+------------+
+ *
+ *             Figure 4: New IP in IP Decapsulation Behaviour
+ *
+ *  returns 0 on success
+ *          1 if something is broken and should be logged (!!! above)
+ *          2 if packet should be dropped
+ */
+static inline int INET_ECN_decapsulate(struct sk_buff *skb,
+                                       __u8 outer, __u8 inner)
+{
+        if (INET_ECN_is_not_ect(inner)) {
+                switch (outer & INET_ECN_MASK) {
+                case INET_ECN_NOT_ECT:
+                        return 0;
+                case INET_ECN_ECT_0:
+                case INET_ECN_ECT_1:
+                        return 1;
+                case INET_ECN_CE:
+                        return 2;
+                }
+        }
+        if (INET_ECN_is_ce(outer))
+                INET_ECN_set_ce(skb);
+        return 0;
+}
+static inline int IP_ECN_decapsulate(const struct iphdr *oiph,
+                                     struct sk_buff *skb)
+{
+        __u8 inner;
+        if (skb->protocol == htons(ETH_P_IP))
+                inner = ip_hdr(skb)->tos;
+        else if (skb->protocol == htons(ETH_P_IPV6))
+                inner = ipv6_get_dsfield(ipv6_hdr(skb));
+        else
+                return 0;
+        return INET_ECN_decapsulate(skb, oiph->tos, inner);
+}
+static inline int IP6_ECN_decapsulate(const struct ipv6hdr *oipv6h,
+                                      struct sk_buff *skb)
+{
+        __u8 inner;
+        if (skb->protocol == htons(ETH_P_IP))
+                inner = ip_hdr(skb)->tos;
+        else if (skb->protocol == htons(ETH_P_IPV6))
+                inner = ipv6_get_dsfield(ipv6_hdr(skb));
+        else
+                return 0;
+        return INET_ECN_decapsulate(skb, ipv6_get_dsfield(oipv6h), inner);
+}
 #endif
diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
index 2431cf83aeca..32786a044718 100644
--- a/include/net/inet_frag.h
+++ b/include/net/inet_frag.h
@@ -29,6 +29,8 @@ struct inet_frag_queue {
 #define INET_FRAG_COMPLETE      4
 #define INET_FRAG_FIRST_IN      2
 #define INET_FRAG_LAST_IN       1
+        u16                     max_size;
 };
 #define INETFRAGS_HASHSZ                64
@@ -59,7 +61,7 @@ void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f);
 void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f);
 void inet_frag_destroy(struct inet_frag_queue *q,
                                struct inet_frags *f, int *work);
-int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f);
+int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f, bool force);
 struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
                struct inet_frags *f, void *key, unsigned int hash)
        __releases(&f->lock);
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 613cfa401672..256c1ed2d69a 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -101,10 +101,8 @@ struct inet_cork {
        __be32                  addr;
        struct ip_options       *opt;
        unsigned int            fragsize;
-        struct dst_entry        *dst;
        int                     length; /* Total length of all frames */
-        struct page             *page;
+        struct dst_entry        *dst;
-        u32                     off;
        u8                      tx_flags;
 };
diff --git a/include/net/ip.h b/include/net/ip.h
index 5a5d84d3d2c6..0707fb9551aa 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -42,6 +42,8 @@ struct inet_skb_parm {
 #define IPSKB_XFRM_TRANSFORMED  4
 #define IPSKB_FRAG_COMPLETE     8
 #define IPSKB_REROUTED          16
+        u16                     frag_max_size;
 };
 static inline unsigned int ip_hdrlen(const struct sk_buff *skb)
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 9fc7114159e8..8a2a203eb15d 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -37,6 +37,7 @@ struct fib6_config {
        int             fc_ifindex;
        u32             fc_flags;
        u32             fc_protocol;
+        u32             fc_type;        /* only 8 bits are used */
        struct in6_addr fc_dst;
        struct in6_addr fc_src;
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index 358fb86f57eb..e03047f7090b 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -5,6 +5,8 @@
 #include <linux/netdevice.h>
 #include <linux/ip6_tunnel.h>
+#define IP6TUNNEL_ERR_TIMEO (30*HZ)
 /* capable of sending packets */
 #define IP6_TNL_F_CAP_XMIT 0x10000
 /* capable of receiving packets */
@@ -12,15 +14,40 @@
 /* determine capability on a per-packet basis */
 #define IP6_TNL_F_CAP_PER_PACKET 0x40000
-/* IPv6 tunnel */
+struct __ip6_tnl_parm {
+        char name[IFNAMSIZ];    /* name of tunnel device */
+        int link;               /* ifindex of underlying L2 interface */
+        __u8 proto;             /* tunnel protocol */
+        __u8 encap_limit;       /* encapsulation limit for tunnel */
+        __u8 hop_limit;         /* hop limit for tunnel */
+        __be32 flowinfo;        /* traffic class and flowlabel for tunnel */
+        __u32 flags;            /* tunnel flags */
+        struct in6_addr laddr;  /* local tunnel end-point address */
+        struct in6_addr raddr;  /* remote tunnel end-point address */
+        __be16                  i_flags;
+        __be16                  o_flags;
+        __be32                  i_key;
+        __be32                  o_key;
+};
+/* IPv6 tunnel */
 struct ip6_tnl {
        struct ip6_tnl __rcu *next;     /* next tunnel in list */
        struct net_device *dev; /* virtual device associated with tunnel */
-        struct ip6_tnl_parm parms;      /* tunnel configuration parameters */
+        struct __ip6_tnl_parm parms;    /* tunnel configuration parameters */
        struct flowi fl;        /* flowi template for xmit */
        struct dst_entry *dst_cache;    /* cached dst */
        u32 dst_cookie;
+        int err_count;
+        unsigned long err_time;
+        /* These fields used only by GRE */
+        __u32 i_seqno;  /* The last seen seqno  */
+        __u32 o_seqno;  /* The last output seqno */
+        int hlen;       /* Precalculated GRE header length */
+        int mlink;
 };
 /* Tunnel encapsulation limit destination sub-option */
@@ -31,4 +58,14 @@ struct ipv6_tlv_tnl_enc_lim {
        __u8 encap_limit;       /* tunnel encapsulation limit   */
 } __packed;
+struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t);
+void ip6_tnl_dst_reset(struct ip6_tnl *t);
+void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst);
+int ip6_tnl_rcv_ctl(struct ip6_tnl *t, const struct in6_addr *laddr,
+                const struct in6_addr *raddr);
+int ip6_tnl_xmit_ctl(struct ip6_tnl *t);
+__u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw);
+__u32 ip6_tnl_get_cap(struct ip6_tnl *t, const struct in6_addr *laddr,
+                             const struct in6_addr *raddr);
 #endif
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 95374d1696a1..ee75ccdf5188 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -808,8 +808,6 @@ struct netns_ipvs {
        struct list_head        rs_table[IP_VS_RTAB_SIZE];
        /* ip_vs_app */
        struct list_head        app_list;
-        /* ip_vs_ftp */
-        struct ip_vs_app        *ftp_app;
        /* ip_vs_proto */
        #define IP_VS_PROTO_TAB_SIZE    32      /* must be power of 2 */
        struct ip_vs_proto_data *proto_data_table[IP_VS_PROTO_TAB_SIZE];
@@ -890,6 +888,7 @@ struct netns_ipvs {
        unsigned int            sysctl_sync_refresh_period;
        int                     sysctl_sync_retries;
        int                     sysctl_nat_icmp_send;
+        int                     sysctl_pmtu_disc;
        /* ip_vs_lblc */
        int                     sysctl_lblc_expiration;
@@ -976,6 +975,11 @@ static inline int sysctl_sync_sock_size(struct netns_ipvs *ipvs)
        return ipvs->sysctl_sync_sock_size;
 }
+static inline int sysctl_pmtu_disc(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_pmtu_disc;
+}
 #else
 static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs)
@@ -1018,6 +1022,11 @@ static inline int sysctl_sync_sock_size(struct netns_ipvs *ipvs)
        return 0;
 }
+static inline int sysctl_pmtu_disc(struct netns_ipvs *ipvs)
+{
+        return 1;
+}
 #endif
 /*
@@ -1179,7 +1188,8 @@ extern void ip_vs_service_net_cleanup(struct net *net);
 *      (from ip_vs_app.c)
 */
 #define IP_VS_APP_MAX_PORTS  8
-extern int register_ip_vs_app(struct net *net, struct ip_vs_app *app);
+extern struct ip_vs_app *register_ip_vs_app(struct net *net,
+                                            struct ip_vs_app *app);
 extern void unregister_ip_vs_app(struct net *net, struct ip_vs_app *app);
 extern int ip_vs_bind_app(struct ip_vs_conn *cp, struct ip_vs_protocol *pp);
 extern void ip_vs_unbind_app(struct ip_vs_conn *cp);
diff --git a/include/net/ipip.h b/include/net/ipip.h
index a93cf6d7e94b..ddc077c51f32 100644
--- a/include/net/ipip.h
+++ b/include/net/ipip.h
@@ -2,6 +2,7 @@
 #define __NET_IPIP_H 1
 #include <linux/if_tunnel.h>
+#include <net/gro_cells.h>
 #include <net/ip.h>
 /* Keep error state on tunnel for 30 sec */
@@ -36,6 +37,8 @@ struct ip_tunnel {
 #endif
        struct ip_tunnel_prl_entry __rcu *prl;          /* potential router list */
        unsigned int                    prl_count;      /* # of entries in PRL */
+        struct gro_cells                gro_cells;
 };
 struct ip_tunnel_prl_entry {
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index c8a202436e01..979bf6c13141 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -34,6 +34,7 @@
 #define NEXTHDR_IPV6            41      /* IPv6 in IPv6 */
 #define NEXTHDR_ROUTING         43      /* Routing header. */
 #define NEXTHDR_FRAGMENT        44      /* Fragmentation/reassembly header. */
+#define NEXTHDR_GRE             47      /* GRE header. */
 #define NEXTHDR_ESP             50      /* Encapsulating security payload. */
 #define NEXTHDR_AUTH            51      /* Authentication header. */
 #define NEXTHDR_ICMP            58      /* ICMP for IPv6. */
@@ -270,8 +271,17 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
 extern bool ipv6_opt_accepted(const struct sock *sk, const struct sk_buff *skb);
-int ip6_frag_nqueues(struct net *net);
+#if IS_ENABLED(CONFIG_IPV6)
-int ip6_frag_mem(struct net *net);
+static inline int ip6_frag_nqueues(struct net *net)
+{
+        return net->ipv6.frags.nqueues;
+}
+static inline int ip6_frag_mem(struct net *net)
+{
+        return atomic_read(&net->ipv6.frags.mem);
+}
+#endif
 #define IPV6_FRAG_HIGH_THRESH   (256 * 1024)    /* 262144 */
 #define IPV6_FRAG_LOW_THRESH    (192 * 1024)    /* 196608 */
@@ -410,6 +420,25 @@ struct ip6_create_arg {
 void ip6_frag_init(struct inet_frag_queue *q, void *a);
 bool ip6_frag_match(struct inet_frag_queue *q, void *a);
+/*
+ *      Equivalent of ipv4 struct ip
+ */
+struct frag_queue {
+        struct inet_frag_queue  q;
+        __be32                  id;             /* fragment id          */
+        u32                     user;
+        struct in6_addr         saddr;
+        struct in6_addr         daddr;
+        int                     iif;
+        unsigned int            csum;
+        __u16                   nhoffset;
+};
+void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq,
+                           struct inet_frags *frags);
 static inline bool ipv6_addr_any(const struct in6_addr *a)
 {
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
diff --git a/include/net/llc.h b/include/net/llc.h
index f2d0fc570527..9e7d7f08ef77 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -151,7 +151,6 @@ extern int sysctl_llc2_ack_timeout;
 extern int sysctl_llc2_busy_timeout;
 extern int sysctl_llc2_p_timeout;
 extern int sysctl_llc2_rej_timeout;
-extern int sysctl_llc_station_ack_timeout;
 #else
 #define llc_sysctl_init() (0)
 #define llc_sysctl_exit() do { } while(0)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index bb86aa6f98dd..82558c8decf8 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -171,6 +171,7 @@ struct ieee80211_low_level_stats {
 * @BSS_CHANGED_IDLE: Idle changed for this BSS/interface.
 * @BSS_CHANGED_SSID: SSID changed for this BSS (AP mode)
 * @BSS_CHANGED_AP_PROBE_RESP: Probe Response changed for this BSS (AP mode)
+ * @BSS_CHANGED_PS: PS changed for this BSS (STA mode)
 */
 enum ieee80211_bss_change {
        BSS_CHANGED_ASSOC               = 1<<0,
@@ -190,6 +191,7 @@ enum ieee80211_bss_change {
        BSS_CHANGED_IDLE                = 1<<14,
        BSS_CHANGED_SSID                = 1<<15,
        BSS_CHANGED_AP_PROBE_RESP       = 1<<16,
+        BSS_CHANGED_PS                  = 1<<17,
        /* when adding here, make sure to change ieee80211_reconfig */
 };
@@ -266,6 +268,8 @@ enum ieee80211_rssi_event {
 * @idle: This interface is idle. There's also a global idle flag in the
 *      hardware config which may be more appropriate depending on what
 *      your driver/device needs to do.
+ * @ps: power-save mode (STA only). This flag is NOT affected by
+ *      offchannel/dynamic_ps operations.
 * @ssid: The SSID of the current vif. Only valid in AP-mode.
 * @ssid_len: Length of SSID given in @ssid.
 * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
@@ -296,6 +300,7 @@ struct ieee80211_bss_conf {
        bool arp_filter_enabled;
        bool qos;
        bool idle;
+        bool ps;
        u8 ssid[IEEE80211_MAX_SSID_LEN];
        size_t ssid_len;
        bool hidden_ssid;
@@ -522,9 +527,6 @@ struct ieee80211_tx_rate {
 *  (2) driver internal use (if applicable)
 *  (3) TX status information - driver tells mac80211 what happened
 *
- * The TX control's sta pointer is only valid during the ->tx call,
- * it may be NULL.
- *
 * @flags: transmit info flags, defined above
 * @band: the band to transmit on (use for checking for races)
 * @hw_queue: HW queue to put the frame on, skb_get_queue_mapping() gives the AC
@@ -555,6 +557,7 @@ struct ieee80211_tx_info {
                                        struct ieee80211_tx_rate rates[
                                                IEEE80211_TX_MAX_RATES];
                                        s8 rts_cts_rate_idx;
+                                        /* 3 bytes free */
                                };
                                /* only needed before rate control */
                                unsigned long jiffies;
@@ -562,7 +565,7 @@ struct ieee80211_tx_info {
                        /* NB: vif can be NULL for injected frames */
                        struct ieee80211_vif *vif;
                        struct ieee80211_key_conf *hw_key;
-                        struct ieee80211_sta *sta;
+                        /* 8 bytes free */
                } control;
                struct {
                        struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
@@ -673,21 +676,41 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
 * @RX_FLAG_HT_GF: This frame was received in a HT-greenfield transmission, if
 *      the driver fills this value it should add %IEEE80211_RADIOTAP_MCS_HAVE_FMT
 *      to hw.radiotap_mcs_details to advertise that fact
+ * @RX_FLAG_AMPDU_DETAILS: A-MPDU details are known, in particular the reference
+ *      number (@ampdu_reference) must be populated and be a distinct number for
+ *      each A-MPDU
+ * @RX_FLAG_AMPDU_REPORT_ZEROLEN: driver reports 0-length subframes
+ * @RX_FLAG_AMPDU_IS_ZEROLEN: This is a zero-length subframe, for
+ *      monitoring purposes only
+ * @RX_FLAG_AMPDU_LAST_KNOWN: last subframe is known, should be set on all
+ *      subframes of a single A-MPDU
+ * @RX_FLAG_AMPDU_IS_LAST: this subframe is the last subframe of the A-MPDU
+ * @RX_FLAG_AMPDU_DELIM_CRC_ERROR: A delimiter CRC error has been detected
+ *      on this subframe
+ * @RX_FLAG_AMPDU_DELIM_CRC_KNOWN: The delimiter CRC field is known (the CRC
+ *      is stored in the @ampdu_delimiter_crc field)
 */
 enum mac80211_rx_flags {
-        RX_FLAG_MMIC_ERROR      = 1<<0,
+        RX_FLAG_MMIC_ERROR              = BIT(0),
-        RX_FLAG_DECRYPTED       = 1<<1,
+        RX_FLAG_DECRYPTED               = BIT(1),
-        RX_FLAG_MMIC_STRIPPED   = 1<<3,
+        RX_FLAG_MMIC_STRIPPED           = BIT(3),
-        RX_FLAG_IV_STRIPPED     = 1<<4,
+        RX_FLAG_IV_STRIPPED             = BIT(4),
-        RX_FLAG_FAILED_FCS_CRC  = 1<<5,
+        RX_FLAG_FAILED_FCS_CRC          = BIT(5),
-        RX_FLAG_FAILED_PLCP_CRC = 1<<6,
+        RX_FLAG_FAILED_PLCP_CRC         = BIT(6),
-        RX_FLAG_MACTIME_MPDU    = 1<<7,
+        RX_FLAG_MACTIME_MPDU            = BIT(7),
-        RX_FLAG_SHORTPRE        = 1<<8,
+        RX_FLAG_SHORTPRE                = BIT(8),
-        RX_FLAG_HT              = 1<<9,
+        RX_FLAG_HT                      = BIT(9),
-        RX_FLAG_40MHZ           = 1<<10,
+        RX_FLAG_40MHZ                   = BIT(10),
-        RX_FLAG_SHORT_GI        = 1<<11,
+        RX_FLAG_SHORT_GI                = BIT(11),
-        RX_FLAG_NO_SIGNAL_VAL   = 1<<12,
+        RX_FLAG_NO_SIGNAL_VAL           = BIT(12),
-        RX_FLAG_HT_GF           = 1<<13,
+        RX_FLAG_HT_GF                   = BIT(13),
+        RX_FLAG_AMPDU_DETAILS           = BIT(14),
+        RX_FLAG_AMPDU_REPORT_ZEROLEN    = BIT(15),
+        RX_FLAG_AMPDU_IS_ZEROLEN        = BIT(16),
+        RX_FLAG_AMPDU_LAST_KNOWN        = BIT(17),
+        RX_FLAG_AMPDU_IS_LAST           = BIT(18),
+        RX_FLAG_AMPDU_DELIM_CRC_ERROR   = BIT(19),
+        RX_FLAG_AMPDU_DELIM_CRC_KNOWN   = BIT(20),
 };
 /**
@@ -711,17 +734,22 @@ enum mac80211_rx_flags {
 *      HT rates are use (RX_FLAG_HT)
 * @flag: %RX_FLAG_*
 * @rx_flags: internal RX flags for mac80211
+ * @ampdu_reference: A-MPDU reference number, must be a different value for
+ *      each A-MPDU but the same for each subframe within one A-MPDU
+ * @ampdu_delimiter_crc: A-MPDU delimiter CRC
 */
 struct ieee80211_rx_status {
        u64 mactime;
        u32 device_timestamp;
-        u16 flag;
+        u32 ampdu_reference;
+        u32 flag;
        u16 freq;
        u8 rate_idx;
        u8 rx_flags;
        u8 band;
        u8 antenna;
        s8 signal;
+        u8 ampdu_delimiter_crc;
 };
 /**
@@ -945,21 +973,29 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
 *      generation in software.
 * @IEEE80211_KEY_FLAG_PAIRWISE: Set by mac80211, this flag indicates
 *      that the key is pairwise rather then a shared key.
- * @IEEE80211_KEY_FLAG_SW_MGMT: This flag should be set by the driver for a
+ * @IEEE80211_KEY_FLAG_SW_MGMT_TX: This flag should be set by the driver for a
 *      CCMP key if it requires CCMP encryption of management frames (MFP) to
 *      be done in software.
 * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
 *      if space should be prepared for the IV, but the IV
 *      itself should not be generated. Do not set together with
 *      @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
+ * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received
+ *      management frames. The flag can help drivers that have a hardware
+ *      crypto implementation that doesn't deal with management frames
+ *      properly by allowing them to not upload the keys to hardware and
+ *      fall back to software crypto. Note that this flag deals only with
+ *      RX, if your crypto engine can't deal with TX you can also set the
+ *      %IEEE80211_KEY_FLAG_SW_MGMT_TX flag to encrypt such frames in SW.
 */
 enum ieee80211_key_flags {
        IEEE80211_KEY_FLAG_WMM_STA      = 1<<0,
        IEEE80211_KEY_FLAG_GENERATE_IV  = 1<<1,
        IEEE80211_KEY_FLAG_GENERATE_MMIC= 1<<2,
        IEEE80211_KEY_FLAG_PAIRWISE     = 1<<3,
-        IEEE80211_KEY_FLAG_SW_MGMT      = 1<<4,
+        IEEE80211_KEY_FLAG_SW_MGMT_TX   = 1<<4,
        IEEE80211_KEY_FLAG_PUT_IV_SPACE = 1<<5,
+        IEEE80211_KEY_FLAG_RX_MGMT      = 1<<6,
 };
 /**
@@ -1074,6 +1110,16 @@ enum sta_notify_cmd {
 };
 /**
+ * struct ieee80211_tx_control - TX control data
+ *
+ * @sta: station table entry, this sta pointer may be NULL and
+ *      it is not allowed to copy the pointer, due to RCU.
+ */
+struct ieee80211_tx_control {
+        struct ieee80211_sta *sta;
+};
+/**
 * enum ieee80211_hw_flags - hardware flags
 *
 * These flags are used to indicate hardware capabilities to
@@ -1203,6 +1249,10 @@ enum sta_notify_cmd {
 *      queue mapping in order to use different queues (not just one per AC)
 *      for different virtual interfaces. See the doc section on HW queue
 *      control for more details.
+ *
+ * @IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF: Use the P2P Device address for any
+ *      P2P Interface. This will be honoured even if more than one interface
+ *      is supported.
 */
 enum ieee80211_hw_flags {
        IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1230,6 +1280,7 @@ enum ieee80211_hw_flags {
        IEEE80211_HW_AP_LINK_PS                         = 1<<22,
        IEEE80211_HW_TX_AMPDU_SETUP_IN_HW               = 1<<23,
        IEEE80211_HW_SCAN_WHILE_IDLE                    = 1<<24,
+        IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
 };
 /**
@@ -1884,10 +1935,14 @@ enum ieee80211_frame_release_type {
 * @IEEE80211_RC_BW_CHANGED: The bandwidth that can be used to transmit
 *      to this station changed.
 * @IEEE80211_RC_SMPS_CHANGED: The SMPS state of the station changed.
+ * @IEEE80211_RC_SUPP_RATES_CHANGED: The supported rate set of this peer
+ *      changed (in IBSS mode) due to discovering more information about
+ *      the peer.
 */
 enum ieee80211_rate_control_changed {
        IEEE80211_RC_BW_CHANGED         = BIT(0),
        IEEE80211_RC_SMPS_CHANGED       = BIT(1),
+        IEEE80211_RC_SUPP_RATES_CHANGED = BIT(2),
 };
 /**
@@ -2264,7 +2319,9 @@ enum ieee80211_rate_control_changed {
 *      The callback is optional and can (should!) sleep.
 */
 struct ieee80211_ops {
-        void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
+        void (*tx)(struct ieee80211_hw *hw,
+                   struct ieee80211_tx_control *control,
+                   struct sk_buff *skb);
        int (*start)(struct ieee80211_hw *hw);
        void (*stop)(struct ieee80211_hw *hw);
 #ifdef CONFIG_PM
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 96a3b5c03e37..980d263765cf 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -49,6 +49,7 @@ enum {
 #include <linux/types.h>
 #include <linux/if_arp.h>
 #include <linux/netdevice.h>
+#include <linux/hash.h>
 #include <net/neighbour.h>
@@ -134,7 +135,7 @@ static inline u32 ndisc_hashfn(const void *pkey, const struct net_device *dev, _
 {
        const u32 *p32 = pkey;
-        return (((p32[0] ^ dev->ifindex) * hash_rnd[0]) +
+        return (((p32[0] ^ hash32_ptr(dev)) * hash_rnd[0]) +
                (p32[1] * hash_rnd[1]) +
                (p32[2] * hash_rnd[2]) +
                (p32[3] * hash_rnd[3]));
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 344d8988842a..0dab173e27da 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -334,18 +334,22 @@ static inline int neigh_hh_bridge(struct hh_cache *hh, struct sk_buff *skb)
 }
 #endif
-static inline int neigh_hh_output(struct hh_cache *hh, struct sk_buff *skb)
+static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb)
 {
        unsigned int seq;
        int hh_len;
        do {
-                int hh_alen;
                seq = read_seqbegin(&hh->hh_lock);
                hh_len = hh->hh_len;
-                hh_alen = HH_DATA_ALIGN(hh_len);
+                if (likely(hh_len <= HH_DATA_MOD)) {
-                memcpy(skb->data - hh_alen, hh->hh_data, hh_alen);
+                        /* this is inlined by gcc */
+                        memcpy(skb->data - HH_DATA_MOD, hh->hh_data, HH_DATA_MOD);
+                } else {
+                        int hh_alen = HH_DATA_ALIGN(hh_len);
+                        memcpy(skb->data - hh_alen, hh->hh_data, hh_alen);
+                }
        } while (read_seqretry(&hh->hh_lock, seq));
        skb_push(skb, hh_len);
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index fd87963a0ea5..4faf6612ecac 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -15,6 +15,7 @@
 #include <net/netns/packet.h>
 #include <net/netns/ipv4.h>
 #include <net/netns/ipv6.h>
+#include <net/netns/sctp.h>
 #include <net/netns/dccp.h>
 #include <net/netns/x_tables.h>
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
@@ -66,6 +67,7 @@ struct net {
        struct hlist_head       *dev_name_head;
        struct hlist_head       *dev_index_head;
        unsigned int            dev_base_seq;   /* protected by rtnl_mutex */
+        int                     ifindex;
        /* core fib_rules */
        struct list_head        rules_ops;
@@ -80,6 +82,9 @@ struct net {
 #if IS_ENABLED(CONFIG_IPV6)
        struct netns_ipv6       ipv6;
 #endif
+#if defined(CONFIG_IP_SCTP) || defined(CONFIG_IP_SCTP_MODULE)
+        struct netns_sctp       sctp;
+#endif
 #if defined(CONFIG_IP_DCCP) || defined(CONFIG_IP_DCCP_MODULE)
        struct netns_dccp       dccp;
 #endif
@@ -88,6 +93,9 @@ struct net {
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
        struct netns_ct         ct;
 #endif
+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+        struct netns_nf_frag    nf_frag;
+#endif
        struct sock             *nfnl;
        struct sock             *nfnl_stash;
 #endif
@@ -105,6 +113,13 @@ struct net {
        atomic_t                rt_genid;
 };
+/*
+ * ifindex generation is per-net namespace, and loopback is
+ * always the 1st device in ns (see net_dev_init), thus any
+ * loopback device should get ifindex 1
+ */
+#define LOOPBACK_IFINDEX        1
 #include <linux/seq_file_net.h>
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index 4a045cda9c60..5654d292efd4 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -17,7 +17,7 @@ struct nf_conntrack_ecache {
        unsigned long missed;   /* missed events */
        u16 ctmask;             /* bitmask of ct events to be delivered */
        u16 expmask;            /* bitmask of expect events to be delivered */
-        u32 pid;                /* netlink pid of destroyer */
+        u32 portid;             /* netlink portid of destroyer */
        struct timer_list timeout;
 };
@@ -60,7 +60,7 @@ nf_ct_ecache_ext_add(struct nf_conn *ct, u16 ctmask, u16 expmask, gfp_t gfp)
 /* This structure is passed to event handler */
 struct nf_ct_event {
        struct nf_conn *ct;
-        u32 pid;
+        u32 portid;
        int report;
 };
@@ -92,7 +92,7 @@ nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
 static inline int
 nf_conntrack_eventmask_report(unsigned int eventmask,
                              struct nf_conn *ct,
-                              u32 pid,
+                              u32 portid,
                              int report)
 {
        int ret = 0;
@@ -112,11 +112,11 @@ nf_conntrack_eventmask_report(unsigned int eventmask,
        if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct)) {
                struct nf_ct_event item = {
                        .ct     = ct,
-                        .pid    = e->pid ? e->pid : pid,
+                        .portid = e->portid ? e->portid : portid,
                        .report = report
                };
                /* This is a resent of a destroy event? If so, skip missed */
-                unsigned long missed = e->pid ? 0 : e->missed;
+                unsigned long missed = e->portid ? 0 : e->missed;
                if (!((eventmask | missed) & e->ctmask))
                        goto out_unlock;
@@ -126,11 +126,11 @@ nf_conntrack_eventmask_report(unsigned int eventmask,
                        spin_lock_bh(&ct->lock);
                        if (ret < 0) {
                                /* This is a destroy event that has been
-                                 * triggered by a process, we store the PID
+                                 * triggered by a process, we store the PORTID
                                 * to include it in the retransmission. */
                                if (eventmask & (1 << IPCT_DESTROY) &&
-                                    e->pid == 0 && pid != 0)
+                                    e->portid == 0 && portid != 0)
-                                        e->pid = pid;
+                                        e->portid = portid;
                                else
                                        e->missed |= eventmask;
                        } else
@@ -145,9 +145,9 @@ out_unlock:
 static inline int
 nf_conntrack_event_report(enum ip_conntrack_events event, struct nf_conn *ct,
-                          u32 pid, int report)
+                          u32 portid, int report)
 {
-        return nf_conntrack_eventmask_report(1 << event, ct, pid, report);
+        return nf_conntrack_eventmask_report(1 << event, ct, portid, report);
 }
 static inline int
@@ -158,7 +158,7 @@ nf_conntrack_event(enum ip_conntrack_events event, struct nf_conn *ct)
 struct nf_exp_event {
        struct nf_conntrack_expect *exp;
-        u32 pid;
+        u32 portid;
        int report;
 };
@@ -172,7 +172,7 @@ extern void nf_ct_expect_unregister_notifier(struct net *net, struct nf_exp_even
 static inline void
 nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
                          struct nf_conntrack_expect *exp,
-                          u32 pid,
+                          u32 portid,
                          int report)
 {
        struct net *net = nf_ct_exp_net(exp);
@@ -191,7 +191,7 @@ nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
        if (e->expmask & (1 << event)) {
                struct nf_exp_event item = {
                        .exp    = exp,
-                        .pid    = pid,
+                        .portid = portid,
                        .report = report
                };
                notify->fcn(1 << event, &item);
@@ -216,20 +216,20 @@ static inline void nf_conntrack_event_cache(enum ip_conntrack_events event,
                                            struct nf_conn *ct) {}
 static inline int nf_conntrack_eventmask_report(unsigned int eventmask,
                                                struct nf_conn *ct,
-                                                u32 pid,
+                                                u32 portid,
                                                int report) { return 0; }
 static inline int nf_conntrack_event(enum ip_conntrack_events event,
                                     struct nf_conn *ct) { return 0; }
 static inline int nf_conntrack_event_report(enum ip_conntrack_events event,
                                            struct nf_conn *ct,
-                                            u32 pid,
+                                            u32 portid,
                                            int report) { return 0; }
 static inline void nf_ct_deliver_cached_events(const struct nf_conn *ct) {}
 static inline void nf_ct_expect_event(enum ip_conntrack_expect_events event,
                                      struct nf_conntrack_expect *exp) {}
 static inline void nf_ct_expect_event_report(enum ip_conntrack_expect_events e,
                                             struct nf_conntrack_expect *exp,
-                                             u32 pid,
+                                             u32 portid,
                                             int report) {}
 static inline int nf_conntrack_ecache_init(struct net *net)
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index 983f00263243..cc13f377a705 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -43,7 +43,7 @@ struct nf_conntrack_expect {
        unsigned int class;
 #ifdef CONFIG_NF_NAT_NEEDED
-        __be32 saved_ip;
+        union nf_inet_addr saved_addr;
        /* This is the original per-proto part, used to map the
         * expected connection the way the recipient expects. */
        union nf_conntrack_man_proto saved_proto;
diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h
index 34ec89f8dbf9..e41e472d08f2 100644
--- a/include/net/netfilter/nf_conntrack_timeout.h
+++ b/include/net/netfilter/nf_conntrack_timeout.h
@@ -55,6 +55,26 @@ struct nf_conn_timeout *nf_ct_timeout_ext_add(struct nf_conn *ct,
 #endif
 };
+static inline unsigned int *
+nf_ct_timeout_lookup(struct net *net, struct nf_conn *ct,
+                     struct nf_conntrack_l4proto *l4proto)
+{
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        struct nf_conn_timeout *timeout_ext;
+        unsigned int *timeouts;
+        timeout_ext = nf_ct_timeout_find(ct);
+        if (timeout_ext)
+                timeouts = NF_CT_TIMEOUT_EXT_DATA(timeout_ext);
+        else
+                timeouts = l4proto->get_timeouts(net);
+        return timeouts;
+#else
+        return l4proto->get_timeouts(net);
+#endif
+}
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 extern int nf_conntrack_timeout_init(struct net *net);
 extern void nf_conntrack_timeout_fini(struct net *net);
diff --git a/include/net/netfilter/nf_nat.h b/include/net/netfilter/nf_nat.h
index b4de990b55f1..bd8eea720f2e 100644
--- a/include/net/netfilter/nf_nat.h
+++ b/include/net/netfilter/nf_nat.h
@@ -43,14 +43,16 @@ struct nf_conn_nat {
        struct nf_conn *ct;
        union nf_conntrack_nat_help help;
 #if defined(CONFIG_IP_NF_TARGET_MASQUERADE) || \
-    defined(CONFIG_IP_NF_TARGET_MASQUERADE_MODULE)
+    defined(CONFIG_IP_NF_TARGET_MASQUERADE_MODULE) || \
+    defined(CONFIG_IP6_NF_TARGET_MASQUERADE) || \
+    defined(CONFIG_IP6_NF_TARGET_MASQUERADE_MODULE)
        int masq_index;
 #endif
 };
 /* Set up the info structure to map into this range. */
 extern unsigned int nf_nat_setup_info(struct nf_conn *ct,
-                                      const struct nf_nat_ipv4_range *range,
+                                      const struct nf_nat_range *range,
                                      enum nf_nat_manip_type maniptype);
 /* Is this tuple already taken? (not by us)*/
diff --git a/include/net/netfilter/nf_nat_core.h b/include/net/netfilter/nf_nat_core.h
index b13d8d18d595..972e1e47ec79 100644
--- a/include/net/netfilter/nf_nat_core.h
+++ b/include/net/netfilter/nf_nat_core.h
@@ -12,10 +12,7 @@ extern unsigned int nf_nat_packet(struct nf_conn *ct,
                                  unsigned int hooknum,
                                  struct sk_buff *skb);
-extern int nf_nat_icmp_reply_translation(struct nf_conn *ct,
+extern int nf_xfrm_me_harder(struct sk_buff *skb, unsigned int family);
-                                         enum ip_conntrack_info ctinfo,
-                                         unsigned int hooknum,
-                                         struct sk_buff *skb);
 static inline int nf_nat_initialized(struct nf_conn *ct,
                                     enum nf_nat_manip_type manip)
diff --git a/include/net/netfilter/nf_nat_helper.h b/include/net/netfilter/nf_nat_helper.h
index 7d8fb7b46c44..b4d6bfc2af03 100644
--- a/include/net/netfilter/nf_nat_helper.h
+++ b/include/net/netfilter/nf_nat_helper.h
@@ -10,6 +10,7 @@ struct sk_buff;
 extern int __nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                                      struct nf_conn *ct,
                                      enum ip_conntrack_info ctinfo,
+                                      unsigned int protoff,
                                      unsigned int match_offset,
                                      unsigned int match_len,
                                      const char *rep_buffer,
@@ -18,12 +19,13 @@ extern int __nf_nat_mangle_tcp_packet(struct sk_buff *skb,
 static inline int nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                                           struct nf_conn *ct,
                                           enum ip_conntrack_info ctinfo,
+                                           unsigned int protoff,
                                           unsigned int match_offset,
                                           unsigned int match_len,
                                           const char *rep_buffer,
                                           unsigned int rep_len)
 {
-        return __nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
+        return __nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff,
                                          match_offset, match_len,
                                          rep_buffer, rep_len, true);
 }
@@ -31,6 +33,7 @@ static inline int nf_nat_mangle_tcp_packet(struct sk_buff *skb,
 extern int nf_nat_mangle_udp_packet(struct sk_buff *skb,
                                    struct nf_conn *ct,
                                    enum ip_conntrack_info ctinfo,
+                                    unsigned int protoff,
                                    unsigned int match_offset,
                                    unsigned int match_len,
                                    const char *rep_buffer,
@@ -41,10 +44,12 @@ extern void nf_nat_set_seq_adjust(struct nf_conn *ct,
                                  __be32 seq, s16 off);
 extern int nf_nat_seq_adjust(struct sk_buff *skb,
                             struct nf_conn *ct,
-                             enum ip_conntrack_info ctinfo);
+                             enum ip_conntrack_info ctinfo,
+                             unsigned int protoff);
 extern int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
                                     struct nf_conn *ct,
-                                     enum ip_conntrack_info ctinfo);
+                                     enum ip_conntrack_info ctinfo,
+                                     unsigned int protoff);
 /* Setup NAT on this expected conntrack so it follows master, but goes
 * to port ct->master->saved_proto. */
diff --git a/include/net/netfilter/nf_nat_l3proto.h b/include/net/netfilter/nf_nat_l3proto.h
new file mode 100644
index 000000000000..bd3b97e02c82
--- /dev/null
+++ b/include/net/netfilter/nf_nat_l3proto.h
@@ -0,0 +1,52 @@
+#ifndef _NF_NAT_L3PROTO_H
+#define _NF_NAT_L3PROTO_H
+struct nf_nat_l4proto;
+struct nf_nat_l3proto {
+        u8      l3proto;
+        bool    (*in_range)(const struct nf_conntrack_tuple *t,
+                            const struct nf_nat_range *range);
+        u32     (*secure_port)(const struct nf_conntrack_tuple *t, __be16);
+        bool    (*manip_pkt)(struct sk_buff *skb,
+                             unsigned int iphdroff,
+                             const struct nf_nat_l4proto *l4proto,
+                             const struct nf_conntrack_tuple *target,
+                             enum nf_nat_manip_type maniptype);
+        void    (*csum_update)(struct sk_buff *skb, unsigned int iphdroff,
+                               __sum16 *check,
+                               const struct nf_conntrack_tuple *t,
+                               enum nf_nat_manip_type maniptype);
+        void    (*csum_recalc)(struct sk_buff *skb, u8 proto,
+                               void *data, __sum16 *check,
+                               int datalen, int oldlen);
+        void    (*decode_session)(struct sk_buff *skb,
+                                  const struct nf_conn *ct,
+                                  enum ip_conntrack_dir dir,
+                                  unsigned long statusbit,
+                                  struct flowi *fl);
+        int     (*nlattr_to_range)(struct nlattr *tb[],
+                                   struct nf_nat_range *range);
+};
+extern int nf_nat_l3proto_register(const struct nf_nat_l3proto *);
+extern void nf_nat_l3proto_unregister(const struct nf_nat_l3proto *);
+extern const struct nf_nat_l3proto *__nf_nat_l3proto_find(u8 l3proto);
+extern int nf_nat_icmp_reply_translation(struct sk_buff *skb,
+                                         struct nf_conn *ct,
+                                         enum ip_conntrack_info ctinfo,
+                                         unsigned int hooknum);
+extern int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
+                                           struct nf_conn *ct,
+                                           enum ip_conntrack_info ctinfo,
+                                           unsigned int hooknum,
+                                           unsigned int hdrlen);
+#endif /* _NF_NAT_L3PROTO_H */
diff --git a/include/net/netfilter/nf_nat_l4proto.h b/include/net/netfilter/nf_nat_l4proto.h
new file mode 100644
index 000000000000..24feb68d1bcc
--- /dev/null
+++ b/include/net/netfilter/nf_nat_l4proto.h
@@ -0,0 +1,72 @@
+/* Header for use in defining a given protocol. */
+#ifndef _NF_NAT_L4PROTO_H
+#define _NF_NAT_L4PROTO_H
+#include <net/netfilter/nf_nat.h>
+#include <linux/netfilter/nfnetlink_conntrack.h>
+struct nf_nat_range;
+struct nf_nat_l3proto;
+struct nf_nat_l4proto {
+        /* Protocol number. */
+        u8 l4proto;
+        /* Translate a packet to the target according to manip type.
+         * Return true if succeeded.
+         */
+        bool (*manip_pkt)(struct sk_buff *skb,
+                          const struct nf_nat_l3proto *l3proto,
+                          unsigned int iphdroff, unsigned int hdroff,
+                          const struct nf_conntrack_tuple *tuple,
+                          enum nf_nat_manip_type maniptype);
+        /* Is the manipable part of the tuple between min and max incl? */
+        bool (*in_range)(const struct nf_conntrack_tuple *tuple,
+                         enum nf_nat_manip_type maniptype,
+                         const union nf_conntrack_man_proto *min,
+                         const union nf_conntrack_man_proto *max);
+        /* Alter the per-proto part of the tuple (depending on
+         * maniptype), to give a unique tuple in the given range if
+         * possible.  Per-protocol part of tuple is initialized to the
+         * incoming packet.
+         */
+        void (*unique_tuple)(const struct nf_nat_l3proto *l3proto,
+                             struct nf_conntrack_tuple *tuple,
+                             const struct nf_nat_range *range,
+                             enum nf_nat_manip_type maniptype,
+                             const struct nf_conn *ct);
+        int (*nlattr_to_range)(struct nlattr *tb[],
+                               struct nf_nat_range *range);
+};
+/* Protocol registration. */
+extern int nf_nat_l4proto_register(u8 l3proto, const struct nf_nat_l4proto *l4proto);
+extern void nf_nat_l4proto_unregister(u8 l3proto, const struct nf_nat_l4proto *l4proto);
+extern const struct nf_nat_l4proto *__nf_nat_l4proto_find(u8 l3proto, u8 l4proto);
+/* Built-in protocols. */
+extern const struct nf_nat_l4proto nf_nat_l4proto_tcp;
+extern const struct nf_nat_l4proto nf_nat_l4proto_udp;
+extern const struct nf_nat_l4proto nf_nat_l4proto_icmp;
+extern const struct nf_nat_l4proto nf_nat_l4proto_icmpv6;
+extern const struct nf_nat_l4proto nf_nat_l4proto_unknown;
+extern bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple,
+                                    enum nf_nat_manip_type maniptype,
+                                    const union nf_conntrack_man_proto *min,
+                                    const union nf_conntrack_man_proto *max);
+extern void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
+                                        struct nf_conntrack_tuple *tuple,
+                                        const struct nf_nat_range *range,
+                                        enum nf_nat_manip_type maniptype,
+                                        const struct nf_conn *ct,
+                                        u16 *rover);
+extern int nf_nat_l4proto_nlattr_to_range(struct nlattr *tb[],
+                                          struct nf_nat_range *range);
+#endif /*_NF_NAT_L4PROTO_H*/
diff --git a/include/net/netfilter/nf_nat_protocol.h b/include/net/netfilter/nf_nat_protocol.h
deleted file mode 100644
index 7b0b51165f70..000000000000
--- a/include/net/netfilter/nf_nat_protocol.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/* Header for use in defining a given protocol. */
-#ifndef _NF_NAT_PROTOCOL_H
-#define _NF_NAT_PROTOCOL_H
-#include <net/netfilter/nf_nat.h>
-#include <linux/netfilter/nfnetlink_conntrack.h>
-struct nf_nat_ipv4_range;
-struct nf_nat_protocol {
-        /* Protocol number. */
-        unsigned int protonum;
-        /* Translate a packet to the target according to manip type.
-           Return true if succeeded. */
-        bool (*manip_pkt)(struct sk_buff *skb,
-                          unsigned int iphdroff,
-                          const struct nf_conntrack_tuple *tuple,
-                          enum nf_nat_manip_type maniptype);
-        /* Is the manipable part of the tuple between min and max incl? */
-        bool (*in_range)(const struct nf_conntrack_tuple *tuple,
-                         enum nf_nat_manip_type maniptype,
-                         const union nf_conntrack_man_proto *min,
-                         const union nf_conntrack_man_proto *max);
-        /* Alter the per-proto part of the tuple (depending on
-           maniptype), to give a unique tuple in the given range if
-           possible.  Per-protocol part of tuple is initialized to the
-           incoming packet. */
-        void (*unique_tuple)(struct nf_conntrack_tuple *tuple,
-                             const struct nf_nat_ipv4_range *range,
-                             enum nf_nat_manip_type maniptype,
-                             const struct nf_conn *ct);
-        int (*nlattr_to_range)(struct nlattr *tb[],
-                               struct nf_nat_ipv4_range *range);
-};
-/* Protocol registration. */
-extern int nf_nat_protocol_register(const struct nf_nat_protocol *proto);
-extern void nf_nat_protocol_unregister(const struct nf_nat_protocol *proto);
-/* Built-in protocols. */
-extern const struct nf_nat_protocol nf_nat_protocol_tcp;
-extern const struct nf_nat_protocol nf_nat_protocol_udp;
-extern const struct nf_nat_protocol nf_nat_protocol_icmp;
-extern const struct nf_nat_protocol nf_nat_unknown_protocol;
-extern int init_protocols(void) __init;
-extern void cleanup_protocols(void);
-extern const struct nf_nat_protocol *find_nat_proto(u_int16_t protonum);
-extern bool nf_nat_proto_in_range(const struct nf_conntrack_tuple *tuple,
-                                  enum nf_nat_manip_type maniptype,
-                                  const union nf_conntrack_man_proto *min,
-                                  const union nf_conntrack_man_proto *max);
-extern void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
-                                      const struct nf_nat_ipv4_range *range,
-                                      enum nf_nat_manip_type maniptype,
-                                      const struct nf_conn *ct,
-                                      u_int16_t *rover);
-extern int nf_nat_proto_nlattr_to_range(struct nlattr *tb[],
-                                        struct nf_nat_ipv4_range *range);
-#endif /*_NF_NAT_PROTO_H*/
diff --git a/include/net/netfilter/nf_nat_rule.h b/include/net/netfilter/nf_nat_rule.h
deleted file mode 100644
index 2890bdc4cd92..000000000000
--- a/include/net/netfilter/nf_nat_rule.h
+++ /dev/null
@@ -1,15 +0,0 @@
-#ifndef _NF_NAT_RULE_H
-#define _NF_NAT_RULE_H
-#include <net/netfilter/nf_conntrack.h>
-#include <net/netfilter/nf_nat.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
-extern int nf_nat_rule_init(void) __init;
-extern void nf_nat_rule_cleanup(void);
-extern int nf_nat_rule_find(struct sk_buff *skb,
-                            unsigned int hooknum,
-                            const struct net_device *in,
-                            const struct net_device *out,
-                            struct nf_conn *ct);
-#endif /* _NF_NAT_RULE_H */
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 785f37a3b44e..9690b0f6698a 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -98,6 +98,10 @@
 *   nla_put_u16(skb, type, value)      add u16 attribute to skb
 *   nla_put_u32(skb, type, value)      add u32 attribute to skb
 *   nla_put_u64(skb, type, value)      add u64 attribute to skb
+ *   nla_put_s8(skb, type, value)       add s8 attribute to skb
+ *   nla_put_s16(skb, type, value)      add s16 attribute to skb
+ *   nla_put_s32(skb, type, value)      add s32 attribute to skb
+ *   nla_put_s64(skb, type, value)      add s64 attribute to skb
 *   nla_put_string(skb, type, str)     add string attribute to skb
 *   nla_put_flag(skb, type)            add flag attribute to skb
 *   nla_put_msecs(skb, type, jiffies)  add msecs attribute to skb
@@ -121,6 +125,10 @@
 *   nla_get_u16(nla)                   get payload for a u16 attribute
 *   nla_get_u32(nla)                   get payload for a u32 attribute
 *   nla_get_u64(nla)                   get payload for a u64 attribute
+ *   nla_get_s8(nla)                    get payload for a s8 attribute
+ *   nla_get_s16(nla)                   get payload for a s16 attribute
+ *   nla_get_s32(nla)                   get payload for a s32 attribute
+ *   nla_get_s64(nla)                   get payload for a s64 attribute
 *   nla_get_flag(nla)                  return 1 if flag is true
 *   nla_get_msecs(nla)                 get payload for a msecs attribute
 *
@@ -160,6 +168,10 @@ enum {
        NLA_NESTED_COMPAT,
        NLA_NUL_STRING,
        NLA_BINARY,
+        NLA_S8,
+        NLA_S16,
+        NLA_S32,
+        NLA_S64,
        __NLA_TYPE_MAX,
 };
@@ -183,6 +195,8 @@ enum {
 *    NLA_NESTED_COMPAT    Minimum length of structure payload
 *    NLA_U8, NLA_U16,
 *    NLA_U32, NLA_U64,
+ *    NLA_S8, NLA_S16,
+ *    NLA_S32, NLA_S64,
 *    NLA_MSECS            Leaving the length field zero will verify the
 *                         given type fits, using it verifies minimum length
 *                         just like "All other"
@@ -203,19 +217,19 @@ struct nla_policy {
 /**
 * struct nl_info - netlink source information
 * @nlh: Netlink message header of original request
- * @pid: Netlink PID of requesting application
+ * @portid: Netlink PORTID of requesting application
 */
 struct nl_info {
        struct nlmsghdr         *nlh;
        struct net              *nl_net;
-        u32                     pid;
+        u32                     portid;
 };
 extern int              netlink_rcv_skb(struct sk_buff *skb,
                                        int (*cb)(struct sk_buff *,
                                                  struct nlmsghdr *));
 extern int              nlmsg_notify(struct sock *sk, struct sk_buff *skb,
-                                     u32 pid, unsigned int group, int report,
+                                     u32 portid, unsigned int group, int report,
                                     gfp_t flags);
 extern int              nla_validate(const struct nlattr *head,
@@ -430,7 +444,7 @@ static inline int nlmsg_report(const struct nlmsghdr *nlh)
 /**
 * nlmsg_put - Add a new netlink message to an skb
 * @skb: socket buffer to store message in
- * @pid: netlink process id
+ * @portid: netlink process id
 * @seq: sequence number of message
 * @type: message type
 * @payload: length of message payload
@@ -439,13 +453,13 @@ static inline int nlmsg_report(const struct nlmsghdr *nlh)
 * Returns NULL if the tailroom of the skb is insufficient to store
 * the message header and payload.
 */
-static inline struct nlmsghdr *nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq,
+static inline struct nlmsghdr *nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq,
                                         int type, int payload, int flags)
 {
        if (unlikely(skb_tailroom(skb) < nlmsg_total_size(payload)))
                return NULL;
-        return __nlmsg_put(skb, pid, seq, type, payload, flags);
+        return __nlmsg_put(skb, portid, seq, type, payload, flags);
 }
 /**
@@ -464,7 +478,7 @@ static inline struct nlmsghdr *nlmsg_put_answer(struct sk_buff *skb,
                                                int type, int payload,
                                                int flags)
 {
-        return nlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
+        return nlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
                         type, payload, flags);
 }
@@ -549,18 +563,18 @@ static inline void nlmsg_free(struct sk_buff *skb)
 * nlmsg_multicast - multicast a netlink message
 * @sk: netlink socket to spread messages to
 * @skb: netlink message as socket buffer
- * @pid: own netlink pid to avoid sending to yourself
+ * @portid: own netlink portid to avoid sending to yourself
 * @group: multicast group id
 * @flags: allocation flags
 */
 static inline int nlmsg_multicast(struct sock *sk, struct sk_buff *skb,
-                                  u32 pid, unsigned int group, gfp_t flags)
+                                  u32 portid, unsigned int group, gfp_t flags)
 {
        int err;
        NETLINK_CB(skb).dst_group = group;
-        err = netlink_broadcast(sk, skb, pid, group, flags);
+        err = netlink_broadcast(sk, skb, portid, group, flags);
        if (err > 0)
                err = 0;
@@ -571,13 +585,13 @@ static inline int nlmsg_multicast(struct sock *sk, struct sk_buff *skb,
 * nlmsg_unicast - unicast a netlink message
 * @sk: netlink socket to spread message to
 * @skb: netlink message as socket buffer
- * @pid: netlink pid of the destination socket
+ * @portid: netlink portid of the destination socket
 */
-static inline int nlmsg_unicast(struct sock *sk, struct sk_buff *skb, u32 pid)
+static inline int nlmsg_unicast(struct sock *sk, struct sk_buff *skb, u32 portid)
 {
        int err;
-        err = netlink_unicast(sk, skb, pid, MSG_DONTWAIT);
+        err = netlink_unicast(sk, skb, portid, MSG_DONTWAIT);
        if (err > 0)
                err = 0;
@@ -879,6 +893,50 @@ static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value)
 }
 /**
+ * nla_put_s8 - Add a s8 netlink attribute to a socket buffer
+ * @skb: socket buffer to add attribute to
+ * @attrtype: attribute type
+ * @value: numeric value
+ */
+static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value)
+{
+        return nla_put(skb, attrtype, sizeof(s8), &value);
+}
+/**
+ * nla_put_s16 - Add a s16 netlink attribute to a socket buffer
+ * @skb: socket buffer to add attribute to
+ * @attrtype: attribute type
+ * @value: numeric value
+ */
+static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value)
+{
+        return nla_put(skb, attrtype, sizeof(s16), &value);
+}
+/**
+ * nla_put_s32 - Add a s32 netlink attribute to a socket buffer
+ * @skb: socket buffer to add attribute to
+ * @attrtype: attribute type
+ * @value: numeric value
+ */
+static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value)
+{
+        return nla_put(skb, attrtype, sizeof(s32), &value);
+}
+/**
+ * nla_put_s64 - Add a s64 netlink attribute to a socket buffer
+ * @skb: socket buffer to add attribute to
+ * @attrtype: attribute type
+ * @value: numeric value
+ */
+static inline int nla_put_s64(struct sk_buff *skb, int attrtype, s64 value)
+{
+        return nla_put(skb, attrtype, sizeof(s64), &value);
+}
+/**
 * nla_put_string - Add a string netlink attribute to a socket buffer
 * @skb: socket buffer to add attribute to
 * @attrtype: attribute type
@@ -994,6 +1052,46 @@ static inline __be64 nla_get_be64(const struct nlattr *nla)
 }
 /**
+ * nla_get_s32 - return payload of s32 attribute
+ * @nla: s32 netlink attribute
+ */
+static inline s32 nla_get_s32(const struct nlattr *nla)
+{
+        return *(s32 *) nla_data(nla);
+}
+/**
+ * nla_get_s16 - return payload of s16 attribute
+ * @nla: s16 netlink attribute
+ */
+static inline s16 nla_get_s16(const struct nlattr *nla)
+{
+        return *(s16 *) nla_data(nla);
+}
+/**
+ * nla_get_s8 - return payload of s8 attribute
+ * @nla: s8 netlink attribute
+ */
+static inline s8 nla_get_s8(const struct nlattr *nla)
+{
+        return *(s8 *) nla_data(nla);
+}
+/**
+ * nla_get_s64 - return payload of s64 attribute
+ * @nla: s64 netlink attribute
+ */
+static inline s64 nla_get_s64(const struct nlattr *nla)
+{
+        s64 tmp;
+        nla_memcpy(&tmp, nla, sizeof(tmp));
+        return tmp;
+}
+/**
 * nla_get_flag - return payload of flag attribute
 * @nla: flag netlink attribute
 */
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index 3aecdc7a84fb..a1d83cc8bf85 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -83,6 +83,10 @@ struct netns_ct {
        int                     sysctl_auto_assign_helper;
        bool                    auto_assign_helper_warned;
        struct nf_ip_net        nf_ct_proto;
+#ifdef CONFIG_NF_NAT_NEEDED
+        struct hlist_head       *nat_bysource;
+        unsigned int            nat_htable_size;
+#endif
 #ifdef CONFIG_SYSCTL
        struct ctl_table_header *sysctl_header;
        struct ctl_table_header *acct_sysctl_header;
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 69e50c789d96..2ae2b8372cfd 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -52,8 +52,6 @@ struct netns_ipv4 {
        struct xt_table         *iptable_security;
 #endif
        struct xt_table         *nat_table;
-        struct hlist_head       *nat_bysource;
-        unsigned int            nat_htable_size;
 #endif
        int sysctl_icmp_echo_ignore_all;
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index df0a5456a3fd..214cb0a53359 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -42,6 +42,7 @@ struct netns_ipv6 {
 #ifdef CONFIG_SECURITY
        struct xt_table         *ip6table_security;
 #endif
+        struct xt_table         *ip6table_nat;
 #endif
        struct rt6_info         *ip6_null_entry;
        struct rt6_statistics   *rt6_stats;
@@ -70,4 +71,12 @@ struct netns_ipv6 {
 #endif
 #endif
 };
+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+struct netns_nf_frag {
+        struct netns_sysctl_ipv6 sysctl;
+        struct netns_frags      frags;
+};
+#endif
 #endif
diff --git a/include/net/netns/packet.h b/include/net/netns/packet.h
index cb4e894c0f8d..17ec2b95c062 100644
--- a/include/net/netns/packet.h
+++ b/include/net/netns/packet.h
@@ -5,10 +5,10 @@
 #define __NETNS_PACKET_H__
 #include <linux/rculist.h>
-#include <linux/spinlock.h>
+#include <linux/mutex.h>
 struct netns_packet {
-        spinlock_t              sklist_lock;
+        struct mutex            sklist_lock;
        struct hlist_head       sklist;
 };
diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h
new file mode 100644
index 000000000000..5e5eb1f9f14b
--- /dev/null
+++ b/include/net/netns/sctp.h
@@ -0,0 +1,131 @@
+#ifndef __NETNS_SCTP_H__
+#define __NETNS_SCTP_H__
+struct sock;
+struct proc_dir_entry;
+struct sctp_mib;
+struct ctl_table_header;
+struct netns_sctp {
+        DEFINE_SNMP_STAT(struct sctp_mib, sctp_statistics);
+#ifdef CONFIG_PROC_FS
+        struct proc_dir_entry *proc_net_sctp;
+#endif
+#ifdef CONFIG_SYSCTL
+        struct ctl_table_header *sysctl_header;
+#endif
+        /* This is the global socket data structure used for responding to
+         * the Out-of-the-blue (OOTB) packets.  A control sock will be created
+         * for this socket at the initialization time.
+         */
+        struct sock *ctl_sock;
+        /* This is the global local address list.
+         * We actively maintain this complete list of addresses on
+         * the system by catching address add/delete events.
+         *
+         * It is a list of sctp_sockaddr_entry.
+         */
+        struct list_head local_addr_list;
+        struct list_head addr_waitq;
+        struct timer_list addr_wq_timer;
+        struct list_head auto_asconf_splist;
+        spinlock_t addr_wq_lock;
+        /* Lock that protects the local_addr_list writers */
+        spinlock_t local_addr_lock;
+        /* RFC2960 Section 14. Suggested SCTP Protocol Parameter Values
+         *
+         * The following protocol parameters are RECOMMENDED:
+         *
+         * RTO.Initial              - 3  seconds
+         * RTO.Min                  - 1  second
+         * RTO.Max                 -  60 seconds
+         * RTO.Alpha                - 1/8  (3 when converted to right shifts.)
+         * RTO.Beta                 - 1/4  (2 when converted to right shifts.)
+         */
+        unsigned int rto_initial;
+        unsigned int rto_min;
+        unsigned int rto_max;
+        /* Note: rto_alpha and rto_beta are really defined as inverse
+         * powers of two to facilitate integer operations.
+         */
+        int rto_alpha;
+        int rto_beta;
+        /* Max.Burst                - 4 */
+        int max_burst;
+        /* Whether Cookie Preservative is enabled(1) or not(0) */
+        int cookie_preserve_enable;
+        /* Valid.Cookie.Life        - 60  seconds  */
+        unsigned int valid_cookie_life;
+        /* Delayed SACK timeout  200ms default*/
+        unsigned int sack_timeout;
+        /* HB.interval              - 30 seconds  */
+        unsigned int hb_interval;
+        /* Association.Max.Retrans  - 10 attempts
+         * Path.Max.Retrans         - 5  attempts (per destination address)
+         * Max.Init.Retransmits     - 8  attempts
+         */
+        int max_retrans_association;
+        int max_retrans_path;
+        int max_retrans_init;
+        /* Potentially-Failed.Max.Retrans sysctl value
+         * taken from:
+         * http://tools.ietf.org/html/draft-nishida-tsvwg-sctp-failover-05
+         */
+        int pf_retrans;
+        /*
+         * Policy for preforming sctp/socket accounting
+         * 0   - do socket level accounting, all assocs share sk_sndbuf
+         * 1   - do sctp accounting, each asoc may use sk_sndbuf bytes
+         */
+        int sndbuf_policy;
+        /*
+         * Policy for preforming sctp/socket accounting
+         * 0   - do socket level accounting, all assocs share sk_rcvbuf
+         * 1   - do sctp accounting, each asoc may use sk_rcvbuf bytes
+         */
+        int rcvbuf_policy;
+        int default_auto_asconf;
+        /* Flag to indicate if addip is enabled. */
+        int addip_enable;
+        int addip_noauth;
+        /* Flag to indicate if PR-SCTP is enabled. */
+        int prsctp_enable;
+        /* Flag to idicate if SCTP-AUTH is enabled */
+        int auth_enable;
+        /*
+         * Policy to control SCTP IPv4 address scoping
+         * 0   - Disable IPv4 address scoping
+         * 1   - Enable IPv4 address scoping
+         * 2   - Selectively allow only IPv4 private addresses
+         * 3   - Selectively allow only IPv4 link local address
+         */
+        int scope_policy;
+        /* Threshold for rwnd update SACKS.  Receive buffer shifted this many
+         * bits is an indicator of when to send and window update SACK.
+         */
+        int rwnd_upd_shift;
+        /* Threshold for autoclose timeout, in seconds. */
+        unsigned long max_autoclose;
+};
+#endif /* __NETNS_SCTP_H__ */
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index f5169b04f082..e900072950cb 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -30,6 +30,11 @@ struct nfc_hci_ops {
        int (*open) (struct nfc_hci_dev *hdev);
        void (*close) (struct nfc_hci_dev *hdev);
        int (*hci_ready) (struct nfc_hci_dev *hdev);
+        /*
+         * xmit must always send the complete buffer before
+         * returning. Returned result must be 0 for success
+         * or negative for failure.
+         */
        int (*xmit) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
        int (*start_poll) (struct nfc_hci_dev *hdev,
                           u32 im_protocols, u32 tm_protocols);
@@ -38,8 +43,8 @@ struct nfc_hci_ops {
        int (*complete_target_discovered) (struct nfc_hci_dev *hdev, u8 gate,
                                           struct nfc_target *target);
        int (*data_exchange) (struct nfc_hci_dev *hdev,
-                              struct nfc_target *target,
+                              struct nfc_target *target, struct sk_buff *skb,
-                              struct sk_buff *skb, struct sk_buff **res_skb);
+                              data_exchange_cb_t cb, void *cb_context);
        int (*check_presence)(struct nfc_hci_dev *hdev,
                              struct nfc_target *target);
 };
@@ -74,7 +79,6 @@ struct nfc_hci_dev {
        struct list_head msg_tx_queue;
-        struct workqueue_struct *msg_tx_wq;
        struct work_struct msg_tx_work;
        struct timer_list cmd_timer;
@@ -82,13 +86,14 @@ struct nfc_hci_dev {
        struct sk_buff_head rx_hcp_frags;
-        struct workqueue_struct *msg_rx_wq;
        struct work_struct msg_rx_work;
        struct sk_buff_head msg_rx_queue;
        struct nfc_hci_ops *ops;
+        struct nfc_llc *llc;
        struct nfc_hci_init_data init_data;
        void *clientdata;
@@ -105,12 +110,17 @@ struct nfc_hci_dev {
        u8 hw_mpw;
        u8 hw_software;
        u8 hw_bsid;
+        int async_cb_type;
+        data_exchange_cb_t async_cb;
+        void *async_cb_context;
 };
 /* hci device allocation */
 struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
                                            struct nfc_hci_init_data *init_data,
                                            u32 protocols,
+                                            const char *llc_name,
                                            int tx_headroom,
                                            int tx_tailroom,
                                            int max_link_payload);
@@ -202,6 +212,9 @@ int nfc_hci_set_param(struct nfc_hci_dev *hdev, u8 gate, u8 idx,
                      const u8 *param, size_t param_len);
 int nfc_hci_send_cmd(struct nfc_hci_dev *hdev, u8 gate, u8 cmd,
                     const u8 *param, size_t param_len, struct sk_buff **skb);
+int nfc_hci_send_cmd_async(struct nfc_hci_dev *hdev, u8 gate, u8 cmd,
+                           const u8 *param, size_t param_len,
+                           data_exchange_cb_t cb, void *cb_context);
 int nfc_hci_send_response(struct nfc_hci_dev *hdev, u8 gate, u8 response,
                          const u8 *param, size_t param_len);
 int nfc_hci_send_event(struct nfc_hci_dev *hdev, u8 gate, u8 event,
diff --git a/include/net/nfc/llc.h b/include/net/nfc/llc.h
new file mode 100644
index 000000000000..400ab7ae749d
--- /dev/null
+++ b/include/net/nfc/llc.h
@@ -0,0 +1,54 @@
+/*
+ * Link Layer Control manager public interface
+ *
+ * Copyright (C) 2012  Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+#ifndef __NFC_LLC_H_
+#define __NFC_LLC_H_
+#include <net/nfc/hci.h>
+#include <linux/skbuff.h>
+#define LLC_NOP_NAME "nop"
+#define LLC_SHDLC_NAME "shdlc"
+typedef void (*rcv_to_hci_t) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
+typedef int (*xmit_to_drv_t) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
+typedef void (*llc_failure_t) (struct nfc_hci_dev *hdev, int err);
+struct nfc_llc;
+struct nfc_llc *nfc_llc_allocate(const char *name, struct nfc_hci_dev *hdev,
+                                 xmit_to_drv_t xmit_to_drv,
+                                 rcv_to_hci_t rcv_to_hci, int tx_headroom,
+                                 int tx_tailroom, llc_failure_t llc_failure);
+void nfc_llc_free(struct nfc_llc *llc);
+void nfc_llc_get_rx_head_tail_room(struct nfc_llc *llc, int *rx_headroom,
+                                   int *rx_tailroom);
+int nfc_llc_start(struct nfc_llc *llc);
+int nfc_llc_stop(struct nfc_llc *llc);
+void nfc_llc_rcv_from_drv(struct nfc_llc *llc, struct sk_buff *skb);
+int nfc_llc_xmit_from_hci(struct nfc_llc *llc, struct sk_buff *skb);
+int nfc_llc_init(void);
+void nfc_llc_exit(void);
+#endif /* __NFC_LLC_H_ */
diff --git a/include/net/nfc/nci.h b/include/net/nfc/nci.h
index 276094b91d7c..88785e5c6b2c 100644
--- a/include/net/nfc/nci.h
+++ b/include/net/nfc/nci.h
@@ -32,6 +32,7 @@
 #define NCI_MAX_NUM_MAPPING_CONFIGS                             10
 #define NCI_MAX_NUM_RF_CONFIGS                                  10
 #define NCI_MAX_NUM_CONN                                        10
+#define NCI_MAX_PARAM_LEN                                       251
 /* NCI Status Codes */
 #define NCI_STATUS_OK                                           0x00
@@ -102,6 +103,9 @@
 #define NCI_RF_INTERFACE_ISO_DEP                                0x02
 #define NCI_RF_INTERFACE_NFC_DEP                                0x03
+/* NCI Configuration Parameter Tags */
+#define NCI_PN_ATR_REQ_GEN_BYTES                                0x29
 /* NCI Reset types */
 #define NCI_RESET_TYPE_KEEP_CONFIG                              0x00
 #define NCI_RESET_TYPE_RESET_CONFIG                             0x01
@@ -188,6 +192,18 @@ struct nci_core_reset_cmd {
 #define NCI_OP_CORE_INIT_CMD            nci_opcode_pack(NCI_GID_CORE, 0x01)
+#define NCI_OP_CORE_SET_CONFIG_CMD      nci_opcode_pack(NCI_GID_CORE, 0x02)
+struct set_config_param {
+        __u8    id;
+        __u8    len;
+        __u8    val[NCI_MAX_PARAM_LEN];
+} __packed;
+struct nci_core_set_config_cmd {
+        __u8    num_params;
+        struct  set_config_param param; /* support 1 param per cmd is enough */
+} __packed;
 #define NCI_OP_RF_DISCOVER_MAP_CMD      nci_opcode_pack(NCI_GID_RF_MGMT, 0x00)
 struct disc_map_config {
        __u8    rf_protocol;
@@ -252,6 +268,13 @@ struct nci_core_init_rsp_2 {
        __le32  manufact_specific_info;
 } __packed;
+#define NCI_OP_CORE_SET_CONFIG_RSP      nci_opcode_pack(NCI_GID_CORE, 0x02)
+struct nci_core_set_config_rsp {
+        __u8    status;
+        __u8    num_params;
+        __u8    params_id[0];   /* variable size array */
+} __packed;
 #define NCI_OP_RF_DISCOVER_MAP_RSP      nci_opcode_pack(NCI_GID_RF_MGMT, 0x00)
 #define NCI_OP_RF_DISCOVER_RSP          nci_opcode_pack(NCI_GID_RF_MGMT, 0x03)
@@ -328,6 +351,11 @@ struct activation_params_nfcb_poll_iso_dep {
        __u8    attrib_res[50];
 };
+struct activation_params_poll_nfc_dep {
+        __u8    atr_res_len;
+        __u8    atr_res[63];
+};
 struct nci_rf_intf_activated_ntf {
        __u8    rf_discovery_id;
        __u8    rf_interface;
@@ -351,6 +379,7 @@ struct nci_rf_intf_activated_ntf {
        union {
                struct activation_params_nfca_poll_iso_dep nfca_poll_iso_dep;
                struct activation_params_nfcb_poll_iso_dep nfcb_poll_iso_dep;
+                struct activation_params_poll_nfc_dep poll_nfc_dep;
        } activation_params;
 } __packed;
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index feba74027ff8..d705d8674949 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -54,6 +54,7 @@ enum nci_state {
 /* NCI timeouts */
 #define NCI_RESET_TIMEOUT                       5000
 #define NCI_INIT_TIMEOUT                        5000
+#define NCI_SET_CONFIG_TIMEOUT                  5000
 #define NCI_RF_DISC_TIMEOUT                     5000
 #define NCI_RF_DISC_SELECT_TIMEOUT              5000
 #define NCI_RF_DEACTIVATE_TIMEOUT               30000
@@ -137,6 +138,10 @@ struct nci_dev {
        data_exchange_cb_t      data_exchange_cb;
        void                    *data_exchange_cb_context;
        struct sk_buff          *rx_data_reassembly;
+        /* stored during intf_activated_ntf */
+        __u8 remote_gb[NFC_MAX_GT_LEN];
+        __u8 remote_gb_len;
 };
 /* ----- NCI Devices ----- */
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 6431f5e39022..f05b10682c9d 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -72,6 +72,7 @@ struct nfc_ops {
 #define NFC_TARGET_IDX_ANY -1
 #define NFC_MAX_GT_LEN 48
+#define NFC_ATR_RES_GT_OFFSET 15
 struct nfc_target {
        u32 idx;
@@ -89,7 +90,7 @@ struct nfc_target {
 };
 struct nfc_genl_data {
-        u32 poll_req_pid;
+        u32 poll_req_portid;
        struct mutex genl_data_mutex;
 };
@@ -112,7 +113,6 @@ struct nfc_dev {
        int tx_tailroom;
        struct timer_list check_pres_timer;
-        struct workqueue_struct *check_pres_wq;
        struct work_struct check_pres_work;
        struct nfc_ops *ops;
diff --git a/include/net/nfc/shdlc.h b/include/net/nfc/shdlc.h
deleted file mode 100644
index 35e930d2f638..000000000000
--- a/include/net/nfc/shdlc.h
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Copyright (C) 2012  Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the
- * Free Software Foundation, Inc.,
- * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- */
-#ifndef __NFC_SHDLC_H
-#define __NFC_SHDLC_H
-struct nfc_shdlc;
-struct nfc_shdlc_ops {
-        int (*open) (struct nfc_shdlc *shdlc);
-        void (*close) (struct nfc_shdlc *shdlc);
-        int (*hci_ready) (struct nfc_shdlc *shdlc);
-        int (*xmit) (struct nfc_shdlc *shdlc, struct sk_buff *skb);
-        int (*start_poll) (struct nfc_shdlc *shdlc,
-                           u32 im_protocols, u32 tm_protocols);
-        int (*target_from_gate) (struct nfc_shdlc *shdlc, u8 gate,
-                                 struct nfc_target *target);
-        int (*complete_target_discovered) (struct nfc_shdlc *shdlc, u8 gate,
-                                           struct nfc_target *target);
-        int (*data_exchange) (struct nfc_shdlc *shdlc,
-                              struct nfc_target *target,
-                              struct sk_buff *skb, struct sk_buff **res_skb);
-        int (*check_presence)(struct nfc_shdlc *shdlc,
-                              struct nfc_target *target);
-};
-enum shdlc_state {
-        SHDLC_DISCONNECTED = 0,
-        SHDLC_CONNECTING = 1,
-        SHDLC_NEGOCIATING = 2,
-        SHDLC_CONNECTED = 3
-};
-struct nfc_shdlc {
-        struct mutex state_mutex;
-        enum shdlc_state state;
-        int hard_fault;
-        struct nfc_hci_dev *hdev;
-        wait_queue_head_t *connect_wq;
-        int connect_tries;
-        int connect_result;
-        struct timer_list connect_timer;/* aka T3 in spec 10.6.1 */
-        u8 w;                           /* window size */
-        bool srej_support;
-        struct timer_list t1_timer;     /* send ack timeout */
-        bool t1_active;
-        struct timer_list t2_timer;     /* guard/retransmit timeout */
-        bool t2_active;
-        int ns;                         /* next seq num for send */
-        int nr;                         /* next expected seq num for receive */
-        int dnr;                        /* oldest sent unacked seq num */
-        struct sk_buff_head rcv_q;
-        struct sk_buff_head send_q;
-        bool rnr;                       /* other side is not ready to receive */
-        struct sk_buff_head ack_pending_q;
-        struct workqueue_struct *sm_wq;
-        struct work_struct sm_work;
-        struct nfc_shdlc_ops *ops;
-        int client_headroom;
-        int client_tailroom;
-        void *clientdata;
-};
-void nfc_shdlc_recv_frame(struct nfc_shdlc *shdlc, struct sk_buff *skb);
-struct nfc_shdlc *nfc_shdlc_allocate(struct nfc_shdlc_ops *ops,
-                                     struct nfc_hci_init_data *init_data,
-                                     u32 protocols,
-                                     int tx_headroom, int tx_tailroom,
-                                     int max_link_payload, const char *devname);
-void nfc_shdlc_free(struct nfc_shdlc *shdlc);
-void nfc_shdlc_set_clientdata(struct nfc_shdlc *shdlc, void *clientdata);
-void *nfc_shdlc_get_clientdata(struct nfc_shdlc *shdlc);
-struct nfc_hci_dev *nfc_shdlc_get_hci_dev(struct nfc_shdlc *shdlc);
-#endif /* __NFC_SHDLC_H */
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index 4c0766e201e3..b01d8dd9ee7c 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -106,6 +106,34 @@ struct listen_sock {
        struct request_sock     *syn_table[0];
 };
+/*
+ * For a TCP Fast Open listener -
+ *      lock - protects the access to all the reqsk, which is co-owned by
+ *              the listener and the child socket.
+ *      qlen - pending TFO requests (still in TCP_SYN_RECV).
+ *      max_qlen - max TFO reqs allowed before TFO is disabled.
+ *
+ *      XXX (TFO) - ideally these fields can be made as part of "listen_sock"
+ *      structure above. But there is some implementation difficulty due to
+ *      listen_sock being part of request_sock_queue hence will be freed when
+ *      a listener is stopped. But TFO related fields may continue to be
+ *      accessed even after a listener is closed, until its sk_refcnt drops
+ *      to 0 implying no more outstanding TFO reqs. One solution is to keep
+ *      listen_opt around until sk_refcnt drops to 0. But there is some other
+ *      complexity that needs to be resolved. E.g., a listener can be disabled
+ *      temporarily through shutdown()->tcp_disconnect(), and re-enabled later.
+ */
+struct fastopen_queue {
+        struct request_sock     *rskq_rst_head; /* Keep track of past TFO */
+        struct request_sock     *rskq_rst_tail; /* requests that caused RST.
+                                                 * This is part of the defense
+                                                 * against spoofing attack.
+                                                 */
+        spinlock_t      lock;
+        int             qlen;           /* # of pending (TCP_SYN_RECV) reqs */
+        int             max_qlen;       /* != 0 iff TFO is currently enabled */
+};
 /** struct request_sock_queue - queue of request_socks
 *
 * @rskq_accept_head - FIFO head of established children
@@ -129,6 +157,12 @@ struct request_sock_queue {
        u8                      rskq_defer_accept;
        /* 3 bytes hole, try to pack */
        struct listen_sock      *listen_opt;
+        struct fastopen_queue   *fastopenq; /* This is non-NULL iff TFO has been
+                                             * enabled on this listener. Check
+                                             * max_qlen != 0 in fastopen_queue
+                                             * to determine if TFO is enabled
+                                             * right at this moment.
+                                             */
 };
 extern int reqsk_queue_alloc(struct request_sock_queue *queue,
@@ -136,6 +170,8 @@ extern int reqsk_queue_alloc(struct request_sock_queue *queue,
 extern void __reqsk_queue_destroy(struct request_sock_queue *queue);
 extern void reqsk_queue_destroy(struct request_sock_queue *queue);
+extern void reqsk_fastopen_remove(struct sock *sk,
+                                  struct request_sock *req, bool reset);
 static inline struct request_sock *
        reqsk_queue_yank_acceptq(struct request_sock_queue *queue)
@@ -190,19 +226,6 @@ static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue
        return req;
 }
-static inline struct sock *reqsk_queue_get_child(struct request_sock_queue *queue,
-                                                 struct sock *parent)
-{
-        struct request_sock *req = reqsk_queue_remove(queue);
-        struct sock *child = req->sk;
-        WARN_ON(child == NULL);
-        sk_acceptq_removed(parent);
-        __reqsk_free(req);
-        return child;
-}
 static inline int reqsk_queue_removed(struct request_sock_queue *queue,
                                      struct request_sock *req)
 {
diff --git a/include/net/scm.h b/include/net/scm.h
index 7dc0854f0b38..975cca01048b 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -12,6 +12,12 @@
 */
 #define SCM_MAX_FD      253
+struct scm_creds {
+        u32     pid;
+        kuid_t  uid;
+        kgid_t  gid;
+};
 struct scm_fp_list {
        short                   count;
        short                   max;
@@ -22,7 +28,7 @@ struct scm_cookie {
        struct pid              *pid;           /* Skb credentials */
        const struct cred       *cred;
        struct scm_fp_list      *fp;            /* Passed files         */
-        struct ucred            creds;          /* Skb credentials      */
+        struct scm_creds        creds;          /* Skb credentials      */
 #ifdef CONFIG_SECURITY_NETWORK
        u32                     secid;          /* Passed security ID   */
 #endif
@@ -49,7 +55,9 @@ static __inline__ void scm_set_cred(struct scm_cookie *scm,
 {
        scm->pid  = get_pid(pid);
        scm->cred = cred ? get_cred(cred) : NULL;
-        cred_to_ucred(pid, cred, &scm->creds);
+        scm->creds.pid = pid_vnr(pid);
+        scm->creds.uid = cred ? cred->euid : INVALID_UID;
+        scm->creds.gid = cred ? cred->egid : INVALID_GID;
 }
 static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
@@ -65,7 +73,7 @@ static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
 static __inline__ void scm_destroy(struct scm_cookie *scm)
 {
        scm_destroy_cred(scm);
-        if (scm && scm->fp)
+        if (scm->fp)
                __scm_destroy(scm);
 }
@@ -112,8 +120,15 @@ static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
                return;
        }
-        if (test_bit(SOCK_PASSCRED, &sock->flags))
+        if (test_bit(SOCK_PASSCRED, &sock->flags)) {
-                put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(scm->creds), &scm->creds);
+                struct user_namespace *current_ns = current_user_ns();
+                struct ucred ucreds = {
+                        .pid = scm->creds.pid,
+                        .uid = from_kuid_munged(current_ns, scm->creds.uid),
+                        .gid = from_kgid_munged(current_ns, scm->creds.gid),
+                };
+                put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds);
+        }
        scm_destroy_cred(scm);
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index ff499640528b..9c6414f553f9 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -114,13 +114,12 @@
 /*
 * sctp/protocol.c
 */
-extern struct sock *sctp_get_ctl_sock(void);
+extern int sctp_copy_local_addr_list(struct net *, struct sctp_bind_addr *,
-extern int sctp_copy_local_addr_list(struct sctp_bind_addr *,
                                     sctp_scope_t, gfp_t gfp,
                                     int flags);
 extern struct sctp_pf *sctp_get_pf_specific(sa_family_t family);
 extern int sctp_register_pf(struct sctp_pf *, sa_family_t);
-extern void sctp_addr_wq_mgmt(struct sctp_sockaddr_entry *, int);
+extern void sctp_addr_wq_mgmt(struct net *, struct sctp_sockaddr_entry *, int);
 /*
 * sctp/socket.c
@@ -140,12 +139,12 @@ extern int sctp_asconf_mgmt(struct sctp_sock *, struct sctp_sockaddr_entry *);
 /*
 * sctp/primitive.c
 */
-int sctp_primitive_ASSOCIATE(struct sctp_association *, void *arg);
+int sctp_primitive_ASSOCIATE(struct net *, struct sctp_association *, void *arg);
-int sctp_primitive_SHUTDOWN(struct sctp_association *, void *arg);
+int sctp_primitive_SHUTDOWN(struct net *, struct sctp_association *, void *arg);
-int sctp_primitive_ABORT(struct sctp_association *, void *arg);
+int sctp_primitive_ABORT(struct net *, struct sctp_association *, void *arg);
-int sctp_primitive_SEND(struct sctp_association *, void *arg);
+int sctp_primitive_SEND(struct net *, struct sctp_association *, void *arg);
-int sctp_primitive_REQUESTHEARTBEAT(struct sctp_association *, void *arg);
+int sctp_primitive_REQUESTHEARTBEAT(struct net *, struct sctp_association *, void *arg);
-int sctp_primitive_ASCONF(struct sctp_association *, void *arg);
+int sctp_primitive_ASCONF(struct net *, struct sctp_association *, void *arg);
 /*
 * sctp/input.c
@@ -156,7 +155,7 @@ void sctp_hash_established(struct sctp_association *);
 void sctp_unhash_established(struct sctp_association *);
 void sctp_hash_endpoint(struct sctp_endpoint *);
 void sctp_unhash_endpoint(struct sctp_endpoint *);
-struct sock *sctp_err_lookup(int family, struct sk_buff *,
+struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *,
                             struct sctphdr *, struct sctp_association **,
                             struct sctp_transport **);
 void sctp_err_finish(struct sock *, struct sctp_association *);
@@ -173,14 +172,14 @@ void sctp_backlog_migrate(struct sctp_association *assoc,
 /*
 * sctp/proc.c
 */
-int sctp_snmp_proc_init(void);
+int sctp_snmp_proc_init(struct net *net);
-void sctp_snmp_proc_exit(void);
+void sctp_snmp_proc_exit(struct net *net);
-int sctp_eps_proc_init(void);
+int sctp_eps_proc_init(struct net *net);
-void sctp_eps_proc_exit(void);
+void sctp_eps_proc_exit(struct net *net);
-int sctp_assocs_proc_init(void);
+int sctp_assocs_proc_init(struct net *net);
-void sctp_assocs_proc_exit(void);
+void sctp_assocs_proc_exit(struct net *net);
-int sctp_remaddr_proc_init(void);
+int sctp_remaddr_proc_init(struct net *net);
-void sctp_remaddr_proc_exit(void);
+void sctp_remaddr_proc_exit(struct net *net);
 /*
@@ -222,11 +221,10 @@ extern struct kmem_cache *sctp_bucket_cachep __read_mostly;
 #define sctp_bh_unlock_sock(sk)  bh_unlock_sock(sk)
 /* SCTP SNMP MIB stats handlers */
-DECLARE_SNMP_STAT(struct sctp_mib, sctp_statistics);
+#define SCTP_INC_STATS(net, field)      SNMP_INC_STATS((net)->sctp.sctp_statistics, field)
-#define SCTP_INC_STATS(field)      SNMP_INC_STATS(sctp_statistics, field)
+#define SCTP_INC_STATS_BH(net, field)   SNMP_INC_STATS_BH((net)->sctp.sctp_statistics, field)
-#define SCTP_INC_STATS_BH(field)   SNMP_INC_STATS_BH(sctp_statistics, field)
+#define SCTP_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)->sctp.sctp_statistics, field)
-#define SCTP_INC_STATS_USER(field) SNMP_INC_STATS_USER(sctp_statistics, field)
+#define SCTP_DEC_STATS(net, field)      SNMP_DEC_STATS((net)->sctp.sctp_statistics, field)
-#define SCTP_DEC_STATS(field)      SNMP_DEC_STATS(sctp_statistics, field)
 #endif /* !TEST_FRAME */
@@ -361,25 +359,29 @@ atomic_t sctp_dbg_objcnt_## name = ATOMIC_INIT(0)
 #define SCTP_DBG_OBJCNT_ENTRY(name) \
 {.label= #name, .counter= &sctp_dbg_objcnt_## name}
-void sctp_dbg_objcnt_init(void);
+void sctp_dbg_objcnt_init(struct net *);
-void sctp_dbg_objcnt_exit(void);
+void sctp_dbg_objcnt_exit(struct net *);
 #else
 #define SCTP_DBG_OBJCNT_INC(name)
 #define SCTP_DBG_OBJCNT_DEC(name)
-static inline void sctp_dbg_objcnt_init(void) { return; }
+static inline void sctp_dbg_objcnt_init(struct net *net) { return; }
-static inline void sctp_dbg_objcnt_exit(void) { return; }
+static inline void sctp_dbg_objcnt_exit(struct net *net) { return; }
 #endif /* CONFIG_SCTP_DBG_OBJCOUNT */
 #if defined CONFIG_SYSCTL
 void sctp_sysctl_register(void);
 void sctp_sysctl_unregister(void);
+int sctp_sysctl_net_register(struct net *net);
+void sctp_sysctl_net_unregister(struct net *net);
 #else
 static inline void sctp_sysctl_register(void) { return; }
 static inline void sctp_sysctl_unregister(void) { return; }
+static inline int sctp_sysctl_net_register(struct net *net) { return 0; }
+static inline void sctp_sysctl_net_unregister(struct net *net) { return; }
 #endif
 /* Size of Supported Address Parameter for 'x' address types. */
@@ -586,7 +588,6 @@ for (pos = chunk->subh.fwdtsn_hdr->skip;\
 extern struct proto sctp_prot;
 extern struct proto sctpv6_prot;
-extern struct proc_dir_entry *proc_net_sctp;
 void sctp_put_port(struct sock *sk);
 extern struct idr sctp_assocs_id;
@@ -632,21 +633,21 @@ static inline int sctp_sanity_check(void)
 /* Warning: The following hash functions assume a power of two 'size'. */
 /* This is the hash function for the SCTP port hash table. */
-static inline int sctp_phashfn(__u16 lport)
+static inline int sctp_phashfn(struct net *net, __u16 lport)
 {
-        return lport & (sctp_port_hashsize - 1);
+        return (net_hash_mix(net) + lport) & (sctp_port_hashsize - 1);
 }
 /* This is the hash function for the endpoint hash table. */
-static inline int sctp_ep_hashfn(__u16 lport)
+static inline int sctp_ep_hashfn(struct net *net, __u16 lport)
 {
-        return lport & (sctp_ep_hashsize - 1);
+        return (net_hash_mix(net) + lport) & (sctp_ep_hashsize - 1);
 }
 /* This is the hash function for the association hash table. */
-static inline int sctp_assoc_hashfn(__u16 lport, __u16 rport)
+static inline int sctp_assoc_hashfn(struct net *net, __u16 lport, __u16 rport)
 {
-        int h = (lport << 16) + rport;
+        int h = (lport << 16) + rport + net_hash_mix(net);
        h ^= h>>8;
        return h & (sctp_assoc_hashsize - 1);
 }
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 9148632b8204..b5887e1677e4 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -77,7 +77,8 @@ typedef struct {
        int action;
 } sctp_sm_command_t;
-typedef sctp_disposition_t (sctp_state_fn_t) (const struct sctp_endpoint *,
+typedef sctp_disposition_t (sctp_state_fn_t) (struct net *,
+                                              const struct sctp_endpoint *,
                                              const struct sctp_association *,
                                              const sctp_subtype_t type,
                                              void *arg,
@@ -178,7 +179,8 @@ sctp_state_fn_t sctp_sf_autoclose_timer_expire;
 /* Prototypes for utility support functions.  */
 __u8 sctp_get_chunk_type(struct sctp_chunk *chunk);
-const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t,
+const sctp_sm_table_entry_t *sctp_sm_lookup_event(struct net *,
+                                            sctp_event_t,
                                            sctp_state_t,
                                            sctp_subtype_t);
 int sctp_chunk_iif(const struct sctp_chunk *);
@@ -268,7 +270,7 @@ void sctp_chunk_assign_ssn(struct sctp_chunk *);
 /* Prototypes for statetable processing. */
-int sctp_do_sm(sctp_event_t event_type, sctp_subtype_t subtype,
+int sctp_do_sm(struct net *net, sctp_event_t event_type, sctp_subtype_t subtype,
               sctp_state_t state,
               struct sctp_endpoint *,
               struct sctp_association *asoc,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index fc5e60016e37..0fef00f5d3ce 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -102,6 +102,7 @@ struct sctp_bind_bucket {
        unsigned short  fastreuse;
        struct hlist_node       node;
        struct hlist_head       owner;
+        struct net      *net;
 };
 struct sctp_bind_hashbucket {
@@ -118,69 +119,6 @@ struct sctp_hashbucket {
 /* The SCTP globals structure. */
 extern struct sctp_globals {
-        /* RFC2960 Section 14. Suggested SCTP Protocol Parameter Values
-         *
-         * The following protocol parameters are RECOMMENDED:
-         *
-         * RTO.Initial              - 3  seconds
-         * RTO.Min                  - 1  second
-         * RTO.Max                 -  60 seconds
-         * RTO.Alpha                - 1/8  (3 when converted to right shifts.)
-         * RTO.Beta                 - 1/4  (2 when converted to right shifts.)
-         */
-        unsigned int rto_initial;
-        unsigned int rto_min;
-        unsigned int rto_max;
-        /* Note: rto_alpha and rto_beta are really defined as inverse
-         * powers of two to facilitate integer operations.
-         */
-        int rto_alpha;
-        int rto_beta;
-        /* Max.Burst                - 4 */
-        int max_burst;
-        /* Whether Cookie Preservative is enabled(1) or not(0) */
-        int cookie_preserve_enable;
-        /* Valid.Cookie.Life        - 60  seconds  */
-        unsigned int valid_cookie_life;
-        /* Delayed SACK timeout  200ms default*/
-        unsigned int sack_timeout;
-        /* HB.interval              - 30 seconds  */
-        unsigned int hb_interval;
-        /* Association.Max.Retrans  - 10 attempts
-         * Path.Max.Retrans         - 5  attempts (per destination address)
-         * Max.Init.Retransmits     - 8  attempts
-         */
-        int max_retrans_association;
-        int max_retrans_path;
-        int max_retrans_init;
-        /* Potentially-Failed.Max.Retrans sysctl value
-         * taken from:
-         * http://tools.ietf.org/html/draft-nishida-tsvwg-sctp-failover-05
-         */
-        int pf_retrans;
-        /*
-         * Policy for preforming sctp/socket accounting
-         * 0   - do socket level accounting, all assocs share sk_sndbuf
-         * 1   - do sctp accounting, each asoc may use sk_sndbuf bytes
-         */
-        int sndbuf_policy;
-        /*
-         * Policy for preforming sctp/socket accounting
-         * 0   - do socket level accounting, all assocs share sk_rcvbuf
-         * 1   - do sctp accounting, each asoc may use sk_rcvbuf bytes
-         */
-        int rcvbuf_policy;
        /* The following variables are implementation specific.  */
        /* Default initialization values to be applied to new associations. */
@@ -204,70 +142,11 @@ extern struct sctp_globals {
        int port_hashsize;
        struct sctp_bind_hashbucket *port_hashtable;
-        /* This is the global local address list.
-         * We actively maintain this complete list of addresses on
-         * the system by catching address add/delete events.
-         *
-         * It is a list of sctp_sockaddr_entry.
-         */
-        struct list_head local_addr_list;
-        int default_auto_asconf;
-        struct list_head addr_waitq;
-        struct timer_list addr_wq_timer;
-        struct list_head auto_asconf_splist;
-        spinlock_t addr_wq_lock;
-        /* Lock that protects the local_addr_list writers */
-        spinlock_t addr_list_lock;
-        
-        /* Flag to indicate if addip is enabled. */
-        int addip_enable;
-        int addip_noauth_enable;
-        /* Flag to indicate if PR-SCTP is enabled. */
-        int prsctp_enable;
-        /* Flag to idicate if SCTP-AUTH is enabled */
-        int auth_enable;
-        /*
-         * Policy to control SCTP IPv4 address scoping
-         * 0   - Disable IPv4 address scoping
-         * 1   - Enable IPv4 address scoping
-         * 2   - Selectively allow only IPv4 private addresses
-         * 3   - Selectively allow only IPv4 link local address
-         */
-        int ipv4_scope_policy;
        /* Flag to indicate whether computing and verifying checksum
         * is disabled. */
        bool checksum_disable;
-        /* Threshold for rwnd update SACKS.  Receive buffer shifted this many
-         * bits is an indicator of when to send and window update SACK.
-         */
-        int rwnd_update_shift;
-        /* Threshold for autoclose timeout, in seconds. */
-        unsigned long max_autoclose;
 } sctp_globals;
-#define sctp_rto_initial                (sctp_globals.rto_initial)
-#define sctp_rto_min                    (sctp_globals.rto_min)
-#define sctp_rto_max                    (sctp_globals.rto_max)
-#define sctp_rto_alpha                  (sctp_globals.rto_alpha)
-#define sctp_rto_beta                   (sctp_globals.rto_beta)
-#define sctp_max_burst                  (sctp_globals.max_burst)
-#define sctp_valid_cookie_life          (sctp_globals.valid_cookie_life)
-#define sctp_cookie_preserve_enable     (sctp_globals.cookie_preserve_enable)
-#define sctp_max_retrans_association    (sctp_globals.max_retrans_association)
-#define sctp_sndbuf_policy              (sctp_globals.sndbuf_policy)
-#define sctp_rcvbuf_policy              (sctp_globals.rcvbuf_policy)
-#define sctp_max_retrans_path           (sctp_globals.max_retrans_path)
-#define sctp_pf_retrans                 (sctp_globals.pf_retrans)
-#define sctp_max_retrans_init           (sctp_globals.max_retrans_init)
-#define sctp_sack_timeout               (sctp_globals.sack_timeout)
-#define sctp_hb_interval                (sctp_globals.hb_interval)
 #define sctp_max_instreams              (sctp_globals.max_instreams)
 #define sctp_max_outstreams             (sctp_globals.max_outstreams)
 #define sctp_address_families           (sctp_globals.address_families)
@@ -277,21 +156,7 @@ extern struct sctp_globals {
 #define sctp_assoc_hashtable            (sctp_globals.assoc_hashtable)
 #define sctp_port_hashsize              (sctp_globals.port_hashsize)
 #define sctp_port_hashtable             (sctp_globals.port_hashtable)
-#define sctp_local_addr_list            (sctp_globals.local_addr_list)
-#define sctp_local_addr_lock            (sctp_globals.addr_list_lock)
-#define sctp_auto_asconf_splist         (sctp_globals.auto_asconf_splist)
-#define sctp_addr_waitq                 (sctp_globals.addr_waitq)
-#define sctp_addr_wq_timer              (sctp_globals.addr_wq_timer)
-#define sctp_addr_wq_lock               (sctp_globals.addr_wq_lock)
-#define sctp_default_auto_asconf        (sctp_globals.default_auto_asconf)
-#define sctp_scope_policy               (sctp_globals.ipv4_scope_policy)
-#define sctp_addip_enable               (sctp_globals.addip_enable)
-#define sctp_addip_noauth               (sctp_globals.addip_noauth_enable)
-#define sctp_prsctp_enable              (sctp_globals.prsctp_enable)
-#define sctp_auth_enable                (sctp_globals.auth_enable)
 #define sctp_checksum_disable           (sctp_globals.checksum_disable)
-#define sctp_rwnd_upd_shift             (sctp_globals.rwnd_update_shift)
-#define sctp_max_autoclose              (sctp_globals.max_autoclose)
 /* SCTP Socket type: UDP or TCP style. */
 typedef enum {
@@ -1085,7 +950,7 @@ struct sctp_transport {
        __u64 hb_nonce;
 };
-struct sctp_transport *sctp_transport_new(const union sctp_addr *,
+struct sctp_transport *sctp_transport_new(struct net *, const union sctp_addr *,
                                          gfp_t);
 void sctp_transport_set_owner(struct sctp_transport *,
                              struct sctp_association *);
@@ -1240,7 +1105,7 @@ struct sctp_bind_addr {
 void sctp_bind_addr_init(struct sctp_bind_addr *, __u16 port);
 void sctp_bind_addr_free(struct sctp_bind_addr *);
-int sctp_bind_addr_copy(struct sctp_bind_addr *dest,
+int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest,
                        const struct sctp_bind_addr *src,
                        sctp_scope_t scope, gfp_t gfp,
                        int flags);
@@ -1267,7 +1132,7 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw, int len,
                           __u16 port, gfp_t gfp);
 sctp_scope_t sctp_scope(const union sctp_addr *);
-int sctp_in_scope(const union sctp_addr *addr, const sctp_scope_t scope);
+int sctp_in_scope(struct net *net, const union sctp_addr *addr, const sctp_scope_t scope);
 int sctp_is_any(struct sock *sk, const union sctp_addr *addr);
 int sctp_addr_is_valid(const union sctp_addr *addr);
 int sctp_is_ep_boundall(struct sock *sk);
@@ -1425,13 +1290,13 @@ struct sctp_association *sctp_endpoint_lookup_assoc(
 int sctp_endpoint_is_peeled_off(struct sctp_endpoint *,
                                const union sctp_addr *);
 struct sctp_endpoint *sctp_endpoint_is_match(struct sctp_endpoint *,
-                                        const union sctp_addr *);
+                                        struct net *, const union sctp_addr *);
-int sctp_has_association(const union sctp_addr *laddr,
+int sctp_has_association(struct net *net, const union sctp_addr *laddr,
                         const union sctp_addr *paddr);
-int sctp_verify_init(const struct sctp_association *asoc, sctp_cid_t,
+int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
-                     sctp_init_chunk_t *peer_init, struct sctp_chunk *chunk,
+                     sctp_cid_t, sctp_init_chunk_t *peer_init,
-                     struct sctp_chunk **err_chunk);
+                     struct sctp_chunk *chunk, struct sctp_chunk **err_chunk);
 int sctp_process_init(struct sctp_association *, struct sctp_chunk *chunk,
                      const union sctp_addr *peer,
                      sctp_init_chunk_t *init, gfp_t gfp);
@@ -2013,6 +1878,7 @@ void sctp_assoc_control_transport(struct sctp_association *,
                                  sctp_transport_cmd_t, sctp_sn_error_t);
 struct sctp_transport *sctp_assoc_lookup_tsn(struct sctp_association *, __u32);
 struct sctp_transport *sctp_assoc_is_match(struct sctp_association *,
+                                           struct net *,
                                           const union sctp_addr *,
                                           const union sctp_addr *);
 void sctp_assoc_migrate(struct sctp_association *, struct sock *);
diff --git a/include/net/snmp.h b/include/net/snmp.h
index 0147b901e79c..71596261fa99 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -154,13 +154,15 @@ struct linux_xfrm_mib {
 */
 #define SNMP_UPD_PO_STATS(mib, basefield, addend)       \
        do { \
-                this_cpu_inc(mib[0]->mibs[basefield##PKTS]);            \
+                __typeof__(*mib[0]->mibs) *ptr = mib[0]->mibs;  \
-                this_cpu_add(mib[0]->mibs[basefield##OCTETS], addend);  \
+                this_cpu_inc(ptr[basefield##PKTS]);             \
+                this_cpu_add(ptr[basefield##OCTETS], addend);   \
        } while (0)
 #define SNMP_UPD_PO_STATS_BH(mib, basefield, addend)    \
        do { \
-                __this_cpu_inc(mib[0]->mibs[basefield##PKTS]);          \
+                __typeof__(*mib[0]->mibs) *ptr = mib[0]->mibs;  \
-                __this_cpu_add(mib[0]->mibs[basefield##OCTETS], addend);        \
+                __this_cpu_inc(ptr[basefield##PKTS]);           \
+                __this_cpu_add(ptr[basefield##OCTETS], addend); \
        } while (0)
diff --git a/include/net/sock.h b/include/net/sock.h
index 0d7e9834d9be..c945fba4f543 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -247,8 +247,7 @@ struct cg_proto;
  *     @sk_stamp: time stamp of last packet received
  *     @sk_socket: Identd and reporting IO signals
  *     @sk_user_data: RPC layer private data
-  *     @sk_sndmsg_page: cached page for sendmsg
+  *     @sk_frag: cached page frag
-  *     @sk_sndmsg_off: cached offset for sendmsg
  *     @sk_peek_off: current peek_offset value
  *     @sk_send_head: front of stuff to transmit
  *     @sk_security: used by security modules
@@ -362,9 +361,8 @@ struct sock {
        ktime_t                 sk_stamp;
        struct socket           *sk_socket;
        void                    *sk_user_data;
-        struct page             *sk_sndmsg_page;
+        struct page_frag        sk_frag;
        struct sk_buff          *sk_send_head;
-        __u32                   sk_sndmsg_off;
        __s32                   sk_peek_off;
        int                     sk_write_pending;
 #ifdef CONFIG_SECURITY
@@ -2026,18 +2024,23 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
 struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
-static inline struct page *sk_stream_alloc_page(struct sock *sk)
+/**
+ * sk_page_frag - return an appropriate page_frag
+ * @sk: socket
+ *
+ * If socket allocation mode allows current thread to sleep, it means its
+ * safe to use the per task page_frag instead of the per socket one.
+ */
+static inline struct page_frag *sk_page_frag(struct sock *sk)
 {
-        struct page *page = NULL;
+        if (sk->sk_allocation & __GFP_WAIT)
+                return &current->task_frag;
-        page = alloc_pages(sk->sk_allocation, 0);
+        return &sk->sk_frag;
-        if (!page) {
-                sk_enter_memory_pressure(sk);
-                sk_stream_moderate_sndbuf(sk);
-        }
-        return page;
 }
+extern bool sk_page_frag_refill(struct sock *sk, struct page_frag *pfrag);
 /*
 *      Default write policy as shown to user space via poll/select/SIGIO
 */
@@ -2218,8 +2221,6 @@ extern int net_msg_warn;
 extern __u32 sysctl_wmem_max;
 extern __u32 sysctl_rmem_max;
-extern void sk_init(void);
 extern int sysctl_optmem_max;
 extern __u32 sysctl_wmem_default;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 9a0021d16d91..6feeccd83dd7 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -98,11 +98,21 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
                                 * 15 is ~13-30min depending on RTO.
                                 */
-#define TCP_SYN_RETRIES  5      /* number of times to retry active opening a
+#define TCP_SYN_RETRIES  6      /* This is how many retries are done
-                                 * connection: ~180sec is RFC minimum   */
+                                 * when active opening a connection.
+                                 * RFC1122 says the minimum retry MUST
+                                 * be at least 180secs.  Nevertheless
+                                 * this value is corresponding to
+                                 * 63secs of retransmission with the
+                                 * current initial RTO.
+                                 */
-#define TCP_SYNACK_RETRIES 5    /* number of times to retry passive opening a
+#define TCP_SYNACK_RETRIES 5    /* This is how may retries are done
-                                 * connection: ~180sec is RFC minimum   */
+                                 * when passive opening a connection.
+                                 * This is corresponding to 31secs of
+                                 * retransmission with the current
+                                 * initial RTO.
+                                 */
 #define TCP_TIMEWAIT_LEN (60*HZ) /* how long to wait to destroy TIME-WAIT
                                  * state, about 60 seconds     */
@@ -214,8 +224,24 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 /* Bit Flags for sysctl_tcp_fastopen */
 #define TFO_CLIENT_ENABLE       1
+#define TFO_SERVER_ENABLE       2
 #define TFO_CLIENT_NO_COOKIE    4       /* Data in SYN w/o cookie option */
+/* Process SYN data but skip cookie validation */
+#define TFO_SERVER_COOKIE_NOT_CHKED     0x100
+/* Accept SYN data w/o any cookie option */
+#define TFO_SERVER_COOKIE_NOT_REQD      0x200
+/* Force enable TFO on all listeners, i.e., not requiring the
+ * TCP_FASTOPEN socket option. SOCKOPT1/2 determine how to set max_qlen.
+ */
+#define TFO_SERVER_WO_SOCKOPT1  0x400
+#define TFO_SERVER_WO_SOCKOPT2  0x800
+/* Always create TFO child sockets on a TFO listener even when
+ * cookie/data not present. (For testing purpose!)
+ */
+#define TFO_SERVER_ALWAYS       0x1000
 extern struct inet_timewait_death_row tcp_death_row;
 /* sysctl variables for tcp */
@@ -398,7 +424,8 @@ extern enum tcp_tw_status tcp_timewait_state_process(struct inet_timewait_sock *
                                                     const struct tcphdr *th);
 extern struct sock * tcp_check_req(struct sock *sk,struct sk_buff *skb,
                                   struct request_sock *req,
-                                   struct request_sock **prev);
+                                   struct request_sock **prev,
+                                   bool fastopen);
 extern int tcp_child_process(struct sock *parent, struct sock *child,
                             struct sk_buff *skb);
 extern bool tcp_use_frto(struct sock *sk);
@@ -411,12 +438,6 @@ extern void tcp_metrics_init(void);
 extern bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst, bool paws_check);
 extern bool tcp_remember_stamp(struct sock *sk);
 extern bool tcp_tw_remember_stamp(struct inet_timewait_sock *tw);
-extern void tcp_fastopen_cache_get(struct sock *sk, u16 *mss,
-                                   struct tcp_fastopen_cookie *cookie,
-                                   int *syn_loss, unsigned long *last_syn_loss);
-extern void tcp_fastopen_cache_set(struct sock *sk, u16 mss,
-                                   struct tcp_fastopen_cookie *cookie,
-                                   bool syn_lost);
 extern void tcp_fetch_timewait_stamp(struct sock *sk, struct dst_entry *dst);
 extern void tcp_disable_fack(struct tcp_sock *tp);
 extern void tcp_close(struct sock *sk, long timeout);
@@ -458,7 +479,8 @@ extern int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr,
 extern int tcp_connect(struct sock *sk);
 extern struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                                        struct request_sock *req,
-                                        struct request_values *rvp);
+                                        struct request_values *rvp,
+                                        struct tcp_fastopen_cookie *foc);
 extern int tcp_disconnect(struct sock *sk, int flags);
 void tcp_connect_init(struct sock *sk);
@@ -527,6 +549,7 @@ extern void tcp_send_delayed_ack(struct sock *sk);
 extern void tcp_cwnd_application_limited(struct sock *sk);
 extern void tcp_resume_early_retransmit(struct sock *sk);
 extern void tcp_rearm_rto(struct sock *sk);
+extern void tcp_reset(struct sock *sk);
 /* tcp_timer.c */
 extern void tcp_init_xmit_timers(struct sock *);
@@ -576,6 +599,7 @@ extern int tcp_mtu_to_mss(struct sock *sk, int pmtu);
 extern int tcp_mss_to_mtu(struct sock *sk, int mss);
 extern void tcp_mtup_init(struct sock *sk);
 extern void tcp_valid_rtt_meas(struct sock *sk, u32 seq_rtt);
+extern void tcp_init_buffer_space(struct sock *sk);
 static inline void tcp_bound_rto(const struct sock *sk)
 {
@@ -889,15 +913,21 @@ static inline bool tcp_in_initial_slowstart(const struct tcp_sock *tp)
        return tp->snd_ssthresh >= TCP_INFINITE_SSTHRESH;
 }
+static inline bool tcp_in_cwnd_reduction(const struct sock *sk)
+{
+        return (TCPF_CA_CWR | TCPF_CA_Recovery) &
+               (1 << inet_csk(sk)->icsk_ca_state);
+}
 /* If cwnd > ssthresh, we may raise ssthresh to be half-way to cwnd.
- * The exception is rate halving phase, when cwnd is decreasing towards
+ * The exception is cwnd reduction phase, when cwnd is decreasing towards
 * ssthresh.
 */
 static inline __u32 tcp_current_ssthresh(const struct sock *sk)
 {
        const struct tcp_sock *tp = tcp_sk(sk);
-        if ((1 << inet_csk(sk)->icsk_ca_state) & (TCPF_CA_CWR | TCPF_CA_Recovery))
+        if (tcp_in_cwnd_reduction(sk))
                return tp->snd_ssthresh;
        else
                return max(tp->snd_ssthresh,
@@ -1094,6 +1124,8 @@ static inline void tcp_openreq_init(struct request_sock *req,
        req->rcv_wnd = 0;               /* So that tcp_send_synack() knows! */
        req->cookie_ts = 0;
        tcp_rsk(req)->rcv_isn = TCP_SKB_CB(skb)->seq;
+        tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
+        tcp_rsk(req)->snt_synack = 0;
        req->mss = rx_opt->mss_clamp;
        req->ts_recent = rx_opt->saw_tstamp ? rx_opt->rcv_tsval : 0;
        ireq->tstamp_ok = rx_opt->tstamp_ok;
@@ -1106,6 +1138,15 @@ static inline void tcp_openreq_init(struct request_sock *req,
        ireq->loc_port = tcp_hdr(skb)->dest;
 }
+/* Compute time elapsed between SYNACK and the ACK completing 3WHS */
+static inline void tcp_synack_rtt_meas(struct sock *sk,
+                                       struct request_sock *req)
+{
+        if (tcp_rsk(req)->snt_synack)
+                tcp_valid_rtt_meas(sk,
+                    tcp_time_stamp - tcp_rsk(req)->snt_synack);
+}
 extern void tcp_enter_memory_pressure(struct sock *sk);
 static inline int keepalive_intvl_when(const struct tcp_sock *tp)
@@ -1298,15 +1339,34 @@ extern int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *, const struct sk_buff
 extern int tcp_md5_hash_key(struct tcp_md5sig_pool *hp,
                            const struct tcp_md5sig_key *key);
+/* From tcp_fastopen.c */
+extern void tcp_fastopen_cache_get(struct sock *sk, u16 *mss,
+                                   struct tcp_fastopen_cookie *cookie,
+                                   int *syn_loss, unsigned long *last_syn_loss);
+extern void tcp_fastopen_cache_set(struct sock *sk, u16 mss,
+                                   struct tcp_fastopen_cookie *cookie,
+                                   bool syn_lost);
 struct tcp_fastopen_request {
        /* Fast Open cookie. Size 0 means a cookie request */
        struct tcp_fastopen_cookie      cookie;
        struct msghdr                   *data;  /* data in MSG_FASTOPEN */
        u16                             copied; /* queued in tcp_connect() */
 };
 void tcp_free_fastopen_req(struct tcp_sock *tp);
+extern struct tcp_fastopen_context __rcu *tcp_fastopen_ctx;
+int tcp_fastopen_reset_cipher(void *key, unsigned int len);
+void tcp_fastopen_cookie_gen(__be32 addr, struct tcp_fastopen_cookie *foc);
+#define TCP_FASTOPEN_KEY_LENGTH 16
+/* Fastopen key context */
+struct tcp_fastopen_context {
+        struct crypto_cipher __rcu      *tfm;
+        __u8                            key[TCP_FASTOPEN_KEY_LENGTH];
+        struct rcu_head                 rcu;
+};
 /* write queue abstraction */
 static inline void tcp_write_queue_purge(struct sock *sk)
 {
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 411d83c9821d..6f0ba01afe73 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -263,7 +263,7 @@ struct km_event {
        } data;
        u32     seq;
-        u32     pid;
+        u32     portid;
        u32     event;
        struct net *net;
 };
@@ -313,7 +313,7 @@ extern void km_state_notify(struct xfrm_state *x, const struct km_event *c);
 struct xfrm_tmpl;
 extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
-extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
+extern void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
 extern int __xfrm_state_delete(struct xfrm_state *x);
 struct xfrm_state_afinfo {
@@ -576,7 +576,7 @@ struct xfrm_mgr {
        struct list_head        list;
        char                    *id;
        int                     (*notify)(struct xfrm_state *x, const struct km_event *c);
-        int                     (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
+        int                     (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
        struct xfrm_policy      *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
        int                     (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
        int                     (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
@@ -1558,7 +1558,7 @@ extern int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
 #endif
 extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
-extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
+extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
 extern int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
 extern void xfrm_input_init(void);
diff --git a/include/scsi/scsi_netlink.h b/include/scsi/scsi_netlink.h
index 5cb20ccb1956..62b4edab15d3 100644
--- a/include/scsi/scsi_netlink.h
+++ b/include/scsi/scsi_netlink.h
@@ -119,29 +119,5 @@ struct scsi_nl_host_vendor_msg {
        (hdr)->msglen = mlen;                                   \
        }
-#ifdef __KERNEL__
-#include <scsi/scsi_host.h>
-/* Exported Kernel Interfaces */
-int scsi_nl_add_transport(u8 tport,
-         int (*msg_handler)(struct sk_buff *),
-        void (*event_handler)(struct notifier_block *, unsigned long, void *));
-void scsi_nl_remove_transport(u8 tport);
-int scsi_nl_add_driver(u64 vendor_id, struct scsi_host_template *hostt,
-        int (*nlmsg_handler)(struct Scsi_Host *shost, void *payload,
-                                 u32 len, u32 pid),
-        void (*nlevt_handler)(struct notifier_block *nb,
-                                 unsigned long event, void *notify_ptr));
-void scsi_nl_remove_driver(u64 vendor_id);
-void scsi_nl_send_transport_msg(u32 pid, struct scsi_nl_hdr *hdr);
-int scsi_nl_send_vendor_msg(u32 pid, unsigned short host_no, u64 vendor_id,
-                         char *data_buf, u32 data_len);
-#endif /* __KERNEL__ */
 #endif /* SCSI_NETLINK_H */